A Gold Standard for Privacy and Security

The Rick Hansen Spinal Cord Injury Registry is achieving a “gold standard” of privacy and security protection for data holdings. Our data collection and management policies and procedures respect and abide by all legal requirements across Canada, international data protection standards, and privacy and security best practices.

It is important to stress that the data provided to researchers does not identify you. The data you provide is stripped of all personal and identifying information, including your personal contact information, before being provided to researchers who access the data. However, it is also important to note that the Registry extends its privacy gold standard to all information that it collects and stores, including information that does identify you personally.

Who has access to your SCI data held at the Registry?

Only a very limited number of Registry personnel have access to your SCI data. Access is limited to those personnel who need SCI data to carry out their job at the Registry. For example, some Registry personnel may have access to SCI data obtained from sponsored sites for data management purposes (e.g. to create de-identified sets of data for research) and to ensure your information is complete and accurate. The Registry monitors and reviews its personnel’s access to SCI data on a regular basis to ensure it remains appropriate.

The Registry may also share a sample of de-identified SCI data with researchers that have a scientifically and ethically approved research proposal in place to further SCI translational research. It is important to note that the Registry requires these researchers to undergo a rigorous research access request and review process before they can obtain access to your data. This process is outlined in the Registry’s Data Use and Disclosure Policy (available upon request). This policy ensures that any access to your SCI data by researchers follows the Registry’s “gold standard” for privacy and security protection.

In addition, the Registry does not disclose your SCI data to any unaffiliated third party, except if required or authorized by law.

Can I withdraw my consent for the use or sharing of my SCI data by the Registry?

Yes. Your consent for the use and sharing of your SCI data via RHSCIR can be withdrawn at any time. If you decide that you no longer want the Registry to use or disclose your SCI data, you must contact the site (e.g. acute care or rehabilitation centre) that originally collected your information. The participating site will inform you of the appropriate process and if there are any limitations in processing your request.

How does the Registry protect your SCI data?

The Registry uses a variety of measures to protect your SCI data against loss, theft, unauthorized access, disclosure, copying, use, modification, transmittal, disposal, and anticipated threats. These protective measures include:

• Physical safeguards (e.g. locked filing cabinets and offices, staff ID and visitor ID badges, and access restrictions to areas and computer equipment that store your SCI data).
• Organizational safeguards (e.g. privacy training and awareness for all the Registry personnel, clear screen policies, and legal agreements with all third parties with access to SCI data).
• Technical safeguards (e.g. data encryption, and access controls which limit access only to authorized Registry personnel).

How can you get access to and correct your SCI data held by the Registry?

You must direct any requests for access to, or correction of, your SCI data to the sites (hospitals) that originally collected the information. This is because the SCI data that the Registry collects does not identify you personally.

If you need information about who to contact at your local participating site you can contact the National RHSCIR office by using the information listed on the Contact page.

Who can you contact if you have any questions or complaints about the privacy practices and program at the Registry?

You can obtain more information or submit questions, comments, or complaints about the privacy practices of the Registry by contacting the Registry Privacy Officer by email or mail at:

Privacy Officer, Rick Hansen Institute, Blusson Spinal Cord Centre, 6^th Floor, 818 West 10^th Avenue, Vancouver, British Columbia, Canada V5Z 1M9

In the event the Registry is not able to address a complaint to your satisfaction, you may contact the Information and Privacy Commissioner in British Columbia:

Office of the Information and Privacy, Commissioner for British Columbia
PO Box 9038, Stn. Prov. Govt., Victoria, BC V8W 9A4 
This e-mail address is being protected from spambots. You need JavaScript enabled to view it