Master Privacy Policy

Multiplex Genomics’ objective is to be the standard for Patient Privacy in the Canadian healthcare industry against which other companies measure themselves. Privacy is the right of an individual to control the Collection, Use and Disclosure of their Personal Information (PI) and Personal Health Information (PHI).

Multiplex Genomics recognizes that protecting its Patients’ privacy is the basis upon which it establishes trust within its healthcare community. Protecting Patient Privacy is fundamental in Multiplex Genomics’ business and reflects our values of Caring, Customer Driven, Agile and One Team. Moreover, it complies with the laws applicable to Multiplex Genomics’ conduct of business.

Multiplex Genomics is a Canadian healthcare services company operating in Ontario. As a national company, Multiplex Genomics may transfer PI/PHI across provincial borders and between business groups within Multiplex Genomics. This Master Privacy Policy establishes a national standard for compliance with applicable provincial and federal Privacy laws and regulations.

Capitalized terms used in this Policy are defined in Appendix A to this Policy. Questions regarding this Policy should be forwarded to the Privacy Office at privacy@mgenomics.ca.

Scope

Multiplex Genomics’ Privacy commitments are set out in this Master Privacy Policy and in Multiplex Genomics’ Privacy policies and procedures that support this Policy, identified in Section 6 below. Where there is a discrepancy between this Master Privacy Policy and any other Multiplex Genomics Privacy policy or procedure, this Policy will take precedence.

The Privacy policies and procedures are intended to reflect and comply with Applicable Privacy Laws. In all cases, these Privacy policies and procedures should be interpreted in a manner that is consistent with Applicable Privacy Laws. In the event of any actual conflict between Multiplex Genomics’ Privacy policies and procedures and Applicable Privacy Laws, the Applicable Privacy Laws are paramount and must be followed.

This Policy applies to all Patient PI/PHI that is Collected, Used, or Disclosed, Retained by Multiplex Genomics, in any form whether oral, electronic, written or otherwise.

Every person who Collects, Uses or Discloses Patient PI/PHI as an Employee, agent or service provider of Multiplex Genomics must comply with this Policy.

This Policy does not include Privacy of Multiplex Genomics’ Employees. Employee Privacy is addressed in a separate Employee-specific policy.

This Policy is current from the last revision date set out in the revision table at the front of the document. Multiplex Genomics’ Privacy Office will review Privacy policies and procedures periodically to ensure that they remain relevant and current with respect to changes in Multiplex Genomics’ business, changing legislation, and evolving technologies. The Chief Privacy Officer will lead a fulsome review of the Privacy policies and procedures at least every two years to ensure they continue to meet Privacy best practices as they evolve.

Governance and Accountability

Multiplex Genomics’ Privacy governance distributes accountability and responsibility for Privacy management and oversight within Multiplex Genomics. While designated individuals or bodies have particular responsibilities, it remains every Employee’s responsibility to ensure compliance with Multiplex Genomics’ Privacy commitments and obligations under Applicable Privacy Laws. Third parties with whom Multiplex Genomics may exchange PI/PHI are also accountable for compliance with their Privacy-related contractual commitments to Multiplex Genomics and with Applicable Privacy Laws.

The Privacy governance framework at Multiplex Genomics is made up of:

1. Board of Directors (BOD)
2. Chief Executive Officer (CEO)
3. Chief Operating Officer (COO)

Accountabilities and Responsibilities

Chief Executive Officer and Board of Directors:

The CEO and BOD have ultimate accountability for protecting Privacy at Multiplex Genomics. The CEO and BOD promote a culture of awareness and compliant Privacy practices throughout the Multiplex Genomics. They are the ‘tone from the top’ in incorporating Privacy considerations into every aspect of Multiplex Genomics’ business that touches PI/PHI.

The BOD, through the Finance, Audit and Risk Committee, will annually review material Privacy breaches and complaints, material changes to Multiplex Genomics’ Master Privacy Policy or the Privacy Risk Management Procedure and will receive other material updates from the Multiplex Genomics Privacy program, including an Annual Report on Privacy (as detailed below). In the interim, the BOD will receive period reports on significant Privacy matters as deemed appropriate by the BOD/CEO and/or the CPO. The CPO, CEO and BOD must immediately be informed of any high risk ] potential or actual Privacy breaches upon being identified, as further described in the Multiplex Genomics Privacy Risk Management Procedure or the Multiplex Genomics Privacy Breach Management Procedure.

The CEO is accountable for ensuring that Multiplex Genomics has an effective Privacy program in place, designed to support the compliance of Employees and third parties with Multiplex Genomics’ Privacy policies and procedures and Applicable Privacy Laws.

The CEO delegates the oversight and management of the Privacy program to the Chief Privacy Officer.

Chief Operating Officer and Privacy Office:

The COO is a Multiplex Genomics executive who is the internal and external point of contact and representative for Privacy matters within Multiplex Genomics. The COO reports to the CEO and is accountable for the strategic and operational oversight of the Multiplex Genomics Privacy program throughout Multiplex Genomics’ businesses. The CPO’s mandate includes:

• Acting as the public face of Privacy compliance within Multiplex Genomics including being the lead or primary point of contact for:
  • privacy inquiries, complaints and access requests
  • the containment, resolution and investigation of privacy breaches
• Oversight for the Multiplex Genomics Privacy program including policies and procedures that reflect privacy best practices, promotion of a privacy-culture and awareness, and delivering privacy training and resources for Employees
• Liaising with Regulators and external and internal stakeholders
• Overseeing Privacy risk management activities
• Leading the Privacy Office in operationalizing the Multiplex Genomics Privacy program

(a) Privacy Office/Privacy Officers:

The COO delegates responsibility for day-to-day management of the Privacy program to the Multiplex Genomics Privacy Officers that form the Privacy Office. The Privacy Office will ensure that Multiplex Genomics complies with its commitments and obligations as set out in its privacy policies and procedures and Applicable Privacy Laws.

Privacy Officers of Multiplex Genomics’ affiliates will provide regular, not less frequently than bi-weekly, reporting on the performance of their respective affiliates’ Privacy programs to the COO. The COO will be engaged by Privacy Officers to consult on material Privacy issues impacting Multiplex Genomics’ affiliates as they arise.

Multiplex Genomics’ Privacy Office will review Privacy policies and procedures periodically to ensure that they remain relevant and current with respect to changes in Multiplex Genomics’ business, changing legislation, and evolving technologies. /p>

(b) Policy and Procedure Review:

The COO will lead a fulsome review of the Privacy policies and procedures at least every two years to ensure they continue to meet Privacy best practices as they evolve. In conducting this bi-annual review, the COO will engage provincial Medical Directors, Client Services, Lab Operations, as well as the Privacy and Cyber-Security Executive Governance Committee to review and provide input into updates to the Privacy policies and procedures. Upon preparing a final draft of updated Privacy policies and procedures acceptable to these reviewers, they will be presented to the CEO and ELT for review and comment. The Master Privacy Policy and the Multiplex Genomics Privacy Risk Procedure will then be presented by the COO to the BOD for its consideration and approval, whether or not material changes have been made. The COO may approve and implement administrative and non-material updates to the Master Privacy Policy and the Multiplex Genomics Privacy Risk Procedure as well as approve any changes to supporting Privacy policies and procedures for the effective and efficient operation of the Privacy program, as needed.

(c) Annual Report on Privacy:

The COO will prepare an Annual Report on Privacy for presentation to the ELT, CEO and BOD. The report will provide summary information about significant Privacy matters at Multiplex Genomics (including its affiliates) in the prior year including:

• Privacy incidents, breaches and investigations
• Privacy inquiries and complaints
• Material Policy or operational updates in the Privacy program
• Enhancements of physical, organizational and technological Security
• Summary of Privacy training and awareness in the prior year
• Privacy risk management report

Executive Leadership Team:

Each ELT member will be responsible for oversight of Privacy compliance and risk management within the Multiplex Genomics functional area for which they are responsible. The ELT will receive periodic reporting on Privacy matters from the COO and will provide input, raise considerations from each member’s function’s Privacy experience and make recommendations on Privacy issues. The ELT will have Privacy as a standing item on its quarterly agenda, or more frequently as requested by the CPO. Matters for ELT consideration include, but are not limited to:

• Privacy issues requiring review or feedback from the ELT
• Privacy breaches and complaints
• Progress of risk mitigation activities and results of PIAs and audits
• Summary of material changes to Multiplex Genomics Privacy policies and procedures
• Function-specific Privacy issues or concerns that have arisen

Privacy and Cyber-Security Executive Governance Committee:

The Privacy and Cyber-Security Executive Governance Committee is a committee of executive leaders including the CEO, COO, and other key members of the ELT, and other key employees across the organization. This Committee was established to integrate Privacy and information security into all business functions. It plays a key role in Multiplex Genomics’ Privacy program in providing a governance body that integrates Privacy and security requirements into the design of Multiplex Genomics’ businesses and ensures the tone at the top for key areas for the organization such as privacy and cyber-security.

Risk and Assurance Policy

Multiplex Genomics applies a risk-based approach to identify, assess, mitigate and monitor risks that may negatively impact Multiplex Genomics’ ability to protect Privacy in compliance with this Policy and Applicable Privacy Laws. Privacy risk management is a continuous process within Multiplex Genomics, overseen by the COO and operationalized by the Privacy Office.

Effective Privacy risk management relies on broad participation and input from every functional area of Multiplex Genomics and every ELT member is responsible for supporting Privacy risk management activities within their respective functions. The Chief Privacy Officer will escalate enterprise-level Privacy risks to the Multiplex Genomics’ Enterprise Risk Management (ERM) Program.

Privacy risk management is detailed in the Multiplex Genomics Privacy Risk Management Procedure. This risk-based approach includes:

• Risk identification and assessment including establishing and maintaining a risk register that applies risk severity and likelihood to guide mitigation initiatives
• Privacy impact assessments (PIAs) to identify Privacy risks inherent in business initiatives, programs or technology solutions, including preliminary Privacy assessments (PPAs) as an essential element of the project lifecycle process
• Periodic monitoring through Privacy compliance audits and risk mitigation efficacy reviews
• Privacy risk training and resources to support the identification, reporting and mitigation of Privacy risks

Appendix A – Definitions

Throughout this Policy, and for all supporting privacy policies, the following definitions will be used for the associated terms:

Anonymize – means the act of stripping data of sufficient identifying detail such that it can no longer be connected with the Patient to whom it originally related, including bythe aggregation of data in a manner that prevents disaggregation that enables connection to that Patient, and Anonymization has a similar meaning.

Applicable Privacy Laws - means all federal, provincial, municipal or other applicable statutes, laws, regulations, rulings, judgments or orders of any governmental or regulatory authority, or judicial body, in any jurisdiction in which Multiplex Genomics conducts business governing the handling of information about an identifiable individual, as may be amended or otherwise revised from time to time, including Ontario’s Personal Health Information Protection Act (PHIPA), British Columbia’s Personal Information Protection Act (PIPA), the federal Personal Information Protection and Electronic Documents Act (PIPEDA), Alberta’s Health Information Act, 2001 (HIA), Saskatchewan’s Health Information Protection Act, 2003 (HIPA), and the province’s public sector privacy legislation where Multiplex Genomics is providing services to a provincial ministry.

Chief Privacy Officer - means the Multiplex Genomics executive accountable for meeting legislative privacy requirements and overseeing the Multiplex Genomics privacy program, reporting to the Chief Executive Officer.

Collection - means the act of gathering, acquiring, creating, recording, or obtaining PI/PHI from any source, including sources other than the Patient to whom the PI/PHI relates, by any means, and Collect and Collecting have similar meanings.

Consent - means an agreement to a proposed course of action. Consent can be either express or implied and can be provided directly by the Patient or by an authorized representative. Express Consent can be given orally, electronically or in writing. Implied Consent is Consent that can reasonably be inferred from a Patient’s action or inaction. Consent must be knowledgeable, must relate to the information collected, used or disclosed for a particular purpose, and must be obtained without deception or coercion.

Custodian - means a person or organization who has custody or control of personal information or personal health information as a result of or in connection to health care services. Multiplex Genomics is a Custodian.

Destroy - means the rendering of a quantity of information in whatever form, such that its content is beyond recovery, such as through shredding, erasure, autoclaving, etc. and Destruction has a similar meaning.

Disclosure - means through action or inaction, permitting access to PI/PHI by a Third Party, and “disclose” has a similar meaning.

Employee - means a permanent, temporary, past or present, full or part-time staff member, consultant or contractor engaged by Multiplex Genomics.

Identified Purposes - means the stated reasons and intended purposes for which PI/PHI is being requested or Collected.

Information and Privacy Commissioner (IPC) - means the independent provincial legislative officer appointed in a province to oversee and promote the protection of personal privacy.

Multiplex Genomics - means Multiplex Genomics Inc. and its affiliates, subsidiaries and divisions now existing or created while this Policy is in effect, including its operating entitles Multiplex Genomics.

Patient - means the individual with respect to whom the personal information or personal health information is being collected.

Personal Health Information (PHI) - means, with respect to an identifiable Patient, whether living or deceased, (a) information concerning the physical or mental health of the Patient; (b) information concerning any health service provided to the Patient; (c) information concerning the donation by the Patient of any body part or any bodily substance of the Patient or information derived from the testing or examination of a body part or bodily substance of the Patient; (d) information that is Collected in the course of providing health services to the Patient; or (e) information that is Collected incidentally to the provision of health services to the Patient; excepting where such information has been sufficiently Anonymized such that it can no longer be connected with the Patient to whom it originally related.

Personal Information (PI) - means information about an identifiable Patient, including Personal Health Information, excepting where such information has been sufficiently Anonymized such that it can no longer be connected with the Patient to whom it originally related.

Policy - means this Master Privacy Policy.

Privacy - means the right of a Patient to control the Collection, Use and Disclosure of their PI/PHI.

Privacy Office - means the Chief Privacy Officer together with the Privacy Officers.

Privacy Officer - means a Multiplex Genomics Employee who is accountable for the day-to-day management of Multiplex Genomics’ Privacy program, reporting to the Chief Privacy Officer.

Retention - means, with regard to Privacy compliance, maintaining possession of a record after Collection.

Security - means the protection of assets by ensuring the confidentiality, integrity and availability of information through the application of safeguards.

Substitute Decision-maker (SDM) - means a second party, authorized under legislation, to make decisions on behalf of a Patient, for example, as in the case of a parent or guardian of a child.

Use - means the treatment, handling, management and Retention of PI/PHI.

Appendix B – Privacy Resources