> For the complete documentation index, see [llms.txt](https://edehr.gitbook.io/edehr-compass/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://edehr.gitbook.io/edehr-compass/legal-and-compliance/privacy/privacy-regulations-and-compliance.md). # Privacy Regulations & Compliance (FOIPPA) ### Guidance for Institutions When adopting EdEHR, institutions are responsible for completing their own privacy compliance process under the legislation that applies to them. In British Columbia, that is the **Freedom of Information and Protection of Privacy Act (FOIPPA)**. Institutions in other provinces or countries should consult their applicable privacy legislation and their own privacy officer. This page uses FOIPPA as the primary reference because most early EdEHR adopters are BC public post-secondary institutions, but the underlying considerations -- what data is collected, how it flows, where it is stored, and what risks exist -- apply broadly regardless of jurisdiction. The information here is provided to help institutions understand what to expect and prepare for. It is not a substitute for your institution's own privacy review process. #### Why a Privacy Impact Assessment (PIA)? A PIA is required under Section 69(5.3) of FOIPPA. It ensures: * Compliance with privacy law. * Transparency around data collection and use. * Risk mitigation strategies are in place. * Institutional privacy officers and the Office of the Information and Privacy Commissioner (OIPC) are consulted when needed. Even if no personal information is collected, PSI must still complete **Part 1 of the PIA** to confirm and document that assessment. ### What Data Is Collected? EdEHR collects minimal personal data necessary for its function: * **Student**: Name, LMS role, LMS user ID, submitted assignments. * **Instructor**: Name, LMS role, LMS user ID, comments on student work. No email addresses, dates of birth, or other personally identifiable information (PII) are stored. *** ### Data Storage & Transmission * **Storage Location**: Toronto, Canada (DigitalOcean servers). * **In Transit**: All communications are encrypted via HTTPS (SHA-256 with RSA). * **At Rest**: All data is encrypted on the server. *** ### Security Measures * **Access Control**: Only accessible through institutional LMS integration (no separate EdEHR login). * **Admin Access**: Limited to one or two vetted individuals via SSH using SSL keys—no password-based access. * **Firewalls**: Dual firewall protection (DigitalOcean + Debian OS). * **Infrastructure Transparency**: EdEHR is an open-source platform. Code is publicly available via GitHub. > 🔗 [EdEHR GitHub Repository](https://github.com/edehr/edehr) *** ### Key FOIPPA Justifications for Data Collection * **Section 26(c)** – Collection authorized when necessary for operational programs. * **Section 33.2(a)** – Permits use by instructors for assessment and feedback. *** ### Data Lifecycle & Retention * Student assignments may be deleted after a course ends at the institution’s discretion. * Schools are expected to download and retain records as they see fit. * EdEHR updates user data from the LMS on each interaction—ensuring accuracy. *** ### ❗ Risk Mitigation Summary
RiskMitigationLikelihoodImpact
Data breachMinimal data collected, encrypted in transit and at restLowLow
Server compromiseDual firewall + restricted SSH accessLowLow
Unauthorized admin accessLMS authentication + unique, non-stored high-entropy passwordsLowMedium
*** ### Student Privacy Notice (Sample) Students must be informed upon enrolment in LMS-integrated courses using EdEHR: * Data is stored in Canada and only minimally collected. * EdEHR is a third-party learning tool and not managed by the institution’s servers. * No direct contact from EdEHR. * The tool supports the development of nursing informatics competencies. *** ### Common or Integrated Programs & Data-Linking EdEHR **does not qualify** as a “common or integrated program” or a “data-linking initiative” under FOIPPA because: * It doesn’t involve new purposes for existing data. * It is not shared across multiple public bodies. * It is institutionally contained. *** ### Next Steps for New PSIs 1. Review and understand FOIPPA compliance expectations. 2. Complete Part 1 (and others if personal info is involved) of the PIA form. 3. Confirm with your institutional privacy officer whether full or partial PIA is required. 4. Use the sample collection notice for all student-facing communications. 5. Refer to your LMS admin for internal data security policies. 6. For changes to EdEHR usage or integration, initiate a **PIA Update**. --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter: ``` GET https://edehr.gitbook.io/edehr-compass/legal-and-compliance/privacy/privacy-regulations-and-compliance.md?ask= ``` The question should be specific, self-contained, and written in natural language. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.