Information and Privacy Commissioner/Ontario

Access and Privacy Office, Ontario Ministry of Government Services

Personal Health Information Protection Act, 2004

What is the Personal Health Information Protection Act, 2004?

The Personal Health Information Protection Act, 2004 (PHIPA) is a provincial law that came into effect November 1, 2004. This law sets out rules for the collection, use and disclosure of personal health information for Health Information Custodians operating within the province of Ontario, and also allows individuals to request access to their own personal health information held by these Custodians.

The legislation balances an individual's right to privacy of their personal health information with the legitimate needs of health care providers who require the information to administer medical treatment, or for other health care reasons - such as funding and health research.

PHIPA requires health information custodians to obtain consent in most circumstances before they collect, use and disclose personal health information. However, in certain circumstances, some collections, uses and disclosures are permitted without consent. In addition, the legislation provides individuals with a right to request access to, or correction of, their personal health information, as well as the ability to request an independent review by the Information and Privacy Commissioner/Ontario of an institution's decisions under PHIPA.

What is a Health Information Custodian?

PHIPA defines health information custodian as listed persons or organizations who have custody or control of personal health information as a result of the work that they do or in connection with the powers and duties they perform. Health Information Custodians include health care practitioners (or a person who operates a group practice of health care practitioners), the operator of a hospital, a nursing home, a pharmacy or an ambulance service. The Minister of Health and Long Term Care is also a Health Information Custodian. Regulations passed by the Province under PHIPA may also list additional Health Information Custodians in the future.

At the City of Ottawa, the following are Health Information Custodians:

• The Ottawa Paramedic Service
• The City's four Homes for the Aged:
• Garry J. Armstrong,
• Carleton Lodge,
• Centre d'accueil Champlain,
• Peter D. Clark Centre
• The Medical Officer of Health and Public Health Branch
• The Employee Assistance Program

Access to Personal Health Information

In accordance with PHIPA, every individual has a right of access to his or her personal information, subject to limited and specific exemptions that are prescribed in the law. Requests for information may be made formally or informally. The City of Ottawa encourages individuals to request their own personal health information informally if possible. This can be accomplished by simply contacting the program area directly that maintains the records, providing proof of identification and, if applicable, paying a fee to cover the cost of reproducing the records.

Only under certain circumstances will the program area advise an individual to submit a formal request under the PHIPA for access to their own personal health information. These include:

• if the request involves searching for a large number of records
• if the request contains a third party's personal health information
• if the records may be protected under other exemptions specified in PHIPA
• if the records may be protected under the Municipal Freedom of Information and Protection of Privacy Act.

Individuals may choose to submit their requests formally. This can be accomplished by completing the Personal Health Information Protection Act Access/Correction Form (pdf) and sending it to the address below, or by submitting a request in writing and addressing it to the Access to Information and Privacy Office, at this address:

PHIPA stipulates that a Health Information Custodian must provide the requester with his or her personal health information and/or a decision regarding the request within 30 calendar days from the date the completed request is received. On occasion, the Health Information Custodian may ask for an extension, if:

• The request is for an extensive number of records;
• The task of locating the records would necessitate a lengthy search; or
• The consultation process required to reply to the request would make it unreasonably practicable to reply within the time frame.

Correction of Personal Health Information

In some instances, you may feel that there is an error or omission in your personal health information the City of Ottawa. To request a correction or omission to this information, you must complete a PHIPA Access/Correction form (pdf), available here or at any of the City's Client Service Centres, or by contacting the Access to Information and Privacy Office at 580-2424, extension 21898.

If you are requesting a correction to your personal health information, you should attach a letter to your application form stipulating clearly the information that you believe to be inexact, incomplete or ambiguous, and the correction or amendment that you wish to make under the Act. In some instances, documentary proof will be required.

After receiving the request for correction, the City of Ottawa will correct or amend the personal health information or advise you of the reason why the information was not corrected or amended. Generally, only facts that are incorrect, incomplete or ambiguous may qualify for a correction. If the correction sought is merely a substitution of opinion, then it will not qualify as a correction of personal health information. If the information consists of a record that was not originally created by the City of Ottawa, it also will not meet the criteria to be considered as a correction request.

In the event that the correction or amendment is not made, you have a right to:

• Prepare a statement of disagreement and request that it be attached to the personal health information you requested to be corrected (a copy of the request for correction may be sufficient); or
• Make a complaint to the Office of the Information and Privacy Commissioner/Ontario

If the requested correction may reasonably be expected to have an effect on the on-going provision of health care or other benefits to you, you may have any person or body to whom the personal information was disclosed within the last twelve (12) months notified of the correction or statement of disagreement.

Making a Complaint to the Information and Privacy Commissioner/Ontario

Individuals who have reasonable grounds to believe that an institution has contravened (or is about to contravene) the provisions of PHIPA may make a complaint to the Information and Privacy Commissioner of Ontario. Similarly, any person may make a complaint to the Commissioner with respect to an institution's refusal of an access to information request. Timelines for making complaints are prescribed in sections 56(2) and (3) of PHIPA.

At the City of Ottawa, every attempt is made to resolve complaints regarding access or privacy matters informally through a resolution that is mutually satisfactory for both the complainant and the City. Sometimes a simple explanation may help to alleviate the concerns that an individual may have.

If you feel that your rights under PHIPA have been contravened, we encourage you to contact our Access to Information and Privacy Coordinator at the City's Access to Information and Privacy Office. However, you are free at any time to submit a formal complaint to the office of the Information and Privacy Commissioner/Ontario :

Personal Health Information Protection Act, 2004 Privacy Practice

The City of Ottawa provides a number of services to residents in the Ottawa area requiring the collection, use and disclosure of personal health information. The City is committed to upholding the standards of privacy established in PHIPA. Protection of privacy is a fundamental part of the City of Ottawa's day-to-day operations. In fact, the City has paid a considerable attention to privacy issues due to its requirement to adhere to privacy standards established under the Municipal Freedom of Information and Protection of Privacy Act (MFIPPA). The following practices are required under both MFIPPA and PHIPA, and are in place at the City of Ottawa. (Please note that each Health Information Custodian at the City of Ottawa will have specific information practices identified in the near future, which will be available through links at this site)

Identifying Purposes

• The City of Ottawa notifies individuals of the purpose for the collection of personal health information and of the intended use(s) of the information.

Consent

• The City of Ottawa obtains an individual's consent to the collection, use and disclosure of personal information, except where there is legal authority to collect, use or disclose the personal information without consent.

Limiting Collection

• The City only collects personal information required for the identified purpose, and collects this information by fair and lawful means.

Limiting Use, Disclosure, Retention

• The City obtains consent from the individual if his or her personal information is used for other purposes.
• The City obtains consent to disclose personal information, except where the disclosure without consent is authorized by law.
• The City keeps personal information for the period specified in legislation or in the City's retention By-Law.

Accuracy

• The City of Ottawa will keep personal health information as accurate and up-to-date as necessary for the fulfillment of the purposes for which it was collected. Where the personal health information is not accurate, the City of Ottawa will make the necessary changes to ensure the correction of the personal health information as outlined in the Personal Health Information Protection Act.

Safeguards

• The City of Ottawa ensures protection of information by security safeguards appropriate to the department in question and to the sensitivity of the information. Depending on the area of service and the nature of the personal information in question, the City uses administrative, technical and physical safeguards to ensure the security of various types of records.

Individual Access & Openness

• The City of Ottawa facilitates and promotes an individual's right of access to his or her own personal information by several means. Individuals are encouraged to seek access to their information informally from individual departments/program areas where possible. The City also routinely informs individuals of the purpose of collection of their personal information and of the intended use of the information through notifications on forms, pamphlets or by other means. On request, the City will provide additional information to individuals concerning the existence, use and disclosure of their personal information. Finally, the City's Access to Information and Privacy Office staff advise individuals on how to make access requests for their information, and how to make correction request.

Challenging Compliance

• The City's Access to Information and Privacy Office provides information to members of the public on how to make an access or privacy complaint at the City of Ottawa, and, if requested, directs individuals to the Information and Privacy Commissioner/Ontario for the purposes of making formal complaints and appeals.

General Information Concerning Collection, Use and Disclosure of Personal Health Information by the Health Information Custodians at the City of Ottawa

Ottawa Paramedic Service:

The Ottawa Paramedic Service collects personal health information from individuals in the course of providing emergency health services. The collection, use and disclosure of personal health information by the Service is regulated by the Ambulance Act, R.S.O. 1990, c. A.19, and its Regulations. Patient information is generally contained in an Ambulance Call Report, which is a record whose form and contents is prescribed by the Ambulance Act and its regulations.

Patient information is confidential. The Service will only disclose patient information to receiving medical staff responsible for the care of the patient, or to the patient himself or herself. Patient information will not be disclosed to any other party unless there is consent from the patient or there is legal authority to support the disclosure without consent. The Service also adheres to patient documentation standards established by the province's Ministry of Health and Long Term Care.

Note: More specific information concerning the Ottawa Paramedic Service's information and privacy practices is now available.

Homes for the Aged:

The City's four Homes for the Aged are: Island Lodge, Carleton Lodge, Centre d'accueil Champlain, and the Peter D. Clark Centre. The Homes collect, use and disclose personal health information in accordance with the Homes for the Aged and Rest Homes Act, R.S.O. 1990, c.H.13, its regulations, and other legislation affecting its residents such as the Health Care Consent Act, 1996, S.O. 1990, c.2, Sch.A. The Homes collect, use and disclose personal health information of their residents for the purposes of providing them residential and medical services, including but not limited to managing the admission, discharge and transfer of the residents, and developing and implementing their plan of care.

A resident's personal health information is confidential. Personal health information will be disclosed by authorized staff of the Homes to members of the resident's medical circle of care for the purposes of health care. Disclosure to third parties will only occur with the consent of the resident or if there is legal authority to disclose without consent.

Note: More specific information concerning the Homes' information and privacy practices is now available.

Medical Officer of Health & Public Health Branch:

The City's Public Health Branch, directed by the Medical Officer of Health, collects, uses and discloses the personal health information of individuals for the purposes of administering and delivering public health programs in Ottawa, in accordance with the Health Protection and Promotion Act, R.S.O. 1990, c.H.7 and its regulations. Personal health information collected by the branch will only be used for the purposes of public health in the context of one of the following areas: community sanitation (including the elimination of health hazards), control of infectious diseases (including communicable, and reportable diseases and the immunization of children or adults), health promotion and prevention of diseases and injuries, and home care services.

The Health Branch often works in co-operation with other entities in the health care field, including health care practitioners and hospitals. However, the Medical Officer of Health and the Public Health Branch staff will keep an individual's personal health information confidential, and will only disclose the information with the individual's consent, or for a legally authorized public health purpose.

Note: More specific information on the Medical Officer of Health and Public Health Branch's information and privacy practices is now available.

Employee Assistance Program

The Employee Assistance Program (EAP) collects personal and/or health related information in the process of providing voluntary counseling and referral services to employees of the City of Ottawa and their family members. The Employee Assistance Program respects the intrinsic worth of each client they serve when entering into a professional relationship with them and all information is regulated by the Ontario College of Social Workers and Social Service Workers (OCSWSSW) and the Canadian Counselling Association.

On behalf of the client the EAP often works in co-operation with other health care professionals, doctors, psychiatrists, psychologists, etc. Information collected is held in the strictest of confidence and will not be disclosed without the written consent of the client. Only in extreme situations may information be disclosed, e.g. when information is subpoenaed or a client is a danger to himself or another or in cases of child abuse. The OCSWSSW is accountable to the Ministry of Community and Social Services.

Note: More specific information on the Employee Assistance Program’s information and privacy practices will be available shortly through a link to be located below.

[ top ]