Privacy Statement
GlGlebe Psychotherapy Personal Health Information Protection Plan
We are committed to protecting your privacy and ensuring the confidentiality of your personal health information. Glebe Psychotherapy engages in a regulated health profession subject to the Personal Health Information Protection Act, 2004 (“PHIPA” or the “Act”). The purpose of this statement is to provide you with information to help you understand how your personal health information is collected and used.
What is my personal health information?
Personal health information includes your name, address, phone number, date of birth, presenting issues, insurance details, and records of the care provided to you. This information is referred to as your health record. Knowing what is in your health record and understanding how your personal information is used, helps you to:
• ensure its accuracy
• better understand who, what, where, why and how others may access your personal information and
• make informed decisions regarding disclosures to others
We collect, and use your personal health information
for the following purposes:
• to provide intakes and referrals to our Registered Psychotherapists and Registered Psychotherapists (Qualifying) in order for them to provide services to clients.
• to obtain payment for services provided.
• to comply with our regulatory obligations to the College of Registered Psychotherapists of Ontario (CRPO) and maintain the standards of record keeping outlined by CRPO.
• your information is disclosed with your consent, which may be express or implied where permitted by PHIPA, or when disclosure is required or authorized by law.
What can you expect from Glebe Psychotherapy and your Therapist?
Any personal information collected will be used for your care and treatment and other purposes permitted or required by law. The Health Information Custodian responsible for your health record is determined by the custody or control arrangements established in accordance with PHIPA. Glebe Psychotherapy and your Therapist are responsible for protecting your personal health information in accordance with their respective legal obligations.
Your consent may be implied for the collection, use and disclosure of your personal health information for care and treatment purposes where permitted by PHIPA, provided the legal requirements for consent are met.
Your personal information will not be disclosed without your consent unless the disclosure is required or authorized by law. Consent may be express or implied where permitted by PHIPA. Express consent will be obtained where required.
Your personal information may be disclosed without your permission when it is required or authorized by law. For example, where there is a duty to report a child in need of protection, where disclosure is necessary to address a significant risk of serious bodily harm to yourself or another person, where statutory reporting obligations concerning sexual abuse by a regulated health professional apply, or where disclosure is legally compelled by a valid court order or other lawful requirement.
In the collection and storage of your Personal Health Information, Glebe Psychotherapy maintains administrative, physical and technical safeguards appropriate to the sensitivity of the information and consistent with the requirements of PHIPA.
We will collect, use and disclose only as much personal health information as is reasonably necessary to achieve these purposes. You can withhold or withdraw your consent to the collection, use or disclosure of your personal health information, subject to applicable legal requirements and exceptions, by contacting Susan Kim, Clinical Director and Privacy Contact Person, at (819) 712-8405.
What are your rights?
Your personal information protection rights include knowing why your personal information is collected, how it is used, and to whom it is disclosed.
Access Rights
• PHIPA provides a broad right of access to the personal health information held by a custodian about an individual. However, PHIPA provides some grounds for refusing such a request including the following:
• it is quality of care information or information generated for a regulated health profession's quality assurance program;
• it is raw data from standardized psychological tests or assessments;
• there is a risk of serious harm to the treatment or recovery of the individual or of serious bodily harm to the individual or another person; or
• access would reveal information protected by a specific exception under PHIPA, including certain confidential sources or legally privileged information.
PHIPA provides procedures for handling access requests including the following:
• the custodian must assist the individual in making a meaningful request, if necessary;
• while the custodian can informally provide access, it can also require a formal written request;
• the custodian should, where reasonably practical, explain terms, codes and abbreviations;
• the custodian must notify the individual of their right to complain to the Information and Privacy Commissioner of Ontario if the request for access is refused (along with the reasons for the refusal) and the burden of justifying the refusal is on the custodian;
• the custodian can refuse frivolous, vexatious and bad-faith requests for access where permitted by PHIPA;
• the custodian must satisfy themself of the identity of the individual before granting access;
• the custodian must provide access to electronic records in accordance with PHIPA and any applicable requirements concerning electronic formats;
• the custodian can only charge a reasonable cost recovery fee for access and must provide an estimate of the fee in advance (the Information and Privacy Commissioner has held that a reasonable fee for photocopying or printing is $30.00 for the first 20 pages and 25 cents for every additional page, subject to applicable circumstances); and
• the custodian must respond to a request for access as soon as possible and no later than 30 days after receiving the request, but the custodian can extend the time for a response by up to another 30 days where permitted by PHIPA, with written notice of the extension and the reasons for it.
Correction Rights
• We have an obligation to correct personal health information where the client demonstrates that it is inaccurate or incomplete for the purposes for which it is used or disclosed, subject to the exceptions in PHIPA.
• Clients may request that their health information be corrected if it is inaccurate or incomplete. Such requests must be made in writing and must explain what information is to be corrected and why.
• We must respond to requests for correction within 30 days (or seek an extension of up to an additional 30 days where permitted by PHIPA, with written notice to the client). Corrections are made in the following ways:
o Striking out the incorrect information in a manner that does not obliterate the record or
o If striking out is not possible: Labelling the information as incorrect, severing it from the record, and storing it separately with a link to the record that enables the Health Information Custodian to trace the incorrect information, or
o Ensuring there is a practical system to inform anyone who sees the record or receives a copy that the information is incorrect and directing that person to the correct information.
• The record will not be corrected if:
o The record was not originally created by the Health Information Custodian and the Health Information Custodian does not have sufficient knowledge, expertise or authority to correct the record, or
o The record consists of a professional opinion or observation which was made in good faith.
• If we choose not to correct a record, the client must be informed in writing. The client will have the choice to submit a statement of disagreement, which will be attached to the health record and disclosed as required by PHIPA when the disputed information is disclosed. In these cases, clients have a right to complain to the Information and Privacy Commissioner of Ontario.
Complaints
• We will receive and respond to complaints or inquiries about our policies and practices relating to the handling of personal health information. We will inform clients who make inquiries or lodge complaints of other available complaint procedures.
• All complaints about the nature of the safeguards or the secure handling of information related to Glebe Psychotherapy's information records, both electronic and physical, should be directed to the Privacy Contact Person - Susan Kim (819) 712-8405.
• A review will be conducted within 7 business days.
• If a complaint is found to be justified, we will take appropriate measures to respond.
• The Health Information Custodian will address any further action required regarding the complaint, through internal procedures or, where required, through notification to the Information and Privacy Commissioner of Ontario.
• The Information and Privacy Commissioner of Ontario oversees compliance with privacy rules and PHIPA. Any individual can make an inquiry or complaint directly to the Information and Privacy Commissioner of Ontario by writing to or calling:
2 Bloor Street East, Suite 1400
Toronto, Ontario M4W 1A8 Canada
Phone: 1 (800) 387-0073 (or (416) 326-3333 in Toronto)
Retention and Destruction of Personal Information
• Glebe Psychotherapy will retain clinical records for at least 10 years after the last client interaction, or for at least 10 years after a minor client turns 18, whichever is later, in accordance with CRPO standards and applicable legal requirements. After the applicable retention period, information will be securely disposed of when no longer required to be retained.
• Should your therapist leave Glebe Psychotherapy, responsibility for your personal health information will remain with the designated Health Information Custodian unless the records are lawfully transferred to another custodian. Any transfer will be managed in accordance with PHIPA, applicable professional standards, and the agreements governing custody and control of the records.
• Information will be disposed of in a secure manner (shredding, deletion in a manner that files cannot be recovered). No 3rd party shredding company will be employed by Glebe Psychotherapy.
Personal Health Information Breach Procedure
In the event of an information breach, the Health Information Custodian will:
• Ensure the Privacy Contact Person and appropriate staff/departments are informed of the breach and take reasonable steps to contain, investigate and document the incident.
• Notify the Information and Privacy Commissioner of Ontario at the first reasonable opportunity where notification is required under PHIPA and its regulations.
• Notify affected individuals at the first reasonable opportunity where personal health information has been stolen, lost, or used or disclosed without authority, as required by PHIPA. The notification will include information about the individual's right to complain to the Information and Privacy Commissioner of Ontario.
• Determine the most appropriate method of notifying affected individuals, taking into account the sensitivity of the information and the circumstances of the breach, and provide the organization's contact information for further questions.
• Maintain required breach documentation and submit annual breach statistics to the Information and Privacy Commissioner of Ontario as required by law.
Health Information Custodian
The Health Information Custodian is ultimately responsible for the personal health information in their custody or control. Under Ontario's health privacy legislation (PHIPA), a Health Information Custodian may be a health care practitioner or a person or organization operating a group practice. Responsibility for personal health information at Glebe Psychotherapy is determined by the applicable custody and control arrangements, and therapists and practice personnel must fulfill their respective legal and professional obligations.
Glebe Psychotherapy's Health Information Privacy Contact Person is Susan Kim, Clinical Director (819) 712-8405.
As custodian you can expect:
• facilitate organization-wide compliance with PHIPA,
• educate the agents of the custodian,
• respond to public inquiries about the custodian's information practices,
• oversee access and correction requests,
• handle privacy complaints.
If you have questions or want to make a complaint about our privacy practices, please contact Susan Kim, Clinical Director, Glebe Psychotherapy (819) 712-8405.