PIPEDA and HIPAA Information
The security and privacy of your information is one of the most important parts of any electronic medical record (EMR). Thousands of private medical charts are stored on our servers every day, and we believe you should know exactly what measures we take, and which guidelines we follow, to keep your data private and secure.
Two privacy laws are relevant to a service like ours, and this page explains how we address both:
- PIPEDA (the Personal Information Protection and Electronic Documents Act) is the Canadian law that governs how organizations collect, use, and disclose personal information about an identifiable individual. In our case, that means medical records. PIPEDA is our primary framework, because SmartND and your stored data are based in Canada. The Office of the Privacy Commissioner of Canada has prepared a guide to help organizations like SmartND meet their responsibilities under PIPEDA, and most of this page follows that structure.
- HIPAA (the Health Insurance Portability and Accountability Act) is the equivalent United States health-privacy law. It becomes relevant only in the limited cases where some information is processed on infrastructure located in the United States, such as certain AI features. Where that happens, we put HIPAA-style protections in place, including a Business Associate Agreement (BAA) with the provider. This is described in the Use of Artificial Intelligence section below.
The sections that follow summarize the PIPEDA guidelines and the steps SmartND has taken to comply.
One important distinction: we store medical information, we do not collect it. We assume that the practitioner collecting information from their patients has obtained the proper consent to do so. SmartND provides tools for practitioners to record that consent was obtained, but we do not monitor, verify, or audit that consent.
Accountability
PIPEDA requires that one person be made accountable for following its principles. SmartND has appointed a Privacy Officer to hold this responsibility and to ensure SmartND complies with every aspect of PIPEDA. You can reach our Privacy Officer through our contact form. Part of the Privacy Officer’s role is to answer the questions below.
What personal information do we collect, and is it sensitive?
We collect personal contact information, and we store medical information entered by healthcare practitioners and their patients. Some of this information can be considered sensitive.
Why do we collect it?
We store this information as a service to healthcare providers, so they can care for their patients more effectively. A healthcare provider’s role is to collect information from their patients in order to assess their condition and build a treatment plan. We help store that information and allow both providers and patients to retrieve it when needed.
How do we collect it?
We collect this information through our cloud-based service, OutSmart EMR.
What do we use it for?
Personally identifiable information is never used for any purpose other than displaying it to the appropriate healthcare providers. Non-identifiable information is used to produce statistical reports about how the OutSmart EMR service is used. These reports contain no personally identifiable information, and are used only to improve the service or to provide useful insights into the industry.
Where do we keep it?
Your medical data is stored on secure servers hosted in Canada, with 24/7 security provided by reputable hosting providers. Some features of our service use artificial intelligence (AI) to assist practitioners, for example by helping to draft clinical letters or summarize information already in a patient’s record. When these AI features are used, the specific information needed to produce that result may be processed on secure infrastructure located in Canada or the United States. This processing is limited to producing the requested result. The stored medical record itself remains in Canada.
How is it secured?
We protect your information through a combination of physical, technical, and administrative safeguards:
- Encryption. Information is encrypted while travelling between your device and our service, using current TLS/SSL standards, and patient data is encrypted while stored on our servers.
- Access controls. Access is restricted on a need-to-know basis. Practitioners and staff see only the data they are authorized to see, and only a small number of senior SmartND personnel can reach the underlying systems, under a strict access procedure.
- Mandatory multi-factor authentication. Multi-factor authentication (MFA) is required on all user accounts, adding a second layer of protection beyond a password.
- Secure, monitored infrastructure. Our servers are hosted by reputable providers in facilities with 24/7 physical security and monitoring.
- Policies, training, and oversight. Our personnel are bound by confidentiality obligations and receive security and privacy training. We maintain security policies that we review and update over time.
- Payment security. Any payment information is handled through PCI-compliant payment processors.
We continually review and improve these safeguards as technology and best practices evolve.
Who has access to it?
Healthcare practitioners can access all the data they have entered, along with any data other practitioners have shared with them. Patients can access their treatment plans and any other data their practitioners have shared with them. Select senior SmartND staff can access the databases, but follow a strict access procedure wherever medical information is involved. Every access to private information is based on a client request, and we obtain your written permission before accessing your data. Your data is stored in a way that makes it difficult for our staff to determine whose data they are looking at. In most cases we can troubleshoot your account without accessing any private medical data at all. In the few cases where we do need to view your medical charts to help solve a problem, that access is limited to the specific area we are helping you with.
To whom is it disclosed?
Personally identifiable information is never disclosed to any third party for that party’s own purposes. The only exceptions are:
- trusted service providers who process information solely on our behalf to operate the service (such as the AI providers described above), under written agreements that bind them to confidentiality and security; and
- cases where we are required to disclose by law.
Where disclosure is required by law, SmartND will first notify the practitioner involved and give them enough time to oppose the request.
When is it disposed of?
Data on OutSmart EMR servers is not disposed of. If SmartND is ever required to dispose of data, all data will be returned to its author before disposal.
Use of Artificial Intelligence (AI)
Some tools within our service use artificial intelligence to help your healthcare provider work more efficiently, for example by drafting a letter or summarizing information already in your record. Your provider always reviews this work before relying on it.
To make these tools work, the information needed for a specific task may be processed on secure computer systems located in Canada or the United States. Information processed in the United States may be subject to U.S. laws, including HIPAA. We take measures to protect your information throughout this processing, including:
- written privacy and confidentiality agreements with the technology providers who help operate these features, including a Business Associate Agreement (BAA) where it applies to health information;
- encryption of information while it is transmitted and handled; and
- strict access controls limiting who and what can access the information.
The providers of these AI tools are not permitted to use your information to train their own AI systems. Your full medical record continues to be stored in its country of origin. If you have questions about how your provider uses these tools, please speak with your healthcare provider.
Identifying Purposes
PIPEDA requires us to identify why we collect personal information at the time we collect it. The personal contact information gathered when you create an OutSmart EMR account is needed to identify the person creating the account. We use that identification to secure the account against unauthorized access and to establish eligibility for special offers or discounts. We do not collect medical information; we only serve as a storage service for that data.
Consent
PIPEDA requires us to obtain informed consent for the collection of personal data. Because we do not collect medical data, we do not obtain consent from patients; that is the practitioner’s responsibility. We do collect personal information for the purpose described above, and we use it as described above. Opening an account for an online service is not a novel use of personal data, so we treat the act of creating an OutSmart EMR account as implied consent to use that personal information for the purpose of opening and securing the account. Everyone who opens an account on OutSmart EMR is also required to agree to our Terms of Service and Privacy Policy.
Limiting Collection
PIPEDA requires us not to collect information indiscriminately. All the information we collect (and again, we do not collect medical information) is used as described above. We do not collect irrelevant information.
Limiting Use, Disclosure, and Retention
PIPEDA requires us to use collected information only for the reasons stated above, and to disclose it only when necessary and permitted under PIPEDA. SmartND uses the information it collects only for the purposes identified above.
Accuracy
PIPEDA requires us to be accurate in how we record information. Our collection methods are tested and reliably store the correct information against the correct individual. If an error ever occurs, we are available to discuss it and to correct it on request.
Safeguards
PIPEDA requires us to use appropriate safeguards to protect personal information against loss, theft, unauthorized access, disclosure, copying, use, or modification. Our safeguards are described above, and we use industry-standard SSL connections during data collection to help prevent the theft of sensitive information.
Openness
PIPEDA requires us to be open about how we safeguard personal information. This document serves that purpose.
Individual Access
PIPEDA requires us to let individuals access the personal information we hold about them. Any medical information on our servers is always available to the practitioner who collected and authored it. If a patient asks us for personal data that a practitioner entered into our system, we will contact that practitioner immediately and inform them of the request. The practitioner will then be given a reasonable amount of time to respond. Patients must make requests for personal information through their practitioner.
Providing Recourse
PIPEDA requires us to provide a simple way for users to raise complaints. You can send complaints through our contact form. We investigate every complaint we receive.