Implementation Guidance Index > Implementer Responsibility

Implementer Responsibility

Privacy and Security

Under PHIPA, Ontario Health (OH) is a Prescribed Organization (PO) with the power and duty to develop and maintain the electronic health record. In doing so, OH manages and integrates personal health information (PHI) it receives from HICs and enables HICs to collect, use and disclose personal health information by means of the EHR.

HICs who view records of PHI by means of the EHR are considered to be either collecting said records if the records were contributed by a different HIC, or using said records if the records were contributed by the viewing HIC. When a viewing HIC collects PHI, this is also considered a disclosure by the contributing HIC. Accordingly, HICs have responsibilities related to viewing of PHI and are required to complete onboarding processes, comply with OH privacy and security policies, procedures, and standards, adhere to consent override requirements, and to query PHI in accordance with the interoperability specifications established by OH. These and other requirements are set forth in the EHR Access Services Schedule of the OH Services Agreement (ESA) and other OH agreements as applicable, which OH executes with viewing HICs.

Further to the above, the specified HICs are also required to provide a report to the OH, upon the request by OH that sets out their compliance with the requirement to select, develop or use digital health assets that comply with this interoperability specification. Such reports must be provided by the HIC through the means, in the format, and within the time period determined by OH. These HICs also must co-operate with and assist OH in monitoring their own compliance with the requirements and must provide any information or records (Which must not include PHI) to OH upon request.

Should OH find reasonable grounds to believe that a HIC has contravened or is about to contravene the requirement to select, develop or use digital health assets that comply with this interoperability specification, OH may make a complaint to the Commissioner under Part VI of the Act and may provide to the Commissioner any information and records obtained under O. Reg. 329/04 sections 32 and 33.

Of note, this interoperability specification by itself does not serve to mandate contribution by HICs to the EHR, but rather establishes the business and/or technical requirements applicable to contribution by specified HICs and specified digital health assets. The information herein is to be read in conjunction with the terms and conditions set forth in the ECA, the EHR Access Services Schedule of the ESA, and any other applicable agreements. For greater certainty, nothing within this interoperability specification relieves a HIC of its obligation to comply with any provisions of PHIPA and its regulations.

System Responsibility for User Authorization, Authentication

A “system” level integration is when a Point of Service (PoS) system representing many users, registers for access to the OLIS repository, instead of registering individual users. In this case, access to the OLIS repository is granted to the PoS System and all access to OLIS by the PoS are treated equally.The responsibility to authenticate and authorize individual access is delegated from the OLIS to the HIC that will access OLIS via the given PoS. The HIC must ensure individual users access the OLIS as required by Ontario Health’s privacy policies.

The PoS System is responsible for ensuring the accuracy of the identity of the individual requester specified in the message. User identities must be tied to authenticated user accounts

User Credentials

In order to meet the privacy obligations, the audit records maintained at the service level need to know the details of the consumer application and the user making the request. To support privacy inquiries into the disclosure of patient PHI, the individual’s username, mnemonic or Unique identifier SHALL be included in the message to identify the individual user that initiated OLIS view request. The consumer shall satisfy this requirement through implementation of OAuth2 token defined in the request message header. The sending application is expected to create a JSON Web Token with the relevant information and embed within the FHIR® request as http header.

NOTE: if OLIS exchange is between systems where no PHI is disclosed to an individual, this does not apply. Refer to the Connectivity section for further details.

Auditing

Both the PoS System and OLIS Repository MUST audit all activity performed via the Application Programming Interface (API). The only exception to this is that PHI in any brokers/intermediaries must be cleared shortly after use.

With a “system” level integration the PoS must audit the user initiating each Search/Retrieve call (this information is invisible to the OLIS repository).

Logging

Both the PoS System and OLIS Repository MUST log all activity performed via the Application Programming Interface (API) for a support purpose. PHI MUST NOT be stored in application log files.

With a “system” level integration, the client system must log activities of the user initiating each Search/Retrieve call (this information is invisible to the OLIS repository).