Review and Approval Process
Where can I find the manuals that set out the requirements for review and approval? The IPC issues manuals and addenda for the initial and subsequent three-year reviews and approvals of prescribed entities, persons, and organizations. Each prescribed entity, person, or organization is responsible for determining the manual(s) and addenda applicable to them, subject to any exceptions granted by the IPC: The IPC manuals and addenda set out the minimum requirements each prescribed entity, person, or organization is to address within their practices and procedures to protect the privacy of the individuals whose personal information or personal health information it receives and maintain the confidentiality of the information. The manuals and addenda also distinguish between the initial review of a prescribed entity, person, or organization and subsequent reviews which take place every three years from the date of the initial approval by the IPC. The process pursued for the initial and three-year reviews has been revised, and the new process was first applied for the 2022-23 review cycle. Please refer to the revised Manual for the Review and Approval of Prescribed Persons and Prescribed Entities for further details of the new review process.
What happens during the initial review? Each prescribed entity, person, or organization seeking the initial approval of the IPC must submit all of their policies, procedures, and practices for consideration as well as any Statements of Requested Exceptions or Statements of Inapplicability that may apply. Statements of Requested Exceptions and Statements of Inapplicability Statements of Requested Exceptions must be requested if there is, or is expected to be, any requirement(s) of the applicable manual or addendum the prescribed entity, person, or organization anticipates they do not or will not be able to address. The Statements of Requested Exceptions must identify the relevant manual/addendum requirement together with a detailed timeline to either achieve compliance or an equivalent standard to protect the privacy of the individuals whose information it receives. Where one or more requirement(s) of a manual/an addendum does not apply to a prescribed entity, person, or organization, they must submit Statements of Inapplicability that identify each requirement that is inapplicable (if any) with a rationale. IPC Review of Submitted Materials Upon receipt, the IPC will review the policies, procedures, and practices implemented by the prescribed entity, person, or organization, along with any Statements of Requested Exceptions and Statements of Inapplicability submitted and will request any additional documentation and clarifications that it deems necessary. On-Site Meeting The IPC will schedule an on-site meeting to discuss the policies, procedures, or practices; review physical security measures put in place to protect the information; and may make further inquiries of the prescribed entity, person, or organization. Following the on-site meeting, the IPC may specify actions for a prescribed entity, person, or organization to take prior to their approval. Approval The IPC will issue a letter to each prescribed entity, person, or organization with its decision whether to approve the policies, procedures, and practices, and any Statements of Requested Exceptions or Statements of Inapplicability. The letter may include recommendations for further improvements to the policies, procedures, and practices of the prescribed entity, person, or organization. At the end of a review, the finalized report is posted on the Reviews and Approvals: Documentation website, along with a letter of approval and any approved Statements of Requested Exceptions and Statements of Inapplicability.
What is involved in subsequent reviews? Entities, persons, and organizations that are prescribed under PHIPA, the Coroners Act, or the CYFSA must be reviewed by the IPC every three years after their initial approval, and they must submit to the IPC: Approval The indicators, sworn affidavit submitted by the prescribed person, entity, or organization, along with the Approval Letter, and any approved Statements of Requested Exceptions and Statements of Inapplicability will be made publicly available on the Reviews and Approvals: Documentation website.
What happens if the practices and procedures are approved? With respect to the initial review, a person, entity, or organization may only operate as a prescribed person, entity, or organization once it submits its practices and procedures to the IPC, the IPC has reviewed and approved the practices and procedures, and the IPC has issued a letter and accompanying report to this effect, unless otherwise specified in legislation. Entities, persons, or organizations that receive subsequent approvals from the IPC can continue to operate as a prescribed entity, person, or organization until the end of the next three-year review. At the end of every review, the IPC updates its Reviews and Approvals: Documentation website with the final documentation for each prescribed entity, person or organization that is approved.
What happens if the practices and procedures are not approved in a subsequent review? An entity, person, or organization may not continue to operate under its authorities as a prescribed entity, person, or organization unless it has submitted the required materials to the IPC, and the IPC has provided an approval letter indicating that its practices and procedures continue to be approved. The IPC will inform the prescribed person, entity, or organization in writing, in the case where their practices and procedures are not approved on the date of requested or required approval. The prescribed person, entity, or organization may resubmit its policies, procedures, and practices and any other requested documentation for approval by the IPC, as described in the IPC’s letter. Once the significant divergence(s) have been adequately addressed, approval will be provided to resume operating as a prescribed person, entity, or organization.
Do all of the three-year reviews and approvals occur at the same time? The IPC normally conducts all three-year reviews and approvals at the same time. If an entity, person, or organization receives approval in an intermediate year, the approval may be granted for a period shorter than three years to ensure the next review falls within the same period as the other three-year reviews and approvals.
Where can I find documentation related to previous reviews and approvals? The published documentation for every review and approval is available on the IPC’s Reviews and Approvals: Documentation website.
