Overview
In Canada, the Personal Information Protection and Electronic Documents Act (PIPEDA) governs how private-sector organizations handle personal information, and several provinces have their own health privacy laws, including Ontario's Personal Health Information Protection Act (PHIPA), Alberta's Health Information Act (HIA), and Quebec's Act respecting the protection of personal information in the private sector. Clinical photographs and the notes recorded alongside them are personal health information under each of them. This guide explains how Dermi Atlas Professional is designed to support the privacy obligations of Canadian dermatology and aesthetic practices.
Custody and Control
Under Canadian health privacy law, the practice that collects the health information is its custodian or trustee.
- Local custody: Dermi Atlas Professional stores patient records, clinical photographs, and the audit log on a computer the practice owns. No patient data is sent to Dermi.
- No remote access path: The software gives Dermi no remote access to the deployment or its data. Assisted setup and data import assistance take place in a remote session that the practice starts and controls, as set out in the Dermi Atlas Assisted Services Terms.
- What Dermi processes: Staff account details (name, username, email address, and account type), account emails with the requesting device's details, license and installation details, and diagnostics the operator chooses to send are processed by Dermi in Canada and the United States, as set out in the Dermi Sub-Processors document. No patient information is included. The complete list is in Data Security Architecture.
Dermi's role and the data it processes are set out in the Dermi Privacy Policy and the Dermi Atlas Professional EULA. The practice's privacy officer or legal counsel makes the resulting determination under PIPEDA and the applicable provincial law.
Mapping Features to the Fair Information Principles
Principle 1: Accountability
- Named individual accounts: Each team member signs in under a named individual account created by claiming an invitation issued from Dermi Portal.
- Individual attribution: Every action is recorded under the account that performed it, and the record stays with the practice after the member leaves.
- Administrative record: Settings changes, account disabling, and the deployment purge are recorded on the Administration Activity card in Dermi Atlas Manager, with the operator name entered at unlock.
Principle 3: Consent
The consent workflow is described in full in Clinical Image Consent. The consent enforcement level is a setting of each account, chosen in the Patient Consent for Clinical Photography card on the Preferences page: Disabled (the default), Advisory, or Required.
- Enforcement: Required blocks image uploads until documented authorization is recorded for the patient; Advisory displays consent reminders without blocking capture.
- Digital consent: The patient reviews a consent description covering the purpose of image collection, how images may be used, the privacy and security measures applied, and their rights including withdrawal, then enters their full name as a digital signature.
- External verification: A clinician records that verbal, written, or other consent was obtained outside the software, with an optional note.
- Withdrawal: Consent is revoked from the patient details page by typing the confirmation phrase REVOKE CLINICAL CAPTURE CONSENT, and, under Comprehensive logging, the revocation is recorded in the audit log.
Principle 4: Limiting Collection
The unique patient identifier is the only required field on a patient record. Every demographic and contact field is optional, so a practice can limit collection to what the service requires.
Principle 5: Limiting Use, Disclosure, and Retention
- Disclosure controls: Exporting reports and downloading or exporting images are Clinician actions; the complete list of Clinician actions is in Account Types and Permissions.
- Disclosure trail: Under Comprehensive logging, PDF reports, image downloads, and exports are recorded, so each occasion on which health information left the software is visible in the audit log.
- Retention: The Data Deletion Policy and the Data Retention Period in Dermi Atlas Manager decide how long deleted records remain recoverable, from 1 to 600 months with a default of 120, after which they are removed automatically. See Configuring Data Retention for Deleted Records.
Principle 7: Safeguards
- Encryption in transit: Connections on the HTTPS address are encrypted with TLS 1.2 or TLS 1.3, using a certificate the deployment generates for the host computer. The HTTP address is unencrypted; HTTPS is recommended wherever the network includes Wi-Fi or is shared.
- Authentication: Passwords are stored only as salted one-way hashes and must meet enforced complexity requirements. Two-factor authentication with recovery codes is optional and recommended.
- Sessions: A session ends after seven days without activity, and each member can sign out one device or every device from Options => Account.
- Immediate removal: An account is disabled at once from Administration => User Accounts in Dermi Atlas Manager.
- Host controls: Full-disk encryption, host firewall rules, and encrypted storage for backups are configured by the practice. Backups are not encrypted by the software and hold every patient record.
Principles 8 and 9: Openness and Individual Access
- Record access: The patient details page presents every recorded demographic and contact field, and the Patient Activity Logs card shows the activity recorded against the record.
- Copies: Complete patient reports can be exported as PDFs and original images downloaded at full resolution, so an access request can be answered with the images themselves.
- Correction: Clinician accounts edit demographic and contact fields from the patient details page, and under Comprehensive logging each change is recorded with its time, the acting account, and the before and after values.
- Openness: The practice's own privacy policy describes its handling of personal information; the deployment details in this guide inform it.
Provincial Considerations
- Ontario (PHIPA): Custodians take reasonable steps to protect personal health information against theft, loss, and unauthorized use, and notify affected individuals and the Information and Privacy Commissioner of Ontario of certain breaches. The local storage model, the audit log, and the account controls support those steps.
- Alberta (HIA) and Quebec: These laws set specific expectations for safeguards and for information that leaves the province or the country. Patient data in Dermi Atlas Professional stays on the practice's computer; the staff account details and technical metadata that Dermi processes are handled in Canada and the United States, as listed in the Dermi Sub-Processors document.
Breach Response
PIPEDA requires an organization to report to the Office of the Privacy Commissioner of Canada, and to notify affected individuals, when a breach of security safeguards creates a real risk of significant harm, and to keep a record of every such breach.
Evidence available from Dermi Atlas Professional:
- Sign-in history: Every sign-in and failed attempt for an account, with IP address, user agent, and timezone, in the Administration Activity drawer with Performed By set to the account.
- Record access: Under Comprehensive logging, each patient's activity log shows who opened, changed, exported, or downloaded the record and when, and narrows to one member and period with the Member and Period filters. The log is read per patient; no view lists one account's clinical activity across every patient.
- Containment: Disabling the account in Dermi Atlas Manager ends its open sessions at once.
Under the Essential level no clinical activity is recorded, and under the default Standard deletion policy the earlier entries of a deleted record are removed when it is deleted; the Recoverable policy keeps them for the retention period.
Checklist for Administrators
To support privacy obligations when using Dermi Atlas Professional:
- Confirm Comprehensive logging: Audit Logging ships set to Comprehensive; confirm it has not been changed to Essential under Administration => Settings in Dermi Atlas Manager.
- Set the consent level: Align the Patient Consent for Clinical Photography setting on every member's account with the practice's consent forms.
- Review the retention period: Confirm the Data Retention Period against the retention rules of the practice's province before reducing it, because a reduction applies to records already deleted.
- Secure the host: Enable full-disk encryption (BitLocker or FileVault) on the host computer and restrict physical access to it.
- Encrypt backups: Keep exported backups on encrypted storage, separate from the host computer.
- Designate a privacy officer: Name the person who reviews the Administration Activity card and the patient activity logs on a set schedule and who handles breach reporting.
Disclaimer: This guide describes software features and is not legal advice. Compliance with PIPEDA and provincial health privacy law is the responsibility of the practice, which should consult a privacy officer or legal counsel regarding its specific obligations.
Related Resources
- Security and Compliance Fundamentals for the shared responsibility model
- Data Security Architecture for what is sent to Dermi and the technical controls
- Audit Logging Configuration for configuring and reading the audit log
- Atlas Manager Administration for the admin passphrase, the account controls, and the deployment-wide settings