Central Toronto Community Health Centres (CTCHC) is committed to protecting the privacy and confidentiality of the personal health information in its custody and control. Anyone who collects, uses or discloses personal health information on CTCHC’s behalf is required to follow these 10 information principles. All CTCHC policies and procedures relating to the collection, retention, disclosure, security and destruction of personal health information are developed in consideration of these ten principles
Principle 1 — Accountability of Personal Health Information
CTCHC is responsible for the personal health information in its custody or control, and has designated an individual, the Executive Director, to act as its privacy contact person. The Executive Director is responsible to oversee and facilitate CTCHC’s compliance with its Privacy Policies and related legislation.
CTCHC demonstrates its commitment to privacy and the confidentiality of personal health information by:
- Implementing policies and procedures to protect personal health information.
- Educating anyone who collects, uses or discloses personal health information on CTCHC’s behalf about their responsibilities under CTCHC’s policies.
- Implementing policies and procedures through the Executive Director’s office to:
- Receive and respond to complaints
- Field inquiries on privacy related matters, and
- make material on CTCHC’s privacy policies and procedures publicly available.
Principle 2 — Identifying Purposes for Which Personal Health Information if Being Collected
CTCHC will identify to clients from whom it collects personal health information (and explain as necessary) the purposes for the collection.
CTCHC collects personal health information for purposes related to direct client care, administration and management of CTCHC programs and services, client billing, statistical reporting, and as permitted or required by law.
When personal health information that has been collected is to be used for a purpose not previously identified, the new purpose will be identified. Unless the new purpose is permitted or required y law, consent is required before the information can be used for that purpose.
Principle 3 — Consent for the Collection, Use and Disclosure of Personal Health Information
CTCHC will generally rely on implied consent from our clients for the collection, use, or disclosure of personal health information. In some circumstances, CTCHC will obtain express consent to collect, use or disclose personal health information as required by CTCHC Policy. CTCHC will collect, use or disclose personal health information as permitted or required by law. CTCHC may disclose personal health information as required by law without consent.
A client may withdraw consent at any time, but the withdrawal cannot be retroactive. Refer to CTCHC’s Operations Manual.
Principle 4 — Limiting Collection of Personal Health Information
CTCHC limits the amount and type of personal health information it collects to that which is necessary to fulfill the purposes identified. Information is collected directly from the client, unless the law permits or requires collection from third parties
Collection of personal health information is done in accordance with CTCHC’s Operations Manual.
Principle 5 — Limiting Use, Disclosure, and Retention of Personal Health Information
CTCHC uses and discloses personal health information for purposes related to direct client care, administration and management of CTCHC programs and services, client billing, teaching, statistical reporting and as permitted or required by law.
Further information about uses and disclosure can be found in CTCHC’s Operations Manual.
Personal health information will be retained in accordance with CTCHC’s policy, and as required by law. Otherwise it will be destroyed, erased, or made anonymous. Please refer to CTCHC’s Operations Manual.
Principle 6 — Accuracy
CTCHC will take reasonable steps to ensure that client’s personal health information is as accurate, complete and up to date as is necessary for the purposes for which it is used or disclosed.
CTCHC will inform any third parties to whom personal health information is disclosed about any limitations on the information’s accuracy.
Principle 7 — Safeguards for Personal Health Information
CTCHC has implemented security safeguards for the personal health information it holds, which include:
- Physical measures (such as locked filing cabinets);
- Organizational measures (such as permitting access on a “need-to-know” basis only), and
- Technological measures (such as the use of passwords and audits).
CTCHC requires anyone who collects, uses or discloses personal health information on its behalf to be aware of the importance of maintaining the confidentiality and privacy of personal health information. This is done through the signing of confidentiality agreements, privacy training and contractual means.
CTCHC has taken steps to ensure that the personal health information in its custody and control is protected against theft, loss and unauthorized use or disclosure.
Care is used in the disposal or destruction of personal health information, to prevent unauthorized parties from gaining access to the information.
Principle 8 — Openness about Personal Health Information Policies and Practices
Information about CTCHC’s policies and practices relating to the management of personal health information are available, including:
- Contact information for the Executive Director, to whom inquires and complaints can be made.
- The process for obtaining access to personal health information held by CTCHC, and making requests for its correction.
- A description of the type of personal health information held by CTCHC, including a general account of its uses and disclosures.
- A copy of CTCHC’s Privacy Statement.
Principle 9 — Individual Access to Personal Health Information
CTCHC will give clients timely access to their personal health information and the ability to correct the personal health information in their record if they meet PHIPA’s requirements.
Principle 10 — Challenging Compliance with CTCHC’s Privacy Policies and Practices
Any individual may address a challenge concerning compliance with CTCHC’s Privacy policies and practices to the Executive Director at (416) 703.8482 ext. 321 or by e-mail.
CTCHC will receive and respond to inquiries and complaints about its policies and practices relating to the handling of personal health information. It will inform individuals who make inquiries or make complaints of other available resources i.e. the Information and Privacy Commission for the province of Ontario.