How does CognisantMD validate health service directory listings as legitimate healthcare providers?

Introduction

The Ocean Healthmap consists of listings that represent health service providers (HSPs) and health information custodians (HICs) as described under PHIPA law.

It is very important that the listings in the directory be accurate and up-to-date to prevent accidental or malicious leakage of personal health information to untrusted third parties by unwitting referrers to the listed services.

Consequently, safeguards must be in place to prevent individuals from masquerading as health service providers, so that referrers do not inadvertently send them their patient's personal health information. Policies should also exist to ensure listings have up-to-date contact information to prevent patient faxes and phone calls from sending to the wrong location.

Maintaining accurate and up-to-date information in a comprehensive health service directory is an ongoing challenge. To minimize the risks involved, CognisantMD's policies are outlined below.

Prioritized Use of Official Sources

When possible, the directory listings in Ocean are directly pulled from "Official Sources", which contains a comprehensive list of physicians and other health service providers in the province. These registry services have their own well-developed and publicly-trusted mechanisms for validating listings. Consequently, the information within these listings are transitively trusted by Ocean to be up-to-date and representative of a trustworthy real-world health information custodian.

For example, the phone and fax numbers for physicians from the eHealth Ontario Provider Registry are presented in the directory as accurate information, along with indicators to show users the source of the information.

Information from these official sources is refreshed in Ocean on a regular basis to ensure the information remains up-to-date.

Official Sources as of May 2018:
Source Governance Synchronization Frequency
eHealth Ontario Provincial Provider Registry Managed and vetted by eHealth Ontario Daily

Third Party HINPs Using Ocean

CognisantMD also allows select not-for-profit organizations to act as their own Health Information Network Providers (HINPs). These organizations have their own policies for validating health information. An example of a HINP using Ocean is the CFFM Care Innovations organization based in the Waterloo Wellington LHIN in Ontario.

These third-party HINPs may validate and submit their own listings as a subset within the wider Ocean Health Service directory. CognisantMD regularly reviews the policies of these HINPs as it pertains to Ocean and provides support to the HINPs to ensure they adhere to the company's own privacy policy.

Current 3rd Party HINPs as of May 2018:
Name
CFFM Care Innovations

Listing Creation and Listing Claims

Listings representing Health Information Custodians (HICs) may be entered or updated in Ocean by either the HINP or the HIC itself:

  1. An authenticated user acting on behalf of an Ocean-affiliated HINP may manually enter a new health listing in Ocean under their own directory subset at any time. This process facilitates HINPs in creating their own comprehensive directory of trusted health services. When a HINP creates a listing, it assumes the responsibility for validating this listing using their own policies and procedures.
  2. Alternatively, HICs may choose to independently create and claim their own listing within the CognisantMD directory, or "claim" a listing as their own. These listings contain both identifying information and contact information for the HIC. Since these individuals in this circumstance are not yet validated by a HINP as trustworthy, the listing is flagged as such in the directory to warn referrers of a potential privacy breach if personal information were to be sent. HINPs may proceed to validate these claimed listings, after which the warning is removed and replaced with an appropriate indicator of the HINP's approval.

CognisantMD's Listing Validation When Acting as HINP

In circumstances where CognisantMD is acting as the HINP, the company directly assumes the responsibility of validating listings.

CognisantMD's steps for validating listings are as follows:

  1. Listings that are flagged as requiring validation are reviewed on a daily basis by a designated HINP administrator.
  2. For each listing requiring validation:
    • The administrator reviews the listing for any obvious initial inaccuracies or inappropriate information.
    • In the event that the listing is considered unreliable or deemed to be "spam", it is deleted immediately.
    • The listing's contact information is cross-listed with official sources when possible (such as the CPSO directory for physicians or a regional directory for social services such centralhealthline.ca)
    • An Internet search is also performed with two separate services (e.g. Google and Microsoft's Bing) to locate any publicly-accessible information regarding the listing to ensure consistency with the claimed information.
    • If a website is found that aligns with the listing, it is also cross-referenced for consistency with the listing's information.
  3. If the information passes this initial screening test, the administrator calls the phone number provided on the listing's information. During the phone call, the administrator identifies CognisantMD and explains the purpose of the call, then proceeds to clearly enumerate all of the listing's information as submitted to confirm accuracy.
    • Up to two voicemails are left on separate days.
  4. If 7 days pass without the administrator successfully manually confirming the accuracy of this information, the listing is deleted.
  5. If the listing however is successfully confirmed, the validation is completed by the administrator and tagged in the directory accordingly. The time, date and administrator that approved the listing is logged.

Reporting and Correction of Invalid or Out-of-Date Listing Information

All individuals interacting with Ocean should flag and report health service listings found to contain inaccurate information in a timely manner. Any user of the directory can quickly and easily alert CognisantMD of the concern by clicking on a hyperlink contextually located next to the listing's information.

Once a listing has been flagged as potentially inaccurate, the listing is flagged for all users along with the user's suggested correction. CognisantMD manually reviews such reports on a daily basis. In the event that a listing is managed by a separate HINP, CognisantMD notifies the HINP of these reports so that the HINP may take appropriate action. If not, CognisantMD follows the same validation steps as those used by initial listing validation to ensure the new information is accurate.

Have more questions? Submit a request