Breach Notification Form

PRIVACY BREACH REPORTING FORM

Right to Information and Protection of Privacy Act (RTIPPA) Personal Health Information Privacy and Access Act (PHIPAA)

Use this form to report a privacy breach. A privacy breach occurs whenever there is unauthorized access, collection, use, disclosure or disposal of personal information and/or personal health information.

WHEN YOU DISCOVER A PRIVACY BREACH:

Step 1: Contain the Breach
Step 2: Evaluate the Risks
Step 3: Notification
Step 4: Prevention

The first three steps should be undertaken immediately upon discovery of the breach or in very quick succession. Regarding Step 3 and as per s.49(1)(c), you must notify the individual to whom the information relates and the Commissioner’s Office. The fourth step is undertaken once the causes of the breach are known, in an effort to find longer term solutions to the identified problem.
STEPS INVOLVED:

Complete this form.
Submit the form online, or Send a completed .PDF version of the form by fax: 506.453.5963, email: access.info.privacy@gnb.ca or regular mail: 230-65 Regent Street, Fredericton, NB E3B 7H8
If you have questions call: 506.453.5965 or 1.877.755.2811

This form is adapted in part from material prepared by the Office of the Information and Privacy Commissioner for Nova Scotia, “Key Steps to Responding to Privacy Breaches” available online at:

https://foipop.ns.ca/sites/default/files/publications/Key%20Steps%20-%20Full%20-%20Final%20-%202015Oct27_0_0.pdf

and in part from material prepared by the Office of the Information and Privacy Commissioner for Newfoundland and Labrador, “Privacy Breach Reporting Form” available online at:

http://www.oipc.nl.ca/pdfs/PrivacyBreachIncidentReportForm.pdf

CUSTODIAN/PUBLIC BODY INFORMATION

Name of custodian/public body

Contact information

Street Address Address Line 2 City State / Province / Region ZIP / Postal Code Country

Contact name and title

Contact telephone

Contact e-mail address

DESCRIPTION OF INCIDENT

Select all that apply:

(please describe)

Briefly describe what happened

Why and how did the breach occur? Please elaborate

How many individuals are affected by the breach?

Format of information involved:

Electronic records:

Paper records:

Portable device (please specify type):

Date of breach:

Date breach was discovered:

How was the breach discovered?

Location of breach:

Type of information involved:

Name, address, date of birth, etc
Medicare Number or registration information
Health care information
Payment or financial information
Other, please specify type

Please specify type:

CONTAINMENT OF BREACH

Immediate steps taken to contain the breach:

If the information was lost, misplaced or misdirected, was the information found or retrieved?

Yes
No

Is there any reason to believe that the information was copied or shared?

Yes
No

Please explain.

Is there a potential that the breach can lead to further privacy breaches?

Yes
No

Please explain.

If applicable, have the police been notified?

Yes
No

If yes, who was notified and when?

If no, why not?

Which other authorities have you notified, if any, and why?

FORSEEABLE HARM

Identify the types of harm that may result from the breach. Some relate strictly to the affected individual; but harm may also be caused to the custodian/public body and other individuals if notifications do not occur:

Identity theft (most likely when the breach includes loss of SIN, credit card numbers, driver’s license numbers, debit card information etc.)
Physical harm (when the information places any individual at risk of physical harm from stalking or harassment)
Hurt, humiliation, damage to reputation (associated with the loss of information such as mental health records, medical records, disciplinary records)
Loss of business or employment opportunities (usually as a result of damage to reputation to an individual)
Breach of contractual obligations (contractual provisions may require notification of third parties in the case of a data loss or privacy breach)
Future breaches due to technical failures (notification to the manufacturer may be necessary if a recall is warranted and/or to prevent a future breach by other users)
Failure to meet professional standards or certification standards (notification may be required to a professional regulatory body or certification authority)
Other

Please Specify:

Have the affected individuals been notified?

Yes
No

If yes, please describe how and when notice was provided:

If no, why not?

WHEN AND HOW TO NOTIFY

When: Notification should occur as soon as possible following a breach. However, if you have contacted law enforcement authorities, you should determine from those authorities whether notification should be delayed in order not to impede a criminal investigation.

How: The preferred method is direct-by phone, letter, email or in person. Indirect notification via website information, posted notices or media should generally only occur when direct notification could cause further harm, is prohibitive in cost, or contact information is lacking. Using multiple methods of notification in certain cases may be the most effective approach.

Considerations Favouring Direct Notification (check all applicable)

The identities of individuals are known
Current contact information for the affected individuals is available
Individuals affected by the breach require detailed information in order to properly protect themselves from the harm arising from the breach
Individuals affected by the breach may have difficulty understanding an indirect notification (due to mental capacity, age, language, etc.)

Considerations Favouring Indirect Notification

A very large number of individuals are affected by the breach, such that direct notification could be impractical
Direct notification could compound the harm to the individuals resulting from the breach

Describe the physical, administrative, and technical safeguards currently in place to protect the personal information in your custody and control relevant to this breach:

Please specify:

CORRECTIVE MEASURES

Based on the cause of the breach, what corrective measures, if any, have been or will be taken to prevent similar breaches from recurring?

OTHER INFORMATION

Please provide any other useful information in relation to this breach that may not be included in this breach reporting form: