Personal health information protection

The Medical Officer of Health (MOH) is the Health Information Custodian for Ottawa Public Health (OPH), a Department of the City of Ottawa. This means, under the Personal Health Information Protection Act, 2004 (PHIPA), the MOH has the responsibility to ensure that personal health information is collected, used, stored and shared with full regard for the protection of privacy and the confidentiality of personal health information. This obligation to protect the privacy of personal health information extends to persons who act as agents of the MOH.

Collection

The MOH collects personal health information from clients and other authorized persons to promote and protect health, and to prevent disease. Personal health information collected may include:

• Name, address, date of birth and Ontario health card number
• Facts about health, health care and history related to exposures to disease
• Information about payment for health care, when required for certain public health services

Personal health information may be collected directly from clients through a face-to-face meeting with an OPH staff person, over the phone, through written papers and/or electronic documents. Personal health information about a client may also be collected indirectly from third parties such as physicians or hospitals where there is legal authority in PHIPA or other legislation to do so. All personal health information collected by OPH is recorded on paper and/or electronically and complies with internal policies and procedures.

Use and disclosure

OPH is mandated by the Ontario government under the Health Protection and Promotion Act (HPPA) to provide disease prevention, health promotion and health protection programs and services to the residents of the City of Ottawa.

The main use of personal health information collected by OPH is to deliver public health services and programs, and to plan, deliver and evaluate appropriate health care and services for individual in accordance with the HPPA or other public health legislation. When necessary, personal health information may be shared within OPH to provide care and investigate and manage potential risks to others or to the population at large. Non-identifying information related to clients’ care and services is used for administration, management, strategic planning, decision-making, research and allocation of resources. This non-identifying information is subject to the Municipal Freedom of Information and Protection of Privacy Act. Under the HPPA, OPH can disclose personal health information to other health units, the Chief Medical Officer of Health and the provincial Ministry of Health and Long-Term Care. Personal health information may also be shared with health care providers to plan and deliver health care or investigate and manage potential health risks to others.

All personal health information is kept private. Unless the law requires disclosure or authorizes sharing of health information with others, OPH cannot and will not give out any personal health information without the consent of the individual involved. If consent is provided to allow a family member or legal representative to have access to personal health information, these representatives may have access to those parts of the personal record that have been identified in the consent. Individuals have the right to withdraw or change the conditions of consent, subject to provisions set out in PHIPA.

Personal health information is kept secure by OPH. All paper records are stored in locked files and/or secured areas. All electronic records require a password for access. Personal health information stored on laptops and other mobile devices is encrypted. Personal health information records are retained and disposed in accordance with PHIPA and City of Ottawa policies and procedures.

Access

Individuals who wish to access or correct their personal health information, or who have questions about how it is collected, maintained, used or disclosed, are encouraged to contact their public health worker in Ottawa Public Health.

However, individuals may also make a written request for access to or correct of personal health information under PHIPA, through the City of Ottawa’s Access to Information and Privacy Office (ATIP) at 613-580-2400, ext. 21898.

Complaints

The City of Ottawa is committed to resolving all concerns or complaints and encourages individuals to first contact the department involved. An individual’s concerns or complaints about access or privacy practices within OPH may be directed to the Medical Officer of Health or the Manager of the individual’s health care provider. For general complaints about privacy practices, individuals may also contact the City’s ATIP Office at 613-580-6744, ext. 21898.

Individuals may also lodge a complaint regarding access or privacy practices of OPH directly with the Ontario Office of the Information and Privacy Commissioner (IPC) at 416-326-3333.

The City of Ottawa Long Term Care Branch (LTC) provides a broad range of long term care based on the individual needs of its residents and clients. To meet residents’ and clients’ needs and provide effective care and service, LTC needs to collect, use and disclose personal health information. As such, LTC is the health information custodian, as defined in the Personal Health Information Act 2004 (PHIPA) and is accountable for the protection of residents’ personal health information.

Collection of personal health information

The purpose of collecting personal health information is to provide health services to residents and clients and to promote health, prevent disease and process payment for health-related services. In all but exceptional circumstances, LTC uses consent to collect, modify, use and disclose personal health information. In general, the information collected consists of:

• The resident’s or client’s name, address and Ontario Health Card number
• Facts about health, health care history and the health care that the resident/client has been provided
• Facts about payment for the resident’s of client’s health care.

Personal information is collected through face-to-face meetings with LTC staff, over the telephone, and through written or electronic documents. Information is collected at an initial meeting and/or through initial submission of admission applications, over time as care and service is provided and when follow-up is completed. The documentation of personal health information by LTC on paper and in electronic format must comply with stringent internal standards, policies and procedures related to confidentiality, the security of information and professional practice standards.

Personal health information of residents is collected in a number of ways:

• Personal Health Information is received from the Community Care Access Centre for the home to make admission decisions
• Directly from residents, as a component of the admission and ongoing assessment of health status
• From residents and other health care professionals as part of the care planning process, which identifies the goals and the interdisciplinary care team’s strategies and interventions for achieving these goals
• Through ongoing documentation and communication in resident’s health records
• Through administrative communication in terms of residents’ health status (e.g., 24-hour report)
• Through hospital transfer notes regarding the residents’ personal health status, e.g., emergency, admission to hospital or attendance at clinic (dental, eye, cardiac, etc.), specialist appointments.
• Personal health information of clients of the community-based service programs (Adult Day Centre) is collected in a number of ways:
• From physicians, families and clients as a component of the assessment process for eligibility for programs and services
• As a component of the service plan which identifies the clients and families’ requested service levels and staff interventions
• From the Community Care Access Centre, community agencies and retirement homes where the clients currently reside.

Use of personal health information

The main purpose of using personal health information is to plan, deliver and evaluate care and service for our residents and clients. It is also used to make decisions about the types of services required and to communicate with other service providers involved in that person’s care. When necessary, personal health information may be used to investigate and manage potential risks for others who may be affected by a health risk.

Non-identifying information related to residents and clients care and service is used for administration, management, strategic planning, decision-making, research, fundraising and allocation of resources within the home to meet legal and regulatory requirements.

Disclosure of personal health information

Personal health information is disclosed to other health care workers involved in the circle of care, based on residents’/clients’ implied consent, to provide the health care workers with the information they need to provide appropriate care when a resident or client is referred and care is transferred. Other than those in the circle of care, personal health information is usually disclosed only when the resident/client gives consent. If a resident or client wishes to refuse consent to disclose information, he/she may do so by notifying his/her Charge Nurse.

Personal health information will be disclosed without consent in exceptional circumstances. These situations include emergency situations in which consent is not possible and the disclosure of personal health information that is required to meet legal and regulatory requirements [e.g., mandatory reporting requirements of the Ministry of Health and Long-Term Care (MOHLTC) and Public Health, law enforcement requests].

Personal health information is sent to hospitals through Emergency Medical Services or in emergency situations, by phone and fax.

Consent for the collection, use and disclosure of personal health information

Requiring consent means that residents and clients must give specific permission for the collection, use and disclosure of personal health information. Consent is ordinarily required:

• Upon admission to the home during the signing of the admission agreement
• Upon transfer of a resident to another long-term care home or hospital

When a resident is transferred to another long-term care home or hospital, the personal health information is placed in a sealed envelope marked confidential, and sent with the Emergency Medical Services personnel or family.

When residents and clients give consent, they are informed of how their personal health information will be used. Residents and clients may give consent that is limited to certain uses of their personal health information. Residents and clients may also withdraw their consent for LTC to use their personal health information for particular purposes.

Personal health information is not disclosed without consent unless sharing of this information is required or permitted by law. In some situations, implied consent may be used by LTC such as in situations in which health care is required but it is not reasonably possible to obtain consent.

Consent to disclose personal health information is also not ordinarily required:

• In situations of imminent harm and risk to the person or others directly affected
• To the Medical Officer of Health for public health protection purposes
• To the Ministry of Health and Long-Term Care (MOHLTC) for monitoring care and payments for health care funded in whole or in part by the Ministry.

Consent is not required for the disclosure of non-identifying information:

• For the purposes of research to be performed in accordance with a research plan approved by a research ethics board
• To a prescribed entity for the purpose of analysis with respect to the management of the health care system
• If the MOHLTC directs a health information custodian to disclose information to a health data institute for the purposes of analysis with respect to the management or evaluation of the health system.

Access to personal health information

Residents and clients have the right to request access to their personal health information, subject to the provisions of PHIPA. LTC policy states that individual residents/clients or the legally authorized substitute decision-maker may make a request for access to the resident’s or client’s personal health information. A designated LTC staff member will be provided, at a mutually convenient time, to explain and help the resident/client understand medical terminology and LTC procedures. However, access to this information may be denied, for specific reasons outlined in the legislation, including situations in which the sharing of the personal health information could reasonably be expected to harm the resident’s or client’s or other’s mental or physical health and safety.

Residents and clients also have the right to ask the LTC to correct a record if it is inaccurate and to ask for and receive, with limited expectations, a copy of their personal health record or portion thereof, as described in PHIPA.

Although residents and clients have the right to see their personal health information, this right does not automatically extend to their family members and /or friends. If consent is provided to let a family member or friend see personal health information, then the family member or friend may be allowed access to the part(s) of the personal health record that the resident/client has consented to let them see. If the resident/client is unable to give consent and /or has a legally authorized substitute decision-maker, then this person may be allowed access to the personal health information, in accordance with their legal authority.

This person is bound by law to act on the resident’s/client’s behalf and must make decisions based on their knowledge of what the resident/client would wish done if he/she were able to decide.

Questions about access to or correcting personal health information can be directed to the Charge Nurse or Manager of Resident Care of the Home.

However, individuals may also make a written request for access or to correct personal health information under PHIPA, through the City of Ottawa Access to Information and Privacy Office at 613-580-2424, ext. 21898.

Family and friends

Personal health information is private. Unless the law authorizes sharing it with others, LTC cannot and will not give out any personal health information without consent. However, it is understood that the home is the residents’ home and family and friends may inquire about their well being from time-to-time. Unless the resident objects, the following information will be provided to someone who makes an inquiry about a resident:

• Confirmation that the person is a resident and their room number
• A general statement about the resident’s health status, such as “well, stable, satisfactory, fair, poor,” etc.

Specific consent is required to authorize LTC to disclose any additional information about the resident.

During an incoming telephone call, staff may not be able to verify that the person calling is who he/she says he/she is. Therefore, to protect the privacy of the resident’s personal health information, only a minimal amount of information will be given over the phone.

Formal requests and complaints

The City of Ottawa is committed to resolving all concerns or complaints and encourages individuals to first contact the department involved. Concerns or complaints about access or privacy practices within the home can be directed to the Administrator.

For general concerns or complaints about privacy practices, individuals are encouraged to contact the Access to Information and Privacy Office at 613-580-2424, ext. 21898

Security

Personal health information is kept securely by LTC. All paper files are stored in locked files and are restricted access. All electronic records are password protected. Residents’ and clients’ personal health information is retained in their active health care record files, which are safely and securely stored to limit access. When the resident or client is discharged or deceased, the inactive health care record is securely stored in a locked area until it is archived.

LTC has policies to limit access to personal health information to the following situations:

• With the informed written consent of either the resident/client or the legally authorized substitute decision-maker
• When required by law
• Upon issuance of a subpoena
• When medical reasons require the release of information without the resident’s/client’s consent
• As required to provide care and service by members of the interdisciplinary care team
• To medical, therapeutic and pharmaceutical consultants, who are included in the circle of care.

The City of Ottawa’s network security and firewall are in place to protect unwarranted access to the server on which electronic personal health information resides. Access to the application that is used for health care records is governed by a unique user identification and password. User identification are assigned and controlled based on the job function of the employee and their need to know. Back-up tapes from the application are stored in a safe. 

Retention of personal health information

Records containing personal health information are retained according to Ministry of Health and Long-Term Care and City of Ottawa policies and professional practice standards. These policies and practices will involve the transfer of the records to the City of Ottawa Records and Information Management Division.

LTC retention policies are based, in part, on the Long-Term Care Homes Act, 2007. Deceased resident documents are retained for five years. Discharged resident documents are retained for 20 years. Deceased & discharged resident files are transferred to the City of Ottawa Records and Information Management Division. Once the records are no longer required to be retained, they are shredded as confidential material.

Privacy matters to us

Our Mission

The mission of the City of Ottawa Long Term Care Homes is to enrich the lives of the residents by providing quality care and services in a home that is comfortable and secure. This commitment extends to protecting the privacy of personal health information.

Personal health information is collected to help provide you with care and service or to process payments for health-related services.

Personal health information includes identifying information that relates to the provision of health care such as your:

• Name
• Address
• Date of birth
• Ontario health card number
• Health care history

The information is used to respond to your health care needs. If you can’t provide information, it may be collected from others to assess your needs.

Under the Personal Health Information Protection Act, 2004 (PHIPA), you have the right to withdraw or limit this consent which protects your information from further use or disclosure but may affect the provision of health care.

You have the right to:

• Access your personal health information (e.g., ambulance call report), subject to limited exceptions as set out in PHIPA
• Request a correction to a record if it is incomplete or inaccurate

For more information, visit the request access to personal health information page.

For directions on how to request a correction:

How and Where to Request a Correction of Personal Information

Your personal health information is kept private, unless the Ottawa Paramedic Service is required to disclose any details for law enforcement purposes, or specifically authorized under PHIPA to share it with others. Personal health information is not released without your written consent.

What is the Personal Health Information Protection Act, 2004?

The Personal Health Information Protection Act, 2004 (PHIPA) is a provincial law that came into effect November 1, 2004. This law sets out rules for the collection, use and disclosure of personal health information for Health Information Custodians operating within the province of Ontario, and also allows individuals to request access to their own personal health information held by these Custodians.

The legislation balances an individual's right to privacy of their personal health information with the legitimate needs of health care providers who require the information to administer medical treatment, or for other health care reasons - such as funding and health research.

PHIPA requires health information custodians to obtain consent in most circumstances before they collect, use and disclose personal health information. However, in certain circumstances, some collections, uses and disclosures are permitted without consent. In addition, the legislation provides individuals with a right to request access to, or correction of, their personal health information, as well as the ability to request an independent review by the Information and Privacy Commissioner/Ontario of an institution's decisions under PHIPA.

What is a Health Information Custodian?

PHIPA defines health information custodian as listed persons or organizations who have custody or control of personal health information as a result of the work that they do or in connection with the powers and duties they perform. Health Information Custodians include health care practitioners (or a person who operates a group practice of health care practitioners), the operator of a hospital, a nursing home, a pharmacy or an ambulance service. The Minister of Health and Long Term Care is also a Health Information Custodian. Regulations passed by the Province under PHIPA may also list additional Health Information Custodians in the future.
At the City of Ottawa, the following are Health Information Custodians:

• The Ottawa Paramedic Service
• The City's four Homes for the Aged:
  • Garry J. Armstrong
  • Carleton Lodge
  • Centre d'accueil Champlain
  • Peter D. Clark Centre
• The Medical Officer of Health and Public Health Branch
• The Employee Assistance Program

Access to personal health information

In accordance with PHIPA, every individual has a right of access to his or her personal information, subject to limited and specific exemptions that are prescribed in the law. Requests for information may be made formally or informally. The City of Ottawa encourages individuals to request their own personal health information informally if possible. This can be accomplished by simply contacting the program area directly that maintains the records, providing proof of identification and, if applicable, paying a fee to cover the cost of reproducing the records.

Only under certain circumstances will the program area advise an individual to submit a formal request under the PHIPA for access to their own personal health information. These include:

• If the request involves searching for a large number of records
• If the request contains a third party's personal health information
• If the records may be protected under other exemptions specified in PHIPA
• If the records may be protected under the Municipal Freedom of Information and Protection of Privacy Act.

Individuals may choose to submit their requests formally. This can be accomplished by completing the Personal Health Information Protection Act Access/Correction Form [ PDF - 59 KB ] and sending it to the address below, or by submitting a request in writing and addressing it to the Access to Information and Privacy Office, at this address:

Access to Information and Privacy Office
Office of the City Clerk
110 Laurier Avenue West
Ottawa, ON KIP IJI

PHIPA stipulates that a Health Information Custodian must provide the requester with his or her personal health information and/or a decision regarding the request within 30 calendar days from the date the completed request is received. On occasion, the Health Information Custodian may ask for an extension, if:

• The request is for an extensive number of records
• The task of locating the records would necessitate a lengthy search
• The consultation process required to reply to the request would make it unreasonably practicable to reply within the time frame.

Correction of personal health information

In some instances, you may feel that there is an error or omission in your personal health information the City of Ottawa. To request a correction or omission to this information, you must complete a Personal Health Information Protection Act Access/Correction Form [ PDF - 59 KB ], available online or at any of the City's Client Service Centres, or by contacting the Access to Information and Privacy Office at 580-2424, extension 21898.

If you are requesting a correction to your personal health information, you should attach a letter to your application form stipulating clearly the information that you believe to be inexact, incomplete or ambiguous, and the correction or amendment that you wish to make under the Act. In some instances, documentary proof will be required.

After receiving the request for correction, the City of Ottawa will correct or amend the personal health information or advise you of the reason why the information was not corrected or amended. Generally, only facts that are incorrect, incomplete or ambiguous may qualify for a correction. If the correction sought is merely a substitution of opinion, then it will not qualify as a correction of personal health information. If the information consists of a record that was not originally created by the City of Ottawa, it also will not meet the criteria to be considered as a correction request.

In the event that the correction or amendment is not made, you have a right to:

• Prepare a statement of disagreement and request that it be attached to the personal health information you requested to be corrected (a copy of the request for correction may be sufficient)
• Make a complaint to the Office of the Information and Privacy Commissioner/Ontario
• If the requested correction may reasonably be expected to have an effect on the on-going provision of health care or other benefits to you, you may have any person or body to whom the personal information was disclosed within the last twelve (12) months notified of the correction or statement of disagreement.

Making a complaint to the Information and Privacy Commissioner of Ontario

Individuals who have reasonable grounds to believe that an institution has contravened (or is about to contravene) the provisions of PHIPA may make a complaint to the Information and Privacy Commissioner of Ontario. Similarly, any person may make a complaint to the Commissioner with respect to an institution's refusal of an access to information request. Timelines for making complaints are prescribed in sections 56(2) and (3) of PHIPA.

At the City of Ottawa, every attempt is made to resolve complaints regarding access or privacy matters informally through a resolution that is mutually satisfactory for both the complainant and the City. Sometimes a simple explanation may help to alleviate the concerns that an individual may have.

If you feel that your rights under PHIPA have been contravened, we encourage you to contact the City’s Access to Information and Privacy Office at 613-580-2424, ext. 21898. However, you are free at any time to submit a formal complaint to the office of the Information and Privacy Commissioner/Ontario:

Office of the Information and Privacy Commissioner/Ontario
2 Bloor Street East,
Suite 1400
Toronto, ON K1P 5M2

Personal Health Information Protection Act, 2004 Privacy Practice

The City of Ottawa provides a number of services to residents in the Ottawa area requiring the collection, use and disclosure of personal health information. The City is committed to upholding the standards of privacy established in PHIPA. Protection of privacy is a fundamental part of the City of Ottawa's day-to-day operations. In fact, the City has paid a considerable attention to privacy issues due to its requirement to adhere to privacy standards established under the Municipal Freedom of Information and Protection of Privacy Act (MFIPPA). The following practices are required under both MFIPPA and PHIPA, and are in place at the City of Ottawa.

Identifying purposes

The City of Ottawa notifies individuals of the purpose for the collection of personal health information and of the intended use(s) of the information.

Consent

The City of Ottawa obtains an individual's consent to the collection, use and disclosure of personal information, except where there is legal authority to collect, use or disclose the personal information without consent.

Limiting collection

The City only collects personal information required for the identified purpose, and collects this information by fair and lawful means.

Limiting use, disclosure, retention

The City obtains consent from the individual if his or her personal information is used for other purposes. 
The City obtains consent to disclose personal information, except where the disclosure without consent is authorized by law. 
The City keeps personal information for the period specified in legislation or in the City's retention By-Law.

Accuracy

The City of Ottawa will keep personal health information as accurate and up-to-date as necessary for the fulfillment of the purposes for which it was collected. Where the personal health information is not accurate, the City of Ottawa will make the necessary changes to ensure the correction of the personal health information as outlined in the Personal Health Information Protection Act.

Safeguards

The City of Ottawa ensures protection of information by security safeguards appropriate to the department in question and to the sensitivity of the information. Depending on the area of service and the nature of the personal information in question, the City uses administrative, technical and physical safeguards to ensure the security of various types of records.

Individual access and openness

The City of Ottawa facilitates and promotes an individual's right of access to his or her own personal information by several means. Individuals are encouraged to seek access to their information informally from individual departments/program areas where possible. The City also routinely informs individuals of the purpose of collection of their personal information and of the intended use of the information through notifications on forms, pamphlets or by other means. On request, the City will provide additional information to individuals concerning the existence, use and disclosure of their personal information. Finally, the City's Access to Information and Privacy Office staff advise individuals on how to make access requests for their information, and how to make correction request.

Challenging compliance

The City's Access to Information and Privacy Office provides information to members of the public on how to make an access or privacy complaint at the City of Ottawa, and, if requested, directs individuals to the Information and Privacy Commissioner/Ontario for the purposes of making formal complaints and appeals.

General information concerning collection, use and disclosure of personal health information by the Health Information Custodians at the City of Ottawa

Ottawa Paramedic Service

The Ottawa Paramedic Service collects personal health information from individuals in the course of providing emergency health services. The collection, use and disclosure of personal health information by the Service is regulated by the Ambulance Act, R.S.O. 1990, c. A.19, and its Regulations. Patient information is generally contained in an Ambulance Call Report, which is a record whose form and contents is prescribed by the Ambulance Act and its regulations.

Patient information is confidential. The Service will only disclose patient information to receiving medical staff responsible for the care of the patient, or to the patient himself or herself. Patient information will not be disclosed to any other party unless there is consent from the patient or there is legal authority to support the disclosure without consent. The Service also adheres to patient documentation standards established by the province's Ministry of Health and Long Term Care.

Note: More specific information concerning the Ottawa Paramedic Service's information and privacy practices is now available.

Homes for the aged

The City's four Homes for the Aged are: Island Lodge, Carleton Lodge, Centre d'accueil Champlain, and the Peter D. Clark Centre. The Homes collect, use and disclose personal health information in accordance with the Homes for the Aged and Rest Homes Act, R.S.O. 1990, c.H.13, its regulations, and other legislation affecting its residents such as the Health Care Consent Act, 1996, S.O. 1990, c.2, Sch. A. The Homes collect, use and disclose personal health information of their residents for the purposes of providing them residential and medical services, including but not limited to managing the admission, discharge and transfer of the residents, and developing and implementing their plan of care.

A resident's personal health information is confidential. Personal health information will be disclosed by authorized staff of the Homes to members of the resident's medical circle of care for the purposes of health care. Disclosure to third parties will only occur with the consent of the resident or if there is legal authority to disclose without consent.

Note: More specific information concerning the Homes' information and privacy practices is now available.

Medical Officer of Health and Public Health Branch

The City's Public Health Branch, directed by the Medical Officer of Health, collects, uses and discloses the personal health information of individuals for the purposes of administering and delivering public health programs in Ottawa, in accordance with the Health Protection and Promotion Act, R.S.O. 1990, c.H.7 and its regulations. Personal health information collected by the branch will only be used for the purposes of public health in the context of one of the following areas: community sanitation (including the elimination of health hazards), control of infectious diseases (including communicable, and reportable diseases and the immunization of children or adults), health promotion and prevention of diseases and injuries, and home care services.

The Health Branch often works in co-operation with other entities in the health care field, including health care practitioners and hospitals. However, the Medical Officer of Health and the Public Health Branch staff will keep an individual's personal health information confidential, and will only disclose the information with the individual's consent, or for a legally authorized public health purpose.

Note: More specific information on the Medical Officer of Health and Public Health Branch's information and privacy practices is now available.

Employee Assistance Program

The Employee Assistance Program (EAP) collects personal and/or health related information in the process of providing voluntary counselling and referral services to employees of the City of Ottawa and their family members. The Employee Assistance Program respects the intrinsic worth of each client they serve when entering into a professional relationship with them and all information is regulated by the Ontario College of Social Workers and Social Service Workers (OCSWSSW) and the Canadian Counselling Association.

On behalf of the client the EAP often works in co-operation with other health care professionals, doctors, psychiatrists, psychologists, etc. Information collected is held in the strictest of confidence and will not be disclosed without the written consent of the client. Only in extreme situations may information be disclosed, e.g. when information is subpoenaed or a client is a danger to himself or another or in cases of child abuse. The OCSWSSW is accountable to the Ministry of Community and Social Services.