1) Objective & Scope of Policy
Carea Community Health Centre is committed to respecting your privacy and has developed a Privacy Statement, in accordance with the new Federal Privacy Act, to inform you of our policy and practices concerning the collection, use and disclosure of personal information.
This policy statement governs personal information collected from and about individuals who are or may become clients, members or donors and those individuals outside of Carea Community Health Centre with whom we work. This policy does not cover aggregated data from which the identity of an individual cannot be determined. Carea Community Health Centre retains the right to use aggregated data in any way that it determines appropriate.
In the event of questions about: (i) access to your personal information; (ii) Carea Community Health Centre collection, use, management or disclosure of personal information; or (iii) this policy statement; please contact:
Carea Community Health Centre
115 Grassmere Ave.
Telephone: (905) 723-0036
2) The Collection, Use and Disclosure of Personal Information
This policy pertains to:
- clients (any individual who may or has used the Carea Community Health Centre services),
- board members (any person who is or who submitted an application to become a board member of Carea Community Health Centre), and
- donors (any person who has made a contribution or donation to the Carea Community Health Centre).
"Personal information" means any information, recorded in any form, about an identified individual, or an individual whose identity may be inferred or determined from such information.
At any time a client may withdraw their consent to use their personal health information by making a formal request to their provider or to the privacy officer which would be documented and added to their record. In addition, the client's name will be recorded on a master list indicating withdrawal of consent.
Clients also have the right to instruct that a part of their personal health information not be shared with other providers or external agencies. This is referred to as the lockbox provision. Procedures dealing with the "Lock Box" provision are detailed below in 2.1 "Lock Box" Provision.
Carea Community Health Centre uses the personal information provided verbally or in writing by clients, members, or donors in order to:
- Provide clients with health and health related services and programs;
- Manage our relationship with clients;
- Manage our relationship with members and donors;
- Meet any legal or regulatory requirement; and
- Such other purposes consistent with the foregoing purposes.
Carea Community Health Centre use of personal information is limited to these purposes. Carea Community Health Centre does not sell, trade, barter or exchange for consideration any personal information it has obtained. Unless permitted by law, no personal information is collected about a client, member or donor without first obtaining the consent of the individual to the collection, use and dissemination of that information.
Personal information will be collected, to the extent possible, directly from the individual concerned. In order to meet client needs, personal information provided by clients may be shared between personnel of the various service areas of Carea Community Health Centre. In the event of a client being incapable of giving consent, effort will be made to obtain consent from a substitute decision maker.
Where a client is transferred to another health care provider not working for or with Carea Community Health Centre, the client's written consent will be obtained prior to disclosing the client's personal information.
Carea Community Health Centre may disclose personal information of clients, members or donors to organizations or individuals that perform services on behalf of Carea Community Health Centre. Using contractual or other arrangements, Carea Community Health Centre shall ensure that agents, contractors or third party service providers, who may receive personal information in the course of providing services to Carea Community Health Centre, agree to use such information solely for the purposes of providing services to Carea Community Health Centre and under the instruction of Carea Community Health Centre and, with respect to that information, to act in a manner consistent with the relevant principles articulated in this policy.
Please note that there are circumstances where the use and/or disclosure of personal information may be justified or permitted or where Carea Community Health Centre is obliged to disclose information without consent. Such circumstances may include:
- Where required by law or by order or requirement of a court, administrative agency or other governmental tribunal;
- Where Carea Community Health Centre believes, upon reasonable grounds, that it is necessary to protect the rights, privacy, safety or property of an identifiable person or group;
- Where it is necessary to permit Carea Community Health Centre to pursue available remedies or limit any damages that Carea Community Health Centre may sustain; or
- Where the information is public.
Where obliged or permitted to disclose information without consent, Carea Community Health Centre will not disclose more information than is required.
2.1 "Lock Box Provisions"
If a client instructs a provider not to release a part of his/her health information to another service provider, the provider must advise the other service provider or agencies that some relevant information has been withheld at the direction of the client.
Procedure to lock:
- A client may verbally, or in writing, ask their provider to "lock" specific and/or all of their personal health information from other service providers. It is preferred that the client provide the request in writing regarding which information and which provider/agency the information is to be withheld from as to ensure proper diligence. It should be pointed out to the client that in doing so their quality of health care may be affected.
- The client's primary provider will complete a "Lock Box" form with all appropriate details and insert into client's chart.
- The client's chart will be marked on the outside front cover that it contains "locked" information.
- If information is "locked" from internal providers/staff, the primary provider who completed the "Lock Box" form is responsible to inform those "locked out" staff.
Procedure to change/revoke lock by client:
- Instructions to change/revoke locked information must be directed to the primary provider in writing.
- Provider will document in progress notes and written of client will be kept in progress notes of chart.
- Marking on outside of client's chart will be removed/revised if applicable.
Procedure to unlock on request by third party:
- Requests for locked information must be directed to the primary provider in writing.
- The primary provider will explore the matter of the "locked" personal health information with the individual and seek his/her consent to access the locked information.
- Written consent will be obtained and placed in the client's chart prior to any information being released.
If the provider believes that disclosure is necessary to eliminate or reduce significant risk of serious bodily harm to person or persons, he/she must: Disclose the personal health information to the third party. Note the disclosure and circumstances surrounding it in client's chart and, if appropriate, informs the client that disclosure has occurred.
3) Accurate Information
Carea Community Health Centre endeavours to ensure that any personal information provided by its Clients and Members and in its possession is as accurate, current and complete as necessary for the purposes for which Carea Community Health Centre uses that data. Information contained in files that have been closed is not actively updated or maintained.
Carea Community Health Centre retains personal information as long as Carea Community Health Centre believes it is necessary to fulfill the purpose for which it was collected and properly disposed of when personal information is no longer used or needed as pertains to our document retention chart.
Carea Community Health Centre endeavours to maintain adequate security with respect to its offices and information stored at it facilities so as to prevent any loss, misuse, unauthorized access, disclosure, or modifications of personal information. If personal information of a client has been lost, stolen, improperly disclosed or had unauthorized use the individual(s) will be notified.
Carea Community Health Centre further protects personal information by restricting access to it to those employees that the management of Carea Community Health Centre has determined need to know that information in order that Carea Community Health Centre may provide its services. Carea Community Health Centre has strict policies in regards to confidentiality of information for both employees and volunteers.
6) Access to Personal Information
Carea Community Health Centre permits access to and review of personal information held and owned by Carea Community Health Centre about an individual by the individual concerned. All requests must be supplied in writing and sufficient information is required to confirm the identity of the person making the request before granting access or making corrections to personal information. Appropriate Carea Community Health Centre staff will be present during the review to address any issues that may arise.
If an individual believes any personal information concerning that individual is not correct, that person may request an update of that information by sending a request to the Privacy Officer. Carea Community Health Centre reserves the right not to change any personal information but will append any alternative text the individual concerned believes appropriate. An individual may also request that Carea Community Health Centre delete an individual's personal information from Carea Community Health Centre's system and records. However, due to technical constraints and the fact that Carea Community Health Centre backs up its systems, personal information may continue to reside in Carea Community Health Centre systems after deletion. Individuals, therefore, should not expect that their personal information would be completely removed for Carea Community Health Centre systems in response to an accepted request for deletion.
Clients may have access to their health information by requesting the information from their provider in writing. Carea Community Health Centre will endeavor to provide the information in question within a reasonable time and no later than 30 days following the request.
Procedure to access Personal Information:
- The client submits the request in writing to the provider detailing the following:
- A description of what information or records is requested.
- The signature of the client.
- The signature of a witness to the authorized person's signature
- The date the written request was signed.
- The written request shall be placed in the client's chart.
- A notation shall be made in the client's record stating:
- What information or records were disclosed
- When the information or records were disclosed
- By whom the information or records were disclosed>
- Before records are copied, each page must be numbered.
Carea Community Health Centre reserves the right to decline access to personal information where the information requested:
- Would disclose the personal information of another individual or of a deceased individual;
- Is subject to solicitor-client or litigation privilege;
- Could reasonably result in:(i) serious harm to the treatment or recovery of the individual concerned; (ii) serious emotional harm to the individual or another individual; or (iii) serious bodily harm to an individual;
- May harm or interfere with law enforcement activities and other investigative or regulatory functions of a body authorized by statute to perform such functions
- Is not readily retrievable and the burden or cost of providing would be disproportionate to the nature or value of the information; or
- Does not exist, is not held or cannot be found by Carea Community Health Centre
Where information will not or cannot be disclosed, the individual making the request will be provided with the reasons for non-disclosure.
Where information will be disclosed, Carea Community Health Centre will endeavor to provide the information in question within a reasonable time and no later than 30 days following the request.
7) Amendment of Carea Community Health Centre Practices and this Policy
This statement is in effect as of January 1, 2017. Carea Community Health Centre will review and revise its privacy practices and this Policy Statement as part of a yearly review. In the event of any amendment, an appropriate notice will be communicated to Clients, Members and Donors in an appropriate manner. Policy changes will apply to the information collected from the date of the revised Policy Statement as well as to existing information held by Carea Community Health Centre
8) Handling Inquiries or Complaints
Any questions, comments or complaints about our privacy policies and procedures are to be directed to our Privacy Officer, at the contact information provided in section 1 of this policy statement. Carea Community Health Centre's Privacy Officer will make all efforts to address concerns however, if the client is not satisfied with the response, he/she may contact the Information and Privacy Commissioner in writing at 2 Bloor Street East, Toronto, Ontario M4W 1A8.
9) In Summary
When you provide Carea Community Health Centre with personal information, you consent and agree to the following:
- The collection, use and disclosure of personal information from or about you as described in Section 2 and to your right to access and correct data as described in Section 6.
- Your acceptance of the risks concerning the transmission of information to Carea Community Health Centre as described in Section 5.
- The amendment of this Policy Statement as described in Section 7.