Minutes - February 17, 2022 - Governance Committee Meeting 

Members Present:

Mr. Matt Reid
Ms. Kelly Elliott
Ms. Aina DeViet
Mr. Mike Steele

Regrets

Ms. Tino Kasi

Others Present:

Ms. Carolynne Gabriel, Executive Assistant to the Board of Health (Recorder)
Dr. Alexander Summers, Acting Medical Officer of Health
Ms. Emily Williams, Chief Executive Officer
Ms. Mary Lou Albanese, Director, Environmental Health and Infectious Disease
Ms. Kendra Ramer, Manager, Strategy, Risk and Privacy
Ms. Mariam Hamou, Board of Health Member

At 6:00 p.m., Ms. Emily Williams, Secretary to the Board of Health / Chief Executive Officer called the meeting to order and opened the floor to nominations for Chair of the Governance Committee for 2022.

It was moved by Mr. Matt Reid, seconded by Mr. Mike Steele, that Ms. Aina DeViet be nominated for Chair of the Governance Committee for 2022.
Carried

Ms. DeViet accepted the nomination.

Ms. Williams called three times for further nominations. None were forthcoming.

It was moved by Mr. Reid, seconded by Ms. Kelly Elliott, that Ms. DeViet be acclaimed as Chair of the Governance Committee for 2022.
Carried

Disclosures of Conflict of Interest

Chair DeViet inquired if there were any disclosures of conflict of interest. None were declared.

Approval of Agenda

It was moved by Mr. Steele, seconded by Mr. Reid, that the AGENDA for the February 17, 2022 Governance Committee meeting be approved.
Carried

Approval of Minutes

It was moved by Ms. Elliott, seconded by Mr. Reid, that the MINUTES of the November 18, 2021 Governance Committee meeting be approved.
Carried

New Business

2022 Governance Committee Reporting Calendar (Report No. 01-22GC)

This report was introduced by Ms. Emily Williams, CEO. Two keys point of this report are the addition of quarterly reports for risk and maintaining five meetings per year as was done last year, as opposed to the three meetings held previously. As there are still some policies requiring review and approval, five meetings is appropriate.

Mr. Matt Reid acknowledged that the Governance Committee did a lot of “heavy lifting” last year with regards to the number of policies they reviewed.

It was moved by Ms. Elliott, seconded by Mr. Reid, that the Governance Committee:
1) Receive Report No. 01-22GC re: “Governance Committee Reporting Calendar & Meeting Schedule”; and
2) Recommend that the Board of Health approve the 2022 Governance Committee Reporting Calendar.
Carried

Governance Policy By-law Review (Report No. 02-22GC)

This report was introduced by Ms. Williams. Two policies are appended to the report: G-000 Bylaws, Policy and Procedures and G-100 Privacy and Freedom of Information. In terms of policy G-100, the main changes refer to the separation of the MOH and CEO roles. Also added to policy G-100 is the authority of the Chair of the Board of Health to decide if legal counsel is required to respond to access requests filed under MFIPPA or PHIPA. Policy G-000 solidifies the process for reviewing policies, and has an updated appendix.

It was moved by Mr. Steele, seconded by Ms. Elliott, that the Governance Committee recommend that the Board of Health:
1) Receive Report No. 02-22GC re: “Governance By-law and Policy Review” for information; and
2) Approve the governance policies as appended to this report.
Carried

Annual Privacy Program Update (Report No. 03-22GC)

This report was introduced by Ms. Williams who introduced Ms. Kendra Ramer, Manager, Strategy, Risk, and Privacy. Ms. Ramer outlined that the Health Unit is required to submit annual statistical reporting to the Information and Privacy Commissioner of Ontario (IPC) as per PHIPA and MFIPPA as to the number of health information privacy breaches which occurred at the organization as well as the number of access requests made under PHIPA and MFIPPA. In 2021, the Health Unit had six privacy breaches, none of which met the threshold for notification to the IPC. Additionally, there were four access requests made under PHIPA and 11 under MFIPPA, 10 of which are closed and one which is being carried forward to be completed in the current reporting year. The Privacy Program will report the annual statistical reports to the IPC by the legislated deadline of March 31.

Mr. Reid inquired if six privacy breaches is typical or if the Health Unit is starting to see an upward trend. Ms. Ramer responded that the Health Unit’s rate of privacy breaches has been steady, with five privacy breaches reported in 2020 and six in 2021. She indicated that this demonstrates that the training which has been implemented is working given the recent increases in the use of digital technology, such as the COVax system.

Ms. DeViet commented that, given the volume of contacts the Health Unit has through the vaccine systems, it is an achievement to have such a small number of complaints and that training always helps.

It was moved by Mr. Steele, seconded by Mr. Reid, that the Governance Committee recommend that the Board of Health receive Report No. 03-22GC re: “Annual Privacy Program Update” for information.
Carried

MLHU Risk Management Plan (Report No. 04-22GC)

Ms. Williams invited Ms. Ramer to speak to this report. Ms. Ramer outlined that the MLHU Risk Management plan now incorporates a new Risk Register. Since 2018, the Ministry of Health has required annual reporting which incorporates a risk management report. This report would have been seen at the Board of Health meeting held in December 2021, which reported only high risks and incorporated key mitigation strategies. A gap in reporting lies in not monitoring the effectiveness of the mitigation strategies on a quarterly basis as well as reporting only high risks and not low and medium risks. As a result of the identification of these gaps, MLHU has modified and improved its risk register in order to report to the Board of Health on a quarterly basis. The Risk Register, in its Excel spreadsheet format, now has additional columns to assess for the strength of controls in order to determine how successful the mitigations strategies are and to determine any residual risks. Reporting on a quarterly basis to the Board of Health, rather an on an annual basis, will assist in ensuring the Board is aware of ongoing risks to the organization as well as annual reporting to the Ministry of Health.

The next Governance Committee meeting in April will see the identified risks analyzed and assessed for the effectiveness of the mitigation strategies as well as the identification of any additional risks.

Ms. DeViet commented that she noticed that “cyber security” was not identified as a risk category in addition to the technology risk category. She inquired if MLHU has the ability to add additional categories to those provided by the Ministry, or if cyber security was captured in a different plan. Ms. Ramer responded that the technology risk category was identified in the Ontario Public Risk Management Framework, which MLHU adapted for its Risk Register; however, MLHU can add additional risk categories at any time if they are identified by management or the Board of Health. Ms. Williams added that the Health Unit has recently assessed cyber security as a medium risk and it will be added to the next reporting of the Risk Registry. The Health Unit has identified phishing as a risk and has performed an exercise to determine a baseline level of staff awareness of phishing and cybersecurity.

It was moved by Mr. Reid, seconded by Ms. Elliott, that the Governance Committee recommend that the Board of Health:
1) Receive Report No. 04-22GC re: “MLHU Risk Management Plan” for information; and
2) Approve the new Middlesex-London Health Unit Risk Management Plan and Risk Register.
Carried

Other Business

The next meeting of the Governance Committee will be held on Thursday, April 14, 2022 at 6:00 p.m.

Adjournment

At 6:18 p.m., it was moved by Mr. Reid, seconded by Mr. Steele, that the meeting be adjourned.
Carried

AINA DEVIET
Chair, Governance Committee

EMILY WILLIAMS
Secretary