top of page

Privacy and Security Questions

Is my information safe?

Your privacy is important to us. POPLAR is committed to keeping your personal health information safe and confidential at all times. To keep the information collected from individual Electronic Medical Records (EMRs) safe and private, POPLAR has partnered with ICES (https://www.ices.on.ca), a trusted steward of Ontario’s health data, to collect and store data for POPLAR. 

 

ICES is one of a handful of organizations in Ontario that have been designated as a “prescribed entity” under the province’s Personal Health Information Protection Act (PHIPA), which legally allows ICES to collect and hold health data. Prescribed entities must have their practices and procedures reviewed and approved every three years by the Information and Privacy Commissioner of Ontario (IPC) to ensure they protect the privacy of individuals whose information they receive and maintain the confidentiality of that information. As a prescribed entity, ICES has received approval of its practices and procedures from the IPC since 2005 under PHIPA.

Where will the data be stored and how is it protected?

The data will be stored in a secure database at ICES.

 

ICES protects the information it collects in many ways—for example, by limiting who can enter certain areas in ICES facilities, using strong digital security tools, and only giving access to specific staff. Before data are made available for analyses, any information that directly identifies a person—like names, addresses, or health card numbers—is removed or replaced with a code that cannot be linked back to an individual. Results are only reported for groups of people, not individuals. Every set of results is checked carefully to make sure no one can be identified.

Who can access the data?

Access to POPLAR data will be strictly controlled and limited by role—only people who need to access the data for their role will have access. All people who have access must follow strict privacy rules.

​

ICES Agents/Staff

  • Only a very limited number of ICES staff will be able to work with the raw data and prepare it for the POPLAR Dataset.

  • These staff are responsible for de-identifying the data and adding special codes to be able to link the data for research purposes.

  • All ICES Agents must also sign a pledge of confidentiality and acceptable use agreements on a yearly basis, which describe the terms and conditions of their data access. 

  • All ICES Agents must also complete annual privacy and security training.

 

Researchers and Analysts

  • After following the POPLAR Project Intake Process, researchers and analysts will only be granted access to specific de-identified data that relates to their research question and project.

  • Access to the POPLAR data will be granted on a project-by-project basis and for a limited time while the project is ongoing.

  • Projects will need to receive approval from ICES’ Privacy and Legal Office and, in many cases, a Research Ethics Board (REB), before gaining access to the POPLAR data.

What is a Research Ethics Board (REB)?

A Research Ethics Board (REB) ensures that research meets scientific and ethical research standards to protect human research participants. REBs review and approve research studies before the research is started. Typically, a REB is associated with a university or hospital.

Why would I want to have my data included in POPLAR?

There are several reasons why you may want to have your data included in POPLAR: ​

​

  1. Having each person’s data included in the database helps ensure that the data is representative of the Ontario population. This allows for research to better show health/illness patterns and outcomes on a large scale and may help healthcare providers improve care for their patients.​

  2. Having your data in the database could not only improve your own experience of healthcare in Canada, but it could also improve the delivery of healthcare for others too!

Are my data being collected?

To find out if your data are being collected, ask your primary care provider if they are participating in POPLAR (through one of the regional Practice-Based Learning and Research Networks in Ontario). There should be information openly available at your provider’s office (such as posters, brochures, images on screens) if they are participating in POPLAR. If at any time you do not want your medical record to be included in POPLAR, please tell your doctor, nurse, or the administrative staff at your primary care clinic.

Do patients provide consent?

​No. Primary care providers and primary care organizations in Ontario are invited to participate in POPLAR through their regional network and provide consent. These providers and organizations are called the Health Information Custodians (HICs). They are authorized to sign data sharing agreements, which give permission for patients’ health information to be shared with ICES for the POPLAR Database. If patients have any questions or concerns about their data being included in the POPLAR Dataset, they can contact POPLAR administration at info@poplarnetwork.ca.

Does POPLAR have patient and care partners in their organization?

Yes, the POPLAR Patient Advisory Committee includes patient representatives from each of the regional networks that make up POPLAR. The Patient Advisory Committee brings information about patient needs, expectations, and experiences to POPLAR’s leadership. Two individuals from the Patient Advisory Committee sit on the POPLAR Steering Committee, where they help govern POPLAR’s operations.

Can patients choose not to participate?

YES. If your healthcare provider is sharing data with POPLAR, you may request at any time that your electronic medical record is not included. Your medical care will not be affected if you choose not to participate in POPLAR. To find out more about opting out, please contact POPLAR administration at info@poplarnetwork.ca.

bottom of page