Public Service Occupational Health Program - Privacy Impact Assessment
Description of Program
Health Canada, under the Policy on Occupational Safety and Health delegation from the Treasury Board, is tasked with the administration of the Public Service Occupational Health Program (PSOHP). Under the program, Health Canada provides occupational health medical advice, guidance and services to departments listed in schedules I and IV of the Financial Administration Act. This includes over 125 departments and agencies representing over 250,000 public servants across Canada and overseas. The PSOHP is delivered across the country by medical officers (doctors employed by the program), nurse practitioners, occupational health nurses, occupational hygienists, technicians and administrative personnel to federal public servants and their dependents who may be exposed to specific health risks due to their type of work.
Public Service Occupational Health Program
Why was a Privacy Impact Assessment (PIA) completed?
This PIA was undertaken as it meets the following criteria established in the Treasury Board of Canada Secretariat Directive on Privacy Impact Assessment:
- when personal information is used for or is intended to be used as part of a decision-making process that directly affects the individual; and
- upon substantial modifications to existing programs or activities where personal information is used or intended to be used for an administrative purpose.
More Information
This PIA focused on Health Canada’s collection, use, disclosure and retention of personal information involved in the PSOHP. It did not include the privacy-related practices of the federal government institutions listed in schedules I and IV of the Financial Administration Act and that are subject to the Treasury Board Policy on Occupational Safety and Health, nor does it include public and private sector entities from which personal information is collected or to which it is disclosed.
The PIA recommended mitigation actions related to the consent practices, the disclosure of some personal information, privacy notice statements, security assessments and retention practices.