Privacy

Privacy of Personal Health Information
A patient’s guide….

Commitment to Patients Regarding the Privacy of Personal Information

At Southlake Regional Health Centre, we respect your right to the privacy of your personal health information.

As our patient, you, or a person legally acting on your behalf, entrust us with information about yourself. To honour that trust, we use and disclose your information for identified or primary purposes related to your care, and we protect it from misuse (see primary purposes). Here are specific steps we take to protect your privacy while delivering high-quality care and services:

We create and enforce policies and procedures to ensure that your personal health information is collected, used and/or disclosed for identified and legitimate purposes only. These policies and procedures conform with privacy laws.

• In order to ensure efficient and safe health care delivery, we assume that we have your implied consent to handle your personal health information for the “primary purposes” related to your care. When it is appropriate, we will strive to obtain express consent, in writing or verbally, for certain aspects of personal information handling (for example, whether or not you wish to have messages left at a given phone number.)
• When we collect your personal information, we only collect what we need for approved purposes. Required information would include such things as your name, address, date of birth, health history, records of your visits and the care that you receive during those visits.
• We keep the information only as long as it is needed or as required by law. When it is no longer needed, we destroy it. Until then, we retain it securely and confidentially.
• Southlake staff who work with patient information are trained in how to appropriately use confidential information and understand that it is available to them only for use in your health care. A violation of confidentiality is not tolerated, with employee penalties ranging up to and including dismissal.
• No matter how your information is stored - on computer, in writing, or some other way - we keep it in a safe and secure way that protects your privacy. We conduct routine investigations to monitor and manage our privacy compliance.

If you have questions…

Subject to legal exceptions, you may access and correct your personal health records. If you wish to do so while you are in hospital, please speak with your caregiver(s) who will direct your wishes and concerns to the appropriate management personnel.

Should you have enquiries after you have been discharged, please contact the hospital’s Manager of Health Information at 905-895-4521, extension 2275.

Subject to certain limitations, you may withhold or withdraw your consent for some of our identified uses and disclosures. For example, at time of registration you can advise the admitting clerk that you wish to “opt-out” of having your name and address shared with the hospital’s Foundation or having copies of results and notes sent to your Family Doctor.

Top

What are Southlake’s primary purposes for collecting personal health information?

Southlake’s primary purposes for collecting personal health information are related to the delivery of patient care, reasons that are required or permitted by law, and those which are typical for the operation of a community/regional hospital. These include promotion of wellness, the diagnosis, treatment and follow-up of illness, and processes for reducing risks of harm to individuals or other persons. They also include the teaching of new healthcare providers, risk management, quality improvement activities (including sending patients satisfaction surveys), support of expense claims, sharing data with recognized institutions for health information management and for some types of approved health research, the latter typically only using data that cannot identify an individual.. For these purposes it is assumed that consent is implied or intended by individuals, as they are seeking health care services from the hospital and, thereby, authorize Southlake to collect, use and share their personal health information. As provided for in the province’s Personal Health Information Protection Act, they also include both the sharing of contact information (names and addresses) with the hospital’s charitable foundation and advising visitors and callers of an individual’s presence in hospital, unless the individual “opts-out” of those processes, usually at the time of registration.

Generally, personal information that is used or disclosed for “secondary” purposes (i.e. those not included in our list of primary purposes) is used or disclosed only with an individual’s express consent. These would include:

• disclosures to certain healthcare providers or services who lie outside of an individual’s obvious “circle of care” (although it should be understood that, in urgent circumstances when patient consent cannot be obtained in a timely manner, information can be shared with such providers without consent when such communication is necessary for care).
• health research where some personal identification of the individual is required and the hospital’s research ethics committee requires that specific consent be sought.

Southlake maintains a special partnership with Stevenson Memorial Hospital in Alliston, Ontario, such that we now use common or shared computerized health information systems

Please note that Southlake’s health care professionals, support staff and volunteers can answer many of the questions you may have about the privacy of your personal health information. However, should you have questions that have not been answered to your satisfaction, please contact our Privacy Officer (Dr. J. Boyle) at 905-895-4521, extension 2321. Ultimately, if concerns persist, you may contact the Information and Privacy Commissioner of Ontario at 1-800-387-0073.

Top

Our Ten Privacy Principles

(Abstracted from Southlake’s Privacy Policy)

Accountability
Southlake is responsible for personal information under its control and has designated an individual who is accountable for the organization's compliance with these principles.

Identifying Purposes For Collection
Southlake, at or before the time information is collected, will identify the purposes for which personal information is collected.

Consent
The knowledge and consent of the individual are required for the collection, use, or disclosure of personal information, except where inappropriate. An individual may withdraw consent at any time, subject to legal restrictions and reasonable notice. (Southlake will inform the individual of the implications of any such withdrawal.)

Limiting Collection
The collection of personal information shall be limited to that which is necessary for the purposes identified by Southlake. Information shall be collected by fair and lawful means.

Limiting Use, Disclosure And Retention
Personal information shall not be used or disclosed for purposes other than those for which it was collected, except with the consent of the individual or as required by law. Personal information shall be retained only as long as necessary for the fulfillment of those purposes.

Accuracy
Personal information will be as accurate, complete, and up-to-date as is necessary for the purposes for which it is to be used.

Safeguards
Security safeguards appropriate to the sensitivity of the information will protect personal information.

Openness
Southlake will make readily available to individuals specific information about its policies and practices relating to the management of personal information.

Individual Access
Upon request, an individual shall be informed of the existence, use, and disclosure of his or her personal information and shall be given access to that information. An individual shall be able to challenge the accuracy and completeness of the information and have it amended as appropriate.

Challenging Compliance
An individual will be able to address a challenge concerning compliance with the above principles to Southlake’s Privacy Officer or, if necessary, to the Hospital’s Chief Executive Officer or to the Information and Privacy Commissioner of Ontario.

Top