Confidentiality & Accreditation Records Policy
A formal policy of the Commission for Health, Safety & Professional Standards, Inc. Normative clauses use “shall.”
| Field | Value |
|---|---|
| Document ID | CHSPS-ACC-104 |
| Title | Confidentiality & Accreditation Records Policy |
| Edition | 2026.1 |
| Status | Published Policy — effective August 19, 2026 |
| Owner | General Counsel & Corporate Secretary |
| Supersedes | New document |
| Next review | No later than August 2028, or earlier upon material change |
| Publication authority | CHSPS controlled-document publication authority |
Purpose
To define what CHSPS keeps confidential, what it publishes, who may access accreditation records, how long records are retained, and how they are protected and disposed of.
1. Scope
1.1 This policy covers all records created or received in CHSPS accreditation activity: applications and evidence, reviewer workpapers and correspondence, committee materials and minutes, decisions and letters, complaint, reconsideration and appeal files, performance-data submissions and validation records, and personal data contained in any of them.
2. Information classes
2.1 Public: standards and policies that CHSPS intentionally publishes (with development/effective status clearly labeled), the verification records of each final accreditation once issued, disposition reports of public comments, and other material CHSPS expressly makes public.
2.2 Restricted: internal working documents whose disclosure is not prohibited but is limited to a need-to-know basis, including draft policies before adoption.
2.3 Confidential: application evidence, self-assessments, reviewer workpapers, findings before final disposition, committee deliberations, complaint and appeal files, identity of complainants who request confidentiality, security-sensitive information (including examination content), and personal data.
3. Confidentiality obligations
3.1 Confidential information shall be accessible only to covered persons assigned to the matter and cleared of conflicts, and shall be used solely for the accreditation purpose for which it was provided.
3.2 Every reviewer, validator, committee member and contractor shall execute a confidentiality undertaking before first access and per engagement.
3.3 Confidential information shall not be shared with CHSPS education, membership or business-development personnel.
3.4 Secure examination content shall never be transmitted through ordinary application channels; where its review is required, CHSPS shall arrange a separate secure channel confirmed in writing, with access logged.
4. What CHSPS publishes and what it never publishes
4.1 CHSPS shall publish accreditation status information as defined by the Decisions & Status Definitions and public verification policy, including adverse status changes.
4.2 CHSPS shall not publish application evidence, findings detail, reviewer identity on specific files, deliberations, or the fact that an organization applied and was denied or deferred, except as required by law.
5. Disclosure exceptions
5.1 Confidential information may be disclosed only: (a) with the written consent of the organization concerned; (b) under legal compulsion, in which case CHSPS shall, where lawful, notify the organization before disclosure; or (c) to the minimum extent necessary to address an imminent threat to public safety, as determined under the governance escalation procedure and recorded.
6. Retention schedule
6.1 Application files and evidence for accredited organizations: the longer of 7 years after the final decision or two full accreditation cycles.
6.2 Files of denied, withdrawn or abandoned applications: 5 years after closure.
6.3 Complaint, reconsideration and appeal files: 7 years after closure.
6.4 Decision letters, certificates, public verification and status-history records, and Board and committee minutes: permanent.
6.5 Interest disclosures, conflict screenings and recusal records: 7 years.
6.6 Performance-data submissions and validation records: per the applicable measures policy, and never overwritten — superseded versions are preserved.
7. Security
7.1 Access to confidential records shall be role-based and logged; accounts shall be deprovisioned promptly on separation or end of engagement.
7.2 Confidential records shall be protected with measures proportionate to sensitivity, including encryption in transit and at rest for electronic records where the sensitivity and storage model warrant those controls.
7.3 Suspected breaches shall be contained and assessed immediately; organizations whose confidential information was affected shall be notified within 5 business days of confirmation, together with the scope and remediation.
8. Disposal
8.1 Records past their retention period shall be destroyed securely — irreversible deletion for electronic records, cross-cut destruction for physical records — and destruction shall be logged.
8.2 No record subject to a legal hold, an open complaint, appeal or investigation shall be destroyed until the hold or matter closes.
9. Requests and custodianship
9.1 Organizations may request copies of their own submissions and decision records at any time during the retention period.
9.2 Should CHSPS cease operations, permanent records and any records still in retention shall pass to a successor or custodian under confidentiality terms no weaker than this policy, and affected organizations shall be notified.
Related documents
Evidence & Documentation Requirements · Privacy Policy · Impartiality & COI (CHSPS-GOV-002) · Policy Manual
Where this policy and a page-level summary elsewhere on this site differ, this controlled document governs. Substantive changes follow the published revision process and never apply retroactively to in-flight matters.