Mitchell Family Doctors is committed to patient1 privacy and to protecting the confidentiality of the health information we hold.
Our doctors belong to a Family Health Organization (FHO) and are collectively health information custodians (HICs) under the Personal Health Information Protection Act, 2004 (PHIPA). The FHO is accountable and liable for compliance with PHIPA and the protection of health records. For the purpose of privacy obligation, Mitchell Family Doctors and our staff are agents of the FHO.
Our commitment to privacy is demonstrated by adherence to privacy policies and procedures to protect the personal health information we hold and by educating our staff and any others who collect, use or disclose personal health information on our behalf about their privacy Responsibilities.
We collect personal health information for purposes related to direct patient care, administration and management of our programs and services, patient billing, administration and management of the health care system.
When personal health information that has been collected is to be used for a purpose not previously identified, the new purpose will be identified prior to use. Unless the new purpose is permitted or required by law, consent will be required before the information can be used for that purpose.
We require consent in order to collect, use, or disclose personal health information. However, there are some cases where we may collect, use or disclose personal health information without consent as permitted or required by law.
Should a patient wish his/her other health care providers (outside of their health care providers at Mitchell Family Doctors) to have access to the patient health record, the patient can provide a verbal or written consent to this effect, which will be communicated to the patient’s physician.
Should a patient wish his/her lawyer, insurance company, family, employer, landlord or other third party individuals or agencies (non-health care providers) to have access to his/her health record, a patient must provide verbal or written consent to this effect.
Implied consent (Disclosures to other health care providers for health care purposes) – Circle of care Patient information may also be released to a patient’s other health care providers for health care purposes (within the “circle of care”) without the express written or verbal consent of the patient as long as it is reasonable in the circumstances to believe that the patient wants the information shared with the other health care providers. No patient information will be released to other health care providers if a patient has stated he/she does not want the information shared. A patient’s request for treatment constitutes implied consent to use and disclose his/her personal health information for health care purposes, unless the patient expressly instructs otherwise. Who can be in the “circle of care” includes (among others providing direct patient care if authorized by PHIPA):
Within the physician’s office:
Outside of Mitchell Family Doctors:
There are certain activities for which consent is not required to use or disclose personal health information. These activities are permitted or required by law. For example, we do not need consent from patients to (this is not an exhaustive list):
If employees have questions about using and disclosing personal health information without consent, they can ask the Privacy Officer.
If consent is sought, a patient may choose not to give consent (“withholding consent”). If consent is given, a patient may withdraw consent at any time, but the withdrawal cannot be retrospective. The withdrawal may also be subject to legal or contractual restrictions and reasonable notice. PHIPA gives patients the opportunity to restrict access to any personal health information or their entire health record by their health care providers within the Family Health Team or by external health care providers. Although the term “Iockbox” is not found in PHIPA, lockbox is commonly used to refer to a patient’s ability to withdraw or withhold consent for the use or disclosure of their personal health information for health care purposes. If a physician leaves Mitchell Family Doctors, his/her patients will be notified and will have a choice whether to transfer their health records in accordance with the rules/guidelines set forth by the College of Physicians and Surgeons of Ontario. http://www.cpso.on.ca/
~ We limit the amount and type of personal health information we collect to that which is necessary to fulfill the purposes identified. Information is collected directly from the patient, unless the law permits or requires collection from third parties. For example, from time to time we may need to collect information from patients’ family members or other health care providers. Personal health information may only be collected within the limits of each employee’s role.
Personal health information is not used for purposes other than those for which it was collected, except with the consent of the patient or as permitted or required by law.
Personal health information may only be used within the limits of each employee’s role. Employees may not read, look at, receive or otherwise use personal health information unless they have a legitimate “need to know” as part of their position. If an employee is in doubt whether an activity to use personal health information is part of his/her position – he/she should ask the Privacy Officer. For example, self-directed learning is not allowed (randomly or intentionally looking at health records for self-initiated educational purposes) without specific authorization.
Personal health information is not disclosed for purposes other than those for which it was collected, except with the consent of the patient or as permitted or required by law. Personal health information may only be disclosed within the limits of each employee’s role. Employees may not share, talk about, send to or otherwise disclose personal health information to anyone else unless that activity is an authorized part of their position. If an employee is in doubt whether an activity to disclose personal health information is part of his/her position – he/she should ask the Privacy Officer.
Health records are retained as required by law and professional regulations and to fulfill our own purposes for collecting personal health information. The Canadian Medical Protective Association (CMPA) and College of Physicians and Surgeons of Ontario (CPSO) advise their members to retain health records for at least 10 years from the date of last entry or, in the case of minors, 10 years from the time the patient would have reached the age of majority (age 18). There may be reasons to keep records for longer than this minimum period. Personal health information that is no longer required to fulfill the identified purposes is destroyed, erased, or made anonymous safely and securely.
We will take reasonable steps to ensure that information we hold is as accurate, complete, and up to date as is necessary to minimize the possibility that inappropriate information may be used to make a decision about a patient.
We have put in place safeguards for the personal health information we hold, which include:
We take steps to ensure that the personal health information we hold is protected against theft, loss and unauthorized use or disclosure.
We require anyone who collects, uses or discloses personal health information on our behalf to be aware of the importance of maintaining the confidentiality of personal health information. This is done through the signing of confidentiality agreements, privacy training, and contractual means. care is used in the disposal or destruction of personal health information, to prevent unauthorized parties from gaining access to the information.
Information about our policies and practices relating to the management of personal health information are available to the public, including:
Patients may make written requests to have access to their records of personal health information.
We will respond to a patient’s request for access within reasonable timelines and costs to the patient, as governed by law. We will take reasonable steps to ensure that the requested information is made available in a format that is understandable.
Patients who successfully demonstrate the inaccuracy or incompleteness of their personal health information may request that we amend their information. In some cases instead of making a correction, patients may ask to append a statement of disagreement to their file.
Please Note: In certain situations, we may not be able to provide access to all the personal health information we hold about a patient. Exceptions to the right of access requirement will be in accordance with law. Examples may include information that could reasonably be expected to result in a risk of serious harm or the information is subject to legal privilege.
Any person may ask questions or challenge our compliance with this policy or with PHIPA by contacting our Privacy Officer:
Mitchell Family Doctors
7 Frances Street
Mitchell, ON NOK lNO
We will receive and respond to complaints or inquiries about our policies and practices relating to the handling of personal health information. We will inform patients who make inquiries or lodge complaints of other available complaint procedures.
We will investigate all complaints. If a complaint is found to be justified, we will take appropriate measures to respond.
The Information and Privacy Commissioner of Ontario oversees our compliance with privacy rules and PHIPA. Any individual can make an inquiry or complaint directly to the Information and Privacy
Commissioner of Ontario.