Compliance is where all healthcare providers and startups are most confused. 

They generally could not figure out which laws apply to us? Which are the requirements? How can we prove compliance readiness? Is there any compliance certification? What is a compliance strategy? Is it a one-time process? Etc … 

What makes the situation more complicated for them is several applicable laws with different requirements. 

So, let’s discuss how healthcare compliance documentation leads you to a successful & easy compliance strategy & implementation and what to & how to document. 

Why is healthcare compliance documentation important? 

Compliance documentation is nothing but a process or task to document information including records, reports, observations and verbal responses required to verify compliance with standards by a healthcare facility or startup. 

In other words, the compliance documents include every technical, administrative and physical measure and policies you have made and implemented to make your healthcare organization or healthcare digital product compliant with healthcare data privacy laws. 

But why is it important to document everything related to compliance? 

• To ease complexities 

As discussed, being compliant with data privacy laws is complex due to several applicable laws and many regulations of each law. 

To address each of the regulations easily, our compliance specialists follow the best practice of writing down each regulation of law, an urgency to satisfy it, different ways to satisfy it and the best way to satisfy it. 

This allows our compliance specialists to get a holistic view of what they have to achieve and how to achieve to be compliant with data privacy laws. 

Compliance documentation also helps them to set a deadline, track progress, assist technical teams with the technical implementation of regulations and implement a compliance strategy the right way.  

• A compliance document is your compliance certificate (absolutely!) 

There is no private or government organization that is authorized to validate your compliance readiness and provide you compliance certificate. 

Thus, you will never be asked by either a user or government to show a certificate that proves compliance readiness. 

However, it is advisable to keep all of your best practices of ensuring compliance readiness well-documented. 

Because many laws including HIPAA ask you to have documented policies and procedures. 

Hence, your compliance documents can act as a compliance certificate when the privacy commissioner inquires about your way to handle data. 

What should you include in your healthcare compliance documents?

Before preparing compliance documents, you must figure out which data privacy laws are applicable to your organization or product. 

You also need to know the type of data or information those applicable laws protect. 

If it is PHIPA (Ontario’s dedicated healthcare privacy laws), you have to prepare a document around what type of data PHIPA protects and every regulation of PHIPA. 

Example 1: 

One of the PHIPA regulations is that it is mandatory for custodians to only collect, use or disclose personal health information if the individual consents. 

So, for this regulation, you have to document the following things. 

• Types of data you can collect, use or disclose 
• Different ways to gather user consents
• A most effective way to gather user consents 

Example 2: 

Another regulation of PHIPA is that a custodian must not collect, use or disclose more personal health information than is necessary to meet a purpose. 

So, for this regulation, you have to document the following things. 

• A purpose you are collecting, using or disclosing data for 
• All data you can collect, use or disclose such as an email, phone number, name, health card number, payment details 
• Only necessary data as per purpose such as email and name (which you are going to collect, use and disclose) 
• Different ways to collect, use and disclose only necessary data 
• Best way to collect, use or disclose only necessary data 

You must now have understood not only what to document but also why documenting all such detail as per each regulation is crucial for successful compliance strategy execution. 

If you are preparing a compliance strategy for a healthcare IT solution such as telemedicine or healthcare CRM, preparing a compliance document helps development teams code the platform in such a way that it handles data as per regulatory requirements. 

How should you prepare healthcare compliance documents? 

Be it PHIPA documentation or PIPEDA documentation, there is no regulated way to prepare compliance documents. 

However, you have to draft it and manage it while following a few best practices our compliance specialists have been following for 7 years. 

• Standardize the document format across your organization. 
• If it is for a healthcare IT product, prepare a document even before the development phase and make sure it is easily understandable by a development team. 
• Include a list of related documents for cross-reference. 
• Prepare separate documents for your organization’s compliance and tech product’s compliance. 
• Prepare separate documents for PIA and TRA. 
• Conduct ongoing monitoring and auditing of compliance documents.
• If you change any policy, ensure to change it in the document as well. 
• Also, develop policies to make changes in the documents. 
• Make sure only authorized users have access to compliance documents. 
• When someone makes changes in the document, every other authorized user should be notified. 
• When you make changes in a document, don’t discard an older version. Keep a log of every change and every document. 

Is this overwhelming for you? We can plan, execute, monitor & manage compliance strategy for you

We are an Ontario-based healthcare-focused IT company. 

Helping healthcare providers, entities and startups eliminate compliance complexities is one of our specializations. 

We have worked with several healthcare organizations to make them compliant with federal and provincial-level data privacy laws in Canada and the USA. 

We also have expertise with PIA and TRA. 

Since compliance is legally mandatory and important for data privacy, our CEO himself leads a team of compliance professionals. 

We are also equipped with technical experts who help our healthcare clients to satisfy the technical requirements of data privacy laws. 

With our Canadian healthcare-specific knowledge and best practices for planning and documenting compliance strategy, we deliver peace of mind to clients. 

We would like to share our case studies on compliance to make you aware of how we understand client requirements, prepare an action plan and execute it.

Case study 1: How did we execute PIA on a healthcare project?

Case study 2: How did we eliminate 47 security gaps to make an app HIPAA compliant?