{"id":2863,"date":"2023-09-01T15:08:41","date_gmt":"2023-09-01T15:08:41","guid":{"rendered":"https:\/\/kleetos.com\/?p=2863"},"modified":"2025-05-20T15:16:50","modified_gmt":"2025-05-20T15:16:50","slug":"privacy-impact-assessment-expert-advice-on-getting-your-pia-right","status":"publish","type":"post","link":"https:\/\/brightsquid.com\/us\/privacy-impact-assessment-expert-advice-on-getting-your-pia-right\/","title":{"rendered":"Privacy Impact Assessment – Expert advice on getting your PIA right"},"content":{"rendered":"\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\"\"\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

When you want to know everything there is to know about Privacy Impact Assessments (PIA), Alberta privacy expert, Ingrid Ruys, is the person to ask. Ms. Ruys has over 30 years of experience helping organizations with regulatory compliance and has served as the Chief Privacy Officer for the Physician Office System Program (POSP) for the last 12 years. She is the founder and owner of RJK General Services Ltd, a privacy, security, and regulatory compliance consultancy. With over 1000 successful PIA\u2019s under her belt, no one is more qualified to advise clinics on PIAs.\u00a0As\u00a0all dentists in Alberta and several other health profession including optometrists and chiropractors are now required to submit PIAs<\/strong>\u00a0as part of their regulatory responsibilities, I wanted to get the facts about what a PIA is, what should be included, and who is qualified to complete one. Here is what Ms. Ruys taught me about getting a PIA right to avoid the serious fines clinics risk by not completing a PIA, or completing it improperly. \u00a0<\/p>

What is a Privacy Impact Assessment?<\/h3>

IR:\u00a0Section 64 of the Health Information Act (HIA) mandates submission of a Privacy Impact Assessment for review by the Office of the Information and Privacy Commissioner (OIPC)<\/strong>. A PIA is an in depth look at how an organization, office or clinic proposes to use and handle patient information and is meant to address potential risks to patient privacy.\u00a0It is a declaration to the OIPC that your clinic understands how, and has sufficient processes in place, to protect the information of your patients.<\/strong>\u00a0Depending on the clinic, a PIA can be 350 pages or more. It\u2019s not light reading. \u00a0<\/p>

Who can complete a PIA?<\/h3>

IR: Technically anyone can complete and submit a PIA. I certainly don\u2019t advise it.\u00a0PIAs are complex documents that require a deep level of understanding of the provincial privacy regulations and the process through which applications are assessed.<\/strong>I have been called in to fix too many PIAs completed by IT people or office staff that didn\u2019t take the time (because it\u2019s not their job or expertise) to learn the intricacies of writing an acceptable PIA, or don\u2019t realize that the system or practice they are implementing has privacy\/security risks. To properly complete a PIA the first time takes weeks of dedicated work. Clinics are much better off, in the long and short run,\u00a0working with a privacy professional<\/a>\u00a0and certified privacy expert who really knows the process and can adapt their understanding to unique office situations. It\u2019ll save a lot of time, avoid disruptions to the work staff are really supposed to be doing, and pretty much guarantee compliance to the Acts and Regulations, as well as acceptance of the PIA. Anyone that hasn\u2019t submitted a successful PIA already, will likely have additional comments and concerns to address and more follow-up, which means additional time before it\u2019s accepted. There are a handful of privacy professionals in Alberta that have many years of experience writing and submitting hundreds of PIAs. They have developed relationships with reviewers and can quickly address concerns if they do arise. Here’s a\u00a0privacy consultant comparison checklist<\/a>\u00a0to help evaluate your options. \u00a0<\/p>

What certifications will a qualified privacy professional have?<\/h3>

IR:\u00a0There are two certifications you want see on the resume of any professional you hire to execute your PIA.<\/strong>\u00a0Either of these certifications prove you are working with a person that knows privacy and can set your clinic up with a successful application. The first certification to look for is from the Canadian Institute of Access and Privacy Professionals – CIAPP. This one can have one of three designations; Certified (C), Professional (P), or Master (M). This certification was originally established with funding from the Privacy Commission of Canada and the Information Commissioner and is supported by access and privacy commissions across the country. The other certification to look for is from the Privacy and Access Council of Canada (IAPP) The CAPP represents national leadership and excellence in information privacy, information access, and data governance. Anyone who has their CAPP certification knows their stuff. There are additional certifications such as HIPAA (US) or CHIMS that prove in depth knowledge of privacy regulations. \u00a0<\/p>

What other factors do clinics need to consider when completing a PIA?<\/h3>

IR:\u00a0For dentists, optometrists, and chiros in Alberta, it\u2019s very important to be thinking about Netcare access requirements.<\/strong>\u00a0A PIA that doesn\u2019t have the proper Netcare references can stand in the way of getting access down the road and will necessitate, at the very least, an amendment to your PIA. That\u2019ll just slow things down, and can get quite expensive. The technology you\u2019re using to solve privacy issues around how you store and share patient information matters. If a service is brand new and hasn\u2019t been reviewed by the OIPC yet, you need to question if you want to be the first one to try it. You\u2019re much more likely to get approval for technology and services that have already been approved on other PIAs. \u00a0<\/p>

Does a completed PIA last forever?<\/h3>

IR: No. Rules change. Legislation is updated all the time.\u00a0Clinics adapt their processes, change the way they administer the practice, and add new technology. All of that means your PIA needs to be updated.<\/strong>\u00a0Seasoned privacy professionals will automatically update PIAs they have submitted to conform with regulation changes. Working with an organization that isn\u2019t focused on Alberta\u2019s privacy regulations everyday means you risk missing these important changes and falling out of compliance. Make sure those legislative refreshes are included in your original PIA. When you do need to submit a PIA or an amendment to address process changes, hiring a professional familiar with your original submission (if possible) will expedite that process so that you\u2019re not waiting months for approval to proceed with your desired changes. \u00a0<\/p>

The bottom line on PIAs<\/h3>

Writing and submitting a PIA can be an intimidating endeavor to the point that your practice avoids doing it until it\u2019s too late. You\u2019ll know it\u2019s too late when the OIPC audits your practice or investigates a patient complaint and you don\u2019t have a Privacy Impact Assessment in place. The fines associated with not having the proper privacy procedures in place (which is the purpose of writing a PIA) can reach $50,000.\u00a0Your PIA doesn\u2019t have to be difficult or time consuming. You don\u2019t need to become an expert in patient privacy.<\/strong>Engage an expert and you\u2019ll actually save time and money. Established experts understand the PIA process and can quickly suggest changes to your plans and processes to ensure you are in compliance with privacy regulations and write a PIA document that will get accepted the first time, so that you can be confident your clinic is operating within the letter of the law.<\/p>

To book\u00a0your expert privacy consultation, contact\u00a0sales@brightsquid.com<\/a>.<\/h4>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t<\/div>\n\t\t","protected":false},"excerpt":{"rendered":"

When you want to know everything there is to know about Privacy Impact Assessments (PIA), Alberta privacy expert, Ingrid Ruys, is the […]<\/p>\n","protected":false},"author":1,"featured_media":3104,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[],"class_list":["post-2863","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-brightsquid-blog"],"yoast_head":"\nGet Your Privacy Assessments Right | Brighsquid Blog<\/title>\n<meta name=\"description\" content=\"Read how to complete your Privacy Impact Assessments properly from certified healthcare privacy compliance experts.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/brightsquid.com\/privacy-impact-assessment-expert-advice-on-getting-your-pia-right\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Privacy Impact Assessment - Expert advice on getting your PIA right\" \/>\n<meta property=\"og:description\" content=\"Read how to complete your Privacy Impact Assessments properly from certified healthcare privacy compliance experts.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/brightsquid.com\/privacy-impact-assessment-expert-advice-on-getting-your-pia-right\/\" \/>\n<meta property=\"og:site_name\" content=\"Brightsquid US | Simplify Clinic Operations, Prevent Privacy Breaches\" \/>\n<meta property=\"article:published_time\" content=\"2023-09-01T15:08:41+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2025-05-20T15:16:50+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/brightsquid.com\/us\/wp-content\/uploads\/sites\/2\/2023\/09\/secure-clinic-messaging-PIA-expert-advice-brightsquid-blog.jpg\" \/>\n\t<meta property=\"og:image:width\" content=\"812\" \/>\n\t<meta property=\"og:image:height\" content=\"372\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/jpeg\" \/>\n<meta name=\"author\" content=\"Brightsquid Secure Communications\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Brightsquid Secure Communications\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"6 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"WebPage\",\"@id\":\"https:\/\/brightsquid.com\/us\/privacy-impact-assessment-expert-advice-on-getting-your-pia-right\/\",\"url\":\"https:\/\/brightsquid.com\/privacy-impact-assessment-expert-advice-on-getting-your-pia-right\/\",\"name\":\"Get Your Privacy Assessments Right | Brighsquid Blog\",\"isPartOf\":{\"@id\":\"https:\/\/brightsquid.com\/us\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\/\/brightsquid.com\/privacy-impact-assessment-expert-advice-on-getting-your-pia-right\/#primaryimage\"},\"image\":{\"@id\":\"https:\/\/brightsquid.com\/privacy-impact-assessment-expert-advice-on-getting-your-pia-right\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/brightsquid.com\/us\/wp-content\/uploads\/sites\/2\/2023\/09\/secure-clinic-messaging-PIA-expert-advice-brightsquid-blog.jpg\",\"datePublished\":\"2023-09-01T15:08:41+00:00\",\"dateModified\":\"2025-05-20T15:16:50+00:00\",\"author\":{\"@id\":\"https:\/\/brightsquid.com\/us\/#\/schema\/person\/6172cfd5b58366fc9449c27459fe3205\"},\"description\":\"Read how to complete your Privacy Impact Assessments properly from certified healthcare privacy compliance experts.\",\"breadcrumb\":{\"@id\":\"https:\/\/brightsquid.com\/privacy-impact-assessment-expert-advice-on-getting-your-pia-right\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/brightsquid.com\/privacy-impact-assessment-expert-advice-on-getting-your-pia-right\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/brightsquid.com\/privacy-impact-assessment-expert-advice-on-getting-your-pia-right\/#primaryimage\",\"url\":\"https:\/\/brightsquid.com\/us\/wp-content\/uploads\/sites\/2\/2023\/09\/secure-clinic-messaging-PIA-expert-advice-brightsquid-blog.jpg\",\"contentUrl\":\"https:\/\/brightsquid.com\/us\/wp-content\/uploads\/sites\/2\/2023\/09\/secure-clinic-messaging-PIA-expert-advice-brightsquid-blog.jpg\",\"width\":812,\"height\":372},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/brightsquid.com\/privacy-impact-assessment-expert-advice-on-getting-your-pia-right\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/brightsquid.com\/us\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Privacy Impact Assessment – Expert advice on getting your PIA right\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/brightsquid.com\/us\/#website\",\"url\":\"https:\/\/brightsquid.com\/us\/\",\"name\":\"Brightsquid US | Simplify Clinic Operations, Prevent Privacy Breaches\",\"description\":\"\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/brightsquid.com\/us\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Person\",\"@id\":\"https:\/\/brightsquid.com\/us\/#\/schema\/person\/6172cfd5b58366fc9449c27459fe3205\",\"name\":\"Brightsquid Secure Communications\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/brightsquid.com\/us\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/secure.gravatar.com\/avatar\/6087d6d32268cb4d89627c663c0b150d?s=96&d=mm&r=g\",\"contentUrl\":\"https:\/\/secure.gravatar.com\/avatar\/6087d6d32268cb4d89627c663c0b150d?s=96&d=mm&r=g\",\"caption\":\"Brightsquid Secure Communications\"},\"sameAs\":[\"https:\/\/brightsquid.com\"],\"url\":\"https:\/\/brightsquid.com\/us\/author\/lro99\/\"}]}<\/script>\n<!-- \/ Yoast SEO Premium plugin. -->","yoast_head_json":{"title":"Get Your Privacy Assessments Right | Brighsquid Blog","description":"Read how to complete your Privacy Impact Assessments properly from certified healthcare privacy compliance experts.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/brightsquid.com\/privacy-impact-assessment-expert-advice-on-getting-your-pia-right\/","og_locale":"en_US","og_type":"article","og_title":"Privacy Impact Assessment - Expert advice on getting your PIA right","og_description":"Read how to complete your Privacy Impact Assessments properly from certified healthcare privacy compliance experts.","og_url":"https:\/\/brightsquid.com\/privacy-impact-assessment-expert-advice-on-getting-your-pia-right\/","og_site_name":"Brightsquid US | Simplify Clinic Operations, Prevent Privacy Breaches","article_published_time":"2023-09-01T15:08:41+00:00","article_modified_time":"2025-05-20T15:16:50+00:00","og_image":[{"width":812,"height":372,"url":"https:\/\/brightsquid.com\/us\/wp-content\/uploads\/sites\/2\/2023\/09\/secure-clinic-messaging-PIA-expert-advice-brightsquid-blog.jpg","type":"image\/jpeg"}],"author":"Brightsquid Secure Communications","twitter_card":"summary_large_image","twitter_misc":{"Written by":"Brightsquid Secure Communications","Est. reading time":"6 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"WebPage","@id":"https:\/\/brightsquid.com\/us\/privacy-impact-assessment-expert-advice-on-getting-your-pia-right\/","url":"https:\/\/brightsquid.com\/privacy-impact-assessment-expert-advice-on-getting-your-pia-right\/","name":"Get Your Privacy Assessments Right | Brighsquid Blog","isPartOf":{"@id":"https:\/\/brightsquid.com\/us\/#website"},"primaryImageOfPage":{"@id":"https:\/\/brightsquid.com\/privacy-impact-assessment-expert-advice-on-getting-your-pia-right\/#primaryimage"},"image":{"@id":"https:\/\/brightsquid.com\/privacy-impact-assessment-expert-advice-on-getting-your-pia-right\/#primaryimage"},"thumbnailUrl":"https:\/\/brightsquid.com\/us\/wp-content\/uploads\/sites\/2\/2023\/09\/secure-clinic-messaging-PIA-expert-advice-brightsquid-blog.jpg","datePublished":"2023-09-01T15:08:41+00:00","dateModified":"2025-05-20T15:16:50+00:00","author":{"@id":"https:\/\/brightsquid.com\/us\/#\/schema\/person\/6172cfd5b58366fc9449c27459fe3205"},"description":"Read how to complete your Privacy Impact Assessments properly from certified healthcare privacy compliance experts.","breadcrumb":{"@id":"https:\/\/brightsquid.com\/privacy-impact-assessment-expert-advice-on-getting-your-pia-right\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/brightsquid.com\/privacy-impact-assessment-expert-advice-on-getting-your-pia-right\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/brightsquid.com\/privacy-impact-assessment-expert-advice-on-getting-your-pia-right\/#primaryimage","url":"https:\/\/brightsquid.com\/us\/wp-content\/uploads\/sites\/2\/2023\/09\/secure-clinic-messaging-PIA-expert-advice-brightsquid-blog.jpg","contentUrl":"https:\/\/brightsquid.com\/us\/wp-content\/uploads\/sites\/2\/2023\/09\/secure-clinic-messaging-PIA-expert-advice-brightsquid-blog.jpg","width":812,"height":372},{"@type":"BreadcrumbList","@id":"https:\/\/brightsquid.com\/privacy-impact-assessment-expert-advice-on-getting-your-pia-right\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/brightsquid.com\/us\/"},{"@type":"ListItem","position":2,"name":"Privacy Impact Assessment – Expert advice on getting your PIA right"}]},{"@type":"WebSite","@id":"https:\/\/brightsquid.com\/us\/#website","url":"https:\/\/brightsquid.com\/us\/","name":"Brightsquid US | Simplify Clinic Operations, Prevent Privacy Breaches","description":"","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/brightsquid.com\/us\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Person","@id":"https:\/\/brightsquid.com\/us\/#\/schema\/person\/6172cfd5b58366fc9449c27459fe3205","name":"Brightsquid Secure Communications","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/brightsquid.com\/us\/#\/schema\/person\/image\/","url":"https:\/\/secure.gravatar.com\/avatar\/6087d6d32268cb4d89627c663c0b150d?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/6087d6d32268cb4d89627c663c0b150d?s=96&d=mm&r=g","caption":"Brightsquid Secure Communications"},"sameAs":["https:\/\/brightsquid.com"],"url":"https:\/\/brightsquid.com\/us\/author\/lro99\/"}]}},"_links":{"self":[{"href":"https:\/\/brightsquid.com\/us\/wp-json\/wp\/v2\/posts\/2863"}],"collection":[{"href":"https:\/\/brightsquid.com\/us\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/brightsquid.com\/us\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/brightsquid.com\/us\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/brightsquid.com\/us\/wp-json\/wp\/v2\/comments?post=2863"}],"version-history":[{"count":14,"href":"https:\/\/brightsquid.com\/us\/wp-json\/wp\/v2\/posts\/2863\/revisions"}],"predecessor-version":[{"id":5312,"href":"https:\/\/brightsquid.com\/us\/wp-json\/wp\/v2\/posts\/2863\/revisions\/5312"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/brightsquid.com\/us\/wp-json\/wp\/v2\/media\/3104"}],"wp:attachment":[{"href":"https:\/\/brightsquid.com\/us\/wp-json\/wp\/v2\/media?parent=2863"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/brightsquid.com\/us\/wp-json\/wp\/v2\/categories?post=2863"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/brightsquid.com\/us\/wp-json\/wp\/v2\/tags?post=2863"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}