Ministry of the
Solicitor General

First Responders COVID-19 Risk Look-Up Tool Web Portal: Protection of Personal Health Information and Appropriate Use

Communiqué du commissaire des incendies

First Responders COVID-19 Risk Look-Up Tool Web Portal: Protection of Personal Health Information and Appropriate Use

Communiqué 2020-10

April 27, 2020

Further to Communique 2020-06 and subsequent emails, I would like to provide you with important information on the contents of the First Responders COVID-19 Risk Look-Up Tool Web Portal (the portal), its appropriate use, and the urgent need to protect personal health information.

Contents of the Portal

The portal now contains confirmed positive test results (beginning on April 1, 2020) for individuals who qualified for and have undergone a COVID-19 test. An individual who is included in the portal is never removed, even if they have subsequently recovered. 

Despite the information available in the portal, fire personnel should continue to conduct point of interaction risk assessments and take other appropriate precautions when interacting with members of the public.

Please note the following considerations regarding the information contained within the portal:

  • It may take up to four days for test results to become available;
  • The information in the portal is only updated once a day and does not reflect real-time testing information;
  • Individuals who have tested positive may no longer have COVID-19; 
  • An individual who is included in the portal is never removed;
  • Individuals’ addresses may be recorded inconsistently;
  • An address for a multi-unit building may have a positive case but not at the relevant unit; and
  • There may be individuals at an address who do not reside there.

The Ministry of the Solicitor General (ministry) continues to work to improve the portal including the quality of data available and will share further updates as available.

Use and Disclosure of Information

Over the course of the past few days, it has come to the attention of the Office of the Fire Marshal that some fire personnel have used or disclosed information in the portal in a manner that is not consistent with Emergency Management and Civil Protection Act (EMCPA) or subsequent. The EMCPA requires that information shared pursuant to O. Reg. 120/20 only be used to prevent, respond to, or alleviate the effects of the emergency. The EMCPA also requires that any information-sharing authorized under the emergency order occur in a manner that limits its intrusiveness.

The portal should not be used to obtain information about employees in the fire service for the purpose of managing the workforce (e.g., identifying whether an employee should remain at home or other employees who were in close contact should self-isolate). Information about employees’ COVID-19 status should be obtained directly from employees where appropriate. Given the limitations of the portal, including those described above, the portal is likely a less reliable tool for identifying individuals who are COVID-19 positive than the information employees themselves can provide.

The portal is only intended to be used to look up the COVID-19 status of individuals that members of the fire service will encounter or have encountered during the declared emergency as a result of responding to calls for service, for the sole purpose of supporting frontline fire personnel in making informed decisions about whether they need to take additional precautions to prevent the spread of COVID-19.  

The portal must not be used to advise any individual about its contents for unauthorized purposes (e.g., disclosures to heads of council or public health units for informational purposes). For greater certainty, searches of the portal should not be conducted to ascertain the number of individuals in a municipality or region that appear on the portal and such information, if already obtained, should not be shared. In the ministry’s view, such use of the portal is not consistent with the requirements of the EMCPA. It is imperative that fire chiefs protect the sensitive personal health information in the portal.

Please note that if fire personnel misuse the portal or information from the portal, it could result in rights to the portal being revoked.  Furthermore, it would be up to individual fire chiefs to determine if additional disciplinary action should be taken against any fire service member who has their access revoked.  It is also a provincial offence for any person to willfully disclose personal information in contravention of the Municipal Freedom of Information and Protection of Privacy Act (MFIPPA) or Freedom of Information and Protection of Privacy Act (FIPPA).

Audit Logging and Accountability

The ministry has instituted an audit logging function that will track all user activity on the portal and may flag any queries that are deemed to be an inappropriate use of the portal (e.g., broad municipal-based searches).  Where such inappropriate use of the portal is confirmed, the ministry may revoke access to the portal for the user who violated the terms of service or the entire group of users affiliated with the fire service. 

Furthermore, the ministry may report suspected unauthorized portal access or use/disclosure of information from the portal to the Information and Privacy Commissioner of Ontario.  The ministry will, on request of a fire chief, provide a copy of an authorized user’s audit logs for the purpose of investigating unauthorized access, or use or disclosure of information, for the purpose of pursuing discipline.

Please note, the EMCPA provides that personal information subject to an emergency order is subject to any law with respect to the privacy and confidentiality of personal information when the declared emergency is terminated.

Please refer to subsection 7.0.2(7) of the EMCPA with respect to the rules that apply to the information subject to this emergency order. Also attached is a Question & Answer document with more information on the portal, for your reference.

If you have any other questions, please contact the COVID-19 Enforcement Support Line at 1-866-389-7638 or speak to your field and advisory services advisor.

Thank you for your continued assistance.

Attachment

Questions and Answers