Sioux Lookout Meno Ya Win Health Centre :: Privacy Policy :: Sioux Lookout, Ontario

PRIVACY POLICY

 

Standard Statement:

 

Sioux Lookout Meno Ya Win Health Centre (SLMHC) and its agents are committed to protecting the privacy, confidentiality and security of the personal health information (PHI) in the SLMHC’s custody or control in accordance with the Personal Health Information Protection Act, 2004 (PHIPA).

Agent – a person who, with the authorization of the SLMHC, acts for or on behalf of the SLMHC in respect of PHI for the purposes of SLMHC, and not the agents own purposes, whether or not the agent has the authority to bind SLMHC, whether or not the agent is employed by SLMHC and whether or not the agent is being remunerated.

 

Scope:

SLMHC is a Health Information Custodian under the Personal Health Information Protection Act, 2004 (PHIPA), and the majority of personal information in the custody or control of SLMHC is Personal Health Information, as governed by PHIPA.

SLMHC also holds employee personal information, which is not governed by privacy legislation in Ontario.

From time to time, SLMHC may be provided with discrete personal information, which is not governed by privacy legislation in Ontario, except if collected, used or disclosed in connection with a commercial activity, which may occur on an exceptional basis.  In the exceptional latter case, SLMHC shall comply with the principles of the Personal Information Protection and Electronic Documents Act (PIPEDA).

In light of the foregoing, this Privacy Policy focuses on the protection of Personal Health Information.

Capitalized terms used throughout, which are not defined, have the meaning set out in the Personal Health Information Protection Act (“PHIPA”).

 

Policy/Procedure:

 

Principle 1 – Accountability for Personal Health Information

As a Health Information Custodian, SLMHC is responsible for all Personal Health Information under its custody or control and has designated a Privacy Officer, who is accountable for SLMHC’s compliance with the following:

1.     Accountability – Accountability for SLMHC's compliance with this policy rests with the Chief Executive Officer, although other individuals within SLMHC are responsible for the day-to-day collection and processing of Personal Health Information.  In addition, other individuals within SLMHC are delegated to act on behalf of the Chief Executive Officer, such as the Privacy Officer (who is the contact person for the purpose of PHIPA).

 

2.     Privacy Officer – As the contact person, the Privacy Officer is an agent of SLMHC and is authorized on behalf of SLMHC to:

 

a.     facilitate SLMHC compliance with PHIPA;

b.     ensure that all agents of are appropriately informed of their duties under PHIPA;

c.      respond to inquiries from the public about SLMHC information practices;

d.     respond to requests of an individual for access to or correction of a record of Personal Health Information about the individual that is in the custody or under the control of the custodian; and

e.     receive complaints from the public about SLMHC’S alleged contravention of PHIPA or its regulations.

 

3.     Agents – SLMHC is responsible for Personal Health Information in its control or custody, including information that has been transferred to an Agent acting for or on behalf of SLMHC in respect of Personal Health Information.  SLMHC may permit its agents to collect, use, disclose, retain or dispose of Personal Health Information on its behalf only if,

 

a.     SLMHC is permitted or required to collect, use, disclose, retain or dispose of the information, as the case may be; and

b.     the collection, use, disclosure, retention or disposal of the information, as the case may be, is necessary in the course of the agent’s duties and is not contrary to this Act or another law.  SLMHC will use contractual or other means to provide a comparable level of protection while the information is being processed by an agent.

 

4.     Related Policies And Practices – SLMHC has implemented policies and practices to give effect to this policy, including:

 

a.     Implementing procedures to protect personal information (see SLMHC policy PR.9.01 Code of Practice in Safeguarding Personal Information).

b.     Establishing procedures to receive and respond to complaints and inquiries. (see SLMHC policy HW.4.30 Complaint Process).

c.      Training staff and communicating to staff, information about SLMHC's policies and practices.

d.     Developing information to explain SLMHC's policies and procedures, and providing interpreter services if required.

 

Principle 2 – Identifying Purposes for the Collection of Personal Health Information

 

SLMHC makes available to the public a written statement that,

 

a.        provides a general description of SLMHC information practices;

b.        describes how to contact the Contact Person;

c.        describes how an individual may obtain access to or request correction of a record of Personal Health Information about the individual that is in the custody or control of SLMHC; and

d.        describes how to make a complaint to SLMHC and to the Commissioner under PHIPA (see document “SLMHC Privacy Statement” in Policytech-Privacy-Forms).


 

1.               Use or Disclosure outside Privacy Statement – If SLMHC uses or discloses Personal Health Information about an individual, without the individual’s consent, in a manner that is outside the scope of the SLMHC description of its information practices in the Privacy Statement, SLMHC shall,

 

a)     inform the individual of the uses and disclosures at the first reasonable opportunity unless, under PHIPA, the individual does not have a right of access to a record of the information;

b)     make a note of the uses and disclosures; and

c)      keep the note as part of the records of Personal Health Information about the individual that it has in its custody or under its control or in a form that is linked to those records.

 

SLMHC collects personal information for the following purposes; for the delivery of direct patient care, the administration of the health care system, research, teaching, statistics, fundraising, and meeting legal and regulatory requirements.

 

Principle 3 – Consent for the Collection, Use, and Disclosure of Personal Health Information

 

SLMHC recognizes that consent to the collection, use or disclosure of Personal Health Information about an individual may be express or implied.

 

1.               Express Consent Required – However, a consent to the disclosure of Personal Health Information about an individual must be express, and not implied, if, SLMHC makes the disclosure to,

 

a.                 a person that is not a health information custodian; or

b.                 to another health information custodian and the disclosure is not for the purposes of providing health care or assisting in providing health care.  The following are exceptions to this requirement:

 

                                            i.               a disclosure where an individual who is a resident or patient in a SLMHC facility provides to SLMHC information about his or her religious or other organizational affiliation, SLMHC may assume that it has the individual’s implied consent to provide his or her name and location in the facility to a representative of the religious or other organization, where SLMHC has offered the individual the opportunity to withhold or withdraw the consent and the individual has not done so;

                                          ii.              collection, use or disclosure of Personal Health Information about an individual for the purpose of fundraising activities where the individual consents by way of an implied consent and the information consists only of the individual’s name and certain prescribed types of contact information; and

                                        iii.              any prescribed type of disclosure that does not include information about an individual’s state of health.

 

2.               Implied consent within the “circle of care – Where SLMHC receives Personal Health Information about an individual from the individual, the individual’s substitute decision-maker or another health information custodian for the purpose of providing health care or assisting in the provision of health care to the individual, SLMHC is entitled to assume that it has the individual’s implied consent to collect, use or disclose the information for the purposes of providing health care or assisting in providing health care to the individual, unless SLMHC is aware that the individual has expressly withheld or withdrawn the consent (see SLMHC form “Release of Personal Health Information Circle of Care Requests” in Policytech-Privacy-Forms).

 

3.                 Elements of Consent – The consent of an individual for the collection, use or disclosure of Personal Health Information by SLMHC must have the following elements.  It must:

 

a.                 be a consent of the individual;

b.                 be knowledgeable;

c.                  relate to the information; and

d.                 not be obtained through deception or coercion.

 

4.                 Knowledgeable Consent – A consent to the collection, use or disclosure of personal health information about an individual is knowledgeable if it is reasonable in the circumstances to believe that the individual knows,

 

a.                 the purposes of the collection, use or disclosure, as the case may be; and

b.                 that the individual may give or withhold consent.

 

5.               Privacy Statement and Knowledgeable Consent – Unless it is not reasonable in the circumstances, it is reasonable to believe that an individual knows the purposes of the collection, use or disclosure of personal health information about the individual by SLMHC given that SLMHC posts and makes readily available the Privacy Statement which describes the purposes, where it is likely to come to the individual’s attention, or provides the individual with separate notice of same.

 

6.                 Disclosure without Consent for Purpose of Health Care – If SLMHC discloses, with the consent of an individual, Personal Health Information about the individual to one of the following categories of health information custodian,

 

a.               a health care practitioner or a person who operates a group practice of health care practitioners;

b.               a service provider within the meaning of the Home Care and Community Services Act, 1994 who provides a community service to which that Act applies;

c.                a community care access corporation within the meaning of the Community Care Access Corporations Act, 2001; and

d.               a person who operates one of the facilities, programs or services set out in paragraph 4 of the definition of “health information custodian” in subsection 3 (1) of PHIPA, for the purpose of the provision of health care to the individual and if SLMHC does not have the consent of the individual to disclose all the Personal Health Information about the individual that it considers reasonably necessary for that purpose, SLMHC shall notify the custodian to whom it disclosed the information of that fact.

 

7.               Withdrawal of Consent – If an individual consents to have a health information custodian collect, use or disclose Personal Health Information about the individual, the individual may withdraw the consent, whether the consent is express or implied, by providing notice to SLMHC, and similarly, an individual may withhold their consent, but the withdrawal or withholding of the consent shall not have retroactive effect.  If a patient chooses to withdraw or withhold consent for information to be sent to certain parties, they will be requested to complete an “Authorization for the Release of Personal Health Information” (see SLMHC form in Policytech-Privacy-Forms), outlining specifically whom they do not want information sent to and the time period involved.  SLMHC will inform the patient or substitute decision maker (SDM) of the risks or implications associated to withdrawing the consent.

 

8.               Lockbox” Provisions – In addition to the ability to withdrawal or withhold their consent as noted above, individuals may provide express instructions to SLMHC not to use or disclose their Personal Health Information for health care purposes without consent in the following circumstances (see SLMHC policies PR.9.25 “Lockbox Guidelines” and PR.9.26 “Express Patient Instruction Lock Box of Personal Health Information”).

 

a.               where SLMHC would otherwise use Personal Health Information about an individual, for the purpose for which the information was collected or created and for all the functions reasonably necessary for carrying out that purpose, but the information was collected with the consent of the individual or under Principle (4.2.b) below, and the individual expressly instructs otherwise;

b.              where SLMHC would otherwise disclose Personal Health Information about an individual to a health information custodian described in paragraph 1, 2, 3 or 4 of the definition of “health information custodian” in PHIPA subsection 3 (1), if the disclosure is reasonably necessary for the provision of health care and it is not reasonably possible to obtain the individual’s consent in a timely manner, but the individual has expressly instructed SLMHC not to make the disclosure; or

c.              where SLMHC would disclose Personal Health Information about an individual collected in Ontario to a person outside Ontario as being reasonably necessary for the provision of health care to the individual, but the individual has expressly instructed SLMHC not to make the disclosure.

 

9.               Capacity and Substitute Decision-Making – An authorized representative (such as a substitute decision-maker, or a person authorized on the individual’s behalf and in the place of the individual, to give, withhold or withdraw the consent) can also give consent, as described in more detail in Sections 21 to 28 of PHIPA (Capacity and Substitute Decision-Making).  Formal written consent, which must adhere to the following:

 

a.              Signed by the client/patient.

b.             An original, not a photocopy or facsimile.  However, in an emergency, a fax will be accepted; however, the original must be mailed as soon as reasonably possible.

 

Principle 4 – Limiting Collection of Personal Health Information

 

Unless required by law, SLMHC shall not collect, use or disclose Personal Health Information about an individual unless:

 

a)     it has the individual’s consent under this Act (see Principle 3 for when express and implied consent are applicable) and the collection, use or disclosure, as the case may be, to the best of the knowledge of SLMHC, is necessary for a lawful purpose; or

b)     the collection, use or disclosure, as the case may be, is permitted or required by this Act (see Principle 3 for examples);

c)      if other information will serve the purpose of the collection, use or disclosure; or

d)     if it is more Personal Health Information than is reasonably necessary to meet the purpose of the collection, use or disclosure, as the case may be.

 

 

1.     Direct Collection (including without consent) – SLMHC may collect personal health information about an individual directly from the individual, even if the individual is incapable of consenting, if the collection is reasonably necessary for the provision of health care and it is not reasonably possible to obtain consent in a timely manner.

 

2.     Indirect Collection – SLMHC may collect personal health information about an individual indirectly if:

 

a.     the individual consents to the collection being made indirectly;

b.     the information to be collected is reasonably necessary for providing health care or assisting in providing health care to the individual and it is not reasonably possible to collect, directly from the individual,

 

                                                              i.      Personal Health Information that can reasonably be relied on as accurate and complete, or

                                                            ii.      Personal Health Information in a timely manner;

 

c.      SLMHC is collecting the information for a purpose related to,

 

                                                              i.      investigating a breach of an agreement or a contravention or an alleged contravention of the laws of Ontario or Canada,

                                                            ii.      the conduct of a proceeding or a possible proceeding, or

                                                          iii.      the statutory function of SLMHC; given that SLMHC is an institution within the meaning of the Freedom of Information and Protection of Privacy Act;

 

d.    SLMHC collects the information from a person who is not a health information custodian for the purpose of carrying out research conducted in accordance with PHIPA subsection 37 (3) or research that a research ethics board has approved under PHIPA section 44 or that meets the criteria set out in PHIPA clauses 44 (10) (a) to (c), except if the person is prohibited by law from disclosing the information to SLMHC;

e.     the Commissioner authorizes that the collection be made in a manner other than directly from the individual;

f.       SLMHC collects the information from a person who is permitted or required by law or by a treaty, agreement or arrangement made under an Act or an Act of Canada to disclose it to SLMHC; or

g.     subject to the requirements and restrictions, if any, that are prescribed, SLMHC is permitted or required by law or by a treaty, agreement or arrangement made under an Act or an Act of Canada to collect the information indirectly.

 

3.     FundraisingSLMHC may collect, use or disclose Personal Health Information about an individual for the purpose of fundraising activities only:

 

a.     Where the individual expressly consents; or

b.     the individual consents by way of an implied consent and the information consists only of the individual’s name, mailing address of the individual, and the name and mailing address of the individual’s substitute decision-maker; and

c.      subject to the following requirements and restrictions on the manner in which consent is obtained and the resulting collection, use or disclosure of Personal Health Information:

 

                                                              i.      Personal Health Information held by SLMHC may only be collected, used or disclosed for the purpose of fundraising activities undertaken for a charitable or philanthropic purpose related to the operations of SLMHC.

                                                            ii.      For Personal Health Information collected on or after November 1, 2004, consent under paragraph (c) (i) (b) of the Act may only be inferred where

 

1.     SLMHC has at the time of providing service to the individual, posted or made available to the individual, in a manner likely to come to the attention of the individual, a brief statement that unless he or she requests otherwise, his or her name and contact information may be disclosed and used for fundraising purposes on behalf of SLMHC, together with information on how the individual can easily opt-out of receiving any future fundraising solicitations on behalf of SLMHC, and

2.     the individual has not opted out within 60 days of when the statement provided under subparagraph above was made available to him or her.

 

                                                          iii.      For Personal Health Information collected before November 1, 2004, SLMHC is entitled to assume that it has the individual’s implied consent to use or disclose the individual’s name and contact information for the purpose of fundraising activities,       unless SLMHC is aware that the individual has expressly withheld or withdrawn the consent.

                                                          iv.      All solicitations for fundraising must provide the individual with an easy way to opt-out of receiving future solicitations.

                                                            v.      A communication from SLMHC or a person conducting fundraising on its behalf to an individual for the purpose of fundraising must not include any information about the individual’s health care or state of health.

 

4.     MarketingSLMHC shall not collect, use or disclose Personal Health Information about an individual for the purpose of marketing anything or for the purpose of market research unless the individual expressly consents.

 

Principle 5 – Limiting Use, Disclosure, and Retention of Personal Health Information

 

1.     Use – SLMHC may use Personal Health Information about an individual for the following purposes (see SLMHC document “Sharing 0f Your Personal Health Information” in Policytech-Privacy-Forms).

 

a.     for the purpose for which the information was collected or created and for all the functions reasonably necessary for carrying out that purpose, but not if the “lock box” set out in Principle (3.8.a) applies;

b.     for a purpose for which this Act, another Act or an Act of Canada permits or requires a person to disclose it to SLMHC;

c.      for planning or delivering programs or services that SLMHC provides or that SLMHC funds in whole or in part, allocating resources to any of them, evaluating or monitoring any of them or detecting, monitoring or preventing fraud or any unauthorized  receipt of services or benefits related to any of them;

d.     for the purpose of risk management, error management or for the purpose of activities to improve or maintain the quality of care or to improve or maintain the quality of any related programs or services of SLMHC;

e.     for educating Agents to provide health care;

f.       in a manner consistent with Part II of PHIPA (Practices To Protect Personal Health Information) for the purpose of disposing of the information or modifying the information in order to conceal the identity of the individual;

g.      for the purpose of seeking the individual’s consent, or the consent of the individual’s substitute decision-maker, when the Personal Health Information used by SLMHC for this purpose is limited to the name and contact information of the individual and the  name and contact information of the substitute decision-maker, where applicable;

h.      for the purpose of a proceeding or contemplated proceeding in which SLMHC or the Agent or former agent of SLMHC is, or is expected to be, a party or witness, if the information relates to or is a matter in issue in the proceeding or contemplated  proceeding;

i.        for the purpose of obtaining payment or processing, monitoring, verifying or reimbursing claims for payment for the provision of health care or related goods and services;

j.        for research conducted by SLMHC, subject to SLMHC preparing a research plan and having a research ethics board approve it; or

k.      subject to the requirements and restrictions, if any, that are prescribed, if permitted or required by law or by a treaty, agreement or arrangement made under an Act or an Act of Canada.

 

2.     Disclosure – SLMHC may disclose Personal Health Information about an individual:

 

a.     to a health information custodian described in paragraph 1, 2, 3 or 4 of the definition of “health information custodian” in PHIPA subsection 3(1), if the disclosure is reasonably necessary for the provision of health care and it is not reasonably possible to obtain the individual’s consent in a timely manner, but not if the individual has expressly instructed the custodian not to make the disclosure;

b.     in order for the Minister, another health information custodian or a local health integration network to determine or provide funding or payment to the custodian for the provision of health care;

c.      for the purpose of contacting a relative, friend or potential substitute decision-maker of the individual, if the individual is injured, incapacitated or ill and unable to give consent personally; or

d.     for the purposes described below, in each as more particularly described in the noted Sections of PHIPA:

 

PHIPA

Disclosures

38.

Disclosures related to providing health care

39.

Disclosures for health or other programs

40.

Disclosures related to risks

41.

Disclosures for proceedings

42.

Disclosure to successor

43.

Disclosures related to PHIPA or other Acts

44.

Disclosure for research

45.

Disclosure for planning and management of health system

46.

Monitoring health care payments

47.

Disclosure for analysis of health system

48.

Disclosure with Commissioner’s approval

 

3.     Retention – SLMHC shall ensure that:

 

a.     the records of personal health information that it has in its custody or under its control are retained, transferred and disposed of in a secure manner, and where the subject of an Access Request for access (defined below), retained for as long as necessary to allow the individual to exhaust any recourse under PHIPA that he or she may have with respect to the request;

b.     where SLMHC or its representatives keep a record of Personal Health Information about an individual:

 

                                                   i.      in the individual’s home in any reasonable manner to which the individual consents, that it does so in accordance with any restrictions set out in a regulation, by-law or published guideline under the Regulated Health Professions Act, 1991, an Act referred to in Schedule 1 of that Act, the Drugless Practitioners Act or the Social Work and Social Service Work Act, 1998; or

                                                  ii.      in a place other than the individual’s home and other than a place in the control of the practitioner if (1) the record is kept in a reasonable manner; (2) the individual consents; and (3) the health care practitioner is permitted to keep the record in the place in accordance with a regulation, by-law or published guideline under the Regulated Health Professions Act, 1991, an Act referred to in Schedule 1 to that Act, the Drugless Practitioners Act or the Social Work and Social Service Work Act, 1998, if the health care practitioner is described in any of clauses (a) to (c) of the definition of “health care practitioner” in PHIPA section 2; and

 

c.      It complies with its guidelines and procedures with respect to the retention of Personal Health Information and applicable laws (see SLMHC policy PR.9.12 Retention of Health Records).

d.     Personal Health Information that is no longer required to fulfill the purposes may be destroyed, erased, or made anonymous in a secure manner and in compliance with legislative requirements (see SLMHC policy PR.9.02 Destruction of Patient Health Records).

 

Principle 6 – Ensuring Accuracy of Personal Health Information

SLMHC, when using Personal Health Information about an individual, shall take reasonable steps to ensure that the information is as accurate, complete and up-to-date as is necessary for the purposes for which it uses the information.  SLMHC will routinely update Personal Health Information when a patient presents for treatment.

SLMHC, when disclosing Personal Health Information about an individual, shall take reasonable steps to ensure that the information is as accurate, complete and up-to-date as is necessary for the purposes of the disclosure that are known to SLMHC at the time of the disclosure; or clearly set out for the recipient of the disclosure the limitations, if any, on the accuracy, completeness or up-to-date character of the information.

 

Principle 7 – Ensuring Safeguards for Personal Health Information

SLMHC shall:

1.     take steps that are reasonable in the circumstances to ensure that Personal Health Information in the custody or control of SLMHC is protected against theft, loss and unauthorized use or disclosure and to ensure that the records containing the information are protected against unauthorized copying, modification or disposal, including the following methods of protection;


a.     Physical measures, for example, locked filing cabinets, lock down of computers when not in use, restricted access to offices, swipe card access to sensitive areas;

b.     Organizational measures, for example, limiting access on a "need-to-know" basis, and

c.      Technological measures, for example, the use of passwords, encryption, and user trail audits.

 

2.     take reasonable steps to ensure that PHI in its custody or control is stored, retained, transferred and disposed of in a secure manner and in accordance with PHIPA and other applicable laws and professional standards;

3.     make its agents aware of the importance of maintaining the privacy and confidentiality of PHI.  Agents are expected to comply with SLMHC’s privacy policies/procedures and information practices, including all conditions and restrictions imposed by SLMHC;

4.     notify the individual at the first reasonable opportunity of the theft or loss or of the unauthorized use or disclosure, and include in the notice a statement that the individual is entitled to make a complaint to the Commissioner under PHIPA Part VI, if Personal Health Information about an individual that is in the custody or control of SLMHC is stolen or lost or if it is used or disclosed without authority; and

5.     notify the Commissioner of such theft or loss or unauthorized use or disclosure, if the circumstances surrounding a theft, loss or unauthorized use or disclosure meet the prescribed requirements;

6.     make its agents aware of the importance of maintaining the confidentiality of personal health information.  As a condition of employment, all SLMHC representatives (e.g., employees, medical staff, volunteers, students, independent contractors or other workers associated with SLMHC) must read, sign and comply with the SLMHC Oath of Confidentiality (see SLMHC document “Oath of Confidentiality” in Policytech-Privacy-Forms).

7.     ensure that care will be used in the disposal or destruction of personal information, to prevent unauthorized parties from gaining access to the information (see SLMHC policy PR. 9.02 Destruction of Patient Health Records).

 

Principle 8 – Openness Regarding Personal Health Information Policies and Practices

 

SLMHC will make readily available to individuals specific information about its policies and practices relating to the management of Personal Health Information.

 

1.     SLMHC policies and practices with respect to the management of personal information are readily available to patients if requested.  Patients will be able to acquire information about its policies and practices without unreasonable effort.  This information will be made available in a form that is generally understandable.  If the need arises, interpreter services are available to patients.

2.     The information made available includes:

 

a.     the SLMHC Privacy Statement (see SLMHC document in Policytech-Privacy-Forms);

b.     the “Sharing of Your Personal Health Information” poster (see SLMHC document in Policytech-Privacy-Forms); and

c.      a copy of  the patient brochure entitled “Privacy at Sioux Lookout Meno Ya Win Health Centre” (see SLMHC document in Policytech-Privacy-Forms).

 

Principle 9 – Individual Access to Own Personal Health Information

 

1.     Right of Access – SLMHC acknowledges that an individual has a right of access to a record of Personal Health Information about the individual that is in the custody or under the control of SLMHC unless:

a.     the record or the information in the record is subject to a legal privilege that restricts disclosure of the record or the information, as the case may be, to the individual;
b.     another Act, an Act of Canada or a court order prohibits disclosure to the individual of the record or the information in the record in the circumstances;
c.      the information in the record was collected or created primarily in anticipation of or for use in a proceeding, and the proceeding, together with all appeals or processes resulting from it, have not been concluded;
d.     the following conditions are met:


                                                              i.      the information was collected or created in the course of an inspection, investigation or similar procedure authorized by law, or undertaken for the purpose of the detection, monitoring or prevention of a person’s receiving or attempting to receive a service or benefit, to which the person is not entitled under an Act or a program operated by the Minister, or a payment for such a service or benefit, and

                                                            ii.      the inspection, investigation, or similar procedure, together with all proceedings, appeals or processes resulting from them, have not been concluded;

e.     granting the access could reasonably be expected to:

                                                    i.      result in a risk of serious harm to the treatment or recovery of the individual or a risk of serious bodily harm to the individual or another person (provided that before deciding to refuse to grant an individual access to a record of personal health information based on the concern that granting the access could reasonably be expected to result in a risk of serious harm to the treatment or recovery of the individual or a risk of serious bodily harm to the individual or another person, SLMHC may consult with a member of the College of Physicians and Surgeons of Ontario or a member of the College of Psychologists of Ontario,

                                                   ii.      lead to the identification of a person who was required by law to provide information in the record to the custodian, or

                                                  iii.      lead to the identification of a person who provided information in the record to the custodian explicitly or implicitly in confidence if the custodian considers it appropriate in the circumstances that the identity of the person be kept confidential;

f.       the following conditions are met; as an institution within the meaning of the Freedom of Information and Protection of Privacy Act, SLMHC would refuse to grant access to the part of the record, under clause 49 (a), (c) or (e) of the Freedom of Information and Protection of Privacy Act, if the request were made under that Act and that Act applied to the record;

g.      the record contains:

                                                   i.      quality of care information;

                                                  ii.      Personal Health Information collected or created for the purpose of complying with the requirements of a quality assurance program within the meaning of the Health Professions Procedural Code that is Schedule 2 to the Regulated Health Professions Act, 1991;

                                               iii.      raw data from standardized psychological tests or assessments;

                                                iv.      Personal Health Information that a researcher uses solely for the purposes of research, where the research is conducted in accordance with a research plan approved under subsection 44 (4) of PHIPA, or has been approved under clause 44 (10) (b) of PHIPA;

                                                  v.      Personal Health Information that is in the custody or control of a laboratory in respect of a test requested by a health care practitioner for the purpose of providing health care to the individual where the following conditions apply; i.e., the individual has a right of access to the information through the health care practitioner, or will have such a right when the information is provided by the laboratory to the health care practitioner within a reasonable time, and the health care practitioner has not directed the laboratory to provide the information directly to the individual.

2.     Records Dedicated to Another Person – A person is not entitled to a right of access to information about the person that is contained in a record that is dedicated primarily to the Personal Health Information of another person.

3.     Severable record – An individual has a right of access to that part of a record of Personal Health Information about the individual that can reasonably be severed from the part of the record to which the individual does not have a right of access as a result of paragraph (1) above.  If a record is not a record dedicated primarily to Personal Health Information about the individual requesting access, the individual has a right of access only to the portion of Personal Health Information about the individual in the record that can reasonably be severed from the record for the purpose of providing access.

4.     Individual’s plan of service – SLMHC shall not refuse to grant the individual access to his or her plan of service within the meaning of the Home Care and Community Services Act, 1994.

5.     Informal access – None of the foregoing prevents SLMHC from:

a.     granting an individual access to a record of Personal Health Information, to which the individual has a right of access, if the individual makes an oral request for access or does not make any request for access under section 53; or

b.     with respect to a record of Personal Health Information to which an individual has a right of access, communicating with the individual or his or her substitute decision-maker who is authorized to consent on behalf of the individual to the collection, use or disclosure of Personal Health Information about the individual.

6.     Duty of SLMHCNone of the foregoing relieves SLMHC from a legal duty to provide, in a manner that is not inconsistent with this policy, Personal Health Information as expeditiously as is necessary for the provision of health care to the individual.

7.     Processing Access RequestsSLMHC shall process access requests in accordance with SLMHC policy PR. 9.30. “Procedure for Processing Access Requests”.

8.     Corrections – SLMHC shall correct Personal Health Information records in accordance with the SLMHC policy PR. 9.31 “Procedure for Correcting Personal Health Information”.

 

Principle 10 – Challenging Compliance with SLMHC’s Privacy Policies and Practices

A patient will be able to address a challenge concerning compliance with this policy to SLMHC Privacy Officer.

1.     SLMHC will investigate all complaints.  If a complaint is found to be justified, SLMHC will take appropriate measures, including, if necessary, amending its policies and practices.

2.     Any person may ask questions or raise concerns regarding SLMHC’s information practices, policies or compliance with PHIPA by contacting SLMHC’s Privacy Officer at privacy(at)slmhc(dot)on(dot)ca or (807) 737-6551.

3.     SLMHC will receive and respond to complaints or inquiries about our information practices and policies and will inform individuals who make inquiries or lodge complaints of other available complaint procedures.

4.     Individuals may also make a complaint to the Information and Privacy Commissioner/Ontario at:

 

2 Bloor Street East, Suite 1400
Toronto, Ontario M4W 1A8 Canada
Phone: 1 (800) 387-0073 (or 416-326-3333 in Toronto)
Fax: 416-325-9195
www.ipc.on.ca

 

Principle 11 – Non-Compliance

Breaches to this Privacy Policy and other related privacy policies may be subject to disciplinary action up to and including termination of the agent’s appointment/employment/affiliation with SLMHC.

SLMHC and its agents may be subject to the fines and penalties up to for failure to comply with PHIPA, and may also be subject to legal action (see SLMHC policy PR 9.29 - Privacy Breach Policy).