Canadian Dental Care Plan - Privacy

Official title: Privacy protection in the Canadian Dental Care Plan

Privacy management

To deliver the Canadian Dental Care Plan (CDCP), Health Canada works with Government of Canada partners and Sun Life Financial Inc. (Sun Life), a contracted third-party administrator.

Government of Canada institutions must protect your personal information and uphold your privacy rights as required by the Privacy Act and related policies.

Health Canada works with the following Government of Canada partners to deliver the CDCP:

• Employment and Social Development Canada/Service Canada (ESDC/Service Canada) administers member applications and member renewals and answers questions from applicants
• the Canada Revenue Agency (CRA) confirms applicants' eligibility
• Public Service and Procurement Canada (PSPC) is responsible for the Government of Canada's contract with Sun Life. PSPC is also responsible for the Contract Security Program that helps ensure that CDCP contractors meet security requirements. Finally, PSPC sends and receives member eligibility review letters on behalf of Health Canada
• Statistics Canada (StatCan) produces CDCP statistical data and insights

Sun Life, as a private-sector partner, complies with the Personal Information Protection and Electronic Documents Act. As the contracted third-party administrator for the CDCP, Sun Life must also comply with the Privacy Act and related policies.

Privacy notice

ESDC/Service Canada provides CDCP member applicants with a privacy notice, and Sun Life provides oral health providers agreeing to participate in the CDCP with a privacy notice. The privacy notice that follows does not replace other CDCP privacy notices. It is an overview of Health Canada and Sun Life's handling of personal information to administer the CDCP. It also tells you about your privacy rights.

Collection and use of personal information

Health Canada and Sun Life collect your personal information under the authority of the Government of Canada's Dental Care Measures Act, the Department of Health Act, and the Income Tax Act. Your personal information is protected by the provisions of the Privacy Act.

Health Canada and Sun Life collect your personal information at different points, and through different ways, for activities that relate directly to the CDCP. This can include:

• enrollment - to ensure that only individuals who are eligible to receive CDCP services are members
• claims processing and verification - to process CDCP claims received from oral health providers and pay oral health providers directly for services covered under the plan, while ensuring the accuracy and integrity of CDCP claims
• contact centre and problem resolution - to respond to enquiries about the CDCP and resolve issues
• authentication - to ensure that you are who you say you are before sharing certain information with you (for example, multi-factor authentication to access Sun Life CDCP portals)
• training and quality assurance - to help ensure that customer care representatives are responding to your calls with clear, consistent and accurate information
• reporting suspicious activity - to allow individuals to report possible benefits claim misconduct to Sun Life, including via subcontractor ClearView Strategic Partners Inc

Disclosure of personal information

Health Canada and Sun Life securely share personal information that is necessary for the administration of the CDCP. In specific and limited cases, Health Canada or Sun Life may lawfully disclose personal information to regulatory bodies or law enforcement agencies, such as in cases of suspected or confirmed fraud.

In addition, Sun Life may share limited personal information with CDCP subcontractors for purposes such as:

• printing and mailing CDCP materials
• responding to your inquiries through the CDCP Customer Care Centre

Health Canada may also share your personal information with:

• ESDC, the CRA and PSPC for the purposes of administering the CDCP
• StatCan, as authorized by the Statistics Act, for producing CDCP statistical data and insights

For CDCP members, when enrolling in the CDCP, you also provide consent to your oral health providers to disclose all personal information, as authorized by the Department of Health Act and the Dental Care Measures Act, that may be considered useful by Sun Life in the context of program administration, conducting claims verifications, managing claims, and patient/client safety. This information may include, but is not limited to, details on the services provided, patient clinical data, payments, and X-rays.

Voluntary participation

Your participation in the CDCP is voluntary. However, if you do not provide the necessary personal information, you cannot participate in the CDCP (or specific CDCP activities).

Your rights and how to contact us

You have the right to access, and where applicable, to correct your personal information. Health Canada describes CDCP personal information under its control in the Canadian Dental Care Plan Personal Information Bank (HC PPU 440). Visit Info Source: Source of Federal Government and Employee Information Health Canada for more information.

For privacy-related questions:

• CDCP members and oral health providers may contact Sun Life by calling 1-888-888-8110
• general enquiries - contact Service Canada at 1-833-537-4342 or visit Contact us - Canadian Dental Care Plan for more options

If have you been unable to resolve a privacy issue with us, you may file a formal complaint with the Privacy Commissioner of Canada about how we have handled your personal information. Visit Report a concern for more information.

Additional privacy information

This section provides links to additional Government of Canada privacy information related to the CDCP.

Glossary

Disclosure (of personal information)

The release of personal information by any method (for example, transmission, provision of a copy, examination of a record) to any body or person.

Reference: Policy on Privacy Protection

Information-sharing arrangement

A written record of understanding that outlines the terms and conditions under which personal information is disclosed between parties. An information-sharing arrangement is usually employed to facilitate the disclosure of personal information between and within federal institutions. An information-sharing arrangement is not legally binding.

Reference: Directive on Privacy Practices

Personal Information Bank (PIB)

A description of personal information that is organized or intended to be retrieved by a person's name or by an identifying number, symbol or other particular assigned only to that person. The personal information described in the personal information bank has been used, is being used or is available for an administrative purpose and is under the control of a government institution.

Reference: Policy on Privacy Protection

Privacy Impact Assessment (PIA)

A process prescribed in policy for identifying, assessing and mitigating privacy risks. Government institutions are to develop and maintain privacy impact assessments for all new or modified programs and activities that involve the use of personal information for an administrative purpose.

Reference: Policy on Privacy Protection

Privacy notice

A verbal or written notice informing an individual of the purpose of collecting their personal information as well as the government institution's legal authority for the collection. The notice, which must reference the personal information bank described in Info Source, also informs the individual of how their personal information will be used and disclosed, their right to access and request the correction of the personal information, any consequences of refusing to provide the information requested, and their right to file a complaint to the Privacy Commissioner of Canada.

Reference: Directive on Privacy Practices