Keeping patient information safe and secure

As a health care provider, you're responsible for protecting personal health information (PHI). Saskatchewan privacy legislation outlines how PHI must be collected, used, disclosed and safeguarded. 

All eHealth Saskatchewan programs and applications that handle personal health information must comply with The Health Information Protection Act (HIPA) and The Freedom of Information and Protection of Privacy Act (FOIP).

HIPA governs personal health information and establishes the requirements for its collection, use, disclosure and protection.

FOIP applies to records held by public bodies. It gives people the right to request access to information and sets rules for protecting personal information. Your organization must follow FOIP processes when responding to access requests.

Audit reports

eHealth provides audit reports to organizations registered for eHR Viewer. These reports show when and by whom personal health information has been viewed in the following systems:

• PIP (Pharmaceutical Information Program) - Stores medication information for Saskatchewan residents.
• PACS (Picture Archiving and Communications System) - Stores diagnostic images and imaging reports.
• eHR Viewer (electronic Health Record Viewer) - Stores patient health information from across Saskatchewan.

All views of personal health information are tracked, including:

• the name of the health care provider who accessed the information
• the date and time the information was accessed
• the type of information viewed

Each access is recorded as an event. Examples of events that can be audited include:

• accessing masked records, including “breaking the glass,” which means overriding a privacy warning to view information needed for patient care. For example, this may be needed if a patient needs emergency care, and the provider needs to view masked information to make a care decision.
• viewing laboratory profiles

Request an audit report for your organization using the form.