PRIVACY


National Association of Pharmacy Regulatory Authority’s
Privacy Policy for Pharmacists' Gateway Canada

 

Introduction


This Privacy Policy describes the manner in which the National Association of Pharmacy Regulatory Authorities (NAPRA), in the course of operating the Gateway, deals with personal Information collected, used, disclosed and stored in the National Repository on its own account and on behalf of the Pharmacy Examining Board of Canada (PEBC) and the pharmacy regulatory authorities (PRAs). A Privacy Impact Assessment has been completed and was used to inform the development of the NAPRA Privacy Policy and also to confirm that Gateway operations comply with applicable privacy legislation in Canada.


About Pharmacists' Gateway Canada


The Gateway consists of a website, the National Repository of international pharmacy graduate (IPG) registration information, and two self-assessment tools for IPGs. The public-facing website provides plain language information about the registration process and the practice of pharmacy in Canada. The National Repository contains information to be used in the pharmacist registration process, submitted by the Candidate, PEBC, the PRAs, and NAPRA including but not limited to: personal identity, academic credentials, professional certification, language proficiency, structured practical training, bridging programs, jurisprudence and registration. IPGs that are seeking registration as a pharmacist in Canada will enrol in the Gateway as the first step in the registration process. This is done by means of the IPG Portal which is accessible from the public-facing website. The two self-assessment tools may be accessed from either the public-facing website or from the IPG Portal. One of the tools will help IPGs determine their understanding of and readiness for the registration process and the practice of pharmacy in Canada. The other tool will help IPGs review their knowledge and skills in order to identify gaps and to prepare a learning plan.


One of the objectives of the Gateway is to help PRAs align registration requirements as much as possible and to create a single point of application and screening for IPGs pursuing Canadian registration. Furthermore, the Gateway aims to reduce duplication in the steps and activities that are related to the registration of IPGs.


About NAPRA


NAPRA is a voluntary association of provincial and territorial pharmacy regulatory bodies and the Canadian Forces Pharmacy Services. It is incorporated under the Canada Not-for-profit Corporations Act. Its members regulate the practice of pharmacy and operation of pharmacies in their respective jurisdictions in Canada and their primary mandates are to protect the public. NAPRA provides a platform to discuss issues and to take a national approach in addressing common issues in the practice of pharmacy in Canada.


NAPRA serves as custodian and system administrator for the Pharmacists’ Gateway Canada


About PEBC


PEBC is the national evaluating body for the pharmacy profession in Canada. The purpose of the PEBC is to assess qualifications for pharmacists and pharmacy technicians on behalf of participating PRAs. PEBC evaluates qualifications, develops and administers examinations including a national Qualifying Examination.


PEBC is responsible for verification of Candidate identity and education and licensure credentials. It also (i) scans and uploads identity information and documents into the National Repository and (ii) uploads results of the Pharmacist Evaluating Examination and Qualifying Examinations into the National Repository.


About the PRAs


The PRAs are responsible for regulating the profession of pharmacy in their respective jurisdiction.


The PRAs are:


• College of Pharmacists of British Columbia;
• Alberta College of Pharmacists;
• Saskatchewan College of Pharmacy Professionals;
• College of Pharmacists of Manitoba ;

• Ontario College of Pharmacists;
• Ordre des pharmaciens du Québec;
• New Brunswick College of Pharmacists;
• Nova Scotia College of Pharmacists;
• Prince Edward Island College of Pharmacists;
• Newfoundland & Labrador Pharmacy Board;
• Yukon Consumer Services;
• Government of the Northwest Territories; and
• Government of Nunavut.


The PRAs are responsible for uploading some Candidate licensure information into the National Repository, specifically information concerning a Candidate’s (i) completion of structured practical training and jurisprudence examination; and (ii) the date when all requirements for registration are complete.


Our Privacy Commitment


NAPRA will maintain the confidentiality and security of Gateway-related Personal Information, as defined below, in its custody or otherwise under its control. This Privacy Policy has been developed to explain how NAPRA protects the privacy of Personal Information of IPGs collected, used, retained, disclosed or disposed of in connection with its operation of the Gateway.


This Privacy Policy reflects the Canadian Standards Association's Model Code for the Protection of Personal Information (CAN/CSA-Q830-96) and the federal Personal Information Protection and Electronic Documents Act (PIPEDA). This Privacy Policy deals with:


a) NAPRA's accountability for its privacy practices;
b) the purposes for which it collects Personal Information of IPGs and the types of Personal Information that it collects;
c) consent;
d) the manner in which NAPRA uses and discloses Personal Information of IPGs;
e) NAPRA's security, retention and disposal processes relating to IPG Personal Information;
f) IPGs' right to access their Personal Information and to request corrections of same;
g) how IPGs can get answers to questions or raise concerns about NAPRA's dealings with Personal Information and/or NAPRA's compliance with this Privacy Policy; and
h) NAPRA's right to amend this Privacy Policy.


Scope


This Privacy Policy applies to Candidate Personal Information that is in the custody or under the control of NAPRA and that has been collected, used, retained, disclosed or disposed of in connection with the operation of the Gateway.


This Privacy Policy also applies to Personal Information that is collected, used or disclosed by NAPRA through the Gateway web site. In that respect, it is important to consult the e-Privacy Commitment for the Pharmacists’ Gateway Canada that forms Part 2 of this Privacy Policy. NAPRA's dealings with the Personal Information through the web site, as contemplated by Our e-Privacy Commitment, nonetheless remain subject to NAPRA's broader privacy commitments in Part 1 of this Privacy Policy.


Definitions


The following definitions have been created to explain terms that are used extensively in this Privacy Policy:


Collect or Collection means the act of gathering or acquiring Personal Information, whether directly or indirectly, by any means and includes the creation of Personal Information.


Consent means agreement with what is being done or proposed. To process Personal Information, consent must be expressed. Express consent is given explicitly, either orally, electronically or in writing.


Disclose or Disclosure means providing Personal Information to anyone other than to (i) the individual to whom it pertains, (ii) his or her authorized agent(s), (iii) to NAPRA, (iv) to the PEBC, or (v) to a PRA for which the individual has provided consent.


Personal Information in this policy means information about an identifiable individual that includes:


• information concerning physical or mental health;
• information derived from testing or examination;
• information collected during the course of the registration and licensing process through the Gateway


Transfer means to receive Personal Information from, or to provide Personal Information to, an organization for which NAPRA provides Personal Information processing services pursuant to a service contract or agreement containing appropriate privacy-related provisions.


Use includes the treatment or handling of Personal Information by NAPRA or by organizations retained by NAPRA to process or otherwise deal with Personal Information on its behalf.


Principle 1 – Accountability


1.1 NAPRA’s Board of Directors is ultimately accountable for privacy-related issues but has delegated specific responsibilities, including the day-to-day responsibility for privacy compliance and administration, to NAPRA's Executive Director. NAPRA's Privacy Management Program includes the following key activities:


• fostering a culture of privacy at NAPRA;
• analyzing and applying privacy-related laws and policies;
• Personal Information security processes (see Principle 7 below);
• access, complaint and correction procedures (see Principles 9 and 10 below);
• a Personal Information retention and disposal policy (see Principles 5.4 and 5.5 below);
• staff training regarding customer privacy;
• development of communications materials to explain its privacy policy and procedures
• administering a privacy audit program; and
• collaborating with NAPRA’s information technology and security consultants.

 

NAPRA's Executive Director may be contacted at:


NAPRA
Suite 1800, 130 Albert Street,
Ottawa, ON K1P 5G4
Phone: 613 569-9658
Fax: 613 569-9659


While the Executive Director is primarily responsible for NAPRA's Privacy Program, other NAPRA personnel may assist the Executive Director for the day-to-day collection and processing of Personal Information.


1.2 NAPRA is responsible for the Personal Information in its custody or under its control, including any Personal Information that it may transfer to another organization for processing. Any organization that NAPRA may engage to process or to otherwise deal with Personal Information is not permitted to use, retain, disclose or dispose of Personal Information transferred to it by NAPRA except in accordance with the terms of its services agreement with NAPRA. and in accordance with this policy.


Principle 2 - Collection Use and Disclosure of Personal Information


2.1 NAPRA collects uses and discloses Candidate Data, Personal Information and any other information contained in the National Repository for the following purposes only:


a) To maintain an electronic file of identity, credential and registration information and documents which can be shared with the PRAs and the PEBC;


b) To process the Candidate’s application including the assignment of a National Gateway Identifier;


c) To process language proficiency results and other registration requirements (e.g., bridging program results);


d) For the purpose of enabling a Candidate to apply for registration with the PRA of their choice;


e) To evaluate a Candidate for registration;


f) To register a Candidate in the appropriate register if the evaluation of their application complies with the requirements of the PRA chosen by the Candidate;


g) To deal with any appeal or review processes that may flow from an application for registration; and


h) To process payments for services;

 


2.2 NAPRA collects, uses and discloses Candidate Data, Personal Information and any other information contained in the National Repository for the following secondary purposes only:


a) To undertake statistical analysis and reporting, but only if the Personal Information has be anonymized;


b) To provide the Candidate with ongoing service.


NAPRA will only ask for Personal Information that it needs for its legitimate operational purposes and for the legitimate operational purposes of the PRAs and the PEBC.


2.2 In any case where NAPRA collects Personal Information directly from a Candidate, it will explain its purposes for collection at or before the time of collection. If Personal Information that has been previously collected is to be used or disclosed for a purpose not previously identified or reasonably related to such a purpose, NAPRA will, subject to its legal rights and obligations, identify that new purpose to the candidate prior to the relevant use or disclosure.

 


2.3 NAPRA personnel who collect Personal Information on behalf of the PRAs and PEBC are able to adequately explain to the candidate the purposes for which his/her Personal Information is being collected.

 

 

Principle 3 – Consent


3.1 Except as permitted by law, NAPRA will not collect, use or disclose a candidate’s Personal Information without his/her consent for the purposes outlined in Section 2.1 and 2.2 of this Privacy Policy.

 

3.2 The Candidate can refuse to consent to NAPRA's collection, use or disclosure of Personal Information about him/her. A Candidate’s refusal to consent could result in it not being feasible to assess his/her eligibility for enrolment in the National Repository and the PEBC Pharmacist Evaluating and Qualifying Examinations or to process his/her application for registration.

 

3.3 The Candidate may withdraw his/her consent to NAPRA’s collection, use or disclosure of Personal Information up until a registration decision is taken by a PRA, by giving NAPRA reasonable notice. A Candidate’s withdrawal of consent could result in the requirement for a Candidate to submit a second time their Candidate Data to the affected PRA.

 

Principle 4 - Limiting Collection

4.1 NAPRA only collects, uses, and discloses Personal Information required to achieve the purposes identified in Principle 2 above. Personal Information is only collected directly from the Candidate, from other Pharmacy Regulatory Authorities, PEBC or testing and/or educational institutions with the candidate’s consent. It collects Personal Information only by fair and lawful means.

 

4.2 NAPRA will collect, use, disclose and retain the following types of Candidate Personal Information:


a) name, address, telephone number;


b) personal photograph and date;


c) date of birth;


d) country of birth;


e) National Gateway Identifier;


f) academic record (name and address of university, university degree, and dates);


g) licensing record (country, name and address of licensing body, dates);


h) successful completion of examinations and assessments


i) date of completing requirements for registration; and


j) Ineligibility to proceed with examinations or certification (or licensure).

 

 

Principle 5 - Limiting Use, Disclosure and Retention

5.1 NAPRA's use, disclosure and retention of Personal Information are limited to the purposes described in Principle 2.1 and 2.2 above or as identified at the time of collection. NAPRA does not use Personal Information if other information will serve the purpose and does not use more Personal Information than is reasonably necessary to meet the purpose. Where NAPRA intends to conduct statistical analyses or reporting, it de-identifies Personal Information using the appropriate methodologies for de-identification before doing so.

 

 

5.2 NAPRA may disclose Personal Information to:

a) Canadian pharmacy regulatory authorities and the Pharmacy Examining Board of Canada, and their representatives, which, in the opinion of NAPRA, have a legitimate request for such information;


b) any other government, person or organization to whom the individual has authorized NAPRA to disclose Personal Information;


c) as otherwise permitted or required by law; and


d) a Canadian pharmacy regulatory authority, in the event that NAPRA ceases the Gateway services on behalf of the Canadian pharmacy regulatory authorities or has been dissolved..


Except as otherwise required or permitted by law, NAPRA does not otherwise sell, trade, barter, exchange or disclose for consideration any Personal Information it obtains about a candidate.

 

 

5.3 NAPRA retains and disposes of Personal Information collected by it via the Gateway in accordance with the NAPRA Policy on the Retention and Disposal of Records and Electronic Data for the Pharmacists’ Gateway Canada. Personal Information in the National Repository will be disposed of in accordance with the NAPRA Policy.

 

 

5.4 Subject to Section 5.3 above, where applicable, Personal Information that is no longer required in order to meet NAPRA's identified and legitimate purposes will be archived in accordance with the NAPRA Policy on the Retention and Disposal of Records and Electronic Data for the Pharmacists’ Gateway Canada.

 


Principle 6 - Accuracy


6.1 NAPRA will not routinely update Personal Information, unless it is necessary to fulfill the purposes for which the Personal Information was collected. However, NAPRA will seek to ensure that Personal Information under its control is reasonably accurate and complete to manage the possibility that inaccurate or incomplete Personal Information may be used to make a decision about the individual whose information it is.

 


Principle 7 - Safeguards


7.1 NAPRA protects Personal Information under its control with reasonable safeguards that are appropriate to the sensitivity of that information. These reasonable safeguards are designed to protect Personal Information in all formats against loss or theft, as well as against unauthorized access, disclosure, copying, use, modification or disposal. Physical access to those areas where Personal Information is gathered, processed or stored is restricted to authorized employees. Appropriate controls are also in place to protect computer systems and data processing procedures and these controls are reviewed on an ongoing basis to ensure compliance with NAPRA security and privacy policies and with privacy and security best practices.

 


Principle 8 - Openness


8.1 Additional information about NAPRA's privacy-related policies and procedures is available upon request.

 


Principle 9 - Individual Access


9.1 Subject to its legal rights and obliga

tions, NAPRA will, upon receipt of a written request for access, inform a candidate about its possession, use or disclosure of Personal Information, if any, and permit him/her to access that Personal Information if it is controlled by NAPRA. If the candidate requests such information or access, he/she must provide sufficient information with his/her request to permit NAPRA to provide an account of the existence, use and disclosure of that Personal Information. Any Personal Information provided by NAPRA to the candidate as a result of a request for access shall be in a generally understandable form.

 

 

9.2 NAPRA will respond to a request within a reasonable time and in any event within thirty (30) days of receipt of the request. NAPRA may extend this response deadline for up to an additional thirty (30) days if replying within thirty (30) days would unreasonably interfere with its operations, or if the time required to undertake any consultations necessary to respond to the request would make it impractical to meet that time limit. When necessary, NAPRA may also extend the response deadline for as long a period as is necessary to permit conversion of the Personal Information at issue into an alternative format that would allow a person with a sensory disability to read or listen to that Personal Information. NAPRA will provide written notice to the candidate of any response period extension within thirty (30) days of the request. NAPRA will respond to a request for access at minimal or no cost. NAPRA will consult with PEBC and PRAs as necessary.

 

9.3 If the Candidate demonstrates to NAPRA's satisfaction that his/her Personal Information that is held or controlled by NAPRA is inaccurate or incomplete, NAPRA will make appropriate amendments. These amendments may involve the correction, deletion, or addition of Personal Information. Where appropriate, the amended Personal Information will be transmitted to other parties that have previously received the inaccurate or incomplete Personal Information.

 

Principle 10 - Challenging Compliance

10.1 In the event that the candidate wishes to enquire or complain about NAPRA's Personal Information practices or NAPRA's compliance with this Privacy Policy, a written enquiry or complaint can be sent to the attention of the Executive Director at the address provided in Principle 1 above. The Executive Director will investigate all complaints and respond to all written enquiries. If a complaint is found to be justified by the Executive Director, NAPRA will take all reasonable steps to amend its relevant privacy-related policies or procedures.

 


Changes to NAPRA’s Privacy Policy


NAPRA shall not revise or modify that policy without first consulting with the PRAs and PEBC, comments from which they shall reasonably consider in revising or modifying the policy, and NAPRA shall not terminate or cancel that policy. Any revisions to the Privacy Policy will only apply to Personal Information collected subsequent to its effective date.