Overview
In Canada, the Personal Information Protection and Electronic Documents Act (PIPEDA) governs how private-sector organizations handle personal information, and several provinces have their own health privacy laws, including Ontario's Personal Health Information Protection Act (PHIPA), Alberta's Health Information Act (HIA), and Quebec's Act respecting the protection of personal information in the private sector. Clinical photographs and the notes recorded alongside them are personal health information under each of them. This guide explains how Dermi Atlas Professional is designed to support the privacy obligations of Canadian dermatology and aesthetic practices.
Custody and Control
Under Canadian health privacy law, the practice that collects the health information is its custodian or trustee.
- Local custody: Dermi Atlas Professional stores patient records, clinical photographs, and the audit log on a computer the practice owns. No patient data is sent to Dermi.
- No remote access path: The software gives Dermi no remote access to the deployment or its data. Assisted setup, which is a remote session, and data import assistance are provided on a deployment that remains under the practice's control, as set out in the Dermi Atlas Assisted Services Terms.
- What Dermi processes: Staff account details (name, username, email address, and account type), account emails with the requesting device's details, license and installation details, aggregate totals of the deployment unless Deployment Statistics is turned off, and diagnostics the operator chooses to send are processed by Dermi in Canada, the United States, and the other locations listed in the Dermi Sub-Processors document. No patient information is included. The complete list is in Data Security Architecture.
Dermi's role and the data it processes are set out in the Dermi Privacy Policy and the Dermi Atlas Professional EULA. The practice's privacy officer or legal counsel makes the resulting determination under PIPEDA and the applicable provincial law.
Mapping Features to the Fair Information Principles
Principle 1: Accountability
- Named individual accounts: Each team member signs in under a named individual account created by claiming an invitation issued from Dermi Portal.
- Individual attribution: Under Comprehensive logging, every action is recorded under the person who performed it, and the record stays with the practice after the member leaves.
- Administrative record: Settings changes, account disabling, and the deployment purge are recorded in the Administration Activity drawer in Dermi Atlas Manager, with the operator name where one was entered at unlock.
Principle 3: Consent
The consent workflow is described in full in Clinical Image Consent. The consent enforcement level is a setting of each account, chosen in the Clinical Image Consent card on the Preferences page: Disabled (the default), Advisory, or Required.
- Enforcement: Required blocks image uploads until documented authorization is recorded for the patient; Advisory displays consent reminders without blocking capture.
- Digital consent: The patient reviews a consent description covering the purpose of image collection, how images may be used, the privacy and security measures applied, and their rights including withdrawal, then enters their full name as a digital signature.
- External verification: A clinician records that verbal, written, or other consent was obtained outside the software, with an optional note.
- Withdrawal: Consent is revoked from the patient's Details page by typing the confirmation phrase REVOKE CONSENT, and, under Comprehensive logging, the revocation is recorded in the audit log.
Principle 4: Limiting Collection
The unique patient identifier is the only required field on a patient record. Every demographic and contact field is optional, so a practice can limit collection to what the service requires.
Principle 5: Limiting Use, Disclosure, and Retention
- Disclosure controls: Exporting reports and downloading or exporting images are Clinician actions; the complete list of Clinician actions is in Account Types and Permissions.
- Disclosure trail: Under Comprehensive logging, PDF reports, image downloads, and exports are recorded, so each occasion on which health information left the software is visible in the audit log.
- Retention: The Data Deletion Policy and the Data Retention Period in Dermi Atlas Manager decide how long deleted records remain recoverable, from 1 to 600 months with a default of 120, after which they are removed automatically. Copies held in existing backups remain until those backups are deleted in Backup Management, and any installation safety copy stays in the backup folder until it is removed from that folder, so the backup folder belongs in the practice's destruction schedule. See Configuring Data Retention for Deleted Records.
Principle 7: Safeguards
- Encryption in transit: Connections on the HTTPS address are encrypted with TLS 1.2 or TLS 1.3, using a certificate the deployment generates for the host computer. The HTTP address is unencrypted; HTTPS is recommended wherever the network includes Wi-Fi or is shared.
- Authentication: Passwords are stored only as salted one-way hashes and must meet enforced complexity requirements. Two-factor authentication with recovery codes is optional and recommended.
- Sessions: A session ends after seven days without activity, and each member can sign out one device or every device from Options => Account.
- Immediate removal: An account is disabled at once from Administration => User Accounts in Dermi Atlas Manager.
- Host controls: Full-disk encryption, host firewall rules, and encrypted storage for backups are configured by the practice. Backups are not encrypted by the software and hold the patient records and images.
Principles 8 and 9: Openness and Individual Access
- Record access: The patient's Details page presents every recorded demographic and contact field, and the Patient Activity Logs card shows the activity recorded against the record.
- Copies: Full Reports can be exported as PDFs and original images downloaded at full resolution, so an access request can be answered with the images themselves.
- Correction: Clinician accounts edit demographic and contact fields from the patient's Details page, and under Comprehensive logging each change is recorded with its time, the acting account, and the before and after values.
- Openness: The practice's own privacy policy describes its handling of personal information; the deployment details in this guide inform it.
Provincial Considerations
- Ontario (PHIPA): Custodians take reasonable steps to protect personal health information against theft, loss, and unauthorized use, and notify affected individuals and the Information and Privacy Commissioner of Ontario of certain breaches. The local storage model, the audit log, and the account controls support those steps.
- Alberta (HIA) and Quebec: These laws set specific expectations for safeguards and for information that leaves the province or the country. Patient data in Dermi Atlas Professional stays on the practice's computer; the staff account details and technical metadata that Dermi processes are handled in Canada, the United States, and the other locations listed in the Dermi Sub-Processors document.
Breach Response
PIPEDA requires an organization to report to the Office of the Privacy Commissioner of Canada, and to notify affected individuals, when a breach of security safeguards creates a real risk of significant harm, and to keep a record of every such breach.
Evidence available from Dermi Atlas Professional:
- Sign-in history: Sign-ins and failed attempts for an account, with the IP address, in the Administration Activity drawer with Performed By set to the account. Attempts refused during the 15-minute lockout after five failures are not listed.
- Record access: Under Comprehensive logging, each patient's activity log shows who opened, changed, exported, or downloaded the record and when, and narrows to one member and period with the Member and Period filters. No administrator view lists one account's clinical activity across every patient; the account's own Your Activity Logs does.
- Containment: Disabling the account in Dermi Atlas Manager ends its open sessions at once. A lost device is signed out by the member under Signed-In Devices on the Account page, which also ends its two-factor trust.
Under the default Standard deletion policy, the earlier entries of a deleted record are removed when it is deleted; the Recoverable policy keeps them for the retention period.
Checklist for Administrators
To support privacy obligations when using Dermi Atlas Professional:
- Confirm Comprehensive logging: Audit Logging ships set to Comprehensive; confirm it has not been changed to Essential under Administration => Settings in Dermi Atlas Manager.
- Set the consent level: Align the Clinical Image Consent setting on every member's account with the practice's consent forms.
- Review the retention period: Confirm the Data Retention Period against the retention rules of the practice's province before reducing it, because a reduction applies to records already deleted.
- Secure the host: Enable full-disk encryption (BitLocker or FileVault) on the host computer and restrict physical access to it.
- Encrypt backups: Keep exported backups on encrypted storage, separate from the host computer.
- Designate a privacy officer: Name the person who reviews the Administration Activity drawer and the patient activity logs on a set schedule and who handles breach reporting.
Disclaimer: This guide describes software features and is not legal advice. Compliance with PIPEDA and provincial health privacy law is the responsibility of the practice, which should consult a privacy officer or legal counsel regarding its specific obligations.
Related Resources
- Security and Compliance Fundamentals for the shared responsibility model
- Data Security Architecture for what is sent to Dermi and the technical controls
- Audit Logging Configuration for configuring and reading the audit log
- Atlas Manager Administration for the admin passphrase, the account controls, and the deployment-wide settings