Privacy policy procedure

of 7
LEEDS, GRENVILLE AND LANARK DISTRICT HEALTH UNIT
Records Management Policy and Procedure
Updated May 2006
Policy:
Records shall be retained for all Health Unit programs and administrative functions and
shall:
1. meet statutory requirements, where applicable,
2. be the property of the Health Unit,
3. be accessible only to authorized personnel,
4. be collected, used, disclosed and disposed of according to guidelines of funding
agencies, professional discipline guidelines and legislative requirements.
Procedure:
1. Purpose
The purpose of Records Management is to:
1.1 Describe and classify the most common types of records that are maintained
by the Health Unit, specify when such records can be transferred to storage
or archives, and when they must be destroyed; and
1.2 Ensure efficiency, consistency and uniformity across the Health Unit with
respect to access, confidentiality and security of records.
1.3 Comply with legal requirements.
2. Responsibility of Management Staff
Management is responsible for:
2.1 Having knowledge of and ensuring compliance with legislation and Board of
Health policies and procedures concerning the records created in their
assigned program areas;
2.2 Ensuring that the records management information is current for the records
kept in their assigned program areas: and
2.3 Managing the recorded information in their assigned program areas according
to the Agency policy.
3. Responsibilities of Every Employee
Every employee is responsible for:
3.1 Creating and maintaining complete and accurate records of their activities;

of 7
3.2 Eliminating unnecessary collection and storage of recorded information
3.3 Developing efficient filing practices;
3.4 Protecting records from unauthorized access, use, and loss; and
3.5 Transferring or disposing of records in accordance with Agency policy.
4. Definition
A record includes all documents used by the Health Unit to perform its functions.
A record includes: archives, client files, completed forms, computer disks,
correspondence (mail, fax, e-mail, and memoranda), financial accounts, ledgers,
maps, meeting agendas and minutes, microfilm, personnel information,
photographs, site plan, and any other material deemed necessary for Health Unit
purposes.
5. Introduction
Records fill the role of 'official memory' of the Health Unit’s past actions. They
embody the identity and substance of the Health Unit even though people and
places change over time.
Records serve important business functions such as supporting program
planning, delivery, and evaluation; policy development; satisfying legal and audit
requirements; protecting individual rights; and ensuring that evidence of activities
and decisions is preserved.
All of the records created by Health Unit staff belong to the Board of Health.
To determine the appropriate retention period for a record, four (4) values must
be assessed:
5.1 Administrative value;
5.2 Fiscal value;
5.3 Legal value;
5.4 Historical value.
Some vital records may include; but are not limited to:
1. Minutes of Board meetings;
2. Annual reports;
3. Strategic plans;
4. Health status reports;
5. Legal agreements and contracts;
6. Union agreements and contracts;
7. Budget papers and settlements;
8. Employment applications;

of 7
9. Personnel records;
10.Department records;
11.Day Care/School Immunization Registers;
Any other file or document deemed vital by the Medical Officer of Health, Board
Chairperson or Director, Corporate Services.
6. Objectives Of Records Management:
Records will be:
6.1 Assessed for relevancy for collection and retention;
6.2 Easily and quickly retrievable;
6.3 Inventoried according to classification, retention period, location and
protection from premature destruction;
6.4 Accessible only by authorized personnel;
6.5 Confidential;
6.6 Retained according to legislated or Board of Health recommendations;
6.7 Disposed of once their value has ceased.
Official records must be saved and organized for convenient access and use. The
unnecessary storage of information, paper or electronic, wastes money, space,
and staff time. Without an effective recorded information management system in
place, the Board of Health faces increased operating costs, loss or unavailability of
critical information, vulnerability in legal and audit situations, inability to meet
freedom of information/privacy requirements, duplication of effort to reassemble
needed information, and poor customer service.
7. Access:
7.1 Direct Access:
Only authorized personnel are permitted to place documents in, or remove
them from a file. Each department should have policies and procedures
defining who has access to the various records kept by that department.
Access to personally identifiable data should be limited to the following:
7.1.1 Staff responsible for providing service to a client;
7.1.2 Staff assigned to tabulate and collate data;
7.1.3 Appropriate records or clerical personnel;
7.1.4 Supervisory staff;
7.1.5 Health Unit solicitor;
7.1.6 Financial inspector, Health Protection and Promotion Act, Part VI,
Sec. 73(4);

of 7
7.1.7 Chief Executive Officer/ Medical Officer of Health, Health Protection
and Promotion Act, Part 74(6).
7.2 Access to electronic records is administered by systems support staff or
designate.
8. Confidentiality:
Ownership, responsibility and control of client records by the Board of Health
carries with it an obligation on the part of the Board to maintain the confidentiality
of client records.
For all practical purposes, all records are considered confidential unless otherwise
noted. Respect for confidentiality is essential to maintain a relationship of trust
between an employee and client. Since Health Unit services are to be provided by
an interdisciplinary team, the employee should explain to the client the need for
sharing pertinent information about the client with other Health Unit personnel and
other health care professionals.
Provision of confidential information for the purposes of research, statistical
compilation or education by persons external to the Health Unit who are
conducting medical or epidemiological research, may be allowed only if such
information is transmitted to the researchers with the consent of the client and/or in
such a form as to mask the identity of the client.
Every Health Unit employee on a professional or clerical basis, must read and sign
a declaration of confidentiality form (COR-*/*-HRS-008) as per Health Unit
document V-665.
9. Security:
All personally identifiable information must be physically secured from access by
unauthorized persons. Secure access must be ensured in all areas where client
records are kept (case files, records in computer data banks, central file areas and
sub-systems).
Records must be secured under lock and key when the Health Unit is not officially
open. During business hours, office doors must be closed and locked when staff
are not in the office or in close proximity to the office where files are kept - such as
during break periods. Key distribution must be limited and documented.
Computers should be locked when staff are away from their desk. A “clean desk”
policy should be adhered to when unattended.
Records that are to be transferred shall be transported in such a manner that they
are never out of the control of the person responsible for their security.
10. Storage:
Records shall be stored in a dry, accessible location under lock and key in
designated areas as determined by each department.
10.1 Computer Disks, Hard Drives and Network
Administrative and department clerical staff shall ensure that:

of 7
10.1.1 All computer disks adhere to a disk identification system;
10.1.2 All computer disks are securely stored at the end of each work day;
10.1.3 Computer hard drives must be secured when office unattended, and
at the end of each work day;
10.1.4 Access codes should be required to retrieve confidential information;
10.1.5 Access is logged off when office is unattended and at the end of each
work day.
The Record Retention Schedule provides the minimum period for retention of
various administrative and operating records. Unless otherwise indicated the
retention period will commence on the date of the last entry on the records.
Official records may not be destroyed except according to this schedule.
11. Official and Transitory Records
An official record is one that must be filed and saved.
A transitory record is one that can de disposed of as soon as you've finished with
it. Ongoing destruction or deletion of transitory records is key to managing
information effectively and reducing records-related costs.
Some common types of transitory records which you can discard as soon as
you've finished with them are:
11.1.1 Miscellaneous notices or memoranda, such as "To All Staff" e-
mails, notices of special events, or minor information items
concerning routine administrative matters or the minor issues not
pertaining directly to your program area;
11.1.2 Information copies of widely distributed materials, such as
committee minutes, agendas, newsletters;
11.1.3 Preliminary drafts of letters, memoranda, or reports, and other
informal notes which do not represent significant steps in the
preparation of a final document, and which do not record decisions;
11.1.4 Duplicate copies of documents in the same medium which are
retained only for convenience or future distribution e.g. extra
photocopies, duplicate copies of databases, etc.;
11.1.5 Personal messages e.g. "Let's meet for lunch…"
11.1.6 Phone messages e.g. "Please return call…."
11.1.7 Publications, such as published reports, telephone directories,
catalogues, pamphlets, or periodicals;
11.1.8 Stocks of obsolete publications, pamphlets, or blank forms;
11.1.9 Unsolicited advertising materials e.g. brochures, price lists, etc.
Note: When discarding transitory records, you still need to keep records which
document significant business transactions, policies, decisions, discussions, or

of 7
services, or which meet legal, financial or other mandatory requirements. These
official records should be organized and maintained for easy assess and
disposed with other records dealing with the same program or activity.
Annotated Copies: If notes have been added to an information copy of a
document to reflect significant input or for other program purposes, then it is not
a transitory record. The document should be saved and scheduled for disposal
with other records related to the same activity or function.
Official Copies: If a widely distributed document originated with your program
area or was distributed by your committee or project team, then yours may be the
official copy of record. In that case, your copy should be retained and scheduled
for disposal with other related records, while all other information copies may be
discarded when no longer needed.
Committee Records: Refer to Board of Health policies and procedures
concerning record keeping for Health Unit standing committees. Staff
participating on other committees and project teams are to ensure that a person
is appointed to keep and maintain official copies for minutes of meetings and
other records.
If you are not sure, get advice from your Director.
12. Electronic Records
Treat electronic records just as you would paper records: if they fall under one of
types of transitory records, delete them as soon as you’ve finished with them. If
they don’t, save them in a directory for future reference and schedule them for
disposal with your other program records.
If you’re not comfortable reading and deleting (“What if I need it later?”), then
save transitory records to a “temporary” folder or directory and spend a few
minutes each week going through it deleting material you no longer need.
When the Computer Systems Administrator advises you to “clean out” old files
and e-mail messages on your network or local drive, they mean get rid of the
transitory records. Don’t wait for the Computer Systems Administrator to tell you
– when you’re searching your computer directories or e-mail folders make it a
practice to scan for transitory records and delete as you go.
What if I have electronic and paper versions of the same document?
If the document is a transitory record, then get rid of both versions as soon as
you’ve finished with them. If it’s an official record, you may need to keep one
format longer than the other. Keep the format that will be most useful and
accessible in the future especially if the records have permanent value.
13. About E-mail
E-mail is a relatively new kind of electronic record. Tailor-made for fast questions
and responses, for setting up appointments, and for conducting daily business, e-
mail is rapidly replacing the phone call and memo as the office communications
tool of choice.

of 7
E-mail messages often multiply at an alarming rate, congesting computer
systems and reducing efficiency.
When e-mail is used to develop policies and administer program delivery, or
when it documents consultations or critical decisions, the e-mail record may be
the only record of important business decisions.
An e-mail message constitutes an official record when the document is made or
received in connection with transaction of business. For instance:
13.1 When it records official decisions;
13.2 When it records or communicates discussions about policies, programs
and program delivery;
13.3 When it contains background information used to develop other
documents such as studies, reports, and position papers.
14. E-Mail Effectiveness
Start with the assumption that a particular message is a record. Because e-mail
is such a flexible information communications tool, users may be tempted to start
with the opposite assumption, deleting haphazardly. That is how many important
documents are lost.
15. Saving E-Mail Documents
Make a habit of saving important e-mails in your e-mail folders, including e-mail
messages you are transmitting. Periodically delete unimportant/transitory
messages.
Do not rely on network backup tapes for storage. Backup tapes are not meant
for regular use, but rather to meet special circumstances, such as an emergency
or accidental erasure of a file. Individual messages are usually very difficult to
find on back-up tapes.
It may be necessary to print out important e-mails and manually file them with
other related records
Management are to ensure that staff understand their responsibilities when using
e-mail and are familiar with record keeping requirements.
16. Archival and Disposal of Records
Each department will designate one (1) day (minimal) per year for all staff to
isolate records for archive or disposal in accordance with applicable record
retention schedule. Ideally this will be coordinated with the entire agency.
Records to be archived will be stored in sealed cardboard boxes and labelled to
indicate the contents and disposal date, if applicable. Boxes will be transferred
to a dry accessible location. Once sufficient records (twenty-five (25) to thirty
(30) boxes) have been identified for disposal, a commercial shredder will be hired
to shred the documents on site.

Privacy policy procedure

More Related Content

Viewers also liked (9)

Similar to Privacy policy procedure (20)

Privacy policy procedure