Disability Case Management Solution

Executive Summary

An assessment of the privacy impacts associated with the implementation of a Disability Case Management Solution (DCM) hosted by a third-party vendor on behalf of the RCMP's Occupational Health and Safety Branch.

This report examines the privacy impacts associated with the collection, use, disclosure and retention of personal information by a vendor-hosted Disability Case Management (DCM) Solution (hereafter, the 'DCM Solution') that is web-based and specifically designed to support occupational health, disability management and accommodation best practices and workflows.

About the RCMP

The RCMP is Canada's national police service. Its operations are governed primarily by the Royal Canadian Mounted Police Act, which sets out the department's constitution and organization, and the primary responsibilities of its members.

By virtue of its federal policing responsibilities, and its obligations as a national police service, the RCMP's mandate is wide-ranging. It includes, among other things, the prevention and investigation of serious and organized crime, the maintenance of peace and order, and the enforcement of federal, provincial and municipal laws.

The department also contributes to public safety and national security, ensuring the safety of state officials and visiting dignitaries, and providing vital operational support and intelligence to police and law enforcement agencies in Canada and abroad.

The Occupational Health and Safety Branch (OHSB)

In fulfilling its mandate, the RCMP employs of over 29,000 employees, a majority of which are regular members (i.e., individuals who have completed RCMP Cadet Training and taken the RCMP's oaths of allegiance). The conditions under which these members conduct domestic and international operations are both physically and psychologically demanding.

Through the Occupational Health and Safety Services Branch (OHSB), the RCMP has designed programs and services to oversee and support the physical and mental health of its members.

The Occupational Health Management and Accommodation Program(OHMA Program) supports operational readiness by establishing and overseeing programs, policies and benefits based on evidence and industry best practices. The following RCMP policies reflect the OHMA Program responsibilities and accountabilities:

• The Disability Management and Accommodation Program Manual (Appendix B) serves as the authority and guideline for disability and accommodation management of members. In accordance with this policy, the RCMP will make every reasonable effort, to the point of undue hardship, to help ill or injured members remain at work and if an absence is required to support recovery, to return to work when they are able.
• The Health Services Manual provides details on occupational health services and supports available to members of the RCMP

Service Delivery Model

The primary purpose for collecting and retaining personal information in support of RCMP Occupational Health Management and Accommodation Program is to assess fitness for duty and deliver occupational health, disability case management, accommodation services and benefits for regular members.

Personal information is collected to administer and deliver the following programs and benefits as per the RCMP Act and RCMP Regulations, 2014, Canadian Human Rights Act and Government of Canada policies, directives, standards and guidelines.

Procurement of a Disability Case Management Solution

The Royal Canadian Mounted Police (RCMP) has procured a web-based Disability Case Management (DCM) software solution specifically designed to support early intervention, proactive disability case management, return-to-work and workplace accommodation best practices and workflows. The implementation of this information technology solution will:

1. capture and protect members personal, injury/illness and medical information, as well as details regarding return-to-work plans and the duty to accommodate;
2. support effective coordination of case management activities among internal stakeholders to ensure the necessary supports for ill or injured members and facilitate successful and safe return to work;
3. minimize the administrative burden for approximately 100 disability management, occupational health and accommodation practitioners across the Force through built-in service standards, auto- generation of pre-defined disability case management tasks and working tools;
4. provide members with easy access to information pertinent to their case and facilitate the communication and submission of documents;
5. provide management with status information on employees that fall within their hierarchy; and,
6. provide management with on-demand reporting capability.

The DCM Solution allows for all information related to a disability management and accommodation case to be housed in one system, accessible as appropriate to the stakeholders involved. It will ensure both medical and non-medical documentation is complete and that RCMP management has real-time reporting on key metrics and trends in disability management. This includes the incidence and duration of absence due to illness and injury; the incidence of work-related versus non-work-related cases; the types of accommodations associated with successful return to work in the RCMP, and so on.

The DCM Solution will promote consistency in disability management across Divisions; identify trends in workplace and health issues and gaps; enhance process efficiencies; and, will inform changes to the Occupational Health Management and Accommodation Program policies and strategies. In addition, it will allow management to monitor and evaluate disability management and accommodation efforts through management dashboards and the generation of pre-defined and custom reports.

Balancing Disability Case Management Needs with Privacy

Procurement of a DCM Solution will help to better facilitate early intervention and disability case management which enables the RCMP to proactively plan for any accommodation needs that the member may have. It also helps to ensure that members are able to access the services and supports throughout their recovery. Although a web-based DCM Solution may introduce certain challenges for the RCMP in the protection and handling of personal information, privacy remains central to the administration and service delivery of these Human Resource Program(s).

Bearing in mind the above, the RCMP has elected to undertake a privacy impact assessment (PIA) in relation to the DCM Solution.

Purpose and Scope of the PIA

The RCMP is named in the Schedule to the Privacy Act^{Footnote 1} and is subject to the privacy policies and directives of the Treasury Board of Canada Secretariat (TBS). Under the TBS Policy on Privacy Protection, all federal institutions subject to the Privacy Act are required to undertake an assessment of the privacy impacts associated with the development or design of new programs or services involving personal information, or when making significant changes to an existing program or service.

The present assessment fulfills the requirement to conduct a PIA under the above policy and complies with the standards for performing PIAs, as set out in the TBS Directive on Privacy Impact Assessments. It also meets the PIA recommendations of the Office of the Privacy Commissioner of Canada's (OPC) Audit and Review Branch, as set out in Expectations: A Guide for Submitting Privacy Impact Assessments.

The purpose of this PIA is to identify and analyze the potential privacy impacts associated with the collection, use, disclosure and retention of personal information by, or on behalf of, the RCMP in the operation and administration of the web-based DCM Solution.

The DCM Solution PIA was completed under the direction of the Director General, Occupational Health Services Branch. It includes an assessment of program authorities, as contained in RCMP's enabling statutes and regulations, a detailed evaluation of privacy risks, an evaluation of personal information safeguards, and an assessment of contractual provisions needed to ensure that privacy is taken into account in the implementation of an outsourced DCM Solution.

The focus of this PIA is on the privacy risks associated with the collection, use, disclosure and retention of personal information by a Contractor on behalf of the RCMP in relation to the delivery of Occupational Health Management and Accommodation Program.

During the Implementation phase, the selected Contractor, Morneau Shepell, will undertake its own respective risk assessment to ensure that their personal information handling practices are compliant with the law and the policies and practices of the RCMP. The Contractor will bear complete responsibility to ensure that the DCM Solution meets all of the contractual privacy standards prior to the implementation date.

Summary of Privacy Issues Identified

Based on the present assessment, potential privacy risks arising from the DCM Solution are expected to be moderate to high. Privacy risks relating to the DCM Solution are expected to be effectively managed and mitigated however by contractual means. To this end, the RCMP has assessed and documented its obligations for privacy in the outsourcing of the DCM Solution, and drafted terms and conditions for privacy and the protection of personal information for inclusion in the final request for proposal and contract.

Whereas the Occupational Health Management and Accommodation Program involves the collection, use, disclosure and retention of sensitive personal information, it is incumbent upon the RCMP to ensure that privacy protections are taken into account before implementing the DCM Solution. It is important to note, that while personal health information pertaining to RCMP members may be created, processed and stored in the DCM Solution, the RCMP retains ownership of this data.

Notwithstanding the above, the following issues and recommendations may be relevant to the implementation of a vendor-hosted Disability Case Management Solution.

• With respect to the Occupational Health Management and Accommodation Program and DCM Solution oversight and evaluation, OHSB as the policy center responsible for program delivery, will oversee the implementation and ongoing phase of the DCM Solution contract.
• With respect to security safeguards, the Contractor will implement and maintain a DCM Solution that safeguard's the RCMP's data at all times by taking all administrative, physical and technical security measures that are necessary to secure and protect its integrity and confidentiality.
• With respect to the personnel who will support the implementation of the DCM Solution and/or provide ongoing system support, all Contractor personnel will be required to obtain and maintain an RCMP personnel security clearance commensurate with the sensitivity of the work being performed throughout the life of the contract.
• With respect to any risks associated with access to sensitive data by RCMP users of the DCM Solution, all persons who collect and use personal heath information held in the DCM Solution will be required to protect the confidentiality of the information. This standard of practice will be reinforced through training, policies and guidelines.

With respect to Personal Information Banks (PIB's) and to ensure an accurate depiction of the modernized RCMP program(s) and services, including the introduction of Disability Case Management Solution, a proposal to revise and update the PPE 808 has been identified and is underway.