ISO 13485 Cl. 4.2.5 - Requirements for Control of Records

[snoopy2017]

4.2.5

The organization shall define and implement methods for protecting confidential
health information contained in records in accordance with the
applicable regulatory requirements.

What are some methods that companies use to protect confidential health information in accordance with applicable regulatory requirements? For example, under HIPPA (US). What about in Canada?

Thank you, everyone.

 

[Ajit Basrur]

4.2.5

The organization shall define and implement methods for protecting confidential
health information contained in records in accordance with the
applicable regulatory requirements.

What are some methods that companies use to protect confidential health information in accordance with applicable regulatory requirements? For example, under HIPPA (US). What about in Canada?

Thank you, everyone.

Overview of privacy legislation in Canada - Office of the Privacy Commissioner of Canada

 

[Mark Meer]

...What are some methods that companies use to protect confidential health information in accordance with applicable regulatory requirements? For example, under HIPPA (US). What about in Canada?.... .

I presume that you deal with confidential health information?

...just making sure because, if you don't (as it is with most device manufacturers), this clause would just be non-applicable (document this somewhere, and you're done!).

 

[mihzago]

As described on the site provided by Ajit, PIPEDA is the main regulation in Canada, with some additional provincial requirements. For example, PIPA Alberta has certain restrictions for processing data outside of Canada.

PIPEDA is similar to the EU GDPR and Australian Privacy Act of 1988, in that all three have very similar data privacy principles that cover all personal information, with special considerations to health related data (HIPAA addresses only PHI).

Canada and Australia on their sites provide a lot of really good guidance documents on interpretation and implementation of the privacy regulations.