Reconnect recognizes the importance of privacy and the sensitivity of its clients’ personal health information (PHI) and other personal information. Reconnect has determined that it is a “health information custodian” under Ontario’s Personal Health Information Protection Act, 2004 (PHIPA), and anyone who collects, uses or discloses PHI on Reconnect’s behalf is required to follow these 10 information principles:
1. Accountability for Personal Health Information
Reconnect demonstrates its commitment to privacy and the confidentiality of PHI by:
• Implementing policies and procedures to protect PHI
• Educating staff and volunteers about Reconnect privacy requirements
• Responding to questions and concerns from clients regarding privacy matters
• Making material about Reconnect’s privacy practices publicly available
2. Identifying Purposes for which Personal Health Information is Being Collected
Reconnect will identify the purposes for which client information is collected at or before the time the information is collected.
Reconnect collects client information for the following purposes:
• Coordinated and effective health care and related services to clients
• Referrals to other related programs for clients
• Planning, delivering and evaluating programs and services
• Quality assurance
• Reporting aggregate information and statistics to funders
• Payment or processing payment for provision of health care
• Research conducted by Reconnect (in accordance with privacy legislation)
• Other purposes permitted or required by law
When PHI that has been collected is to be used for a purpose not previously identified, consent is required unless the use is permitted or required by law.
3. Consent for the Collection, Use, and Disclosure of Personal Health Information
In order to provide coordinated and effective health care, it is important that Reconnect collect client information from other service providers and share information about clients with such providers. The knowledge and consent of the client is required for the collection, use and disclosure of client information, except when permitted by law.
Although not legally required in all circumstances, as a matter of policy, Reconnect seeks express written consent for the sharing of client information whenever possible.
A client may withdraw consent to the collection, use or disclosure of all or a part of their PHI at any time.
4. Limiting Collection of Personal Health Information
Reconnect will limit the collection of client information to that which is necessary to provide optimal care through Reconnect’s programs and services, and for other purposes identified in Principle 2 above. Client information shall be collected by fair and lawful means.
5. Limiting Use, Disclosure, and Retention of Personal Health Information
All information about a client’s involvement with Reconnect is considered confidential. Reconnect will not use or disclose client information for purposes other than those for which it was collected, except with the consent of the individual or as required or permitted by law. Client information will be retained only as long as necessary for the purposes for which collected.
6. Accuracy of Personal Health Information
Reconnect takes reasonable steps to ensure PHI is as accurate, complete and up-to-date as necessary for the purposes for which it is to be used. Reconnect does not routinely update information in its control unless routine updates are necessary to fulfill the purposes for which the information was collected. A client has a right to challenge the accuracy of their PHI.
7. Safeguards for Personal Health Information
Reconnect recognizes the sensitivity of PHI and takes reasonable measures to ensure that client information are kept safe from loss or theft, unauthorized access, use, copying, disclosure or modification.
Client information in Reconnect’s custody or control is protected by physical, administrative and security safeguards. These include:
• Restricted access to client information
• Premises security
• Technological safeguards
• Privacy training for staff and volunteers
• Destruction of client information in a secure manner
• Requiring contractors to comply with security safeguards
Reconnect responds promptly, effectively and sensitively and in accordance with all laws and requirements to any unauthorized collection, use, or disclosure of client information.
8. Openness about Personal Health Information Policies and Practices
Information about Reconnect’s policies and practices relating to the management of client information are readily available to individuals, including:
• Reconnect’s Statement of Information Purposes (on-line)
• Contact information for the Privacy Officer and Information and Privacy Commissioner/Ontario (set out below)
9. Individual Access to Personal Health Information
A client may request access to their client records in Reconnect’s custody or control. The Privacy Officer will respond to an individual’s written request within reasonable timelines as governed by legislation.
A client may challenge the accuracy and completeness of their client information. Any challenge is to be directed to Reconnect’s Privacy Officer. The Privacy Officer will investigate and amend the information, as appropriate.
10. Challenging Compliance with Reconnect’s Privacy Policies and Practices
Privacy Officer, Reconnect Community Health Services
56 Aberfoyle Crescent, 4th Floor
Phone: (416) 248-2050 ext. “0”
Fax: (416) 248-6557
Reconnect will investigate all complaints received. If a complaint is found to have merit, Reconnect will take appropriate measures to address the complaint.
If a client has any concerns about how their PHI is being handled, he or she has the right to contact the Information and Privacy Commissioner/ Ontario at:
Office of the Information and Privacy Commissioner of Ontario
2 Bloor Street East, Suite 1400
Phone: (416) 326-3333 or 1-(800) 387-0073