Each slide is read aloud as you go. Please turn your device sound on, or switch narration off at any time using the button in the bottom bar.
You control the pace — narration follows your Continue button.
SLFNHA
Sioux Lookout First Nations Health Authority
Annual Training · Privacy & Confidentiality
Privacy Training
Protecting client information — everyone's responsibility.
Required annually for all staff with PHI access
What you'll learn today
Today's Training
🔍
What is privacy & why it matters
📋
What counts as Personal Health Information
🤝
Consent — implied and express
🔒
Safeguarding PHI: digital, paper & phone
⚠️
Recognizing & reporting privacy breaches
🌿
OCAP® — First Nations data sovereignty
📝 Includes 3 quizzes and 2 reflection moments to check your understanding.
Foundations
Why Privacy Matters
Client trust
Privacy = Trust
Clients share their most sensitive information with us because they trust us. Privacy is the foundation of that trust — and of safe, effective care.
Legal obligation
PHIPA 2004
Ontario's Personal Health Information Protection Act sets binding rules. Violations can result in fines, termination, and regulatory action.
Definition
Privacy
An individual's right to control who sees their personal information — when, how, and why it's collected or shared.
Definition
Confidentiality
Our duty to keep client information private — securing files, limiting access, and only sharing when appropriate.
Definitions
What Must We Protect?
PHI — Personal Health Information
Diagnoses & medical history
Family health history
OHIP / INAC numbers
Care received here or elsewhere
Any format: paper, email, verbal
PI — Personal Information
Full name + demographics
Date of birth or death
Contact information
Driver's licence / SIN / Status #
Employment information
Not private information
Job title
Business address
Business phone number
General area codes
✦ Quiz 1 of 3 — True or False
"A client's job title and business phone number are Personal Health Information (PHI) and must be protected under PHIPA."
Select an answer to continue →
All Staff
Your Privacy Responsibilities
1
Know the policies — Follow SLFNHA's privacy policies and procedures relevant to your role.
2
Complete training annually — Before getting PHI access, and every year after.
3
Ask when unsure — If you don't understand your privacy obligations, ask your manager or Privacy Officer.
4
Protect PHI — Take reasonable steps to prevent unauthorized access, use, or disclosure.
5
Report breaches quickly — Notify your manager and the Privacy Officer as soon as possible.
PHI Sharing
Consent — When Do You Need It?
✓ Implied consent
No active step needed
Assumed when you:
• Collect information directly from the client
• Use PHI to provide health care
• Share with most healthcare providers (hospital, CCAC, mental health program)
! Express consent required
Must explicitly ask
Required when sharing with:
• Client's family, friends, or community
• Federal nursing stations
• Traditional health partners outside SLFNHA
• Band health services or transportation providers
Withdrawal of consent
Clients can block their PHI at any time. If blocked, you can only access it with express consent, to prevent serious harm, or if your manager and Privacy Officer approve.
💭 Moment of Reflection
"A client's adult daughter calls asking about her mother's recent appointment. She says her mother asked her to call. What do you do?"
?
Does calling on someone's behalf automatically count as consent?
?
What type of consent — implied or express — applies here?
?
What steps would you take before sharing any information?
?
What would you document, and where?
Take a moment — there's no single right answer. Discuss with your team if possible.
Limiting Access
The Need-to-Know Rule
Only access, use, or share the minimum amount of PHI needed to do your job.
✓ Do
Access only records of clients in your direct care
Use standard forms and templates
Ask yourself: "Is this information necessary?"
Disclose only relevant, current information
✗ Don't
Look up records of neighbours, family, or friends
Browse your own health record
Send more info than the situation requires
Snoop — even out of curiosity
Safeguarding
Digital Safeguards
✓ Do
Use a strong, unique password
Change password at least every 6 months
Lock screen or log out when stepping away
Notify IT immediately if password is compromised
✗ Don't
Share your password with anyone
Disable or interfere with security software
Log in using someone else's credentials
Use personal or unapproved devices for SLFNHA work
Safeguarding
Paper & Communication
📁 Paper files — Do
Lock paper files when not in use
Keep SLFNHA materials with you in the community
Collect printouts from printers immediately
Leave drawers or offices unlocked unattended
Put PHI in recycling — use confidential shredding
📞 Communicating PHI — Do
Verify client identity before discussing PHI by phone
Leave only appointment reminders in voicemail
Confirm fax number before every send
Use personal social media for health information
Discuss clients in elevators, cafeterias, or transit
🎯 Quiz 2 of 3 — Scenario
You print a client's care summary and walk away for a phone call. 10 minutes later — the printout is gone. What do you do first?
Select the best answer to continue →
Recognize & Respond
Privacy Breaches
A privacy breach is any unauthorized collection, use, disclosure, access, modification, or disposal of PHI — whether accidental or intentional.
Examples
!
Looking up a neighbour's file not in your care
!
Faxing a record to the wrong number
!
Talking to a client's family without consent
!
Discussing a client in a public elevator
If you suspect a breach
1
Contain
Retrieve lost records if safe. Secure — do NOT destroy PHI.
2
Notify within 1 hour
Tell your manager and Privacy Officer immediately.
3
Support
Cooperate fully with any investigation.
✦ Quiz 3 of 3 — True or False
"If you accidentally fax PHI to the wrong number, you should investigate on your own first before telling your manager — to avoid causing unnecessary alarm."
Select an answer to continue →
Annual Requirement
Code of Conduct & Agreements
Privacy code of conduct
Sign Annually
All staff must read and sign this document before accessing PHI, and once a year after. It outlines your personal commitment to protect client privacy.
Find it: F:\Privacy and Confidentiality
Work-from-home agreement
Before You WFH
A separate privacy agreement must be signed before working remotely. It covers how to protect client information outside the office.
Consequences of non-compliance
• Disciplinary action up to termination
• Referral to the Information & Privacy Commissioner of Ontario
• Notification to your regulatory college
• Law enforcement involvement where applicable
Leadership
For Managers
📋
Define Purposes
Establish why and how your team collects, uses, and discloses PHI.
🔑
Access Control
Ensure staff access only the PHI they need. Track and review access levels.
⚠️
First Breach Contact
You're the first point of contact when your staff encounter a breach.
🎓
Training Compliance
Remove staff PHI access if privacy training is not completed annually.
📄
Vendor Agreements
Review vendor contracts to ensure privacy requirements are met.
🔍
Privacy Impact
Notify the Privacy Officer when new programs or systems involving PHI are planned.
First Nations Data Sovereignty
OCAP® Principles
Registered trademark of the First Nations Information Governance Centre (fnigc.ca/ocap)
O
Ownership
Communities own information about themselves collectively, just as individuals own their personal data.
C
Control
Communities must control how information about them is collected, used, and shared — at every level.
A
Access
Nations must have access to their own data and be able to manage who else has access to it.
P
Possession
Physical control of data protects ownership. Data cannot be taken or used without permission.
SLFNHA does not collect, use, or disclose community-level health information without consent of community leadership. Research must follow Tri-Council Policy Statement Chapter 9.
💭 Final Reflection
"Think about your day-to-day work. Where are the moments when client privacy could be at greatest risk — and what is one thing you can do differently?"
?
Where do you handle PHI most often — on paper, electronically, over the phone?
?
Have you ever overheard PHI discussed in a public or shared space?
?
If you saw a colleague access a record they shouldn't, would you know what to do?
?
Is there anything in your current habits you want to strengthen after today?
Take a moment to reflect before moving to the final section.
Questions? Contact us
Privacy Officer & Program Manager SLFNHA & SLRPSI
📞
807-737-3933 / 807-737-0359
✉️
privacy@slfnha.com
✉️
Kiruthika.Radhakrishnan@SLFNHA.COM
When in doubt — ask before you act.
Certificate of Completion
Annual Privacy Training
Sioux Lookout First Nations Health Authority
SLFNHA
—
Quiz score
—
Slides completed
Record your completion
Enter your name to log that you finished this training. Your quiz score and completion date are added automatically.