Privacy Impact Assessment Alberta

Dental clinic compliance with the Privacy Impact Assessment regulatory statutes in Alberta can be challenging. Maintaining private records of dental patients is a heavy responsibility.

The appropriate collection, use, and disclosure of confidential information are critical to maintaining privacy for the patients who choose to place trust in your practice. A strong emphasis on data security is necessary to maintain that trust.

Are you concerned about meeting regulatory compliance?

Do you wish to establish security practices that allow your patients to feel safe and secure?

Data custodians such as dentists are required to prove their digital infrastructure is secure with a Privacy Impact Assessment (PIA).

A dental PIA is an audit of your internal processes within your dental clinic that defines how you identify and mitigate cybersecurity risks. Section 64 of the Health Information Act (HIA) states the following:

All dental practices in Alberta are required to have a PIA and have the PIA document submitted to OIPC.

In addition to dentists, optometrists, pharmacists, opticians, chiropractors, physicians, surgeons, midwives, podiatrists, denturists, dental hygienists, and registered nurses must also comply with the OIPC in submitting a PIA.

The PIA documents how your organization manages the personal data that you retain on your patients and outlines the steps being taken to protect that data.

Developing your PIA might seem intimidating, but to remain in compliance with Alberta’s Health Information Act, private dental practices do not have a choice.

Depending on how large your clinic is, your PIA might be several hundred pages long. In addition to describing how patient data is stored, you must also provide information about how your staff is trained, who has access to data, the physical and digital storage processes for data, and the security you have in place to protect the data.

Luckily, there are many resources available to assist in creating and filing a PIA.

1. The first step is to begin the process as soon as possible. You must document everything associated with privacy risks. You can continue operating your practice and submit your PIA, even as you work to establish better data security practices.
2. Your dental PIA is a living document that you can update as you implement more procedures to safeguard patient data.
3. Creating awareness of the risks that exist puts you one step ahead of potential hackers who may make malicious attempts at gaining access to your confidential servers.
4. After completing your PIA, it must be submitted to the OIPC for approval, which can take up to 12 months.

The one thing you should not do is ignore this requirement.