Accessing Your Health Information
Under Ontario’s health privacy law, anyone who provides you with health services must protect your health information. That includes us. We have to tell you what we do with your health information, and in certain situations, ask permission before we get it, use it or share it. We are not allowed to collect, use or share health information if we don’t need to, or collect, use or share more information than is necessary. You can also ask to see the information in your record and ask us to change or correct it if you think there is a mistake.
Under the law, we have to tell you if your health information is stolen, lost or if it’s been used or shared improperly. In certain cases, we also have to report the privacy breach to the Information and Privacy Commissioner of Ontario (IPC). The IPC oversees compliance with Ontario’s health privacy law, hears and decides complaints about the handling of personal health information, and educates the public about their privacy rights.
This brochure describes our privacy practices and tells you how you can exercise your rights.
For more information, please see our contact person whose name is at the end of this brochure.
Who Can Use and See Your Health Information
Implied Consent To Collect, Use And Share Your Information To Provide Health Care
When you seek health care from us, and unless you tell us otherwise, we assume that we have your permission to collect, use and share your health information among the health care providers at our organization. This includes doctors, nurses, residents, social workers, therapists, and other professionals or their support staff who provide or assist in providing health care to you. We may also share your health information with other health care providers outside our organization so they can provide you with ongoing health care and follow-up. Generally, we do not allow staff members who do not provide or assist in your health care to see your health information.
Updating The Provincial Electronic Health Record
We may provide your health information to Ontario Health to update your provincial electronic health record (EHR).
The EHR system is a provincial health record system that allows your health care providers to access, in one place, your health information from anywhere across the province.
The purpose of the EHR is to help facilitate and coordinate your health care across providers.
Express Consent To Share Your Information With Other People
Sometimes we cannot assume we have your permission to share your health information with others. For example, we generally have to ask your express permission to share your health information with:
- people who do not provide you with health care, like insurance companies or your employer
- a health care provider for reasons other than providing you with health care
People outside the health care system who receive your health information from us can only use it or share it for the reasons that they lawfully received it or if it is allowed or required by law.
Let us know if you want us to share your health information with your family and friends. For example, you may want us to tell your loved ones about your care or treatment plan or what kind of care you may need at home.
Limits On Collecting, Using And Sharing Your Health Information
In some cases, you can tell us not to collect, use or share some or all of your health information. If you choose to limit how we share your health information for health care purposes, you should be aware that when we give your health information to other health care providers, we are still required to tell them when we are not able to give them all the information they will need to provide you with health care.
For more information, please speak to our contact person whose name is at the end of this brochure.
Using Your Health Information Without Your Consent
Ontario’s health privacy law allows or requires us to use your health information without your consent in some situations, including:
- to educate those acting on our behalf in providing health care, such as medical students or residents
- to contact you to get your consent, or the consent of someone who may consent on your behalf
- to do research with the approval of a research ethics board
- to receive payment for our services
- to plan or deliver our programs or services
- for risk management purposes
- in a legal proceeding (e.g. a court case) where we or someone acting on our behalf is a party or a witness
- as permitted or required by law
Sharing Your Health Information Without Your Consent
The law allows or requires us to share your health information with others without your consent in some situations, including:
- if sharing the information is necessary to provide you with health care and we cannot get your consent in a timely manner
- to obtain payment for providing health care through government programs, like the Ontario Health Insurance Plan (OHIP)
- to contact a relative, friend or someone who may consent on your behalf, if you are injured, incapacitated or ill and unable to give consent
- to report certain diseases to public health authorities
- when we suspect certain types of abuse
- to reduce or eliminate a risk of harm
- to assist with a law enforcement investigation or to comply with a warrant
- in a legal proceeding where we or someone acting on our behalf is a party or witness
- as permitted or required by law
Information About A Deceased Individual
The law also allows us to share health information about a deceased individual:
- to identify the individual who has died
- to inform someone that the individual has died and the circumstances of the death, where appropriate
- if the deceased individual’s spouse, partner, sibling or child needs the information to make decisions about their own health care or their children’s health care
If You’re In A Health Care Facility Such As A Hospital
We may tell your family, friends and others who ask general information about you, such as your location and health status. Let our staff know if you do not want us to share this kind of information. You may not want us to share this information with anyone, or you may only want us to share it with certain people who you can name or describe, such as your spouse or children.
If you give us information about your religious or other organizational affiliation, we may share your name and location with a representative of that organization to provide you with support, such as spiritual care, unless you tell us not to. Once again, you should let us know if you do not want us to give this kind of information to religious and other organizations.
People Who Can Make Decisions For You
We presume that you are able to make your own decisions about your health information. If we determine that you cannot, another person, usually a family member, will make decisions for you. The law tells us who to turn to first on a list of “substitute decision makers.” That person can make decisions about your health information that relates to that treatment. Alternatively, you may decide, in advance, who can consent on your behalf when you are no longer capable to make these decisions.
We may give your substitute decision maker information about you to help them make decisions on your behalf. They can also ask to see your records, and our staff will give them information about your health. We will ask you or the person who can consent on your behalf, before giving your health information to your other family members.
Fundraising And Marketing
Many health care organizations undertake fundraising campaigns to improve their services, such as buying new medical equipment. To support these efforts, the law allows us to share limited information about you for fundraising. For example, we may share your name and address so that fundraisers, such as a hospital foundation, can contact you or someone who is acting on your behalf. However, we will not share any health information for this purpose without your explicit consent.
You can tell us at any time if you do not want fundraisers to contact you. To do so, please speak to our contact person whose name is at the end of this brochure.
The law prohibits us from sharing your health information for marketing purposes unless you allow us to. For example, if we believe that a particular medical device could help you, we would have to ask you before giving your name to someone who wants to sell you the device.
Sometimes, we will ask you for consent before we use or share your health information for this purpose. In other circumstances, when a research ethics board determines it is appropriate and the researcher complies with specific requirements, your consent may not be required. If that happens, researchers can only use your health information according to an approved research plan, and cannot contact you without your consent.
Planning And Managing The Health System And Facilitating Health Care
The law allows us to share your health information with certain organizations that help:
- improve and make health care delivery easier
- plan and manage the health care system
These specific organizations are designated by law and have their practices and procedures reviewed and approved by the IPC every three years.
Your Health Number
The number on the front of your OHIP card is your “health number” and is a special kind of health information, with special rules.
Only people and organizations that provide you with health care or goods or services funded by the government of Ontario, like health care covered by OHIP, can require you to show your health card.
A health care provider can collect, use and share your health number, to treat you and receive payment from OHIP.
Your Rights And Choices
Seeing Your Health Record
You have the right to see your health record and to get a copy of it. You simply have to ask us for it in writing, and you may be required to pay a fee.
Some exceptions may apply. For example, you may not be able to see information in a record that relates to law enforcement, or legal proceedings or that is about another individual.
We must respond to your request within 30 days. There may be a delay of up to a maximum of 30 more days if we have to ask others about the record or if we need time to find the record and process the request. We must tell you about any delays within the first 30 days of receiving your request. If you require the record urgently, we must respond to your request within a shorter period, if possible.
Correcting Your Record
If you believe that your health record is inaccurate or incomplete, you may write to us and ask for a correction.
We must reply to your request within 30 days. In some cases, we may extend the time for a response up to a maximum of 30 more days. We must tell you about any delays within the first 30 days of receiving your request.
We are not obligated to correct a record created by someone else or if it contains a professional opinion or observation made in good faith. We will tell you why we are refusing a requested correction. If we refuse your request, you have the right to have a statement of disagreement attached to your record. You can also ask to have this statement made available to those who see the record.
Who You Can Talk To About Your Questions Or Concerns
Please speak to the contact person whose name is at the end of this brochure:
- if you have a question about our privacy policies and practices in handling your health information
- if you wish to talk to someone about your health information, or you want to know more about how to give, withhold or withdraw consent to your health information being collected, used or given out to someone else
- if you want to see your health record or request a correction
- if you are wondering about something that may have happened to your health information, and need more detailed information
Please come to us first if you are not happy about something related to your health information. If you have a complaint, we will work with you to try to resolve your concerns. To discuss your concerns and see if we can help fix the situation, please speak to our contact person.
The Information And Privacy Commissioner Of Ontario
If we are unable to resolve all of your concerns about your health information, you may contact the IPC, which oversees compliance with Ontario’s health privacy law.
You can make a complaint to the IPC about any decision, action or inaction that you believe does not comply with the law, such as:
- if you are unable to resolve a complaint or concern about how your health information has been handled
- if you are unable to see all of your health information, or want to complain about a delay in responding to your request
- if you feel the health information in your record is incorrect and you have been unable to persuade us to correct the information to your satisfaction, or if we refuse to attach your statement of disagreement to your record, or
- if you disagree with the fee that we charged for you to see or get a copy of your health record
Generally, you must file a complaint within a year of becoming aware of a matter and submit it in writing. You only have six months to make a complaint if it is about an access or correction request. If your complaint cannot be resolved through mediation, the IPC may investigate and make a binding decision to settle the matter.
You can contact the IPC at:
About the IPC
The role of the Information and Privacy Commissioner is set out in five statutes: the Freedom of Information and Protection of Privacy Act, the Municipal Freedom of Information and Protection of
Privacy Act, the Personal Health Information Protection Act, 2004, Part X of the Child, Youth and Family Services Act, 2017, and the Anti-Racism Act.