Privacy, Ethical Review, System Security and Database Management Policy Statement...

It is CORI’s policy to control the collection, use, and disclosure of personal information in accordance with requirements set out in the Freedom of Information and Protection of Privacy Act of Alberta and other relevant provinces, as well as, the Personal Information Protection and Electronic Documents Act of Canada. In the case that CORI must comply to new legislation or additional legislation from other jurisdictions, CORI will make a commitment to do so in a timely manner, as is reasonably possible. The Board of CORI reserves the right to make changes to these policies in the cases where CORI needs to improve adherence to legislation, adhere to new legislation, or to provide quality service.

Part A: CORI Privacy Policy Statement

Part B: Ethical Review Policy

Part C: System Security & Database Management Policy



Part A: CORI Privacy Policy Statement

1. Accountability
The CORI is responsible for personal information under its control and designates the Executive Director to be accountable for the CORI's compliance with the Acts.

2. Identifying Purposes
The purposes for which personal information is collected shall be identified by the CORI at or before the time the information is collected.

3. Consent
The knowledge and consent of agency directors and individuals are required for the collection, use, or disclosure of personal information.

4. Limiting Collection
The collection of personal information shall be limited to that which is necessary for the purposes identified by the agency for case management, outcome management, and administrative data collection that would normally occur in the day-to-day work of agency personnel. CORI will not demand any additional data collection for any research, best practice, or other evaluation projects. All associate agencies have the right to decline involvement in collection of data for evaluation of CORI service’s.

5. Limiting Use, Disclosure and Retention
Personal information shall not be used or disclosed for purposes other than those for which it was collected, except with the consent of the individual or as permitted by law. Personal information shall be retained only as long as necessary for the fulfillment of those purposes or where stated by law. CORI will not use, disclose, or retain information for corporate interest. In the case that CORI uses information to investigate best practices of services within specific client or community problem and need areas, only aggregated data will be reported. All analyses of such data must comply to the policies and procedures of the CORI Ethics Procedures and Policies (based upon the “Tri-Council Policy Statement for Ethical Research with Humans”).

6. Accuracy 
Agency personnel are responsible to be as accurate, complete, and up-to-date as is possible and necessary. CORI will not edit any agency information unless directed to do so by the agency user.

7. Safeguards 
CORI will protect Personal information using security safeguards such as encryption coding, firewalls, hierarchical security login models, and other technology where appropriate to protect the confidentiality of information.

8. Openness
The CORI shall make readily available to individuals specific information about its policies and practices relating to the management of personal information.

9. Individual Access
Upon request, an individual shall be informed of the existence, use, and disclosure of his or her personal information and shall be given access to that information. An individual shall be able to challenge the accuracy and completeness of the information and have it amended as appropriate. In the case that clients request such information, the agency collecting data will be informed and a joint agency. Client, and CORI meeting can be established to fully disclose any personal information available on the CORI system. 

10. Challenging Compliance
An individual may challenge compliance with the above principles to the Executive Director of CORI or individuals accountable for the CORI's compliance. 

11. CORI Responsibility
Compliance. All CORI employees, who collect, maintain and/or use personal information, are responsible for insuring that the collection, use and disclosure of this information is carried out in accordance with this policy and relevant procedures. 

Noncompliance. CORI employee noncompliance to the above policies or CORI Ethical Procedures may result in the employees termination.

Accountability. The Executive Director is accountable for the CORI's policies and practices, management of the CORI System, and is the individual to whom complaints and inquiries can be forwarded.



Part B: Ethical Review Policy

Introduction...
Prior to developing an application for ethic review, all investigators should become familiar with the CORI policy statements. Familiarization with the ethics review process and the parameters for conducting research will ensure that the process proceeds as smoothly as possible. The CORI has adopted the Tri-Council Policy statement on Ethical Conduct for Research Involving Humans to develop its policy statements, ethics review procedures, and to act as the basis for ethical decision-making (a copy can be accessed through: http://www.nserc.ca/programs/ethics/english/policy.htm ). 

Investigators must familiarize themselves with this document. Most requests to use CORI data for any research or evaluation must go through the Ethics Review Process prior to any data analyses. However, some exceptions do apply. For example, evaluation of a single agency and its programs with the informed consent of the agency, or when requested by the agency does not require an ethics review using the CORI Review Process. The ethics review also does not need to occur when more than one agency wishes to produce a joint evaluation of services. In such instances, all agencies must consent to evaluation and submit their own data sets to the evaluator.

Review Process
In all instances where evaluation or research is planned using multiple agency data and the analyses require complied data using the CORI database, then an ethics review is required.
In these cases, all applications to use CORI data for any research or evaluation must go through the Ethics Review Process prior to any data analyses (see the Ethics Committee Review Flow Chart and the CORI Ethics Review Application Form Introduction for specific procedures).

Purpose of Review
The purpose of the Ethics Review is to ensure that all research and evaluation using CORI data meet basic criteria for best practice research. It also ensures that both client and agency confidentiality and anonymity are protected and that there is a maximum of benefit to clients, agencies, regions, and the community while minimizing harm.

Review Committee Meetings
The ethics Review Committee or Research Ethics Board (REB) will meet 30 days or more after an application is forwarded to the CORI and one week or more after all members receive the application proposal. 

Committee Meeting Costs
All costs that are related to ethics committee meetings are the responsibility of the investigator that submits the proposal and/or his or her sponsoring organization.

Client Consent
Each Agency using the CORI or HOMES system must create its own consent form indicating that the client, as a part of service with the agency, consents to having information stored and retained by the Hull Outcome Monitoring and Evaluation System (HOMES). The agency will inform the client that stored information is for the purposes of project and service case management and for evaluation of the effectiveness of the services the client will receive. CORI data is collected with the intent to determine the best practices within specific service areas or to assist human service professionals to better address specific client-related problems. In all cases, research or evaluation proposals must fit within this stated purpose.

In the case that a proposal requests that additional research or evaluation be completed with client sets, then agencies must approve such requests prior to submission, and all clients and/or guardians must sign an additional consent form stating the purpose of the research or evaluation. In addition, relevant regional authorities must be contacted and prior approval be given within each region to consent to the proposed research or evaluation.

Releases of Data
All releases of data must be for case management, program management or program evaluation. Agency Executive Directors may release data from their own data sets for their own case management, program management or program evaluation purposes.

• The ethics committee is convinced that the basis of the research or evaluation is to determine the best practices within a specific service area or to assist human service professionals to address specific client-related problems.
• The ethics committee is convinced that the investigator can give assurances that the released analyses will not be used for purposes other than to advance knowledge regarding best practices within specific service areas or to assist human service professionals to address specific client-related problems.
• The ethics committee is convinced that the risks associated to the proposal are clearly outlined and justified.
• The ethics committee is convinced that the benefits to the clients, agencies, community, and/or regions are great enough to out weight any inherent risks in the proposal.
• The analyses of data will be conducted at the CORI site.
• The results of the data are compiled to ensure client and agency anonymity.
• Only data analyses results are submitted to external researchers, not raw data.