As a health care, rehabilitation and disability management service provider we employ a number of professional staff members who may, during the course of their duties, have access to personal information that we hold.
What is personal information?
Personal information means any information about an identifiable individual that is recorded in any form, but does not include customer related business information.
Why do we collect personal information?
Our primary purpose for collecting information is to provide our clients with the highest quality health care, rehabilitation and disability management services to maximize their medical, psychological, vocational and social recovery.
What personal information do we collect?
Examples of the type of personal information we collect: name, home contact information, insurance benefit coverage, gender, age, language, education or training, occupation/profession, marital status, income, medical history and information, legal counsel, work hours, intentions (i.e. to utilize services, to change jobs) and letter written to the organization by the person.
We do not disclose personal information to the General Public.
How do we obtain personal information?
We obtain personal information directly from our clients, customers, other health care and rehabilitation providers, and in the course of providing our various assessment and treatment services.
Will personal information be disclosed to third parties?
On occasion personal information may be disclosed to a third party. As such, external consultants (i.e. auditors, lawyers, voluntary accreditation programs) may, on our behalf, do audits and continuing quality improvement reviews of our organization, including reviewing client files and interviewing our staff.
Our organization, and its professional staff, is regulated by provincial government regulations, The College of Occupational Therapists of Ontario, The Ontario Kinesiology Association, The Ontario College of Social Workers and Social Service Workers, The Canadian Counselling and Psychotherapy Association, The College of Nurses of Ontario, The College of Physicians and Surgeons of Ontario, The Ontario College of Psychologists, The College of Audiologists and Speech Language Pathologists of Ontario, the Vocational Rehabilitation Association of Canada, the College of Vocational Rehabilitation Professionals and others,. These bodies may inspect our records and interview our staff as a part of their regulatory activities in the public interest. In addition, as professionals, we will report serious misconduct, incompetence or incapacity of other practitioners whether they belong to other organizations or our own.
Also, our organization should report information suggesting serious illegal behaviour to the authorities.
In addition like all organizations, various government agencies (i.e. Canada Customs and Revenue Agency, Information and Privacy Commissioner, Human Rights Commission, various levels of courts, tribunals and commissions of inquiry, etc.) have the authority to review our files and interview our staff as a part of their mandates. In these circumstances, we also may consult with professionals (i.e. lawyers, accountants) who will investigate the matter and report back to us on our legal responsibilities to disclose information and our obligation to do so.
Also, from time to time, if our client’s are at risk of harming themselves, or harming someone else, or if they are below the age of consent, then it may be necessary to disclose confidential information to appropriate persons in order to protect our clients and others. All staff have been made aware of circumstances when it is appropriate to disclose confidential information to third parties, and how to determine when it is appropriate to disclose information if they are uncertain when presented with a specific situation.
How can the client withdraw consent?
The client may withdraw their consent to the use of their personal information at any time by contacting our Privacy Officer, Andrew Ferguson at firstname.lastname@example.org. If consent is withdrawn, this may limit the services or products we are able to provide. In some circumstances, legal requirements may prevent the client from withdrawing consent.
How can personal information be accessed and updated?
With some exceptions, you have the right to see what personal information we hold about you. We can help you identify what records we might have about you. We will also try to help you to understand any information you do not understand (e.g. short forms, technical language, etc.). We will need to confirm your identity, if we do not know you, before providing you with this access.
We reserve the right to charge a nominal fee for such requests, where extensive photocopying is required, or other fees related to the retrieval of personal information are incurred.
We may ask you to put your request in writing. If we cannot give you access, we will tell you within 30 days if possible and tell you the reason, as best we can, as to why we cannot give you access.
If you believe there is a mistake in the information, you have the right to ask for it to be corrected. This applies to factual information and not to any professional opinions we may have formed. We may ask you to provide documentation that our files are wrong.
Where we agree that we made a mistake, we will make the correction and notify anyone to whom we sent this information. If we do not agree that we have made a mistake, we will still include in our file a brief statement from you on the matter and we will forward that statement to anyone else who received the earlier information.
How is your personal information protected?
We understand the importance of protecting personal information. For that reason, we have taken the following steps:
- Paper information is either under supervision or secured in a locked or restricted area
- Electronic hardware is either under supervision or secured in a locked or restricted area at all times. In addition, passwords are used on all computers
- Paper information is transmitted through sealed, addressed envelopes or boxes by reputable companies
- Electronic information is transmitted either through a direct line or is anonymized or encrypted
- External consultants and agencies with access to personal information must enter into privacy agreements with us regarding any information they may receive from us
- We destroy paper files containing personal information by shredding. We destroy electronic information by deleting it and, when the hardware is discarded, we ensure that the hard drive is re-formatted
- Rehab First prohibits the use of Social Networking sites for the purposes of communication in addition all staff members are trained in the proper use of email and voice mail to ensure our privacy standards are met during these types of communication
How long do we keep personal information?
We need to retain personal information for some time to ensure we can answer questions you might have about the services provided and for our own accountability to external regulatory bodies. However, (in order to protect your privacy) we do not want to keep personal information too long. We retain client files for ten years.
Our client and contact directories are much more difficult to systematically destroy, so we remove such information when we can if it does not appear we will be contacting you again. However, if you ask, we will remove such information immediately. You can make this request in writing by contacting our Privacy Officer, Andrew Ferguson at email@example.com
We keep any personal information relating to our general correspondence with people who are not clients, newsletters, seminars and marketing activities for one year after the newsletter ceases publication or a seminar or marketing activity has been completed.
Do you have a concern?
Issues or concerns may be resolved by contacting our Privacy Officer at Andrew Ferguson at firstname.lastname@example.org.
For more general inquiries, the Information and Privacy Commissioner of Canada oversees the administration of the privacy legislation in the private sector.
The Information and Privacy Commissioner can be reached at:
112 Kent Street
Ottawa, Ontario K1A 1H3