32 Office of the Saskatchewan Information and Privacy Commissioner. The Rules of Procedure. Effective 1 Dec. 2018. Updated 16 Aug. 2023. Part 7: Procedure on Privacy Breach Investigations Under HIPA This Part outlines the procedure that the commissioner’s office will follow and require trustees follow when carrying out an investigation of a possible privacy breach. 7-1 Complaint of Breach of Privacy (1) The commissioner’s office may become aware of a possible privacy breach in several different ways including: • An individual complaining to the commissioner’s office about a trustee’s, actions or practices; • Another individual in possession of personal health information notifying the commissioner’s office; • Employees of a trustee informing the commissioner’s office of inappropriate practices within the organization; • The commissioner’s office becoming aware of media reports of a potential privacy breach or inappropriate privacy practices; and upon becoming aware, the commissioner’s office may commence an investigation. (2) A complainant can report a possible privacy breach by completing the Alleged Breach of Privacy Reporting Form: for Affected Individuals/Complainants or an equivalent document and delivering it to the commissioner’s office by email, regular mail, courier or personal delivery. (3) If a complainant has not yet given the trustee an opportunity to respond to the matter, the commissioner’s office may refer the complainant to the trustee before proceeding with an investigation. (4) Once contact is made pursuant to subsection (2), the commissioner’s office will advise the complainant or third party of any additional information required to support an investigation and the complainant or third party will have 30 days, unless the commissioner determines otherwise, to provide that additional information. If the information is not provided in that time, the investigation will not continue unless the commissioner determines there are unique circumstances.
RkJQdWJsaXNoZXIy MTgwMjYzOA==