About Government On-Line (GOL)
An initiative of the Government of Canada, the goal of the GOL initiative is to use information and communication technology to provide Canadians with increased access to citizen-centred, integrated services – anytime, anywhere – in the language of their choice. This initiative allows Canadians and organizations to access general information about Government of Canada programs and services, to apply for services on-line, and, in some cases, allows individuals to access personal information about themselves collected and used by various government institutions.
This Privacy Impact Assessment (PIA) describes the Benefits and Health Services On-Line (B&HSOL) system and demonstrates the considerations and steps taken to protect the client's personal information when it is being transferred electronically.
About the B&HSOL system
Veterans Affairs (VA) has developed a system for on-line submissions of electronic health assessment forms using the B&HSOL system. The B&HSOL system will allow VA District Office Nurses (DON) to select specific forms for clients and forward them to a contracted health professional for completion. The System will allow VA's contracted health professionals to digitally receive, sign and submit standard nursing assessment reports (or forms) on-line once the health professional has registered for a Public Key Infrastructure (PKI) certificate and enrolled in the B&HSOL system.
Once the appropriate DON closes a form, it will be available for viewing only through the Client Inquiry functionality in B&HSOL and the Client Service Delivery Network (CSDN), an integrated system that supports the delivery of benefits and services associated with the Disability Pension, Economic Support and Health Care programs of the Department. Only VA employees will have access to view completed client assessment forms; contracted health professionals will not have access to the Client Inquiry functionality. A VA employee's access to view completed forms will be based on restricted system access profile grids for B&HSOL and CSDN. Clients will not have on-line access to their completed forms, but this information will be accessible to clients through a formal request under the Privacy Act.
To support the on-line system, VA will subscribe to the service provided by Public Works and Government Services Canada's (PWGSC) Secure Applications and Key Management Service (SAKMS) to enable electronic program delivery via the Internet in a secure environment This information is protected by Secure Socket Layers (SSL), Entrust TruePass technology and based on guidelines from the Communications Security Establishment (CSE). VA will use major elements of Secure Channel's service capabilities to support communication and interaction between VA and its contracted health professionals including SCNet -- a government-wide telecommunications network for connecting departmental systems.
About the PIA
Veterans Affairs is committed to protecting the personal information of its clients and has taken measures to ensure that this system conforms to the principles of the Privacy Act and Regulations and the Treasury Board policy on Privacy and Data Protection that govern the collection, use, correction, protection, retention and disposal of personal information.
The Outstanding Issues portion of this PIA identifies two privacy-related issues. Both issues relate to processes within VA and are considered to be low risk.
- Control and Custody of Records: Third-party health professionals need to be made aware that their obligations with respect to record retention and client information, currently written into standard contracts, carry over into the electronic domain. A formal notification process for third-party users will mitigate this risk.
- Electronic Document Management: As VA does not currently have an electronic document management system, all forms will have to be printed and sent to VA's Records section. This issue will continue to be explored by the Strategic Information Management Group as it has been addressed in the recent Information Management Capacity Check (IMCC).