Review of Existing Relevant Virtual Health Guidelines and Practices
Table of Contents
- 1 Table of Contents
- 2 Purpose of the Document
- 3 Summary of Relevant Guidelines
- 3.1 Regional Resources
- 3.2 Common elements in virtual care guidelines
- 3.2.1 Consent
- 3.2.1.1 Consent Analysis
- 3.2.2 Privacy
- 3.2.2.1 Privacy Analysis
- 3.2.3 Security
- 3.2.3.1 Analysis on Security
- 3.2.4 Virtual Visit Software Tools and Platforms
- 3.2.5 Billing
- 3.2.6 Regulations
- 3.2.6.1 Analysis on Regulations
- 3.2.7 Patient Guidelines
- 3.2.7.1 Analysis on Patient Guidelines
- 3.2.8 Virtual Visit Guidelines with Specific Accessibility Considerations
- 3.2.9 Telepractice in other fields
- 3.2.10 Examples of Accessibility Guidelines Not Related to Virtual Healthcare
- 3.2.1 Consent
- 4 Summary of Existing Practices
- 5 Recommended Models and Best Practices
Purpose of the Document
This document summarizes a scan of Canadian jurisdictions' virtual health guidelines, tool kits, policies and related resources. The document is a living document and will be updated and revised as new information is discovered.
The source table for this summary is located at https://wiki.fluidproject.org/download/attachments/202506392/IUI%20Accessibility%20Review.xlsx?api=v2
Other guidelines relevant to digital accessibility and inclusion have also been collected and are located at https://wiki.fluidproject.org/download/attachments/202506392/Jurisdictional_Review%23FB93A.xls?api=v2 and in the Legislation and articles of interest pages of the wiki .
Summary of Relevant Guidelines
The following section provides links to resources published by the governing bodies in each province or territory that we were able to access. All information is gathered from official, publicly available documentation from governing bodies in each of the provinces and territories.
In the sections "Telepractice in other fields" and "Examples of Accessibility Guidelines Not Related to Virtual Healthcare" below, information is gathered from sources in other practices / industries, or outside of governing bodies in Canada.
Regional Resources
Most regions in Canada have guidelines published by their governing body that are publicly accessible on the Internet.
Regions in Canada where published guidelines were not found for governing body:
New Brunswick
Northwest Territories
Nunavut
Common elements in virtual care guidelines
We examined virtual care guidelines for a variety of elements including ones related to accessibility. The most common elements in the guidelines were:
Consent
Privacy
Security
Software Tools and Platforms
Regulations / Ethics
Billing
The following table summarizes areas of guidance specific to virtual healthcare from each province in Canada. It is important to note that this table indicates the topic being mentioned, and does not indicate the breadth or depth of that discourse.
Region | Billing | |||||||
|---|---|---|---|---|---|---|---|---|
Alberta |  | | | | | | | |
British Columbia | | | | | | | | |
Manitoba | | | | | | | | |
New Brunswick | Unknown | | Unknown | Unknown | Unknown | | | |
Newfoundland & Labrador | | | | | | | | |
Nova Scotia | | | | | | | | |
Northwest Territories | | | | | | | | |
Nunavut | | | | | | | | |
Ontario | | | | | | | | |
Prince Edward Island | | | | | | | | |
Quebec | | | | | | | | |
Saskatchewan | | | | | | | | |
Yukon | | | | | | | | |
Legend:
= Information present and publicly available from governing body
= Information not found in context of virtual healthcare
Unknown = Inconclusive. Information may require special access
Consent
In all jurisdictions, consent is required to proceed with virtual visits. There are two main forms of consent: written and verbal. Many governing bodies reference the communication templates published by CMPA.
Alberta:
BC:
Manitoba:
New Brunswick:
Inconclusive. Most information for practitioners requires login credentials.
Newfoundland and Labrador:
Northwest Territories:
No information found.
Nova Scotia:
Ontario:
Prince Edward Island:
Verbal consent is required. Written consent is waived for virtual visits (See page 2 of guide)
Quebec:
Informed consent and disclosure of risk must be given (Page 14). References Patient Consent form from McGill.
Saskatchewan
Verbal and Written consent is required, and references CMPA template as examples.
Yukon
Telemedicine guide has a short outline of a workflow which includes informed consent. No other explanation or examples are provided.
Consent Analysis
The process for consent is fairly uniform across all jurisdictions likely due to established in-person protocols for consent, and the CMPA guidance and templates published. In all cases verbal or written consent is required to be recorded into the patient's medical record.
Opportunities for inclusion:
patient to provide consent in other forms:
non-verbal, non-written consent. This can include gestures, movement, symbols, and utterances.
languages other than English or French
patient risk and limitation information provided in multiple formats and modalities for informed consent
provide patient rights as part of informed consent
Privacy
Patient health information privacy and security are often dealt with together, with a general consensus around privacy safeguards.
Alberta:
Virtual care tools require a Privacy Impact Assessment (or PIA)
In response to COVID, a number of tools are pending assessment, but can be used.
References:
British Columbia:
Guidance from the Doctor's Technology Office outlines privacy practices and safe guards.
References:
Manitoba:
Quick start guide mentions legal and professional obligations to privacy and security, and acknowledges that streamlining the process may be necessary to respond to crisis.
References:
New Brunswick:
Inconclusive. Information for practitioners requires login credentials.
Northwest Territories:
Outline of rights of patients under the Health Information Act, and a basic privacy guide.
References:
Nova Scotia:
Getting Started guide page 9 outlines privacy and security safeguards. References the Doctors of BC DTO security guide
Privacy legislation in Nova Scotia
Nunavut:
No information found
Ontario:
Prince Edward Island:
Guide has some information about privacy as it relates to sharing patient information, verbal consent, and compliance with the Health Information Act.
Quebec
Section 2.4 of the Guide discusses the doctor's responsibility to protect the privacy of the patient. Asks questions about security of data storage and retention.
Saskatchewan
Privacy mentioned in context of the Pexip software.
Yukon
Telemedicine guide page 2 outlines the requirements for physicians to ensure setting and patient information is private.
Privacy Analysis
While all jurisdictions understand the importance of privacy, the guidance presented varies drastically from jurisdiction to jurisdiction. For example, in one province privacy in virtual healthcare may refer to privacy settings in a web conferencing platform, while in another province, privacy refers to data storage and retention. In some regions, legislation already exists regarding (electronic) privacy and it may be up to the healthcare practitioner to understand aspects of that legislation as it applies to their virtual healthcare practice and their patients.
Security is often mentioned alongside guidance for privacy. While there are aspects of privacy that overlap with security, the two issues are actually distinct. This can lead to an incorrect assumption that addressing privacy issues is equivalent to addressing security issues.
The following are suggestions to improve the implementation of privacy practices in virtual healthcare:
Define the distinction between privacy and security
provide guidance to both healthcare providers and patients to be active participants in privacy
articulate the different aspects of privacy:
considerations for physical spaces
communication privacy (what should, or shouldn't go into patient-practitioner communication)
ensuring privacy of devices used before, during, and after visits
considerations with 3rd parties involved in care such as MOAs, and patient caregivers
network privacy
existing legislation and policies
Since privacy can encompass such a large domain, a challenge will be to distill privacy concerns to be practical and meaningful.
Security
The term "security" has different meanings depending on the context it is used in virtual care. Security can refer to end-to-end encryption of a video conferencing system, or it could mean the safeguarding of data. For example in Manitoba and PEI, security is referred to only in context of selecting a video conferencing app. Conversely, the Doctor's Technology Office in BC provides distinctions between session and technology safeguards, and provides guidance.
Security can cover the following topics relevant to virtual healthcare (not an exhaustive list):
encryption on electronic communication
viruses and malware
secure and private physical environment for both patient and practitioner
secure and private communication network, portals, and firewalls
secure and insecure methods of communication
identity validation including login passwords, unique URLs, and patient
data storage
data retention
digital information security regulation and legislation
Alberta:
The Office of the Information and Privacy Commissioner of Alberta has published an advisory covering: interception, misdirection, alteration, loss, and inference of information. The advisory has guidance to safeguard against these risks.
British Columbia:
The DTO has provided guidance on three dimensions of security: informed risk, session safeguards, and technology safeguards.
10 hospitals in BC have a joint policy for digital communication. The policy covers permitted communications, consent, identity validation, device and application requirements, encryption, record keeping, and breach notification.
Manitoba:
Doctors are reminded of their professional and legal obligations to security in the quick start guide.
Security features of applications are documented in Video Visit Apps guide.
New Brunswick:
Inconclusive. Information for practitioners requires login credentials.
Newfoundland and Labrador
Guidance provided to Newfoundland is a copy of the same safeguards from the DTO office in BC, which includes guidance for session and technology safeguards.
Northwest Territories
No information found
Nova Scotia
Page 9 of Getting Started guide outlines device safeguards. References the Doctors of BC DTO security guide
Nunavut
No information found
Ontario
OTN outlines the security requirements for selecting a virtual care platform including virtual visits, messaging, and data storage.
Prince Edward Island
Security is discussed in terms of Zoom settings. (Guide page 4)
Quebec
Guidance has been published for email and text (SMS) messaging security best practices
Saskatchewan
Security mentioned in context of the Pexip software.
Yukon
Telemedicine guide page 2 outlines the requirements for physicians to ensure setting and patient information is secure.
Analysis on Security
The topics covered by security is wide-ranging and differs greatly from region to region. Information security is a large domain, with some aspects not immediately relevant to practitioners, caregivers, or patients.
Suggestions on improving communication on matters related to security:
define clearly the difference between security and privacy as it relates to virtual healthcare
break down security into 4 topics for patients: physical space, device, network, and storage (including personal information and passwords).
break down security into 7 topics for practitioners: physical space, device, network, communication tools, virtual visit software / platform, storage (including patient records, and passwords), and legislation / regulations.
inclusive and accessible forms of security - the challenges posed by accounts (logins and passwords), and captchas
strategies for accommodating less-than-ideal security situations such as patients in communal environments, insecure networks, etc.
shift the burden of security from the patient to the infrastructure and design of the platform (i.e. make it easier for the patient to engage)
See notes about registration challenges in notes from Maritime doctor
Virtual Visit Software Tools and Platforms
Each region in Canada has different criteria and recommendations when it comes to virtual visit software and platforms.
Alberta:
Alberta's Virtual Care toolkit has a list of possible software tools including tools that have PIA submissions.
British Columbia:
BC Provincial Health Services Authority is subsidizing Zoom licenses for physicians, nurse practitioners, and specialists.
DTO quick start guide also mentions Doxy.me, Livecare, Memora Health as other possible platforms.
Manitoba:
Adapted technology list based on the list from BC and suggests flexibility in choosing video conferencing application.
Manitoba College of Physicians suggest a variety of free tools, including Facebook Messenger.