Lieutenant Governor 4 PROVINCE OF•BRITISH COLUMBIA ORDER OF THE LIEUTENANT GOVERNOR IN COUNCIL Order in Council No.— 1031 , Approved and Ordered NOV 2 9 2001 Executive Council Chambers, Victoria On the recommendation of the undersigned, the Lieutenant Governor, by and with the advice and consent of the Executive Council, orders that order in council 642/97 is rescinded; 2 the Medical Services Commission may enter into an information-sharing agreement, substantially in the form as attached, with the Worker's Compensation Board. Minister o Healt ervices Presiding Member the Executive Council (This

part is for administrative purposes only and is not part of the Order) Authority under which Order is made: Act and section:- Medicare Protection Act,

section 5 id.d7_7001 -1.3 Other (specify):- KAMPROA\01C.00\WCB 01C.doc

INFORMATION SHARING AGREEMENT Dated for reference the day of , 2001 Between: HER MAJESTY THE QUEEN IN RIGHT OF THE PROVINCE OF BRITISH COLUMBIA AS REPRESENTED BY THE MEDICAL SERVICES COMMISSION (the "Commission") Agreement Administrator: Director, Billing Integrity Program, Medical Services Plan Ph: Fax: Email: And: WORKERS' COMPENSATION BOARD OF BRITISH COLUMBIA (the "Board") Agreement Administrator: Director, Health Care Services Ph: Fax: Email:

WHEREAS the Board and the Commission are public bodies under the FIPPAct;

WHEREAS pursuant to s. 26 of the Freedom of Information and Protection of Privacy Act (the "FIPPAct"), a public body may collect personal information where the collection is authorized by or under

an Act, the collection is for the purposes of law enforcement, or the information is related to and is necessary for an operating program or activity of the public body;

WHEREAS pursuant to s. 27(1) of the FIPPAct, a public body may collect the personal information from a source other than the individual the information is about if, inter alia, another method of collection is authorized by another enactment, the information can be disclosed to the public body under s. 33, or the collection is for the purposes of law enforcement;

WHEREAS pursuant to s. 32 of the FIPPAct, a public body may use personal information only for the purpose for which that information was obtained and compiled, or for a use consistent with that purpose, or for a purpose for which that information may be disclosed to that public body under s.33;

WHEREAS pursuant to s. 33(

c) of the FIPPAct, a public body may disclose personal information for a use consistent with the purpose for which it was obtained or compiled;

WHEREAS s. 34(1) of the FIPPAct defines a consistent use as one that has a reasonable and direct connection to the purpose for which the information was obtained or compiled, and is necessary for performing the statutory duties, or operating a legally authorized program, of the public body that uses or discloses the information;

WHEREAS pursuant to s. 33(

d) of the FIPPAct, a public body may disclose personal information for the purpose of complying with an enactment of, or with a treaty, arrangement or agreement made under an enactment of British Columbia or Canada;

WHEREAS pursuant to s. 5(1),

Part 1 of the Workers Compensation Act (the "WCAct"), where personal injury or death arising out of and in the course of the employment in an industry within the scope of

Part 1 is caused to a worker, compensation as provided by

Part 1 must be paid by the Workers' Compensation Board (the "Board");

WHEREAS pursuant to s. 21 of the WCAct, the compensation provided by the Board may include an array of medical or health care services that the Board considers reasonable and necessary;

WHEREAS pursuant to, inter alia, ss. 87 and 88 of the WCAct, the Board has broad authority to make inquiries to gather the information it deems necessary for its purposes; 2

WHEREAS the Board therefore has the authority under s. 88 of the WCAct and s. 26 and 27 of the FIPPAct to collect personal information from the Commission for the purpose of administration and investigation of claims for payment for medical services;

WHEREAS pursuant to the Medicare Protection Act (the "MPAct"), the Medical Services Commission (the "Commission") has broad authority to administer the MPAct including the Medicare system established thereunder;

WHEREAS the Medical Services Plan is the division of the Ministry of Health Services that collects and retains information on behalf of the Commission and assists the Commission in carrying out its duties and powers under the MPAct.

WHEREAS the Commission's Billing Integrity Program is established to manage the Medical Services Plan's monitoring and recovery functions in order to deter and detect inappropriate billing of Medical Services Plan claims;

WHEREAS the Commission has the authority under s. 36 of the MPAct to collect personal information for the purpose of investigation of claims by practitioners for payment under the Medicare system;

WHEREAS pursuant to s. 5(1)(

n) of the MPAct the Commission has the authority, with the prior approval of the Lieutenant Governor in Council, to enter into agreements inter alia, with a person in British Columbia for the purposes of the MPAct;

WHEREAS pursuant to s. 5(1)(

j) of the MPAct the Commission has the authority to determine whether any matter relates to the rendering of a benefit;

WHEREAS pursuant to s. 5(1)(

r) of the MPAct the Commission has the authority to provide, to a person or body prescribed by the Lieutenant Governor in Council, information regarding claims submitted by the practitioner to the Commission for the purpose of audit or investigation of a practitioner's pattern of practice or billing;

WHEREAS pursuant to s. 5(5) of the MPAct, without limiting the generality of s. 5(1)(n), the Commission has the authority to, with the prior approval of the Lieutenant Governor in Council, enter into an information sharing agreement with a public body as defined by the FIPPAct; 3

WHEREAS pursuant to s. 5(6) of the MPAct "an information sharing agreement" is a data-matching or other agreement to exchange personal or other information for the purpose of administering medical or health care benefits provided under inter alia, the MPAct or a prescribed enactment of B.C.;

WHEREAS pursuant to s. 80 of the WCAct the Board is a corporation;

WHEREAS pursuant to s. 29 of the

Interpretation Act, a corporation is a "person";

WHEREAS the Commission has the authority under s. 26 and 27 of the FIPPAct to collect personal information from the Board for the purpose of administration and investigation of claims for payment for medical services;

WHEREAS the personal information collected by both the Board and the Commission about treatment provided to claimants includes particulars about the identity of the injured worker, the nature of the worker's injury, the name of the workers' medical and other health care practitioners and the treatment provided to the worker by practitioners;

WHEREAS there is a clear overlap in the personal information collected by the Board and the Commission for their respective statutory purposes;

WHEREAS the Board and the Commission wish to exchange information for their respective administration of claims by practitioners for payment for medical and other health care services under the worker's compensation and Medicare systems, including for detection and investigation of fraudulent or otherwise inappropriate claims for payment;

WHEREAS the information is necessary for both the Board and the Commission to effectively and efficiently perform their statutory duties and operate their legally authorized programs relating to billing and payment for medical and other health care services provided to workers;

WHEREAS both the Board and the Commission as well as practitioners, employers, workers and the public have an interest in reducing inappropriate costs to the Board's worker's compensation and the Commission's Medicare systems;

WHEREAS the prior approval of the Lieutenant Governor in Council described above has been obtained and is affixed hereto as Appendix "A";

NOW THEREFORE the Board and the Commission agree to the following: 4

Purpose 1.1 The purpose of this Agreement is to document the terms and conditions of the exchange of certain personal information by the parties, in compliance with the MPAct, the WCAct, the FIPPAct, and other applicable legislation.

Definitions 2.1 In this Agreement, "Personal Information" includes: a) "clinical data" meaning the information in patient clinical charts created by a practitioner or a person acting on the practitioner's behalf; and b) "profile data" in relation to a health care or medical practitioner, meaning any information relating to or resulting from an analysis of the health care practitioner's pattern of billing practice or claims, including as the pattern compares to that of his or her peers. 2.2 In this Agreement: a) "peers" in relation to a health care or medical practitioner, means other practitioners in the same health care profession; and b) "practitioner" means a health care practitioner or medical practitioner as defined in the MPAct.

Use of Personal Information 3.1 The Personal Information is exchanged solely for the purpose of audit and investigation of practitioner billing to the Medical Services Plan and the Board.

This purpose includes any proceedings arising out of those investigations or audits. 3.2 The parties will use the Personal Information to assist in the audit and investigation of billing practices and claims of practitioners, where the Commission or the Board has, or both have, an interest or concern about billing practices or claims of any practitioner. 3.3 Furthermore, the parties will use the Personal Information in compliance with s. 32(

a) of the FIPPAct. 5

Collection and Disclosure of Personal Information 4.1 The parties agree to exchange the Personal Information necessary for verification of data relevant to practitioners' billing practices and claims submitted to the Commission under the Medical Services Plan and to the Board. 4.2 Where the Board or the Commission requires disclosure of Personal Information from the other party pursuant to the Agreement, or wishes to disclose Personal Information pursuant to the Agreement, the notice thereof, in writing by letter or electronic mail, and the actual disclosure of the Personal Information, shall be made through the agreement administrators for each party, being:

a) for the Board, the Director of Health Care Services; and

b) for the Commission, the Director of the Billing Integrity Program of the Medical Services Plan; as the case may be. 4.3 Notwithstanding any other provision in this Agreement, the parties agree that no clinical data will be exchanged, except that information in patient clinical charts that in the opinion of both parties is relevant to an audit of, or investigation or other inquiry into, any practitioners billing practices. 4.4 The Commission will provide as reasonably necessary the following information to the Board with respect to any practitioner:

a) practitioner profile data;

b) results of any practitioner audits; and

c) other information pertaining to billing and billing patterns. 4.5 The Board will provide as reasonably necessary the following information to the Commission with respect to any practitioner:

a) information pertaining to billing patterns;

b) results of investigations by the Board of any practitioner. Accuracy 5.1 Each party will make every reasonable effort to ensure the Personal Information in its custody is accurate, complete and up-to-date. 6

Security 6.1 It is understood and agreed by each party that the Personal Information exchanged pursuant to the Agreement is to be used exclusively for the purposes set out herein.

Each party will take all appropriate and reasonable measures necessary to ensure that the security of the information obtained by it under this agreement is protected in accordance with s.30 of the FIPPAct and is used and disclosed only as required by this Agreement or otherwise by law. 6.2 Each party will make reasonable arrangements to maintain the security of the Personal Information in its custody, by protecting it against such risks as unauthorized access, collection, use, disclosure or disposal. 6.3 Each party will advise the other party immediately, and, in the case of the Commission, the Ministry of Health Planning, Information and Privacy Branch, and, in the case of the Board, the Board's Freedom of Information and Protection of Privacy Department and Information Services Division of any circumstances, incidents or events that to its knowledge have jeopardized or may in future jeopardize:

a) the privacy of individuals; or

b) the security of any computer system in its custody that is used to access the Personal Information. 6.4 The Commission will comply with the security provisions of

Chapter 10 of the British Columbia Government Management Operating Policy (GMOP). The Board will comply with the security provisions of its applicable ISD Information System Security policies, including but not limited to its:

a) Information Asset Protection Policy,

b) Levels of Information Confidentiality Standard,

c) Logical Access to Information Systems Policy, and

d) Logical Access to Information Systems Standard. 6.5 The Commission and the Board will retain and dispose of documents in compliance with the Document Disposal Act and the FIPPAct. 6.4 Transfer of information shall be by way of paper documentation. 7

Compliance Monitoring and Investigations 7.1 Each party shall adhere to the following protocol and procedure with respect to the exchange of information under this Agreement:

a) no information will be released by either party to the other party until a request has been made pursuant to s. 4.1 of this Agreement;

b) each party will record and monitor requests made by it and the other party for access to the Personal Information under this Agreement;

c) the agreement administrators shall each vet the requests made to their respective party under s. 4.1 and ensure that any information released complies with this Agreement;

d) any information disclosed between the parties shall be disclosed to the agreement administrator as the case may be, who will be responsible to ensure that the information is used in a lawful manner and in compliance with this Agreement. 7.2 With respect to the information exchanged under this Agreement, each party, after notifying the Information and Privacy Branch of the Ministry of Health Planning in the case of the Commission, and, in the case of the Board, the Board's Freedom of Information and Protection of Privacy Department and Information Services Division, will investigate all reported cases of any:

a) access to or modification of the Personal Information in its custody;

b) use of the Personal Information in its custody;

c) disclosure of the Personal Information in its custody; that is not authorized or is otherwise not in accordance with this Agreement. 7.3 Each party will investigate all breaches of privacy or security with respect to the Personal Information in its custody or with respect to any computer system in its custody that is used to access the Personal Information. In such cases:

a) The Commission will consult with the Information and Privacy Branch of the Ministry of Health Planning.

b) The Board will consult with the Board's Freedom of Information and Protection of Privacy Department and Information Services Division. 8

7.4 Each party will report to the other party the results of any investigation under s. 7.2 or 7.3 and the steps taken to address any remaining issues or concerns about the security of the Personal Information or computer systems, or the privacy of individuals to whom the Personal Information relates. 7.5 The parties acknowledge that each party is and remains subject to its own internal audit procedures to ensure compliance with the party's program goals and statutory mandate, including compliance with this Agreement.

a) In the case of the Ministry of Health Services, the Audit process respecting compliance with this agreement shall be as described in Appendix B.

b) In the case of the Board, the Audit process respecting compliance with this agreement shall be as described in Appendix C. Modification of Agreement 8.1 Amendments to this Agreement may be made, so long as they are made in writing and signed by both parties. 8.2 Despite 8.1, the Commission shall, prior to amending this agreement, consult with the Information and Privacy Branch of the Ministry of Health Planning. 8.3 Despite 8.1, the Board shall, prior to amending this agreement, consult with the Board's Freedom of Information and Protection of Privacy Department.

Termination of Agreement 9.1 Subject to s. 9.2, either party may terminate this Agreement by providing written notice to the other party ninety (90) days prior to the date on which the notifying party intends that the Agreement will terminate. 9.2 Either party may terminate this Agreement at any time, in writing but without prior notice to the other party, if and only if the party terminating the Agreement has reasonable grounds to conclude that the other party has failed in a material way to meet its obligations under this Agreement. 9

Term of Agreement 10.1 This Agreement will be and remain in force during the period commencing on the date of reference of this Agreement and ending on the date of termination in accordance with s. 9.1 or 9.2 herein. Appendices 11.1 Any appendices to this Agreement are part of the Agreement between the parties. if there is a conflict between a provision in an appendix and any provision of this Agreement, the provision in the appendix is inoperative to the extent of the conflict unless it expressly states that it operates despite a conflicting provision of this Agreement.

Agreed to on behalf of Her Majesty the Queen in Right of the Province of British Columbia, as represented by the Medical Services Commission: (Authorized representative) Date Agreed to on behalf of the Workers Compensation Board of British Columbia: (Authorized representative) Date 10

APPENDIX A ORDER IN COUNCIL

APPENDIX B MINISTRY OF HEALTH SERVICES COMPLIANCE AUDIT Ministry of Health Services Procedures to ensure Compliance with the Memorandum of Understanding 1. MSC will delegate the responsibility and authority for implementing the procedure for exchanging information to specified individuals, who will create and maintain appropriate records of those exchanges. 2. The Health Information Access Centre of the Ministry of Health Planning (the "HIAC") will investigate all cases where it is suspected or evident that there may be:

a) unauthorized access, use or disclosure of data or information covered by the Agreement, or

b) breaches of confidentiality. 3. If the investigation discloses unauthorized access, use, or disclosure, or if anything is found jeopardizing confidentiality of data or the security of any computer system or network used to access data, the HIAC will notify MSC and the Information and Privacy Branch of the Ministry of Health Planning. 4 MSC will notify the Information and Privacy Branch of the Ministry of Health Planning with a detailed report of the remedial actions taken.

APPENDIX C WORKERS COMPENSATION BOARD COMPLIANCE AUDIT Workers Compensation Board Procedures to ensure Compliance with the Memorandum of Understanding 1. The Board will delegate the responsibility and authority for implementing the procedure for exchanging information to specified individuals, who will create and maintain appropriate records of those exchanges. 2. The Board's Freedom of Information and Protection of Privacy Department and Information Services Division's Information Systems Security Department (ISSD) will investigate all cases where it is suspected or evident that there may be:

a) unauthorized access, use or disclosure of data or information covered by the Agreement, or

b) breaches of confidentiality. 3. If the investigation discloses unauthorized access, use, or disclosure, or if anything is found jeopardizing confidentiality of data or the security of any computer system or network used to access data, the ISSD will notify the Freedom of Information and Protection of Privacy Department. 4. ISSD will notify the Freedom of Information and Protection of Privacy Department with a detailed report of the remedial actions taken.