MVP program · Clinical care providers
Minimum Viable Privacy Program for Home & Community Care Agencies
Minimum Viable Privacy packages a working baseline into one program a small community agency can afford before it ever wins a contract: a gap review of field-device practices and PSW confidentiality controls, the policies an Ontario Health atHome security schedule actually checks, training for ten people, and twelve hours of coaching, for $5,499 CAD a year. It suits the fifty-to-two-hundred-person non-profit bidding on its first SPO contract, or an existing provider that has never had its practices documented in a way a funder could review.
Reviewed by the Privacy Horizon team · Last reviewed
What you're protecting
The one gap MVP closes first for a small agency
A small community agency cannot build everything at once, so the baseline starts with the exposure most likely to sink a first SPO bid.
PSW field-device and confidentiality practices
Most small agencies have no written rule for what a personal support worker's phone must have configured before it holds a care plan. MVP closes that gap first, since PSWs have no licensing college to fall back on.
A named privacy owner
Most agencies this size have no role that includes privacy explicitly. MVP assigns the function, typically to the director of quality or operations, and equips them to actually hold it.
The custodian status question, answered once
Whether the agency is a PHIPA custodian in its own right under Connecting Care Act funding, documented clearly instead of assumed, since a bid reviewer will eventually ask.
Consent language for lockbox codes and family contacts
What clients are told, and asked to agree to, about who may hold a lockbox code or be contacted about their care, checked against what field staff actually do.
A retention starting point for visit records
Visit notes, missed-visit reports and old paper files accumulate with no disposal rule at most small agencies. The baseline sets a first retention schedule that gives cleanup a defensible starting point.
Regulatory map
The compliance floor a first-time SPO bidder needs cleared
Before any control gets built, MVP answers the question a bid reviewer will ask first: does this agency understand its own custodian status.
Custodian status under Connecting Care Act funding
PHIPA s.3(1) para 3 makes an agency delivering home and community care under Connecting Care Act, 2019 s.21 funding a health information custodian, a status MVP documents plainly for a bid package.
Breach notice and IPC reporting basics
PHIPA s.12(2) and O. Reg. 329/04 set out notification and IPC reporting duties, including the March 1 statistics filing, which MVP's policy set walks a first-time custodian through.
Agent responsibility for PSWs under s.17
The custodian answers for a PSW's conduct as its agent, the reason MVP prioritizes field-device and confidentiality controls ahead of anything more technical.
Alberta and BC obligations for multi-province operators
A small agency also delivering continuing-care services in Alberta or operating in BC carries HIA or PIPA obligations in parallel, which MVP's gap review scopes based on where the agency actually operates.
What goes wrong
What stays exposed for an agency with no baseline at all
Small agencies without any program tend to discover the gap the same way: mid-bid, mid-incident, or mid-audit, none of them a good time to start.
A bid rejected for missing evidence, not missing intent
A first-time SPO bid can lose out simply because the agency has no policy or training evidence to submit, regardless of how carefully client data is actually handled day to day.
A PSW improvising confidentiality rules under pressure
Without written, trained guidance, a worker facing a family member's question at the door makes a judgment call the agency has no record of ever having addressed.
A lost phone or file with no response plan
A device or paper record lost in the field, without any prior baseline, turns a routine field-workforce risk into a first-ever incident response handled entirely from scratch.
Sector peers making the same gap visible
Publicized incidents in home and community care have raised the bar for what a funder or client now expects to see documented, leaving an agency with no baseline looking conspicuously behind.
Our mvp program for home & community care agencies
What the MVP year delivers for a small home-care agency
The package is fixed and sequenced so the pieces a bid reviewer checks land first, built around field operations rather than a generic office checklist.
Baseline privacy gap review
A structured look at field-device practices, consent language and current policy, benchmarked against PHIPA and any provincial statute that applies, producing a short, ranked list.
Prioritized control recommendations
Directional guidance on what to fix first once custodian status is confirmed, typically device configuration, a retention schedule and consent language.
Core policy development
A starter mobile-device and confidentiality policy, a lockbox-code procedure and a retention schedule, drafted for how your agency actually runs visits.
Readiness assessment workshops
Working sessions with leadership and field-operations staff that rehearse the situation prompting the purchase, most often a first SPO bid or renewal.
Training with ten seats
Role-appropriate privacy and security training and human-risk assessment for up to ten people, enough to cover leadership and a first cohort of PSWs at this size of agency.
Twelve hours of coaching
Expert time spent wherever the year takes you, a bid question, a family complaint, or a lost-device incident, as it lands.
How the engagement runs
How the baseline gets built over the term
Setup is deliberately light on a small team, and the sequence is built to have core evidence ready before a bid deadline.
Step 1
Intake and the custodian determination
We confirm the agency's status under PHIPA or the applicable provincial statute, so every later decision starts from a documented answer.
Step 2
Gap review against field practice
Device handling, consent language and current policy are reviewed against that determination, and findings become a short list leadership can approve quickly.
Step 3
Policy drafting and readiness workshops
Core policies are drafted and rehearsed live with your team, built around the bid, renewal or audit situation that started the engagement.
Step 4
Training rollout and coaching close-out
The ten training seats are delivered by role, and remaining coaching hours handle whatever surfaced mid-year, ending the term with a clear view of what more a larger program would add.
What it costs
What MVP costs and what a home-care agency gets for it
Minimum Viable Privacy is $5,499 CAD per year, billed annually on a twelve-month term, and covers the gap review, core policy development, readiness assessment workshops, twelve hours of coaching, and training with human-risk assessments for ten seats. The price is fixed and published, so an executive director can approve it without a procurement process.
Agencies that outgrow it, typically by winning several concurrent SPO contracts, adding an OHT relationship, or facing recurring subcontractor oversight demands, usually move to the Virtual Privacy Office retainer once the MVP year ends, and everything built during MVP carries forward.
Home & Community Care Agencies: MVP program questions, answered
Five things, sized to the agency: a named privacy owner, a documented custodian determination, a field-device and confidentiality policy for PSWs, basic consent language for lockbox codes and family contact, and trained staff who can speak to it during a bid review. That is what MVP delivers across its term, without a hire or a large consulting budget.
Usually yes for the pieces a bid reviewer actually checks: a custodian determination, a core policy set and evidence of staff training. The gap review and policy drafting are sequenced to land early in the term so a near-term bid deadline can be met, with the remaining coaching hours available afterward.
For most first-time SPO bidders, yes, MVP covers what a contract review actually asks for at this size. Pen testing, incident response planning and vendor review tend to become relevant once the agency wins the contract, adds a mobile app, or takes on additional funding relationships.
The ten included training seats typically cover leadership and a first cohort of field staff, giving the agency a working start on PSW confidentiality training. An agency with many more PSWs than seats can add training separately or plan for the larger seat count included in a future Virtual Privacy Office retainer.
Almost always. A policy written before the agency held any SPO contract typically predates the custodian question entirely and says nothing specific about field devices or lockbox codes. The gap review treats it as a starting draft rather than discarding it, which usually shortens the policy work.
Nothing is wasted. Agencies that win multiple SPO contracts, add an OHT relationship or face recurring subcontractor due diligence typically step up to the Virtual Privacy Office, where a designated privacy coach and monthly hours replace the fixed package. Every policy and schedule from MVP carries directly into that retainer.
More for home & community care agencies
Other services for this niche
About this service
What's Protecting Your Business from the Next Threat?
Don't wait for a breach to expose your vulnerabilities. Let Privacy Horizon secure your data, ensure compliance, and build lasting trust.