Your Health Information and Your Privacy
Protecting your privacy is important to us
Under Ontario’s health privacy law, anyone who provides you with health services must protect your health information. That includes us. We have to tell you what we do with your health information, and in certain situations, ask permission before we get it, use it, or share it. We are not allowed to collect, use, or share health information if we don’t need to, or collect, use, or share more information than is necessary. You can also ask to see the information in your record and ask us to change or correct it if you think there is a mistake.
Under the law, we have to tell you if your health information is stolen, lost, or if it’s been used or shared improperly. In certain cases, we also have to report the privacy breach to the Information and Privacy Commissioner of Ontario (IPC). The IPC oversees compliance with Ontario’s health privacy law, hears and decides complaints about the handling of personal health information, and educates the public about their privacy rights.
This page describes our privacy practices and tells you how you can exercise your rights.
WHO CAN USE AND SEE YOUR HEALTH INFORMATION
IMPLIED CONSENT TO COLLECT, USE, AND SHARE YOUR INFORMATION TO PROVIDE HEALTH CARE
When you seek health care from us, and unless you tell us otherwise, we assume that we have your permission to collect, use, and share your health information among the health care providers at our organization. This includes doctors, nurse practitioners, nurses, residents, social workers, therapists, and other professionals or their support staff who provide or assist in providing health care to you. We may also share your health information with other healthcare providers outside our organization so they can provide you with ongoing health care and follow-up. Generally, we do not allow staff members who do not provide or assist in your health care to see your health information.
UPDATING THE PROVINCIAL ELECTRONIC HEALTH RECORD
We may provide your health information to Ontario Health to update your provincial electronic health record (EHR).
The EHR system is a provincial health record system that allows your healthcare providers to access, in one place, your health information from anywhere across the province.
The purpose of the EHR is to help facilitate and coordinate your health care across providers.
EXPRESS CONSENT TO SHARE YOUR INFORMATION WITH OTHER PEOPLE
Sometimes we cannot assume we have your permission to share your health information with others. For example, we generally have to ask your express permission to share your health information with:
Let us know if you want us to share your health information with your family and friends. For example, you may want us to tell your loved ones about your care or treatment plan or what kind of care you may need at home.
LIMITS ON COLLECTING, USING, AND SHARING YOUR HEALTH INFORMATION
In some cases, you can tell us not to collect, use, or share some or all of your health information. If you choose to limit how we share your health information for healthcare purposes, you should be aware that when we give your health information to other healthcare providers, we are still required to tell them when we are not able to give them all the information they will need to provide you with health care.
USING YOUR HEALTH INFORMATION WITHOUT YOUR CONSENT
Ontario’s health privacy law allows or requires us to use your health information without your consent in some situations, including:
SHARING YOUR HEALTH INFORMATION WITHOUT YOUR CONSENT
The law allows or requires us to share your health information with others without your consent in some situations, including:
INFORMATION ABOUT A DECEASED INDIVIDUAL
The law also allows us to share health information about a deceased individual:
PEOPLE WHO CAN MAKE DECISIONS FOR YOU
We presume that you are able to make your own decisions about your health information. If we determine that you cannot, another person, usually a family member, will make decisions for you. The law tells us who to turn to first on a list of “substitute decision makers.” That person can make decisions about your health information that relates to that treatment. Alternatively, you may decide, in advance, who can consent on your behalf when you are no longer capable of making these decisions.
We may give your substitute decision-maker information about you to help them make decisions on your behalf. They can also ask to see your records, and our staff will give them information about your health. We will ask you or the person who can consent on your behalf, before giving your health information to your other family members.
RESEARCH
We may use or share your health information for research projects, such as those that are meant to improve health care or the health system. Sometimes, we will ask you for consent before we use or share your health information for this purpose. In other circumstances, when a research ethics board determines it is appropriate and the researcher complies with specific requirements, your consent may not be required. If that happens, researchers can only use your health information according to an approved research plan, and cannot contact you without your consent.
PLANNING AND MANAGING THE HEALTH SYSTEM AND FACILITATING HEALTHCARE
The law allows us to share your health information with certain organizations that help:
YOUR HEALTH NUMBER
The number on the front of your OHIP card is your “health number” and is a special kind of health information, with special rules.
Only people and organizations that provide you with health care or goods or services funded by the government of Ontario, like health care covered by OHIP, can require you to show your health card.
A healthcare provider can collect, use and share your health number, to treat you and receive payment from OHIP.
YOUR RIGHTS AND CHOICES
SEEING YOUR HEALTH RECORD
You have the right to see your health record and to get a copy of it. You simply have to ask us for it. We may ask you to put your request in writing, and you may be required to pay a fee.
Some exceptions may apply. For example, you may not be able to see information in a record that relates to law enforcement, or legal proceedings or that is about another individual.
We must respond to your request within 30 days. There may be a delay of up to a maximum of 30 more days if we have to ask others about the record or if we need time to find the record and process the request. We must tell you about any delays within the first 30 days of receiving your request. If you require the record urgently, we must respond to your request within a shorter period, if possible.
CORRECTING YOUR RECORD
If you believe that your health record is inaccurate or incomplete, you may write to us and ask for a correction.
We must reply to your request within 30 days. In some cases, we may extend the time for a response up to a maximum of 30 more days. We must tell you about any delays within the first 30 days of receiving your request.
We are not obligated to correct a record created by someone else or if it contains a professional opinion or observation made in good faith. We will tell you why we are refusing a requested correction. If we refuse your request, you have the right to have a statement of disagreement attached to your record. You can also ask to have this statement made available to those who see the record.
WHO YOU CAN TALK TO ABOUT YOUR QUESTIONS OR CONCERNS
Please speak to the front desk at the Sundridge & District Medical Centre:
THE INFORMATION AND PRIVACY COMMISSIONER OF ONTARIO
If we are unable to resolve all of your concerns about your health information, you may contact the IPC, which oversees compliance with Ontario’s health privacy law.
You can make a complaint to the IPC about any decision, action, or inaction that you believe does not comply with the law, such as:
You can contact the IPC at:
Information and Privacy Commissioner of Ontario
2 Bloor Street East, Suite 1400, Toronto, ON, M4W 1A8
Telephone: 416 326 3333 or 1 800 387 0073
TTY: 416 325 7539
www.ipc.on.ca
[email protected]
About the IPC
The role of the Information and Privacy Commissioner is set out in five statutes: the Freedom of Information and Protection of Privacy Act, the Municipal Freedom of Information and Protection of Privacy Act, the Personal Health Information Protection Act, 2004, Part X of the Child, Youth and Family Services Act, 2017, and the Anti-Racism Act.
Protecting your privacy is important to us
Under Ontario’s health privacy law, anyone who provides you with health services must protect your health information. That includes us. We have to tell you what we do with your health information, and in certain situations, ask permission before we get it, use it, or share it. We are not allowed to collect, use, or share health information if we don’t need to, or collect, use, or share more information than is necessary. You can also ask to see the information in your record and ask us to change or correct it if you think there is a mistake.
Under the law, we have to tell you if your health information is stolen, lost, or if it’s been used or shared improperly. In certain cases, we also have to report the privacy breach to the Information and Privacy Commissioner of Ontario (IPC). The IPC oversees compliance with Ontario’s health privacy law, hears and decides complaints about the handling of personal health information, and educates the public about their privacy rights.
This page describes our privacy practices and tells you how you can exercise your rights.
WHO CAN USE AND SEE YOUR HEALTH INFORMATION
IMPLIED CONSENT TO COLLECT, USE, AND SHARE YOUR INFORMATION TO PROVIDE HEALTH CARE
When you seek health care from us, and unless you tell us otherwise, we assume that we have your permission to collect, use, and share your health information among the health care providers at our organization. This includes doctors, nurse practitioners, nurses, residents, social workers, therapists, and other professionals or their support staff who provide or assist in providing health care to you. We may also share your health information with other healthcare providers outside our organization so they can provide you with ongoing health care and follow-up. Generally, we do not allow staff members who do not provide or assist in your health care to see your health information.
UPDATING THE PROVINCIAL ELECTRONIC HEALTH RECORD
We may provide your health information to Ontario Health to update your provincial electronic health record (EHR).
The EHR system is a provincial health record system that allows your healthcare providers to access, in one place, your health information from anywhere across the province.
The purpose of the EHR is to help facilitate and coordinate your health care across providers.
EXPRESS CONSENT TO SHARE YOUR INFORMATION WITH OTHER PEOPLE
Sometimes we cannot assume we have your permission to share your health information with others. For example, we generally have to ask your express permission to share your health information with:
- people who do not provide you with health care, like insurance companies or your employer
- a healthcare provider for reasons other than providing you with healthcare
Let us know if you want us to share your health information with your family and friends. For example, you may want us to tell your loved ones about your care or treatment plan or what kind of care you may need at home.
LIMITS ON COLLECTING, USING, AND SHARING YOUR HEALTH INFORMATION
In some cases, you can tell us not to collect, use, or share some or all of your health information. If you choose to limit how we share your health information for healthcare purposes, you should be aware that when we give your health information to other healthcare providers, we are still required to tell them when we are not able to give them all the information they will need to provide you with health care.
USING YOUR HEALTH INFORMATION WITHOUT YOUR CONSENT
Ontario’s health privacy law allows or requires us to use your health information without your consent in some situations, including:
- to educate those acting on our behalf in providing health care, such as medical students or residents
- to contact you to get your consent or the consent of someone who may consent on your behalf
- to do research with the approval of a research ethics board
- to receive payment for our services
- to plan or deliver our programs or services
- for risk management purposes
- in a legal proceeding (e.g. a court case) where we or someone acting on our behalf is a party or a witness
- as permitted or required by law
SHARING YOUR HEALTH INFORMATION WITHOUT YOUR CONSENT
The law allows or requires us to share your health information with others without your consent in some situations, including:
- if sharing the information is necessary to provide you with health care and we cannot get your consent in a timely manner
- to obtain payment for providing health care through government programs, like the Ontario Health Insurance Plan (OHIP)
- to contact a relative, friend, or someone who may consent on your behalf, if you are injured, incapacitated, or ill and unable to give consent
- to report certain diseases to public health authorities
- when we suspect certain types of abuse
- to reduce or eliminate a risk of harm
- to assist with a law enforcement investigation or to comply with a warrant
- in a legal proceeding where we or someone acting on our behalf is a party or witness
- as permitted or required by law
INFORMATION ABOUT A DECEASED INDIVIDUAL
The law also allows us to share health information about a deceased individual:
- to identify the individual who has died
- to inform someone that the individual has died and the circumstances of the death, where appropriate
- if the deceased individual’s spouse, partner, sibling, or child needs the information to make decisions about their own health care or their children’s health care
PEOPLE WHO CAN MAKE DECISIONS FOR YOU
We presume that you are able to make your own decisions about your health information. If we determine that you cannot, another person, usually a family member, will make decisions for you. The law tells us who to turn to first on a list of “substitute decision makers.” That person can make decisions about your health information that relates to that treatment. Alternatively, you may decide, in advance, who can consent on your behalf when you are no longer capable of making these decisions.
We may give your substitute decision-maker information about you to help them make decisions on your behalf. They can also ask to see your records, and our staff will give them information about your health. We will ask you or the person who can consent on your behalf, before giving your health information to your other family members.
RESEARCH
We may use or share your health information for research projects, such as those that are meant to improve health care or the health system. Sometimes, we will ask you for consent before we use or share your health information for this purpose. In other circumstances, when a research ethics board determines it is appropriate and the researcher complies with specific requirements, your consent may not be required. If that happens, researchers can only use your health information according to an approved research plan, and cannot contact you without your consent.
PLANNING AND MANAGING THE HEALTH SYSTEM AND FACILITATING HEALTHCARE
The law allows us to share your health information with certain organizations that help:
- improve and make healthcare delivery easier
- plan and manage the health care system
YOUR HEALTH NUMBER
The number on the front of your OHIP card is your “health number” and is a special kind of health information, with special rules.
Only people and organizations that provide you with health care or goods or services funded by the government of Ontario, like health care covered by OHIP, can require you to show your health card.
A healthcare provider can collect, use and share your health number, to treat you and receive payment from OHIP.
YOUR RIGHTS AND CHOICES
SEEING YOUR HEALTH RECORD
You have the right to see your health record and to get a copy of it. You simply have to ask us for it. We may ask you to put your request in writing, and you may be required to pay a fee.
Some exceptions may apply. For example, you may not be able to see information in a record that relates to law enforcement, or legal proceedings or that is about another individual.
We must respond to your request within 30 days. There may be a delay of up to a maximum of 30 more days if we have to ask others about the record or if we need time to find the record and process the request. We must tell you about any delays within the first 30 days of receiving your request. If you require the record urgently, we must respond to your request within a shorter period, if possible.
CORRECTING YOUR RECORD
If you believe that your health record is inaccurate or incomplete, you may write to us and ask for a correction.
We must reply to your request within 30 days. In some cases, we may extend the time for a response up to a maximum of 30 more days. We must tell you about any delays within the first 30 days of receiving your request.
We are not obligated to correct a record created by someone else or if it contains a professional opinion or observation made in good faith. We will tell you why we are refusing a requested correction. If we refuse your request, you have the right to have a statement of disagreement attached to your record. You can also ask to have this statement made available to those who see the record.
WHO YOU CAN TALK TO ABOUT YOUR QUESTIONS OR CONCERNS
Please speak to the front desk at the Sundridge & District Medical Centre:
- if you have a question about our privacy policies and practices in handling your health information
- if you wish to talk to someone about your health information, or you want to know more about how to give, withhold, or withdraw consent to your health information being collected, used, or given out to someone else
- if you want to see your health record or request a correction
- if you are wondering about something that may have happened to your health information, and need more detailed information
THE INFORMATION AND PRIVACY COMMISSIONER OF ONTARIO
If we are unable to resolve all of your concerns about your health information, you may contact the IPC, which oversees compliance with Ontario’s health privacy law.
You can make a complaint to the IPC about any decision, action, or inaction that you believe does not comply with the law, such as:
- if you are unable to resolve a complaint or concern about how your health information has been handled
- if you are unable to see all of your health information or want to complain about a delay in responding to your request
- if you feel the health information in your record is incorrect and you have been unable to persuade us to correct the information to your satisfaction, or if we refuse to attach your statement of disagreement to your record, or
- if you disagree with the fee that we charged for you to see or get a copy of your health record
You can contact the IPC at:
Information and Privacy Commissioner of Ontario
2 Bloor Street East, Suite 1400, Toronto, ON, M4W 1A8
Telephone: 416 326 3333 or 1 800 387 0073
TTY: 416 325 7539
www.ipc.on.ca
[email protected]
About the IPC
The role of the Information and Privacy Commissioner is set out in five statutes: the Freedom of Information and Protection of Privacy Act, the Municipal Freedom of Information and Protection of Privacy Act, the Personal Health Information Protection Act, 2004, Part X of the Child, Youth and Family Services Act, 2017, and the Anti-Racism Act.