Assess PIPA responsibilities across the supplier chain
The B.C. privacy commissioner's guidance for private organizations should inform the PIPA assessment. Determine the roles and any other applicable information requirements for the clinical practice, operating company, and participating suppliers.
Map what each system collects, uses, stores, and shares. Include support conversations, recordings or transcripts, automated analysis, exports, and backup services. Information sent outside the main chart remains part of the service's privacy responsibilities.
Ask why each flow is necessary for the reviewed purpose. Remove avoidable collection and broad access. A feature being available in a subscription does not establish that it is appropriate for the health information involved or that the contract covers the intended use.
Review changes before enabling them with real records. A supplier update can add processing or access without changing the patient-facing design. Give an accountable person authority to pause the connection until the relevant purposes, safeguards, agreements, and patient rights have been assessed.