PHIPA
PHIPA is Ontario's provincial law governing the collection, use, and disclosure of personal health information (PHI) by health information custodians and the organizations that support them.
Why is the Personal Health Information Protection Act (PHIPA) Important to Alohi?
PHIPA matters to Alohi because it defines how we protect personal health information on behalf of Ontario health information custodians who use our products. When a custodian engages Alohi under a signed custodian agreement, we act as an agent and electronic service provider under PHIPA, handling PHI only as instructed by the custodian and only for the purposes they authorize.
Hospitals, clinics, pharmacies, and other Ontario health information custodians trust Alohi because our safeguards build on the same standards already validated through our ISO/IEC 27001 certification and SOC 2 Type II report, extended specifically to meet PHIPA's requirements for agents and electronic service providers.
What are Alohi's Data Protection Procedures & Policies?
At Alohi, we are deeply committed to protecting personal health information through meticulous monitoring, advanced encryption, secure handling practices, and a commitment to continual improvement, ensuring the utmost standards of data protection and regulatory compliance. Here is our approach:
Access Control
In the Alohi Suite, we vigilantly monitor every file transfer, automatically archiving each one. This allows us to maintain oversight over who accesses our systems, especially those that manage personal health information.
Data Encryption & Secure Transmission
We employ robust encryption to protect your documents, both at rest and in transit. This means we lock down your files with a strong digital key, and when they're on the move, they're protected from unauthorized access.
Audit Trails
Sign.Plus and Fax.Plus maintain comprehensive records of all documents sent or received, enabling thorough retrospective analysis. On request, custodians can obtain an electronic record of accesses and transfers involving their data.
User Authentication
Accessing Alohi Suite requires a unique identifier like an email or a securely encrypted username and password. Each login is authenticated with a unique digital ID cookie, securing your session from beginning to end.
No-Storage Option
Alohi Suite offers you the choice to bypass storing your data on our servers. If selected, incoming documents are directly emailed to you without being saved on our end, and outgoing documents are deleted immediately after transmission.
Data Deletion
Should you choose to end your service with an Alohi product, you can request the removal of all your data from our servers. We ensure no paper trails are left; any necessary printed materials are destroyed immediately after use.
Fortified Data Centers
Our data centers are secure strongholds, adhering to the highest security standards and certifications. Custodians can choose a Canadian processing region for Fax.Plus and Sign.Plus, enforced through both technical and contractual controls.
Continuous Security Enhancement
We proactively identify risks and fortify our security measures, including regular updates to our policies, ongoing staff training, security assessments of our applications and networks, risk evaluations, and strict adherence to regulatory compliance.
Additional robust measures incorporated by Alohi:
Products in Scope
PHIPA coverage applies to Fax.Plus and Sign.Plus for custodians on a plan with Advanced Security Controls enabled and a signed custodian agreement in place. Dial.Plus and Scan.Plus are not currently covered under PHIPA and should not be used to handle personal health information.
Confédération Suisse
Confederazione Svizzera
Confederaziun Svizra
Swiss Confederation
Innosuisse - Swiss Innovation Agency
