Credit Valley Hospital

Protecting your privacy

Protecting your Privacy

This information has been provided as a result of a joint initiative by
The Credit Valley Hospital
Trillium Health Centre
William Osler Health Centre

Our Commitment to Privacy, Confidentiality and Security of Personal Health Information

At Credit Valley Hospital, we recognize that your Personal Health Information deserves to be treated with the same respect and sensitivity with which we treat you, our patient. We have therefore taken measures to ensure that we protect the privacy, confidentiality and security of your personal health information. Those measures include

A Statement of Information Practices which govern how we use the personal health information that we collect from you, and the purposes and conditions under which we may disclose it. Please if you have any inquiries or concerns about our information practices.
Extensive training for our staff, volunteers and healthcare professionals.

We have developed Frequently Asked Questions to assist you in understanding what our Information Practices mean to you. The information contained in the Statement of Information Practices and Frequently Asked Questions will be constantly updated to reflect changing legislation, and continuous improvements to the way in which we collect, use, disclose and protect your personal health information as we deliver services to you.

If you would like access to your personal health information record, please .

(Definition of) Personal Health Information

‘Personal Health Information’ is spoken or written information that:

relates to the physical or mental health of the individual, including the individual’s family medical history
relates to the individual’s health care
is an individual health care plan, according to the Long Term Care Act, 1994
relates to the individual’s healthcare payments or eligibility for healthcare
relates to an individual’s donation of any body part or bodily substance, or is derived from testing of such body part or substance
is the individual’s health number, or
identifies a provider of healthcare to the individual or a substitute decision-maker of the individual

Information is ‘identifying’ when it is personal or it is reasonable to believe that it could be utilized, either alone or with other information, to identify the individual.

Statement of Information Practices

Our Statement of Information practices describes how we use the personal health information that we collect from you, how we protect your information, and the purposes and conditions under which we may share it with it. We value the trust you have placed in us and we are committed to ensuring that your information remains confidential and secure.

1. Accountability and Openness

We are accountable to project the privacy of personal health information in our custody or under our control. We also keep a strong focus on performance excellence by ensuring that we monitor how we are doing. We use these results to continuously improve the way in which we protect your right to privacy.

At Credit Valley Hospital we are open about how we protect the privacy of your personal health information. We have assigned a contact person to address your privacy-related inquiries or complaints, and your requests for access to your personal health information records.

2. Collection

We collect personal health information primarily from you, for the purpose of providing you with appropriate health care. If you are unable to provide us with the information we need to treat you, we may collect the information from other healthcare professionals who are or who have been involved in your treatment, or someone who has been designated as your substitute decision-maker.

We will also collect personal health information about you from someone other than yourself if you provide us with consent to do so, or if we are authorized to do so by legislation.

We will only collect the information we need to treat you. We promise to comply with the regulations and legal requirements governing health information and privacy.

3. Use

We will use your personal health information to:

Plan and enhance our services to you, including:
- Evaluation and monitoring of our programs
- Chart reviews
- Monitoring or preventing fraud or any unauthorized receipt of services or benefits
- Educating our agents to provide health care
- Contacting you to gather information on your satisfaction with or concerns about your visit. This will help us to continuously improve our services to you
Contact you for donations. Our hospital foundation will always provide you with an opportunity to decline further contact.

4. Disclosure

Your personal health information will be shared with other healthcare professionals involved in your treatment.
In cases where you are unable to provide consent, we may discuss some parts of your personal health information with your substitute decision maker in order to obtain their consent for ongoing treatment.
We will disclose personal health information where we are legislated to do so or where a court order or warrant is provided to us
We will disclose your general status and location as a patient to individuals inquiring about you, unless you tell us not to
With your consent, we will also disclose your personal health information to researchers as long as our hospital has approved the research proposal and the researcher has entered into a confidentiality agreement with us
We will disclose your information for the purposes of processing insurance claims.
If you indicate that you would like spiritual care while in the hospital, we will share your name, religious affiliation and location with our spiritual advisors.

5. Consent

When you provide us with your personal health information we believe that you understand that the information will be used and shared with others involved in your healthcare.

If you do not wish your personal health information to be used or shared, you have the right to refuse to provide all or part of the information to us. At the time we request the information or anytime afterwards.
We may not be able to fulfil your wishes if they impact our ability to deliver quality healthcare to you, or if we are legislated to use or disclose the information that you are objecting to. In these cases we will discuss the impact of your objection with you.

If we find it necessary to disclose your information for purposes other than providing healthcare, we will notify you of the purpose for the disclosure and ask you for consent to disclose the information.

The way we collect your consent may vary depending on the purpose for the consent.

6. Notice

We have posted notices at key areas in our hospital. The notices explain why we collect, use and disclose your personal health information and tell you where to get more detailed information.

7. Accuracy

We strive to keep your personal health information as accurate, complete and up to date as possible, taking into account its uses and your interests.

8. Safeguards

We maintain a high level of security with respect to the confidentiality of your personal health information. Our staff, physicians and volunteers are required to abide by our privacy policy and sign an agreement to that effect. We use up-to-date technology standards to secure your information, and we monitor internal compliance with our information practices. In some cases we may share your personal health information with third party data processors, vendors, suppliers or providers responsible for administering our programs. These organizations must sign a contract with us to follow privacy and health information practices that are the same or similar to our own.

9. Individual Access and Correction

We establish and maintain a record of your personal health information. You have the right to access your health record by submitting a written request to our department or call 905-813-3830. We must provide you with access to your file within 30 days of your request. If your request requires us to conduct a lengthy search, we may request an extension for another 30 days.

You may request corrections to the information in your file by providing us with additional information that supports your request. If your file contains information that was not provided by our hospital, we may not have the knowledge to correct that particular information and you may need to go back to the source request the correction.

10. Inquiries and Challenging Compliance

You may direct any inquiries about our information practices, or complaints with respect to our compliance with our information practices, to our or call 905-813-3830.

If you are unable to resolve your complaint by working with our Privacy Office, you may contact the Information and Privacy Commissioner at:

Information and Privacy Commissioner/Ontario
2 Bloor Street East
Suite 1400
Toronto, Ontario
M4W 1A8

(416) 326-3333

Frequently Asked Questions

1	Q.	What is privacy?
	A.	Your right as a patient to determine when, how, and to what extent you share information about yourself with others. You will be able to make this determination because we will notify you regarding the purposes for which we collect, use or disclose your personal health information, and we will ask you for permission to collect, use or disclose your personal health information where applicable. Privacy is best addressed at or before the time we collect your information.
2	Q.	What is confidentiality?
	A.	Protecting your information after it is collected. This means that staff members, physicians and volunteers must not talk about or disclose your personal health information to anyone other than you, your substitute decision maker where applicable, or other staff or healthcare team members that have a need to know.
3	Q.	What is security?
	A.	Physically and technologically protecting your information after it is collected. This means that staff members, physicians and volunteers will physically protect your information by (for instance) locking their file cabinets. The hospital will technologically protect your information by (for instance) ensuring that your information can only be accessed by those with a need to know.
4	Q.	The Statement of Information Practices provides me with some information about who the hospital discloses my personal health information to. Can you provide me with a few more details?
	A.	*Other members of your healthcare team, such as physicians, nurses and others involved in the provision of your healthcare.* The Provincial Ministry of Health and Long Term Care (billing information), the Canadian Institute for Health Information (statistical information), Health Canada (public health surveillance), and Cancer Care Ontario (pathology reports) – to ensure that the healthcare system is running optimally. Private insurance companies regarding incidental costs not covered by provincial health insurance. The Hospital will always obtain permission from the patient in this instance. *Collection agencies to collect on unpaid costs which were not covered by provincial health insurance.* *Researchers whose studies have been approved through the hospital’s Research Committee.*
5	Q.	Does the hospital share any of my information with other organizations, for reasons other than to provide me with healthcare?
	A.	*Not without your consent, or unless we are legislated to do so.*
6	Q.	Does the Hospital ever sell or lease my personal health information to drug companies, or anyone else?
	A.	*No.*
7	Q.	The Statement of Information Practices tells me that I can contact the Privacy Office (905-813-3830) if I have any privacy-related inquiries or complaints. However, if I am providing information at any point during my visit (for example at registration, or when I am in the Health Information Management department) and have a question about why certain information is being collected or how it is being used, can’t the staff member I’m dealing with answer the question?
	A.	All of our staff are trained to respond to your questions to the best of their ability at the time. However if the staff member is unable to respond to the question, they will seek assistance as soon as possible or if necessary they may refer you to our Privacy Office (905-813-3830) for further assistance.
8	Q.	What should I include in my request to access to my personal health information record ?
	A.	The written request for health records must include your name, date of birth, and mailing address as well as the type of information you are requesting. The request must be dated, witnessed and signed by one other person.
9	Q.	How long is my personal health information kept?
	A.	The Public Hospitals Act says that if you are eighteen years of age or older, we must keep your personal health information for at least ten years after your last visit. If you are under eighteen years of age, we must keep your personal health information for at least ten years after you turn eighteen.
10	Q.	Can my family see my personal health information?
	A.	*Not without your consent, or the consent of your substitute decision maker as applicable.*
11	Q.	Can you provide me with some examples of when I may be required to provide consent, and tell me what happens if I am unable to provide consent?
	A.	Some examples are consent for researchers to store and use your personal health information for clinical studies, or consent to disclose your personal health information to your private insurance company to facilitate payment of your bill.If you are unable to provide consent directly to the hospital, the consent decision falls to your appointed substitute decision maker (such as a parent or guardian). The person is bound by law to act on your behalf and to make decisions based on their belief of what you would wish to be done if you were able to decide for yourself.
12	Q.	Can all hospital staff access my personal health record?
	A.	*Healthcare professionals directly involved in your care may access your personal health information.* Staff members in other areas of the Hospital that are not involved in your healthcare may have access to your personal health information for the purposes of managing the healthcare system. For instance, the finance department has access to your information to facilitate payment of your bill.
13	Q.	Will the hospital share information about my hospital visit with my family physician?
	A.	Family physicians with hospital privileges have computer access to view personal health information belonging to their patients, and we will provide copies of key reports to your family physician if he/she is listed in your chart.
14	Q.	If I am a youth, do I need parental consent if I wish to access my personal health information record?
	A.	No, you do not need parental consent to access your personal health information record, although if you are unable to consent the hospital may require consent from your custodial parent (or your access parent if your custodial parent is unavailable), or guardian.
15	Q.	What happens if I am inquiring about records for a deceased patient?
	A.	To obtain records for individuals who are deceased or incapable of signing a consent, proof of executorship or legal signing authority must be submitted with the request.
16	Q.	Many areas of the hospital are open and patients, visitors and staff in general can sometimes overhear physicians talking to patients or family about health information. Is this a breach of patient privacy?
	A.	Staff make every effort to discuss personal health information in a confidential manner by lowering their voice when discussing patient information in a public area (so that no-one else can overhear the conversation).