text:
Posted on November 15, 2021 by Jean Eaton in Blog
This is a cautionary tale.
And it could save you a lot of embarrassment – even legal issues.
The way a healthcare provider collects, uses and discloses personal health information (PHI) is critical to an efficient healthcare practice.
It's also required by legislation and professional college regulations and standards.
Policies and procedures must be in writing, available to employees, and monitored to ensure that they are followed. Otherwise, you face all sorts of risks, including privacy breaches and other legal problems.
Policies and procedures must be in writing, available to employees, and monitored to ensure that they are followed. #Policies	Click to Tweet
Everyone in a healthcare practice — including front office staff, wellness practitioners and physicians and other custodians — must be aware of and follow these policies and procedures.
These policies and procedures also become the foundation of your privacy impact assessment (PIA).
That's why, in this Privacy Breach Nugget, we'll review a privacy breach investigation report from Alberta's Office of the Information and Privacy Commissioner (OIPC). Whether you have a new practice, or an existing practice, we have a number of services and resources designed to help you manage your practice in a way that not only meets legal requirements, but is streamlined and efficient, and keep your information secure.
This report started with an employee suspected of accessing health information for an unauthorized purpose.
It started with at the clinic with a conflict between the employees and the employer.
An employee (Employee A) was on leave from her position at the clinic. Her access to the electronic medical record (EMR) was suspended during her leave.
Employee A wanted to access patient information to support her dispute with management. Over two months, Employee A used Employee B's credentials to access patient records.
This action is in contravention of the Health Information Act (HIA) sections 27 and 28.
This is where this case becomes even more convoluted and, in fact, a better case study of what not to do.
Understanding the Health Information Act
The Health Information Act (HIA) requires the custodian (the physician, in this case) to take reasonable steps to maintain administrative, technical, and physical safeguards to protect patient privacy as required by sections 60 and 63 of the HIA, and section 8 of the Health Information Regulation.
In November 2013, the clinic submitted a privacy impact assessment (PIA) to the OIPC prior to its implementation of an electronic medical record (EMR).
The PIA included written policies and procedures.
The letter to the OIPC accompanying the PIA was signed by two physicians, as well as Employee A who was the privacy officer at that time.
The physician named in the investigative report is not the current custodian at the clinic. The physician was hired in 2015 and therefore not a member of the clinic in 2013 and not involved in the initial PIA submission.
During the investigation, both employees indicated that the policies and procedures to protect patient privacy were in a binder in the clinic, but it was never used or shared with the staff.
Oaths of confidentiality may have been previously signed by the employees, but the documents could not be produced during the investigation.
Section 8 (6) of the Regulation states the 'custodian must ensure its affiliates are aware of and adhere to all of the custodians administrative, technical, and physical safeguards in respect of health information.'
It's common practice for clinics to require employees to sign confidentiality agreements and ensure that they receive patient privacy awareness training with regular updates.
But in this investigation, the employees said they never received privacy awareness training.
Show Me Policy and Procedure Checklist
Access To Patient Information
The employees also stated it was common practice at this clinic for individuals to not log off of their EMR account on the computers at the reception desks. It was common practice for other employees to access an open session to quickly perform a task in the EMR.
The investigator concluded that the physician was in contravention of the HIA section 63(1) which requires custodians to establish or adopt policies and procedures that would facilitate the implementation of the Act and regulations.
These specific findings were made:
The custodian failed to ensure the clinic employees were made aware of and adhered to the safeguards put in place to protect health information in contradiction contravention of section 8(6) of the regulation.
The custodian was in contravention of section 8(6) of the regulation which requires custodians to ensure that their affiliates are aware of and adhere to all of the custodian's administrative, technical, and physical safeguards with respect to health information. It's important to note any collection use or disclosure of health information by an affiliate of a custodian is considered to be the collection, use, and disclosure by the custodian.
The custodian failed to ensure the employee and the other clinic staff adhered to technical safeguards as required by section 60 of the HIA and section 8(6) of the regulations.
Privacy Breach Nuggets You Need to Know
Privacy breaches are in the news every day. The more you know how breaches can affect you allows you to be more proactive to prevent privacy breach pain.
Get Your Privacy Documents In Order
To protect yourself and your practice from patient privacy breaches (and massive fines, see the conclusion to this article), follow these steps.
Find your policies and procedures and review them with all staff and custodians. Make sure you document that this has been done.
Review and update your privacy awareness training and ensure all staff, including custodians, have completed this recently. Make sure you have this documented, including certificates of attendance if available.
Oath of confidentiality documents should be signed by all of all clinic staff and custodians and maintained in a secure location.
Review your privacy impact assessment and ensure all of your current custodians have read this and understand it. Visit this post for more information to help you determine if you need a PIA amendment.
This incident occurred in 2016. The OIPC office did not recommend any additional sanctions against the clinic, physicians, or employees.
To get templates of policies and procedures for your healthcare practice, be sure to sign up for the Practice Management Success Membership
New Amendments To The HIA
This case might have turned out differently today.
New amendments, as of 2018, provide a provision for fines under the HIA ranging from $2,000 to $200,000.
The public — and our patients — expect and trust us to make sure that their personal health information is kept secure and confidential.
It's our responsibility to make sure we have these administrative, technical, and physical safeguards in place and are maintained in a consistent fashion.
When you've done the hard work to implement your patient privacy policies and procedures and your privacy impact assessment, make sure you continue your journey and keep these documents up-to-date and current. To help you, sign up for the Practice Management Success Membership.
There are many patient privacy breaches in the news each day, and you never know when it could happen to you.
The more you know about the breaches and how they can affect you allows you to be more proactive to prevent privacy breach pain. If you need to prepare your privacy breach management plan, start your on-line training 4-Step Response Plan right away!
If you need templates of policies and procedures for your healthcare practice, be sure to sign up for the Practice Management Success Membership. These tips, tools, templates, and training will help you save time and money to develop and maintain policies and procedures in your healthcare practice.
When we know better, we can do better…
I've helped hundreds of healthcare practices prevent privacy breach pain like this. If you would like to discuss how I can help your practice, just send me an email. I am here to help you protect your practice.
PRIVACY BREACH NUGGETS are provided to help you add a 'nugget' to your privacy education program. Share these with your staff and patients as a newsletter, poster, or staff meeting.
Jean L. Eaton, Your Practical Privacy Coach
Click Here To Register for the FREE Training Video "Can You Spot the Privacy Breach?"
Healthcare Policies And Procedures: Essential in EVERY Practice
Alberta Office of the Information and Privacy Commissioner. Investigation Report H2019-IR-01 Investigation into alleged unauthorized accesses and disclosures of health information at Consort and District Medical Society Clinic. May 21, 2019. https://www.oipc.ab.ca/media/996888/H2019-IR-01.pdf
Alberta, clinic, custodian, health, Health Information Act, healthcare, HIA, medical, Patient privacy, physicians, Policies and procedures, Prevent privacy breaches, privacy, privacy breach, Privacy Impact Assessment, reasonable safeguards, templates
How to Manage a Privacy Breach with Confidence
Posted on August 31, 2021 by Jean Eaton in Blog, Services, Training, Upcoming events/workshops
The new mandatory privacy breach notification provisions to the Health Information Act (HIA) effective August 31, 2018. Are YOUR policies and procedures up to date?
Custodians will be required to notify the Office of the Information and Privacy Commissioner (OIPC) and the Minister of Health, privacy breaches with risk of harm.
If you haven't updated your privacy breach management policy, trained your staff, and prepared your reporting procedures yet, let me help you with done-for you templates and training!
If you're a healthcare practice manager, owner or privacy officer who really needs to know how to respond to a privacy breach but doesn't have a step-by-step plan ready to implement, then here's the answer you've been looking for…
Introducing the "4 Step Response Plan" on-line education with quick and helpful content so that you will properly manage a privacy breach. This is critical to the continued success of your business.
Privacy Incidents Happen!
60% of small and medium business owners go out of business within 6 months after a privacy and security breach. Patients, clients, employees and business partners trust you to keep their private and sensitive information confidential and secure.
Mandatory privacy breach reporting is quickly becoming a legislated requirement – and many businesses are not prepared!
Not recognizing and not notifying a privacy breach quickly and properly could result in fines and even jail time for the business, healthcare provider, employee, or vendor!
Learn NOW how to manage a privacy breach – Don't get caught scrambling when a privacy breach happens.
The biggest mistake in managing a privacy breach is not recognizing the privacy breach.
The second biggest mistake is not knowing what to do about it.
Many healthcare practice managers, owners and privacy officers can't get past the idea that simply hoping that you won't have a privacy breach is not a good business strategy!
But nothing could be further from the truth!
What people are saying about the '4 Step Response Plan'
Well it happened! We recently had a privacy breach. It was an 'oops' but never the less a privacy breach. I had started the 4 Step Response Plan – Prevent Privacy Breach Pain but thought I had time to go through it. Unfortunately not. Your course has been a godsend with all the information and forms that I need to work through this privacy breach and notifying process. Nancy D
Results Oriented Learning
The 4 Step Response Plan will help you with prevent privacy breach pain and give you the tips, templates, training, and tools that you can use right away to prepare your privacy breach response plan.
Learn to
Recognize a privacy breach.
Understand why a privacy breach is a significant problem.
Understand the cost of a privacy breach and why you need to be prepared now.
Use the 4 Step Response Plan to develop a privacy breach management plan.
Prevent a privacy breach from happening again.
… and much, MUCH more!
When you have a privacy breach you must recognize the breach, contain it, notify the affected individuals, and prevent it from happening again. When you have this plan you will have confidence that you have identified and managed your areas of risk and dramatically reduce the risk of a privacy breach. Your staff will recognize a privacy breach early and respond quickly. You will manage the breach with minimum of risk to your patients, clients, and your practice.
In the world of privacy breaches 'If' has become 'When'. Are you be ready?
The 4 Step Response Plan includes
6 interactive lessons
60 minute training webinar
Video introduction to each lesson
Template policies and procedure NEW! Updated Privacy Breach Management Policy
Scenarios and examples
Downloadable resources, checklists and templates New! Privacy Breach Reporting Form to make it easy for you to meet your notification requirements.
BONUS – Discussion Group (not Facebook!)
Exclusive to registered participants – collaboration with others to help you solve problems and Jean will be there to answer your questions and encourage your progress.
BONUS – Monthly Q&A With Jean
Monthly incident response training using recent real-world reported privacy breaches and mentoring with live Q&A with Jean to help you overcome obstacles so that you can get your privacy breach management plan finished!
BONUS – Privacy Breach Awareness Training for YOUR Employee's Orientation
Video (8 min) – "Can You Spot the Privacy Breach?"
Learning Resources Guide to download
Post Test
Certificates of Completion
This on-line education program may be eligible for Continuing Professional Development credits with your professional association.
Self-paced And Self-learning – All Lessons Are Available Right Away – No Waiting To Get The Content That You Need Most!
Get Started Right Now!
Not having your privacy breach management policies and procedures in place will
make it harder to respond to a privacy breach
mis-steps – opens you up to fines, sanctions, and re-work that will cost you time and money
blind-sided by mandatory privacy breach reporting requirements
So if you're a privacy officer, practice managers, healthcare providers, or a clinic manager who needs to know how to respond to a privacy breach but doesn't have a step-by-step plan ready to implement you need to act on this right now.
When you have your privacy breach response plan in place you will have confidence that you are prepared to respond to the breach with confidence.
Get the step-by-step help to customize your policies and training and
You will save time and save money.
Your staff will recognize a privacy breach early and respond quickly.
You will respond to the breach with a minimum of risk to your patients, clients, and your practice.
Click the Button Below to Get Started Right Away!
You will be re-directed to Stripe to make your purchase by credit card or debit.
Your receipt will indicate payment has been made to Information Managers Ltd.
Your confirmation and receipt will be provided to the email address that you complete your registration.
Use your best email address – you don't want to miss access to all the resources!
Jean L. Eaton, BA. Admin (Healthcare) CHIM, CC is constructively obsessive about privacy, confidentiality, and security when it comes to the handling of personal information, particularly in primary health care settings.
Jean provides solutions that are practical and effective for today's healthcare providers so they can implement privacy by design and best practices to protect privacy, confidentiality, security of personal information.
Jean specializes in making practical recommendations for 1000's of independent health care providers and comply with privacy legislation while improving efficiency in their practice management. Jean is a consultant and speaker on the topic of privacy breach management, including 'virtual privacy officer' on demand.
She is the privacy awareness training facilitator to hundreds of medical clinics and healthcare practices and organizations that support independent healthcare businesses and privacy officers across Canada and the US. With over twenty years of experience, I have the knowledge and tools to help your business improve your information privacy practices.
I'm delighted to share this with you now in this course.
So go ahead, click the order button right now and you're well on your way to privacy breach management plan success!
Here Is My Personal Guarantee
Email Jean with your questions.
Jean L. Eaton is the host of the Privacy, Confidentiality and Security Workshops for Your Healthcare Practice © series.
4 Step Response Plan, incident response, online education, prevent privacy breach pain, privacy breach, privacy officer training, training
Healthcare Privacy Breach Training
Posted on August 11, 2021 by Jean Eaton in Blog
Learn From Someone Else's Privacy Breach!
Using privacy breach examples from other healthcare practices makes realistic privacy breach training content to prevent them from happening in your clinic!
The cost of a data breach continues to rise, and healthcare is the costliest industry, according to IBM's Cost of Data Breach Report 2021.
This report indicates that the average cost of a data breach including personally identifying information (PII) is
$180 per record containing PII
Assuming that a family practice physician has a panel size of 2,000 patients, the cost of a privacy breach could be $180 x 2,000 = $360,000
If you work in a group practice with 4 physicians and all of your patient records were included in the privacy breach, this could cost your practice up to $1.4 M
Privacy breach notification requirements are changing, and so are the fines if your practice is in violation of privacy legislation in Canada like the Alberta Health Information Act (HIA) and the Ontario Personal Health Information Protection Act (PHIPA).
In this free 60-minute workshop, Jean will share recent privacy breach examples in healthcare and discuss how to prevent them from happening in your clinic.
Who Should Attend the Privacy Breach Training?
Everyone in your medical, dental, chiropractic, podiatry, practice should attend this workshop. This is a great orientation for new employees and a timely refresher for everyone else.
I believe that practical privacy breach training is a reasonable safeguard to protect patient information and the reputation of the healthcare providers and the clinic.
Make this a lunch and learn event!
Confidently Respond to a Privacy Breach…You'll Sleep Better at Night!
Patients, clients, employees and business partners trust you to keep their private and sensitive information confidential and secure.
The Biggest Mistake In Managing A Privacy Breach
Your Practical Privacy Coach has prepared this FREE 60-minute workshop with recent privacy breach examples to help you spot a privacy breach in your healthcare practice!
Use these privacy breach examples to
improve your privacy management program and prevent similar incidents
prepare your privacy incident response plan so that you can quickly spot and stop a similar privacy breach in your practice
reduce privacy breach costs, harm to patients, loss of reputation
train your team and privacy officer
Join us on Thursday, August 19th, 2021
12 Noon MT
Learn From Someone Else's Privacy Breach Workshop
Register for Your FREE LIVE Workshop
In the world of privacy breaches 'If' has become 'When'. Will you be ready?
If you want to confidently and properly manage a privacy breach, start by attending this workshop. If you need to create or update your privacy breach incident response plan, check out the 4 Step Response Plan on-demand training, too.
This Workshop Includes:
Q&A with Jean L. Eaton, Your Practical Privacy Coach when you join the webinar live
Access to the replay for a limited time
PDF cheat sheets
BONUS – Privacy Breach Awareness Training for YOUR employee's orientation. Includes Video – "Can You Spot the Privacy Breach?", Learning Guide, Post Test, and Certificates of Completion
This webinar may be eligible for Continuing Professional Development credits with your professional association.
Jean L. Eaton, BA Admin (Healthcare), CHIM, CC is constructively obsessive about privacy, confidentiality, and security when it comes to the handling of personal information, particularly in primary health care settings.
So go ahead, register right now before it is too late!
Which of these best describes your business?
Physiotherapy Office
We use MailChimp as our marketing automation platform. By clicking below to submit this form, you acknowledge that the information that you provide will be transferred to MailChimp for processing in accordance with their Privacy Policy and Terms.
You will also benefit from the occasional Privacy and Practice Management tips by email of similar resources that you can use right away!
Health Information Act, prevent a privacy breach, privacy breach, respond to a privacy breach
Table-Top Privacy Breach Fire Drill
Posted on April 19, 2021 by Meghan in Blog
Use A Table-Top Privacy Breach Fire Drill to Protect Your Practice
A table-top privacy breach fire drill is a cost-effective way to prepare for a privacy and security incident in your healthcare organization. You should have a written privacy breach incident response plan in your healthcare practice. Have you practiced your response plan lately?
A table-top privacy breach fire drill allows your incident response team to rehearse their skills in a controlled exercise.
Do you remember your school days when every month or two you had a fire drill? The fire alarm would go off and everybody would go out the doors and very calmly go down the stairs and out the doors and into their muster point.
We take the same approach with privacy breach fire drills. Fires can happen at different times, places, and for different reasons. Whey you change the scenario, you develop alternate strategies or playbooks to best respond to the fire.
A privacy breach incident playbook contains all the actionable steps to take when a privacy beach incident occurs. Your playbook will have many 'plays' or actions to take when different types of privacy breach incidents occur. You could also think of it as a recipe book. You have many types of recipes to select from. Identify the ingredients that you have on hand (or the characteristics of the latest privacy incident) and select the most appropriate recipe to resolve the incident.
Healthcare providers, owners, and privacy officers hear about big privacy breaches on the news and hope it won't happen to them. It keeps them up at night…because they know that properly preventing or managing a privacy breach is critical to the continued success of their business. Implementing a table-top privacy breach fire drill will help!
Picture this. You call a meeting of your incident response team. This may include your privacy officer, computer network support or managed services provider lead, physician, dentist, or other healthcare lead, your media spokesperson, and clinic manager. The privacy officer distributes a privacy breach incident scenario summarized on one page.
The team members read the scenario and then discuss what steps that they would take to respond to the privacy breach incident.
Using the 4 Step Response Plan as your playbook guideline, the incident response team note-keeper documents the hypothetical steps that the team takes to respond to the breach. Record the decisions, the resources, and the questions that you explore in this scenario.
When the table-top exercise is complete, you now have a detailed action steps that you can take when a similar privacy incident occurs in your healthcare practice.
How To Use The Table-Top Privacy Breach Fire Drill Technique
The goal of a privacy breach fire drill is to develop your playbook so you can spring into action when a similar privacy and security incident occurs in your healthcare practice.
First, identify a scenario that could happen in your practice. Unfortunately, it's easy to find an example about a privacy and security breach in the news. Grab a privacy breach example and pull out the bits and pieces of the information that might apply to your organization. When you select scenarios that could happen in your organization the exercise is more meaningful for you, and you will develop tools and templates that are going to help you in the event that a very similar privacy and security incident happens in your organization.
Let's use the recent privacy breach incident that came from the province of Saskatchewan* when a cybersecurity attack that happened in their E-Health system. This attack may have started when an employee who had authorized access to the e-health system used a personal tablet to connect with a USB to the Saskatchewan health authority's computer. This enabled a virus from that personal tablet to infect the computer system and ultimately the e-health system, allowing millions of files to be stolen. Strip the example down to its key points. Create additional details and assumptions where needed to give the team members enough information to discuss the scenario during the fire drill exercise.
Step 1 Contain The Breach
The first step in every incident is to spot and stop the breach. Make an assumption that the employee who connected the personal device to your computer is now seeing that message on the screen that says that there's a virus in the system. One of your incident team members plays the role of the employee and completes Step 1 of the privacy breach incident response form and notifies their supervisor or the privacy officer.
Another team member assumes the role of the privacy officer and explains what their next action steps would be.
Record each action that you consider. Document each policy, resource, phone number and email address that you would use in a real event. This creates the action steps in your playbook.
Step 2 Evaluate the Risks
Discuss the risks that could affect the computer systems. What tools do you need to evaluate the harm of this incident? How might this affect patient care and the privacy of patient information?
Contact your vendors and ask them to contribute to the risk assessment in this scenario.
Who else might you want to call on for assistance to investigate this incident?
You might want to revisit the news item for additional information about the actions that were taken that you might also need to explore.
In your playbook, record good leading questions to help you to investigate the incident and evaluate the risks of harm.
Step 3 Notification
Strategize who you would notify about the incident. Prepare written notification to the custodians, patients, regulators and even media statements. These become templates in your playbook that you can quickly implement in your real event.
Role-play your media spokesperson being interviewed on the evening news. It's much better to practice now, before you are in a crisis.
Step 2 Prevent the Breach From Happening Again
This might be the most valuable step in the privacy breach fire drill. Complete the privacy breach incident worksheet and summarize this practice scenario. Consider how likely this scenario could happen in your practice. What type of training could be done now to prevent this from happening? What tools or training do your incident response team members need today to make it easier for them to monitor and prevent this scenario from happening?
Fire-Drills Lead to a Confident Response
At the conclusion of this fire-drill, your team is ready, energized, and have the tools that they need to make sure that they can respond to that privacy and security breach as quickly as possible. This absolutely is a great investment in your time. These table-top privacy breach fire drills are a great demonstration of your commitment as an organization to ensure that you are protecting the privacy confidentiality and security of health information.
I hope that this privacy tip to help you do your tabletop privacy and security breach fire drills will be a value to your organization.
Do you need help to create your privacy breach management plan – and a mentor to help you get it done?
Check out the 4 Step Response Plan – tips, tools, templates, and training to help you create your privacy breach management plan!
4 Step Response Plan
*Reference:
Saskatchewan IPC finds ransomware attack results in one of the largest privacy breaches in this province involving citizens' most sensitive data. January 8, 2021 – Ron Kruzeniski, Information and Privacy Commissioner. https://oipc.sk.ca/saskatchewan-ipc-finds-ransomware-attack-results-in-one-of-the-largest-privacy-breaches-in-this-province-involving-citizens-most-sensitive-data/
fire drill, healthcare, privacy breach, privacy officer, privacy officer training, privacy training, table-top privacy breach fire drill
Pharmacist Convicted and Fined Under the HIA
Posted on February 1, 2021 by Meghan in Blog
An Edmonton pharmacist was in a vehicle accident. The pharmacist subsequently accessed and used the health information of the individual involved in the accident in an attempt to persuade the individual from submitting an insurance claim for the vehicle accident.
The individual submitted a complaint to OIPC in April 2018 and an investigation was launched.
The pharmacist appeared in court on Friday January 15, 2021. He was convicted of an offence under the Health Information Act (HIA). He was ordered to pay a $5,000 fine, plus a $1,000 victim fine surcharge for using health information in contravention of the HIA.
This Could Happen To You
Are you prepared? If you have a privacy breach like this in your practice, be prepared to implement the 4 Step Response Plan.
It is an offence under HIA to knowingly use health information in contravention of the act (section 107(2)(a)).
What Happens When A Privacy Breach Is Reported To The OIPC
When a privacy breach is reported to the OIPC, the OIPC will review the report and consider the custodian's determination if a reasonable risk to the patient(s) was present. The OIPC will review the report and consider:
agree (or not) with the determination of risk of harm
was the patient notified appropriately
is there an offence under the HIA
is an investigation warranted?
If an investigation is indicated, the OIPC will conduct the investigation and report their findings to the Crown prosecutors at Alberta Justice. The Crown will determine if it continues to press charges under the HIA.
Privacy Breaches – What You Need to Know
1. Provide privacy awareness training for each employee and healthcare provider at orientation and regularly throughout the employment.
2. Collect the employee's oath of confidentiality, including an acknowledgement that the employee understands the principles of only accessing and using the health information necessary to perform their job.
3. Monitor your users' access to health information to quickly identify when a suspicious privacy incident occurs. The sooner you identify a privacy breach, the sooner you can limit the risk.
4. Implement your sanction policy when needed. Your sanctions policy clearly identifies the sanctions when an employee or healthcare provider is liable of an offence under the HIA.
5. Report a privacy breach to your custodians and healthcare providers, the Office of the Information and Privacy Commissioner, and the Minister of Alberta Health and the individuals affected by the breach.
The more you know about how breaches can affect you allows you to be more proactive to prevent privacy breach pain and protect the privacy, confidentiality, and security of your patients' information.
This is one of the many training sessions available in the e-course 4 Step Response Plan – Prevent Privacy Breach Pain
In the e-course, I mentor you and provide you with tips, tools, templates and training to help you complete your Privacy Breach Management Plan and respond to a privacy breach with confidence.
Find out more and register for the course using the button below!
Click Here To Register for the 4 Step Response Plan online course
AB OIPC, (https://www.oipc.ab.ca/news-and-events/news-releases/2021/pharmacist-fined-for-breaching-health-information.aspx), January 2021.
Edmonton Journal https://edmontonjournal.com/news/local-news/edmonton-pharmacist-fined-after-post-collision-snooping-of-health-info-threatening-other-driver-privacy-commissioner) January 2021
Not sure what is considered a privacy breach? See When is a Privacy Breach a Privacy Breach?
Do you have a privacy breach awareness program in place in your healthcare practice?
Spotting a privacy breach is the first step to stopping a privacy breach.
You Can Use This Privacy Breach Example to Review and Improve Your Practice.
4 Step Response Plan, Alberta, clinic, conviction, health, Health Information Act, healthcare, HIA, incident response, pharmacist, privacy breach
OIPC Annual Report
Posted on December 27, 2020 by Meghan in Blog
Alberta Office of the Information Privacy Commissioner Annual Report
Recently, the Alberta Office of the Information Privacy Commissioner (OIPC) released their Annual Report 2019/2020.
The report is from April 2019 to March 2020. This is the first full year of mandatory privacy breach reporting requirements in Alberta.
Because of the volume of the privacy breaches, the OIPC have now chosen to triage privacy breach reports. They are fast tracking any of those breaches where individuals have not yet been notified about that privacy breach or where there is a potential offense is suspected.
If you've submitted a privacy breach report to the commissioner's office and haven't heard from them yet, it may be because it's gone through this triage process and, if you have completed an internal investigation and notified affected individuals, your breach report has not been flagged as a high priority.
OIPC Investigations
The OIPC conducted investigations regarding offences under the Health Information Act (HIA), usually privacy beaches. In that time period, they forwarded 18 cases to the Special Prosecutions Branch of Alberta Justice for further investigation.
Privacy Breach Trends
There were some interesting privacy breach trends that were reported by the commissioner's office that were reported to them under the PIPA legislation, the Personal Information Protection Act. Of the cases that were reported to them, a hundred of them were all electronic systems compromises. So they have lost some security in the computer network system of some kind, either that was in their direct control or by a third party vendor.
Human error is still a large source of privacy breaches. This can include both misdirected communications, such as miss-sent snail mail, email, or faxes; and unauthorized disclosure, such as when health providers discuss health information with other providers not involved in the patient care.
There were also 20 incidences of theft that they noted in this report and it included rogue employees.
Snooping continues to be an issue, although the report did not provide numbers to go with that.
Ransomware is also a serious issue, one that the commissioner office predicts to continue, particularly in clinics who have a lack of technical security controls on their computer systems.
Social engineering, which is tricking someone into divulging information based on false pretenses and assumptions, is a significant danger in the healthcare industry.
Social Engineering Example
Somebody posed as a pharmacist and wrote emails to pharmacies in order to get information about a particular patient. The email reads like the patient traveled from one location to another location and the fraudulent pharmacist is asking their buddy pharmacists at the other location to provide some information.
This social engineering campaign was considered a significant threat and the college of pharmacists actually released an advisory to pharmacies to warn them of this social engineering attack.
This is a good word of caution for all of us is to not make assumptions just because somebody's email signature line says a pharmacist or other healthcare provider. We still need to make sure that we have verified the identity of that individual and not rely on that email signature alone.
You can download the report from the OIPC website. It provides a variety of other statistics and examples about investigations reports and privacy breach trends that may be of interest to you.
Download the OIPC Annual Report Here
4 Step Response Plan – Prevent Privacy Breach Pain On-line Webinar
5 Low Cost Steps You Can Take Now To Prevent Employee Snooping In Healthcare And Prevent Privacy Breach Pain
Snooping Conviction Earns 3 Years' Probation
Keeping Privacy Active in the Minds of Clinic Staff
3 Parts To Every Privacy Awareness Training Plan
What Healthcare Providers Need to Know About Computer Security and Standards
Health Information Act, medical clinic, OIPC, privacy and security, privacy breach
Posted on October 22, 2020 by Meghan in Blog
Healthcare Employers, Privacy Officers Need To Prevent Employee Snooping
Human curiosity, interpersonal conflicts, shaming or bullying or financial gains are common motivators for snooping. We seem to be hard-wired to want to peek into someone else's personal and private information. Snooping is a violation of trust between our patients and the healthcare providers and the people who work for them.
We want our patients to trust us. We need the patients to share their personal information with us so that we can provide the appropriate health services to them. When healthcare providers and employees snoop in our patient's information we destroy that trust with the patient. When one of our team members is snooping, it harms the effectiveness of our teams and damages morale in the clinic.
When employees are snooping in personal health information, it costs the employer time and money.
What Is Snooping?
Looking at someone's personal information without having an authorized purpose to access that information to do your job is known as 'snooping'.
Even when you are "just looking" at personal information but don't share that information with anyone else, this is still a privacy breach.
It is illegal.
Snooping incidents are on the rise and can cost you time, money, heartache, and headache in your practice.
When there is an offence under the privacy legislation like the Health Information Act, there may be an investigation, charges and court appearances, fines, penalties, and loss of employment.
Snooping is entirely preventable. You can easily use the 5 low cost steps to prevent employee snooping in your healthcare practice.
How Can You Prevent Employee Snooping?
Let's take a look at the pro-active steps that you can take today to prevent employee snooping.
Step 1. Be A Privacy Champion
The first step is to be a privacy champion. Everyone can be a privacy champion in your role in your practice. Make sure that you understand the legal and regulatory obligations about privacy and how it affects your health care practice and your patients is an important step.
In addition, each practice should have a named privacy officer who is responsible for the accountability and management of privacy compliance in your practice. In fact, simply having a named privacy officer increases the likeliness of spotting and responding to a privacy breach more quickly than a practice that does not have a privacy officer.
The privacy officer will also ensure that there are appropriate policies and procedures related to the correct collection, use, and disclosure of health information – and appropriate monitoring and enforcement when snooping is suspected.
Step 2. Train Privacy Awareness
Healthcare practices must provide privacy awareness training to all of their employees at their orientation and not rely on the assumption that the employees have learned about privacy awareness in their previous roles.
When the training includes examples of snooping and clear expectations about the potential consequences and sanctions, you have set the stage to define the culture that snooping is not acceptable. Unfortunately, there are many examples of snooping privacy breach incidents in the news. When you discuss these examples, you can increase privacy awareness and learn from someone else's privacy breach.
Use These Examples as part of your training to inform employees about the consequences of snooping
Snooping Conviction Earns 3 Years' Probation
Recent Privacy Breach Convictions Under Alberta's Health Information Act
Step 3. Reasonable Safeguards
Implementing reasonable safeguards makes it easier for people to do the right thing and avoid the temptation of snooping.
There are three types of safeguards.
Administrative. Written policies, procedures, training, and oaths of confidentiality are examples of administrative safeguards. When there are clear, written, expectations about privacy and confidentiality, including snooping, we are more likely to achieve positive privacy practices.
Technical. This often includes security related to computers. For example, making sure that we have role-based access to systems and personal health information supports the need to know principle. Computer networks and electronic medical record systems that have user management audit logging and enforce unique user ID are other examples about technical safeguards that allows us to prevent and monitor snooping incidents.
Physical. Restricted access to paper records, ensuring that documents are shredded appropriately are examples of physical safeguards that can prevent employee snooping.
Step 4. Monitor to Prevent Snooping
Knowing that their supervisor, co-worker, or privacy officer is observing their interactions with personal information may help to deter employees from snooping.
The supervisor or privacy officer may routinely monitor user audit logs of systems containing personal information to search for unusual activity or pro-active review of users looking up patient information with the same last name or access to VIP records.
Listen to the podcast, How AI Improves EMR Auditing | Episode #094 to learn about an easy way to perform user monitoring and quickly recognize risks from external bad actors and employee snooping incidents!
Step 5. Consequences When Employees Snoop
Well documented and implemented consequences is step 5 to prevent snooping incidents.
Written sanctions and discipline policy are required both as a deterrent to snooping and to facilitate the quick response to a privacy incident.
When proactive measures fail, consequences may be appropriate. The consequences need to be reasonable, consistent across all providers and employees, and fair to the circumstances.
Snooping is a privacy breach, and it will require investigation and reporting. Your written privacy breach policies, procedures and forms will help you to respond quickly to a snooping incident.
Sanctions might also be applied outside of the organization. When a privacy breach is reported to the OIPC or a privacy complaint is made to the OIPC, charges may be laid under the HIA.
Listen to the podcast, 5 Steps to Prevent Employee Snooping | Episode #097 to learn more about snooping and how to prevent it in your healthcare practice!
When we know better, we do better
Download the Practice Management Success Tip, '5 Steps To Prevent Employee Snooping'.
Share and discuss examples of snooping and your related policies and procedures to support privacy awareness in your practice.
The Practice Management Success Tip, 5 Steps to Prevent Employee Snooping, will help you
Take 5 practical steps to prevent employee snooping.
Provide clarity about what is considered a privacy breach.
Contribute to the health information privacy compliance in your healthcare practice.
Show Me The 5 Steps to Prevent Employee Snooping
employee snooping, employee training, prevent employee snooping, privacy, privacy breach, privacy officer role and responsibility, reasonable safeguards
Privacy Awareness in Healthcare Training: Dental Practices
Posted on June 15, 2020 by Meghan in Blog, Services
NEW! Privacy Awareness in Healthcare Training – Dental Practices
Privacy Awareness Training for Dental Practices
Is your dental clinic in compliance with the Alberta Dental Association & College, Health Information Act (HIA) and Personal Information Protection Act (PIPA)?
Dentists and dental practices in Alberta are required to have an ongoing privacy program to ensure the protection of private records and patient information. The appropriate collection, use, and disclosure of personal information is critical to maintaining privacy for patients that choose to trust in your practice. Accomplishing this important goal demands an up-to-date training strategy.
Regular privacy awareness training protects patients, employees and your business. The key components of your training strategy must revolve around ensuring HIA compliance to mitigate risk of a privacy breach. Everyone in your clinic – dentists, dental assistants, dental hygienists, office staff, contractors and even practicum students and volunteers must understand how to correctly handle personal information, so it remains confidential and secure. Maintaining high standards that safeguard information privacy and security is an essential aspect of asset management for any health care provider.
Corridor Interactive's training includes a personalized printable certificate of achievement to support compliance and may be used for your continuing education credits, too! Our training delivers industry best practices and is ideal for all levels of staff in any dental organization or clinic that collects, uses or discloses personally identifying information. This includes direct care providers in your practice as well as privacy officers, support staff and any other employees who are not directly involved in patient care.
Corridor's Privacy Awareness Training for Dental Practices educates dentists, dental assistants, dental hygienists, and all office staff on:
Understanding Privacy
Privacy Principles
Collection, Use & Disclosure
Privacy Breaches
What is "Health Information"
Handling Personal Sensitive Health Information
If You Are A
dentist,
dental assistant,
dental hygienist,
or work in a dental practice
You Need Privacy Awareness in Healthcare Training – Dental Practices
Understand patient and client privacy rights.
Respect personal health information and your obligations.
Confidently and correctly handle personal health information.
Use reasonable safeguards to protect personal health information (PHI).
Recognize and respond to a privacy breach
Support key policies, procedures and risk management programs in your healthcare practice.
Interactive Online Learning Experience provided by Corridor Interactive
Corridor Interactive's Buy Now Training Programs give you access to the most current information available, at your convenience. Complete your course all at once, or in multiple sessions from any location – it's up to you. All you need is an internet connection and an email address to get started…it's that easy!
Fits into your schedule – you can start, pause at anytime, and return to the course exactly where you left off.
Easy to use – navigation buttons makes it easy to continue to the next topic or pick and choose the order that you want to see the content.
Get started immediately – the entire course is ready for you!
Work at your own pace – you have access to the course for three (3) months. Most students complete the course in under 2 hours.
You can listen to the narration for each module.
Practical examples, too, to make it easier for you to apply what you have learned in the course to your job.
Links to extra resource material and websites related to your topic of study, to peruse at your convenience.
A printable Certificate of Completion, available as soon as you successfully complete your course.
An audit trail and record of your course activity and training history.
Self-directed learning features including the ability to pause your course at any time and resume later, right from where you left off.
Unlimited access to your course and resources for the duration of your subscription term.
Technical support with a one-business day turnaround for end-user support help and questions.
Automatic emails when you complete your course, or reminders if you have not completed.
Developed by Corridor's team of seasoned software specialists and instructional designers, this unique online learning application is the optimum vehicle for delivering learning content.
$30 per subscription
Give your staff the knowledge and tools they need to apply policy in their day-to-day work AND prevent a privacy breach with privacy awareness training.
Privacy Awareness in Healthcare Training – Dental Practices
Protect your organization and your patients. Equip your staff with the information they need to confidently and correctly handle personal health information. Learn basic healthcare privacy principles and how to handle personal health information, use safeguards, and recognize and report a privacy breach.
Sounds great! Sign me up!
This self-paced on-line education includes:
6 Quizzes
"When we know better, we can we do better."
As an employer and health care provider, you are responsible to provide training to all of your employees about privacy awareness. Protect your organization and your patients. Equip your staff with the information they need to confidently and correctly handle personal health information.
I am constructively obsessive about privacy and confidentiality in the healthcare sector–and I think you should be, too! I designed this course to assist healthcare providers, clinic managers, practice managers, privacy officers and independent healthcare practice owners provide practical privacy awareness training that was easy to implement, consistent content, cost-effective and meaningful to your day-to-day business.
When each member of your independent healthcare practice completes this privacy awareness course, you will have clearer expectations and confidence that your team will maintain the privacy, confidentiality and security of your patient's health information. Give your patients the gift of privacy. Improve your healthcare practice with privacy awareness education.
Jean L. Eaton, Your Practical Privacy Coach Information Managers Ltd.
How can I access the course?
The course, Privacy Awareness in Healthcare Training – Dental Practices is available on-line from any internet enabled device. You can use your desktop computer, smart phone or tablet to view the slides and even hear the narration.
How long is the course?
Most students complete the course in under 3 hours. You can start and stop the course at any time. Let's say you decide to take 20 minutes each day to work on the course. You can login and start the course right away. When you come back to the course the next day, you can start right from where you left off. You will have all the modules and the post-test done within 6 days. Don't worry about missing a few days – you have access to the course for a full 3-months!
This is my first job in a dental practice. Do I know enough to start the course?
You bet! The course is easy to read and I explain all the terms that you need to know. There are a lot of practical examples, too, to make it easier for you to apply what you have learned to your job.
I've worked in healthcare for a long time. Do I still need to take this course?
You bet! Seasoned professionals like yourself have an extra obligation to share your knowledge with new workers. This course will help you to refresh key principles and suggest wording, examples, and key messages that you can use to train new employees to their specific tasks in the workplace. The course will help you to advocate for the privacy rights of your patients. Unfortunately, we have many examples where trained professionals who "should have known better" make errors in judgement causing privacy breaches that affect our patients, our business, and the reputation of healthcare. Healthcare practitioners and owners have a responsibility to ensure that everyone in the practice receive comprehensive privacy awareness training regularly.
Will I get a certificate of completion that I can give my employer?
Yes – at the end of the course, you will have the opportunity to complete a short on-line quiz to confirm that you understand the key concepts. Then you will have access to a Certificate of Completion that you can download and share with whomever you choose.
Can I get continuing education credits with my professional association?
Maybe! If you are a member of a professional association and you would like to seek credits from for taking this course, please let us know so we can take steps to request pre-approval. Often, professional association and colleges will grant continuing education (CE) credits based on your certificate of completion.
How much is the course?
The course is $30 per individual 3 month subscription. Click here to buy it right away.
I think everyone in my healthcare practice should take this course! Can I buy in a group package?
Yes – Privacy Awareness in Healthcare Training – Dental Practices is available in group packages, or it can be customized to incorporate your organization's privacy policy and practices. Employers can monitor the employee's training progress and receive a report of employee's satisfactory completion of on-line quizzes. Track annual privacy awareness training through our online platform to demonstrate your compliance with legislation. Contact Corridor Interactive for more information.
I agree that privacy awareness training is important - but I don't work in healthcare. Do you have a corporate privacy awareness program?
While these programs have been developed with health care providers in mind, the privacy principles and fundamentals of protecting personal information are appropriate for any organization that collects, uses, and discloses personally identifying information. Contact us for information about our Corporate Privacy Awareness Program!
Interested in Group Training?
Employers can also purchase training for groups of employees; employees can access the internet based training at a time and location convenient to them. Employers can monitor the employee's training progress and receive a report of employee's satisfactory completion of on-line quizzes. Track annual privacy awareness training through our online platform to demonstrate your compliance with legislation.
Email Corridor Interactive to Order Group Training
Corridor Interactive, dentists, health care, Health Information Act Training, healthcare, healthcare provider, primary healthcare, privacy, privacy awareness, privacy breach, training
PIPEDA Mandatory Privacy Breach Notification
Posted on January 19, 2020 by Jean Eaton in Blog
Organizations subject to PIPEDA are required to report to the OPC any breaches of security safeguards involving personal information that pose a risk of significant harm to the individuals.
PIPEDA is a Canadian federal law that sets out the rules for the collection, use and disclosure of personal information in the course of those commercial activities. PIPEDA outlines the 10 Fair Information Privacy Principles that businesses must follow regardless of their size. Organizations need to know privacy rules and make sure that you have the appropriate safeguards implemented in your business.
Does PIPEDA Apply To You?
PIPEDA applies to most businesses across Canada, excepting Quebec, British Columbia, and Alberta. These provinces have their own private sector laws that are substantially similar to PIPEDA.
But even in those provinces, PIPEDA covers federally regulated industries like transportation, telecommunications and banking. In addition, all businesses that operate in Canada and handles personal information that crosses provincial or national borders are subject to PIPEDA, regardless of which province or territory that they're based in. All businesses in the three territories also fall under PIPEDA.
In Alberta, we have privacy legislation called the Health Information Act (HIA) that takes precedence over PIPEDA and Alberta's Personal Information Protection Act, (PIPA). If a business, like a physician's office, has a privacy breach which includes health information, then the custodian of the physician office must report the privacy breach following the HIA regulations. If employee information or other non-health information is included in the breach then that triggers privacy breach notification under PIPA. Sometimes, a breach can include both types of information and the physician office must notify under each legislation.
In BC, the Personal Information Protection Act (PIPA) is BC's private sector privacy law that has also been deemed substantially similar to the federal private sector privacy law. BC does not have health information specific privacy legislation, so PIPA applies to private organizations in BC, including physician practices, and governs how the personal information about patients, employees and volunteers may be collected, used and disclosed.
If you are a business in Canada, for example, an electronic medical records (EMR) business and you have a data center in Canada where all of your clients across Canada provide their information and store it in your data center, the EMR vendor likely falls under the PIPEDA regulations.
The vendor may be responsive to other legislation as well. If you are an EMR vendor, you do not directly comply with the HIA in Alberta because that applies only to custodians. However, as an information manager of a custodian under the HIA, you have some obligations under the HIA in the event of a privacy breach. But that does not mean that you don't also have obligations under PIPEDA.
What Is Included In Personal Information?
Personal information is more than just a name or an address. It's data about an identifiable individual that can, by itself or combined with other information, identify a person. It could be a person's age, ethnicity, medical information, credit card number or even an income level. It might also include their Internet Protocol (IP) address or their website or email information.
Regular surveys done by the Office of the Privacy Commissioner of Canada says that small businesses tend to be less aware of their privacy responsibilities than larger organizations. In 2017, 65% of large organizations with more than 100 employees indicated that they were privacy aware. But only 43% of small businesses indicated that they were privacy aware. Smaller companies may not have dedicated compliance officers or privacy officers, and they may not have a sense of privacy knowledge.
The compliance challenge for smaller organizations is made more difficult by the limited human and sometimes the financial resources available to them and the gap on the knowledge about the privacy obligations.
Lack of awareness can potentially lead to complaints about your business, which has an impact on your business's reputation.
A privacy breach occurs when there is an unauthorized access to or the collection, use, disclosure, our disposal of personal information. There are many things that could qualify as a privacy breach. If you have a financial transaction that includes clients' information and now is publicly available on your website, that's a privacy breach. If you have somebody in your organization who has access to personally identifying information as part of their job, but they use it for some purpose other than their job, that's snooping, and that is a privacy breach.
There are many examples about what is a privacy breach, but any time that you view, use, or disclose without aauthorization is considered a privacy breach.
Privacy breaches also have a negative impact to our business because it takes time and resources to manage a privacy breach, and it has a huge impact to the reputation of an organization.
Privacy Breach Notification
The November 2018 PIPEDA mandatory privacy breach notification regulations requires you to know where all of your personally identifiable information sources are and know the safeguards implemented to protect the data.
Then, you need to monitor the data to identify any breaches. If there is a breach of those security safeguards, you need to record all breaches. So even if there is a breach of a safeguard that nobody has exploited, you still need to record that you have identified that there is a potential risk and what you've done to be able to manage that risk and prevent that from happening again.
Next, you need to determine the risk of significant harm, or ROSH. (more about this later.)
The risk of harm test that identifies what information had been included in the breach and the type of harm that could happen to that individual as a result of the breach. When it reaches that ROSH threshold, then you need to notify the Office of the Privacy Commissioner of Canada office. Or, if you are in BC, Alberta or Quebec, you need to report that to the provincial privacy commissioner.
You also need to notify other people about that privacy breach.
You probably need to notify your clients. If you are an EMR vendor or another vendor that's providing a service to healthcare providers, you need to notify them about the breach.
As an example, if you are an EMR vendor that has been breached–perhaps a security compromise or hack into your data centre–you have a responsibility to notify the healthcare providers who collected the personal information. The EMR vendor must also report the privacy breach to the Office of the Privacy Commissioner.
You might also have an obligation to notify the individuals that have been affected by that breach. In your information manager agreement in Alberta, you should have clear written expectations about whether or not a vendor should notify the patients directly about a privacy breach or if the custodian or the health care provider is going to assume that responsibility. This is an important detail that you need to identify in your information manager agreement.
Also see the Practice Management Success Tip Top 3 Agreements Your Healthcare Practice Must Have (And Why) from Information Managers at https://InformationManagers.ca/top-3 for more on information management agreements (IMA.)
The risk of significant harm (ROSH) is a framework for assessing the risk to the individual as a result of the breach of individually identifying information. Adopt and use a framework for your organization to assist you to quickly and consistently assess a breach for ROSH.
If there is personally identifying information included in the breach, we can assume that the information is sensitive information to the individual. Generally, I recommend a default that if individually identifiable information is included in the breach, then assess that there is a significant risk of harm to the individual.
The circumstances of a breach may make the information more or less likely to be used maliciously. For example, additional questions that you may want to consider include how did the breach occur? How likely is it that someone would be harmed by the breach? Who actually accessed or could have accessed that personal information? How long has that personal information been exposed? Is there evidence of malicious intent, like hacking? Or was it a theft? Or did somebody intentionally tried to use that information and use it in a very covert way? Were a number of pieces of personal information breached therefore, increasing the risk of misuse? Is the breached information in the hands of an individual that represents a reputation to the risk of that individual or themselves? Or, was the information exposed to a limited, known number of entities who have committed to destroy and not disclosed the data.
Privacy Is Good For Business
As always, good privacy is good for business. Poor privacy protection can damage your company's reputation and cut into your profit margin. When your practice proactive privacy, you enjoy the confidence and trust of your customers. Canadians tell us that the more they trust a company, the more likely they are to do business with it. Getting privacy right is your opportunity to demonstrate that you deserve their trust and their business.
Remember that one of the fair information principles is accountability. At the end of the day, you are responsible for protecting the personal information that you have collected.
Reference: Privacy and your business: An introduction to the Personal Information Protection and Electronic Documents Act. Office of the Privacy Commissioner of Canada. https://www.priv.gc.ca/en/privacy-topics/privacy-laws-in-canada/the-personal-information-protection-and-electronic-documents-act-pipeda/pipeda-compliance-help/pipeda-compliance-and-training-tools/pp_bus/
Privacy Management Program
Build privacy protections into everything you do is a business. Having clear policies and procedures for the collection, use and disclosure of personal information is of vital importance for your business.
The 4 Step Response Plan will help you with prevent privacy breach pain and give you the tips, templates, training, and tools that you can use right away to prepare your privacy breach response plan:
In the world of privacy breaches 'If' has become 'When'. Will you be ready?
The best way to do this is by developing a privacy management program that covers all aspects of how you handle personal information. The 4 Step Response Plan will help your organization be prepared to prevent privacy breach pain.
Click here for more information on the on-line 4 Step Response Plan course available now!
Learn How To Manage A Privacy Breach With Confidence
#PracticeManagementNugget, Canada, healthcare, mandatory notification, mandatory privacy breach notification, personal information protection electronic documents act, PIPEDA, podcast, privacy breach
Confident Women Leaders – 10 Key Steps To Prevent A Privacy Breach
Recently, I was a guest on Confident Women Leaders Community Facebook Live hosted by Kathy Archer, Leadership Development Coach with Silver River Coaching.
It was a lot of fun to talk with Kathy about how small business, not-for-profit organizations, and clubs can quickly and easily build in privacy with their employees and volunteers as part of good business practices.
Practical Privacy Tips
We talked about the 3 simple practical tips every organization can use to prevent a privacy breach. This works for every type of organization.
Tip #1: Create an inventory of the personal information that your organization collects and is now responsible to keep confidential and secure.
Know what you collect, and review the reason why you collect the information. Make sure that you collect the least amount of information on a need to know basis at the highest level of anonymity. Use the inventory like a library account – keep track of who has access to the information, and when it is returned.
Tip #2: Create a checklist for the orientation of each new employee and volunteer that clearly tells them of your organizations expectations about how they will keep volunteer, employee, client, and donor personal information private, confidential, and secure.
Name a privacy officer in your organization and make sure everyone knows who this is. Make sure to train and support your privacy officer so that they can do a good job for you.
You can use the 10 Key Steps To Prevent A Privacy Breach Checklist as part of your orientation package.
Tip #3: Make it easy for volunteers and employees to keep information confidential and secure.
It's not always about technology.
You can manage personal information on paper. Or, you could use private shared computer networks for your authorized users, like board directors and managers, to access all of their organization business records.
Here's an example of a breach in a social service agency who did not properly secure board minutes containing confidential information on a computer server and faced a $25 million lawsuit.
Join Kathy's Private Community of Women Leaders to watch the Facebook Live replay (available for a limited time!) You can take these easy to implement steps to protect your clubs, healthcare practices, and small businesses from errors, omissions or attacks that could result in complaints, fines and even jail time!
I've put together a checklist for you about the 10 Key Steps To Prevent A Privacy Breach.
Download the checklist and make sure that you implement these best practices in your business.
Confident Women Leaders Community
Confident Women Leaders Community with Kathy Archer is ongoing training for women leaders in Canada's non-profit organizations.
Leaders often hit a point where they find themselves in over their heads and wondering if they have what it takes to lead. Maybe that is where you are at now! Know you are not alone!
As a Leadership Development Coach and Leader of the Confident Women Leader's Community Kathy Archer is here to provide you with guidance, support, information and a big hug when you need it!
But it's not just me. We are all in this together!
CONNECT WITH Kathy Archer
https://www.silverrivercoaching.com/
confident, Kathy Archer, leaders, privacy breach, Silver River Coaching, women
"This was my first Webinar and I'm signed up for a few more in the coming weeks. Like Karol, we also have a weight management program at our clinic; fortunately our clientele is quite large as it is through physician referral from surrounding areas, but I think her talk about social media and automation could really help our clients. I look foreword to more seminars online and your newsletter soon."
--Practice Management Nugget event, 'Engage your patients using automated tools' with Karol Clark
- Alissa from Whitecourt


At Castor Sprattlin Law Group, LLC, our approach to legal services is simple: we provide legal services to our clients with their needs in mind!
Our clients vary from start-ups, medium and large sized companies to professionals, couples and families. With skilled and experienced legal counsel and a capable team, we are able to meet the most complex legal needs of our clients, while still providing the personal attention that larger firms often cannot provide. We offer cost-effective, solution-oriented representation, advice and planning geared to the specific needs of our clients. We take great pride in our demonstrated record of success and our reputation for skill, honesty and integrity.
Above all, we value our client relationships. Clients and friends routinely refer business to our firm because diligent representation, coupled with timely and effective communication, is the heart and soul of our practice.
We help our business clients in Georgia and New York with employment law compliance, cost effective workplace strategies, and effective protection of their bottom line. Our main objective is to keep our business clients out of court and out of sight of government agencies.
We also help educational institutions in Georgia navigate the difficult world of Title IX complaints (sexual assault and misconduct) . We use proven investigative techniques to conduct prompt, thorough and impartial investigations that meet Title IX requirements.
We also assist start-ups and individual entrepreneurs with business formation and related matters including preparation of business plans, operating agreements, shareholder agreements and succession plans.
We rely on our more than 15 years of diverse experience to provide guidance on employment law and estate planning issues to our clients. Our diverse experience includes judicial internship, litigation practice at large firms, and business counseling.
As judicial interns, we had the opportunity to observe first-hand how judges handled employment law and other litigation matters. During our tenure at large law firms, we advised and represented Fortune 500 companies in litigation throughout the country and gained significant experience advising and representing them. We have also served as go-to employment counsel for small to medium sized companies providing guidance on various issues related to employee relations and business operations. Our experience as litigators and business counselors has enabled us to approach client matters creatively and cost-effectively.
We regularly provide information, conduct seminars and workshops on current employment law and estate planning issues.
We Put Our Clients First and Are Committed To Legal Excellence!
One of the things that makes Nancy Castor Sprattlin such a great lawyer is that she's willing to think outside of the box. Instead of examining a matter and immediately going to what has been done in the past, she takes the time to look at the client's needs and tailor an innovative solution.


text:
Alternative Fact of the Week: Comey, Russia, Gowdy
Former FBI Director James Comey speaks about his book "A Higher Loyalty" during a discussion at the Brookings Institution May 11, 2018 in Washington, D.C. (BRENDAN SMIALOWSKI / AFP/Getty Images )
"Who are you going to believe — me or your lying eyes?" Versions of that chestnut can be traced as far back as the Marx Brothers. It used to be funny, a false conundrum. Decades ago, Richard Pryor famously used it in his stand-up routine about getting caught by his wife in bed with another woman. But in the Trump era, it's more like the recognition of a legitimate dilemma. Take, for example, President Donald Trump's Thursday morning tweet denying that he fired FBI Director James Comey over the Russia investigation.
Not that it matters but I never fired James Comey because of Russia! The Corrupt Mainstream Media loves to keep pushing that narrative, but they know it is not true!
"Not that it matters but I never fired James Comey because of Russia! The Corrupt Mainstream Media loves to keep pushing that narrative, but they know it is not true!" the president tweeted shortly after 8 a.m.
There's only one problem with that assertion. He's linked the Comey firing to the investigation of Russian meddling in the 2016 multiple times. Here's an obvious example: During his interview with NBC News' Lester Holt in May of last year, President Trump was asked about the firing and Deputy Attorney General Rod Rosenstein's memo recommending it because of his actions in the Hillary Clinton investigation. President Trump's on-the-record, on-camera response? It wasn't to bemoan how Secretary Clinton was treated over private emails. He went straight to the Russia investigation.
President Donald Trump arrives at the White House campus in Washington, D.C. on May 30, 2018. (Evan Vucci / AP)
"I was going to fire Comey knowing, there was no good time to do it. And in fact when I decided to just do it, I said to myself, I said you know, this Russia thing with Trump and Russia is a made up story, it's an excuse by the Democrats for having lost an election that they should have won."
Sound familiar? It should. Mr. Trump has been describing the Russia investigation as a "witch hunt" for a long time. Even Rudy Giuliani, one of the president's attorneys, has said the firing was related to Russia, specifically telling Fox News' Sean Hannity: "He fired Comey because Comey would not, among other things, say that he wasn't a target of the investigation." Never mind that Mr. Trump denied a Comey-firing-Russia link in an April tweet. Who can keep these contradictory claims straight?
And, indeed, that seems to be the point. President Trump and his closest allies must have decided that the best way to deal with adverse facts is to offer alternative "facts" without bothering to be consistent. Confusion is their ally. Yet even in this haze of prevarication and gaslighting, truth seems to have a sneaky way of showing up unexpectedly. And this week, the best examples came from two truly unexpected sources: House Oversight Committee Chairman Trey Gowdy and Mr. Trump himself.
It was Mr. Gowdy, a former prosecutor (and, let's face it, until this moment mostly known as his party's leading Benghazi conspiracy theorist), who debunked the president's claim that the FBI had a "spy" in the Trump campaign. After meeting with top Justice Department officials who briefed him and a select few others on the work of special counsel Robert S. Mueller III, here's what he told Fox News Tuesday: He said there was no spy and that the FBI had acted honorably. "I am even more convinced that the FBI did exactly what my fellow citizens would want them to do." He later expanded on those thoughts, telling CBS that President Trump could have picked someone other than Jeff Sessions to be his attorney general (had he realized Mr. Sessions would recuse himself from the Russia matter). To which the president soon after responded on Twitter: "And I wish I did!"
That's a truthful two-fer. Representative Gowdy's approaching retirement seems to have freed him to speak honestly about the Russia investigation while President Trump's anger at Attorney General Sessions for recusing himself from the Russia investigation seems too apparent to bother covering up. The way things are headed, such moments of candor deserve to be celebrated. Their like may not be seen — or heard from — again soon.

redpajama_set_name: RedPajamaCommonCrawl


text:
Our commitment to sustainability, environmental, wildlife, marine and biosphere protection.
TRAVEL EMISSIONS
Like other business travellers, we primarily use ground-based forms of transport such as cars, Jeeps, Land Rovers, motorcycles, trucks, quads and other vehicles driving on roads, tracks, backroads, trails, and very rarely fly anywhere, if we can drive there on an expedition.
For promoting the company, our clients and partners, business travel produces our most significant environmental impact. We use combustion-driven vehicles in our work, on tours and expeditions, which consume petrol, diesel, oil, other fluids and produce carbon emissions. We use the most recent versions of the vehicles, in order to maximise the advantages of new technologies and cleaner systems, in order to reduce our carbon footprint. Where possible, we have carbon emission filters installed on our vehicles.
Our Environmental Strategy focuses on tackling the underlying causes that are driving nature's decline - notably the food system and climate change. We have therefore set an ambitious target of keeping carbon emissions from business operations and travel as low as possible, using e-vehicles, renewable energy-driven transport services and other forms of low-impact municipal travel. We promote sustainable commuting by using bicycles, feet (walking), using rail season tickets and car sharing services. We occasionally have to use car ferries on some of our journeys, but given the nature of our preferred travel style, we don't use cruise ships - ever.
TRAVEL FUEL CONSUMPTION
As part of the tech, mobility and travel industries, we have implemented a Sustainable Travel Policy to help us minimise our own impact. This policy questions the necessity to travel each time, and ensures that we only use the most sustainable means available. We use public transport for local travel wherever available and practical, and prohibit certain short-range flights, expecting our staff to use alternative transport whenever possible. We travel in economy class, and our teams have to prioritise their travel and only make the most important journeys, saving time, resources, pollution and emissions.
Around 10% of our business travel emissions are from air travel, making this another priority for us to manage. As an international organisation, reducing our flight emissions to zero is not a realistic option. So instead, we've worked hard to reduce and manage them so that we only take essential flights, using Skype and other online meeting technologies to minimise the necessity for face-to-face meetings. We group the necessary meetings together, using the same flights to attend many different meetings, in one business trip.
ENERGY USAGE AND CONSUMPTION
We're also committed to running our facilities and buildings as efficiently as possible, ensuring we minimise energy use for our operations. We monitor our energy consumption and assess factors like weather and staff occupancy to check our usage is normal. For our offices in the various locations, we purchase electricity from renewable energy suppliers and share knowledge and information with other companies about how to streamline and reduce waste, save expenses and maintain a more environmentally friendly and efficient operation.
Instead of sourcing heat externally and using air conditioning, we use a more energy efficient ground source heat pump for heating and cooling. We also use natural ventilation during warmer months by opening windows and doors. We have features in our offices to help reduce energy use such as on-demand hot water boilers, LED lighting and motion-sensitive lighting. Our environmental purchasing guidelines include information on electrical equipment, so we can ensure we choose efficient devices.
Since we moved in in, we've been calibrating and adjusting the new technology to optimise the building climate, using both mechanical cooling and natural ventilation, ensuring that we maintain the best standards for naturally ventilated and air conditioned buildings and a healthy working environment for our training staff and course participants.
WATER CONSUMPTION AND REDUCTION
Water is an important natural resource so we try to use as little as possible in our offices, facilities and operations. Recycled rainwater is used to water the plants, and where possible, recycled rainwater and greywater (from sinks and showers) is used to flush the toilets. This system reduces the municipal water we use by over 50%. A leak-detection monitoring system means we find out about leaks quickly, limiting any water loss.
Installations and features like dual flush toilets, automatic taps in bathrooms, and shower heads and kitchen taps fitted with flow restrictors also help reduce water usage.
WASTE MATERIAL MANAGEMENT
REDUCE, REUSE, RECYCLE. We have a responsibility to manage our waste in the most sustainable way possible, in our mission to reduce pollution and wasteful consumption. We encourage visitors and staff to reduce consumption of materials as a first priority, we then aim to reuse materials wherever possible, and when things have reached the end of their useful life-cycle and must be disposed of, we recycle everything.
We control the way waste is managed, with clearly labelled waste and recycling bins at our facilities and centres. Separated food waste, biodegradables, plastics, glass, metals, electronics and other materials in individual containers to be sent for recycling. Waste disposal arrangements at our facilities are managed by the municipal waste management companies. Our general waste is used to produce energy from incineration, and our food waste is used to produce fertiliser for crops and energy for homes, schools and businesses.
PRINTED MATERIALS FOR EVENTS
We are a non-paper organisation, working almost entirely digitally. We promote a 'digital first' way of working, encouraging staff to work digitally rather than printing internally or externally. All our bookkeeping and accounts are handled digitally, invoices and receipts are scanned and registered online, and processed digitally. Thinking carefully about what we purchase and the suppliers we use, is another way we can reduce our environmental impact.
Most of the paper we print on is for fundraising purposes and despite using digital fundraising for the most part, the printing of promotional materials remains a necessary impact of our activities. To reduce our impact on forests, we only use FSC certified or 100% recycled paper and timber, and we only print when it is absolutely necessary, and avoid it if possible. When we do have to print documents, we use monochrome printers with ISO 14001 certification, which ensures that the manufacturers are also working to manage and reduce their own impacts.
PURCHASING PRODUCTS FOR COURSES, EXPEDITIONS AND EVENTS
Our environmental purchasing guidelines ensure that our staff purchase items produced in an environmentally and socially responsible way. The guidelines focus on maximising the use of natural, sustainable materials, considering the whole life cycle of the product - not just how and where it was made, but how it is transported, distributed, and will be recycled at the end of its use.
Events are an important way for us to engage with people and spread our message. We carefully consider venue, location, logistics, the materials we'll use - how will people travel there, and the environmental impacts, features and facilities at the venue.
Our food and beverage policy reflects our work on diet and nutrition, providing vitamin and nutrient-rich, tasty, practical, sustainable food and beverages. We focus on healthy, sustainable produce and support certified locally-sourced products that benefit the environment.
PLASTICS, REDUCTION, ELIMINATION
The impact of plastics, particularly on our oceans, is a fast-growing global epidemic. We have ended all use of single-use plastics in our operations, expeditions, products and training courses. Wherever possible, we don't use plastic water bottles. We have implemented a non-single-use plastic policy which emphasises eradication as the best alternative and then focuses on using reusable, renewable, or recyclable alternatives.
OUR SUPPORT FOR OTHER ORGANISATIONS
SILKROAD 4.0 supports a number of environmental and wildlife conservation organisations, most of which are on the front line between the impact of humanity on our natural world, and the consequences and results of our blatant natural resourse consumption and ongoing exploitation of biospheres, habitats, animals and wildlife, in the name of profit.
Environmental Policy	Sustainability	Motorcycles	Mobility	Renewable Energy	Sustainable	Policy	Recycling	Upcycling	Carbon Footprint	Fuel Consumption	Petrol	Diesel	E-vehicles	Transportation	Transport	Business Travel	Emissions	Energy Use	Renewewable	Facility Management	Travel Emissions	Sustainable Travel Policy	Trucks	Cars	Automobiles	Energy Efficiency	Environmental Strategy	Carbon Emissions	Biodegradable	Waste Disposal	Recycle	Carbon Offsetting	Forests	Carbon Neutral	Planting Forests	CO2
MAIN ARTICLE SLIDER
Be Open For Better Business
Nomadic Tech Incubator™
The Glue That Binds It Together
Smart Technology Travels
Carbon Neutral? Plant Forests
KTM - Ready To Race
Open Caravan Initiative™
Innovators, Incubators, Investors
Everything starts with People
Peace Through Innovation
Overland Expeditions & Vanlife
Chasing F.I.R.E. & Geoarbitrage
PARTNER LOGO SLIDER - MAIN


Ninety industry professionals joined the ThinCats team last week to unveil the next developments in the SME finance revolution. The backdrop was the underground bunker where, on becoming Prime Minister in May 1940, Winston Churchill said, 'This is a room from which I will direct the war'. The Cabinet War Rooms sheltered the heart of the British military and government command throughout the Second World War, and now provide a fascinating insight into the strategies and planning behind the war effort.
In the Harmsworth Room, housing the original 1940's electric generator wall featuring fascinating LEDs, switches and dials, we introduced the London team, and explained how and why ThinCats does the deals that the high street banks simply can't do, and how we can help SMEs from across the capital achieve their growth ambitions.
Damon Walford, CDO, said: "It was apt that we chose the Churchill War Rooms for our London event. Our team in the capital have shown time and time again that they are prepared to stand up for what they believe in when it comes to funding growing SMEs.
"At ThinCats we like to think we are spearheading an Alternative Finance Movement that is revolutionising the way SMEs access funding by swimming against the tired tide of the traditional lenders; as Churchill said: 'Kites rise highest against the wind - not with it'.


Here's My Latest Video Tip To Help You Learn How To Dance Like Nobody Is Watching!
Check out this week's Video Tip! Click here to watch!
New Year Reflection: What Was Great In Your Life, What Wasn't And How To Create More Of The Good Stuff!


text:
Controversy overshadows Osaka's Open triumph: Worldwide opinion split over penalties against Serena Williams
Joshua Lloyd, Editor-in-Chief
Serena Williams lost in straight sets to Naomi Osaka on Saturday. Williams was penalized one game and one point for code violations during the match.
The 2018 US Open was one for the time capsules, but it will be remembered for one controversial match that may have signaled a turning point in 21st-century tennis.
Sure, there were five-set wars of attrition in the men's quarterfinals, a heartbreaking forfeit by Nadal in the semis, incredible upsets in the women's bracket and a ridiculous shot by Federer that left Nick Kyrgios in shock.
In the men's final, Novak Djokovic bested Juan Martín del Potro in straight sets to claim his third US Open championship. Djoker shot up three spots in the world rankings and now sits at number three behind Nadal and Federer.
Ashleigh Barty and CoCo Vandeweghe upset the second-seeded team of Tímea Babos and Kristina Mladenovic to claim the Women's Doubles title. Mike Bryan and Jack Sock cruised past Łukasz Kubot and Marcelo Melo in the Men's Doubles final, a career first for Sock and the sixth win for Bryan.
But those weren't the stories everyone was talking about after the finals at Arthur Ashe last weekend. The bewildering Women's Singles championship match was what grabbed the most headlines.
It was a true underdog story as Naomi Osaka stepped onto the court against Serena Williams, who was riding a wave of momentum from her success-story comeback. Williams suffered from serious childbirth complications in Sept. 2017, making a return to tour uncertain for the new mother and former world number-one.
Serena turned her pregnancy struggles into inspiration, drawing public and media attention to the lack of lifesaving drugs and medical equipment for mothers worldwide.
Osaka, however, had no such publicity. She took down Maria Sharapova, Karolína Plíšková and Simona Halep en route to winning the 2018 Indian Wells Masters in March before entering the US Open seeded twentieth. She made her way to the semis rather easily and defeated fourteenth-seed Madison Keys to punch her ticket to the finals.
Williams and Osaka had dueled only once before facing off at Arthur Ashe Stadium. Osaka won in straight sets in the first round of the 2018 Miami Open.
There was history waiting to be made on both sides of the finals court. Osaka was attempting to become the first Japanese player in history to claim a Grand Slam title. Serena was shooting for Margaret Court's record of 24 career Grand Slams, a total that Serena trails by one.
Osaka seized a surprising early lead, winning the opening set 6-2. Williams was up 1-0 in the second when chair umpire Carlos Ramos called a violation against her for alleged coaching. Replays show her coach, Patrick Mouratoglou, making gestures with his hands. He later admitted to signaling some coaching from the player's box but believed Williams was unaware of his coaching attempts.
Williams discussed the matter twice with Ramos over the following two games, telling him "I don't cheat to win. I'd rather lose. I'm just letting you know."
An unforced backhand error by Williams a few games later prompted her to slam her racquet on the court, for which Ramos handed her a second code violation. Per code violation rules, the next game started with Osaka at a 15-0 advantage.
Williams took issue with the penalty and brought up the first code violation, telling Ramos that he owed her an apology and saying that he would never do another one of her matches. "I have a daughter and I stand by what is right for her," Williams insisted, referring to her one-year-old child, Alexis Olympia.
Osaka held serve to level the set 3-3 and broke Serena's next serve to overtake Williams' lead. Williams continued to shout Ramos down, calling him a "liar" and a "thief" for "stealing" a point after the racquet abuse violation.
In turn, Ramos delivered a third code violation, this time for verbal abuse, which gave Osaka the next game automatically and put her up 5-3. Williams spoke heatedly to WTA supervisor Donna Kelso and tournament director Brian Earley, claiming that the umpire was handing her unfair penalties because she was a woman and that male players had gotten away with worse behavior in the past.
Williams held her next serve to take the set to 5-4, but it was Osaka who fired the match-ending serve to win 6-2, 6-4 and close out the chaotic affair.
Divided reactions have poured in from media outlets and tennis icons around the world. Billie Jean King, Andy Roddick, Victoria Azarenka and others have voiced their criticisms of the penalties against Serena and supported her in calling out the perceived double standard. Only days later, Williams was fined $17,000 for the code violations during the match.
And in the midst of all this, Naomi Osaka is the forgotten woman.
Not in Japan, of course, where she's getting the national hero treatment. Days removed from the match, she's still making the newspapers and remains the hottest discussion topic on television, which is remarkable given that multi-ethnic identity is still a contested issue in Japan. Osaka was born to a Japanese mother and a Haitian-American father. Yomiuri Shimbun, the biggest newspaper in Japan, said that Osaka is "a new heroine that Japan is proud of."
Tennis coverage in the United States, however, would do well to remember this: the shy 20-year-old who quoted the Pokémon theme song during a press conference toppled a living legend and now sits at number seven in world tennis rankings. She was ranked nineteenth prior to the match with Serena.
After a Women's Singles final that may have altered the trajectory of modern tennis, only a few things are clear. The tension over tennis' apparent double standard has long been brewing. At Arthur Ashe on Saturday, it finally boiled over.
For Serena, a record-tying twenty-fourth Grand Slam is still within reach. For Osaka, this is the first big win in a career that will be full of crowning moments.
Naomi Osaka is the first Japanese player in history to win a Grand Slam title. She jumped twelve places up the world singles rankings to number seven after defeating Serena Williams in the final.
The hurdles to producing independent student journalism grow higher every year — funding cuts, skyrocketing costs for printing and supplies, competition for traditional advertisers all threaten our ability to serve the BU community. Support independent student journalism at Bloomsburg University by making a donation to The Voice.
Joshua Lloyd, Author
Bloomsburg Students Discover Dead Body in Abandoned Hotel
Bloom Student Found Dead; Three Hospitalized
The Continuation of Bloomsburg Greek Life after Disaffiliation
Would you like if The Voice aired scores for Bloomsburg sports?
No (100%, 1 Votes)
Yes (0%, 0 Votes)
Update from BU Dining Services Leaves Students in Suspense
Fun-filled First Week of the Semester
Spring Semester Means Major Internship Stress, But Why?
Tweets by BUvoice
Will Bloom Go Greek Again?
PA Ballot Results – Shapiro, Fetterman, Leadbeter
Dean of Students Quits the Commonwealth
Josh Shapiro Campaign lands on Bloomsburg's Steps
BU Forensics Team Wins Big
Staying Informed On Fentanyl
All You Need To Know About The Black Studies Minor
Should Minimum Wage be Raised for On-Campus Food Workers?
Man Shot on Main Street, Police Search for Gunman
All The Voice Picks Reader Picks Sort: Newest


I am busy adding a lot of FLAC files to my iTunes library using the Pure Music "add a FLAC file" option - no problem. However, If I move a FLAC album to Playlist and attempt to burn it to a CD it burns but you cannot hear the results. Does the Pure Music "convert to Apple Lossless" option alleviate this problem?
Just not sure what kind of file it converts to Apple Lossless and will that solve my "silent CD" problem?
I am not familiar with Pure Music being able to transcode files from one audio codec to another. It is a music playback software rather than a process software (rip, extract, transcode). It does allow for the playback of FLAC files but it uses iTunes only for database/file management purposes. Where do you see a conversion option to ALAC within PM?
When you click on Pure Music at the very top of the screen (next to the Apple) on of the options that comes up is "Convert Audio files to Apple Lossless".
Apparently you cannot burn a FLAC file to a CD and expect to hear it later! That was new information to me!
I had never noticed that. I always use XLD.
I own Pure Music 2.
Whilst using the Bookmark feature is a quick and easy way of allowing playback of FLAC files in iTunes, it does come with drawbacks. The reason is that the files are not really inside iTunes so there is nothing to burn. And as soon as you move the files, it looses the bookmark and you have to repeat the process from the new location.
I much prefer to convert the FLAC files to Apple lossless and then add them to the iTunes library. Pure Music plays them in 24/96 or 24/192 (bitdepth/frequency) with full fidelity, bypassing Apples playback which forces 16bit/44khz.
Once you do this you can burn the playlist to Disc as normal.
By the way, XLD is twice as fast at converting than the converter in Pure MUsic. And it runs in the background while you listen to music. I have not found any sonic differences and I have not read anything on-line that describes a difference in trans coding from Flac to Apple Lossless. I can tell you that I have ripped my entire CD collection and I have accumulated a large replacement collection of 24 bit versions from HDTracks, etc. The 24 bit versions sound much better at least to my ears.
So, if you have a favourite album and are wondering if it is worth buying from an HD download site, I can tel you definitely yes.
If you'd like to convert FLAC files to Apple Lossless, you can have a try of Apple Music Converter, which can meet your needs with three steps.
Just add FLAC files to this program, and choose Apple Lossless format and then click the 'Convert' button, all steps are done. Just wait for your Apple Lossless files.
FLAC is lossless format, if you want to convert apple music to lossless format, you can follow this tips to convert Apple Music to FLAC format. Hope this software can help you well.