Sample privacy impact assessment: a dental clinic changes its practice software

Example Dental Clinic is replacing its practice management software, currently installed on a server in its office, with cloud software from a Québec publisher, hosted in Québec. The new software will hold patients' records, including medical history, X-rays and treatment plans, as well as the schedule, billing and claims to insurers. Example Dental Clinic is undertaking the project to keep its patients' records, to manage its schedule, billing and insurer claims, and to send patients appointment reminders by text message. The information will not be used for any purpose other than these.

This assessment covers the acquisition of the new software. It includes the migration of existing records by the publisher, the hosting of the information in the cloud, access to it by Example Dental Clinic staff, its retention and return at the end of the contract, and the sending of appointment reminders through a text message service. The records concern between 100 and 10,000 people, many of them children, and consist largely of health information, which makes the information highly sensitive. The assessment is limited to the processing described here and does not cover other activities of Example Dental Clinic. The text message service has not yet been named by the publisher, so the assessment of that part of the project relies on incomplete information.

The personal information comes from Example Dental Clinic's patients. It includes their name, date of birth and contact details, their medical history and records, their X-rays, and their insurance and billing information. Patients are informed of how their information is handled. When the project begins, the publisher will migrate the existing records, including those of many children, from the office server to the new cloud software. From then on, information collected from patients will be recorded directly in the software.

The publisher hosts the records, the schedule and the billing information, and processes them in Québec under a written agreement with Example Dental Clinic. To send appointment reminders, patients' contact details and appointment information will be passed to a text message service. The publisher has not yet identified this service. Where it processes the information, and whether a written agreement covers that processing, remain to be confirmed. Within Example Dental Clinic, access to the information is limited to staff who need it for their work. No decision about patients is made exclusively by automated processing.

The contract with the publisher sets the retention period for the information and provides for the data to be returned to Example Dental Clinic at the end of the contract. Patients receive appointment reminders by text message. How long the text message service keeps the information it receives remains to be confirmed once that service is identified.

The assessment produced two findings, both concerning the text message service that will send appointment reminders. The first is that it is not known whether a written agreement governs that service's processing of patients' information. The second is that the place where the service processes the information is unknown. The main risk identified is that information could be processed outside Québec without adequate protection, which is rated high in severity and medium in likelihood. The assessment also identified two risks rated high in severity and low in likelihood: unauthorised access to the information, and retention longer than necessary. The high sensitivity of the health information involved, and the number of children whose records are migrated, add weight to these risks.

The hosting arrangement with the Québec publisher rests on a written agreement that sets the retention period and the return of the data. The text message service is the main point still to be clarified. Its identity, its processing location, the existence and terms of an agreement with it, and how long it keeps the information all remain to be confirmed. Example Dental Clinic adopts the four measures set out in this document to address these findings and risks.