| |
Are there rules for how Bridgepoint Health collects, uses, and discloses my personal health information?
What does Bridgepoint Health use my health information for?
Can I request that Bridgepoint Health not collect or use my personal health information for any of the following purposes: the delivery of direct patient care, administration of the health care system, program evaluation, quality improvement and assurance, Research Ethics Board approved research and statistics?
Can I request my personal health information not be used for the purpose of fundraising?
Who does Bridgepoint Health disclose my personal health information to?
Does Bridgepoint Health ever sell patient information to drug companies, market research companies or anyone else?
Will Bridgepoint Health disclose my health information to any outside company or my employer?
Can I access my health information?
Where do I go to access my personal health information?
What if information contained in my medical record is inaccurate or incomplete?
Can Bridgepoint Health provide me with access to my lab tests done outside of Bridgepoint?
Can my family and friends see my personal health information?
What happens if I am incapable of providing consent?
How does Bridgepoint Health determine who to appoint as my substitute decision maker?
Can all Bridgepoint Health staff access my patient record?
Can my family physician access my Bridgepoint Health personal health information?
Can I communicate with my health care providers at Bridgepoint Health by e-mail?
How is my personal health information protected?
When I called the hospital to see how my friend or family member was doing, the Bridgepoint Health staff would not tell me what the problem with my friend or family member was - why is that?
I have noticed that many areas of the hospital are open and I can sometimes overhear staff talking to patients or family about health information. Is this not a breach of patient privacy?
Where is my Bridgepoint Health patient record stored, and for how long?
The Personal Health Information Protection Act
What is the Ontario Personal Health Information Protection Act?
To whom does PHIPA apply?
What is the purpose of PHIPA?
What is personal health information?
What is a health information custodian?
What is an agent?
What is meant by circle of care?
What rights do I have as a patient under PHIPA?
What is the difference between express and implied consent?
If I have more questions, whom do I ask?
Are there rules for how Bridgepoint Health collects, uses, and discloses my personal health information?
Bridgepoint Health has a Privacy Policy that is based on the Ontario Personal Health Information Protection Act (PHIPA). The Bridgepoint Health Privacy Policy governs the manner in which Bridgepoint Health collects, uses, and discloses personal health information.
Top
What does Bridgepoint use my health information for?
Bridgepoint Health uses your information for the delivery of direct patient care, administration of the health care system, program evaluation, quality improvement, Research Ethics Board approved research, statistics, fundraising, and meeting legal and regulatory requirements.
Examples of these uses include:
- Administration of the Health Care System: Bridgepoint Health needs some basic information about you to be able to identify your records when you visit the hospital.
- Research Ethics Board Approved Research: You may be asked if you wish to participate in a clinical trial being carried out at Bridgepoint Health.
- Statistics: To enable continuous quality improvement, Bridgepoint Health keeps statistics on all patient visits.
- Fundraising: Your name and address may be used by the Bridgepoint Health Foundation to contact you about fundraising opportunities unless you notify us that you do not wish to be contacted about fundraising.
- Legal Requirements: Bridgepoint Health may receive court documents requesting your personal health information for a legal investigation or court proceedings.
- Regulatory Requirements: Bridgepoint Health collects your health insurance number, because it is required for the processing and funding of services.
Top
Can I request that Bridgepoint Health not collect or use my personal health information for any of the following purposes: the delivery of direct patient care, administration of the health care system, program evaluation, quality improvement and assurance, Research Ethics Board approved research and statistics?
Bridgepoint Health cannot adequately deliver care without some necessary personal health information. The Bridgepoint Health Privacy Policy states that we only collect the information we need for the purposes listed above. For more information or to request a copy of the Privacy Policy, please contact Bridgepoint Health Chief Privacy Officer at privacyoffice@bridgepointhealth.ca or by phoning 416-461-8252 ext. 1321.
Bridgepoint Health is required to report certain pieces of information to the Provincial Ministry of Health (billing information), the Canadian Institute for Health Information (coded discharge abstracts), Toronto Public Health (public health surveillance information), and Cancer Care Ontario (pathology reports). This is done to ensure the health care system is running optimally, and to conduct statistical comparisons of population health characteristics over a broad geographical range.
Bridgepoint Health carries out research to improve the health care of its patients and ensure the maximum effectiveness of the care provided. Bridgepoint Health personnel may only collect and use the minimum amount of information necessary to fulfill the requirements of a Research Ethics Board approved study. Before researchers may access and personal health information, Bridgepoint Health removes as much identifying information as possible. Also, your consent will always be obtained prior to participating in clinical trial research, or any other research that may have a direct impact on your care.
The collections, uses, disclosures and retentions described above are required as an ongoing component of Bridgepoint Health’s ability to provide health care to the population it serves, while working to enhance the health status of Canadians.
Top
Can I request my personal health information not be used for the purpose of fundraising?
From time to time, you may be contacted by the Bridgepoint Health Foundation. Bridgepoint Hospital provides only your name and address to the Bridgepoint Health Foundation for the purpose of fundraising. The Bridgepoint Health Foundation is dedicated to supporting excellence in health care by raising funds for research, medical education, and the improvement of patient care. You can be removed from our fundraising contact list at any time by contacting the Bridgepoint Health Chief Privacy Officer at privacyoffice@bridgepointhealth.ca or by phoning 416-461-8252 ext. 1321 or by contacting the Bridgepoint Health Foundation at 416-461-8252 ext. 2057.
Top
Who does Bridgepoint Health disclose my personal health information to?
Bridgepoint Health is required to disclose patient information to several organizations. This includes the Ontario Ministry of Health and Long-Term Care, The Canadian Institute for Health Information and Toronto Public Health. Information may also be disclosed to other physicians or health care organizations directly involved in delivering care to our patients. Bridgepoint Health places appropriate safeguards on the transmission of all information disclosed to other organizations and seeks to ensure that appropriate data protection measures are in place at those organizations.
Top
Does Bridgepoint Health ever sell patient information to drug companies, market research companies or anyone else?
Bridgepoint Health does not sell patient information to anyone – including drug companies or market research companies.
Top
Will Bridgepoint Health disclose my health information to any outside company or my employer?
Bridgepoint Health requires your express consent prior to disclosing any of your personal health information to anyone outside of your circle of care, such as insurance providers or your employer.
Top
Can I access my health information?
You have a right to access your personal health information, and Bridgepoint Health has an obligation to make it available to you, with limited exceptions. Exceptions are made if releasing your information would put you or a third party at risk – in which case Bridgepoint Health may choose not to disclose some or all of that information.
Top
Where do I go to access my personal health information?
If you would like access to your personal health information, please contact Bridgepoint’s Health Records Department.
The Health Records department may ask you to present personal identification to access your health record. You may access your personal health information; however, you may not access third party information or information about individuals other than yourself that may be in your patient chart. If your chart contains third party information, it may take up to 30 days to have this information removed from your chart prior to you viewing it.
There is no charge for access, but there is a processing fee associated with requesting a photocopy of the chart.
Top
What if information contained in my medical record is inaccurate or incomplete?
Under the Bridgepoint Health Privacy Policy, you have the right to request changes to any information in your record that you believe is inaccurate or incomplete. If the information is determined to be inaccurate or incomplete upon review, Bridgepoint Health will amend the information, as required. Depending upon the nature of the information in question, this may involve the correction or addition of information. Where appropriate, the amended information will be transmitted to other health care providers with access to the information in question.
Top
Can Bridgepoint Health provide me with access to my lab tests done outside of Bridgepoint?
If your Bridgepoint Health clinician refers you to another organization (e.g. MDS, CML, Gamma-Dynacare) to have a test completed, this information will be provided to Bridgepoint Health and will be included in your medical record. These tests may be accessed through the Health Records Department, as described above. Bridgepoint Health may not have copies of tests ordered by physicians outside of Bridgepoint Health or completed prior to your receiving care a Bridgepoint Health.
Top
Can my family and friends see my personal health information?
Although you have the right to access your charts, this right does not automatically extend to family members and/or friends. If you consent to let a friend or family member see your chart or be informed of your health status or condition, then the friend/family member may be provided with the information that you have consented to make available to them.
Top
What happens if I am incapable of providing consent?
Bridgepoint Health will generally presume that you are capable of making your own decisions regarding the collection, use or disclosure of your personal health information if you are able to understand and appreciate the consequences of providing, withholding or withdrawing your consent. If it is believed that you are incapable of providing consent, PHIPA permits a substitute decision maker (such as a relative, spouse, or the Public Guardian and Trustee) to make a decision on your behalf.
Top
How does Bridgepoint Health determine who to appoint as my substitute decision maker?
If you are determined to be incapable of providing consent, the following individuals are legally authorized to provide consent on your behalf, in the following order of priority:
- A substitute decision maker if the purpose of collection, use or disclosure is necessary for, or ancillary to, a decision about treatment under Part II of the Health Care Consent Act, 1996, a decision about admission to a care facility under Part III of the Health Care Consent Act, 1996 or a decision about a personal assistance service under Part IV of the Health Care Consent Act, 1996.
- A guardian of the person or guardian of property.
- An attorney for personal care or attorney for property.
- A representative appointed by the Consent and Capacity Board.
- The individual’s spouse or partner.
- A child or parent of the individual.
- A parent of the individual with only a right of access to the individual.
- A brother or sister of the individual.
- Any other relative of the individual.
A person listed above may only consent if he or she is capable of consent, is at least 16 years of age or the parent of the individual to whom the personal health information relates, is available and willing to assume responsibility for making a decision and is not prohibited by a court order or separation agreement from having access to the individual to whom the personal health information relates or from giving or refusing consent on behalf of the individual.
Where two or more persons who are equally ranked and ranked ahead of all others disagree about whether to consent, the Public Guardian and Trustee may make the decision of whether or not to consent in their place.
Consent may also be provided by a person authorized or required by law to act on your behalf. If a patient passes away while at Bridgepoint Health, consent must be obtained from the deceased individual's estate trustee or person who has assumed responsibility for administration of the estate, if the estate does not have an estate trustee.
Top
Can all Bridgepoint Health staff access my patient record?
No. Only staff involved in your care may access your patient record. All Bridgepoint Health staff are bound by the Bridgepoint Health Privacy Policy, which requires that staff only access information on a need to know basis.
Top
Can my family physician access my Bridgepoint Health personal health information?
In order to ensure you receive the highest level of care possible, Bridgepoint Health may share information about your care with health care providers who are part of your circle of care. If you do not wish to have information about your care shared within your circle of care, such as with your family physician or a community care access centre, please notify your Bridgepoint Health care provider or contact the Bridgepoint Health Chief Privacy Officer at privacyoffice@bridgepointhealth.ca or by phoning 416-461-8252 ext. 1321.
Top
Can I communicate with my health care providers at Bridgepoint Health by e-mail?
Unfortunately, Bridgepoint Health cannot guarantee the security of personal health information during transit over the internet and, therefore, Bridgepoint staff is not permitted to communicate personal health information over the internet. To protect your privacy you should never send personal health information by email. If you have specific needs or concerns, please contact your direct care provider or the Bridgepoint Health Chief Privacy Officer at privacyoffice@bridgepointhealth.ca or by phoning 416-461-8252 ext. 1321.
How is my personal health information protected?
There are three components to protecting patient information at Bridgepoint Health:
- Administrative Safeguards: The Bridgepoint Health Privacy Policy governs the manner in which all Bridgepoint Health care providers and other employees manage patient information.
- Physical Safeguards: Bridgepoint Health has a number of physical safeguards which range from locked doors, to staff wearing photo identification.
- Technical Safeguards: Bridgepoint Health’s technical department upgrades the security capabilities of the Bridgepoint Health network on an ongoing basis. Computers at Bridgepoint Health use passwords to protect the system from inappropriate accesses from within the organization and a firewall to protect the system from inappropriate access outside the organization.
When I called the hospital to see how my friend or family member was doing, the Bridgepoint Health staff would not tell me what the problem was with my friend or family member. Why is that?
When you call Bridgepoint Health, staff have no way to verify that you are who you say you are. Therefore, to protect patient privacy, only a minimal amount of information is given out over the phone. This is supported by the Bridgepoint Privacy Policy and the Personal Health Information Protection Act, which do not permit personal health information to be released to the public. However, Bridgepoint Health may describe the health status of your friend or family member in general terms, such as good, fair or poor, unless your friend or family member has instructed Bridgepoint Health not to disclose this information.
Top
I have noticed that many areas of the hospital are open and I can sometimes overhear staff talking to patients or family about health information. Is this not a breach of patient privacy?
Bridgepoint Health makes every effort to provide an environment in which as much privacy as possible is available to patients. Since it is inevitable that some information may be overheard in crowded hospital rooms, staff and patients are strongly encouraged to protect the confidentiality of personal health information which they discuss or may overhear. An individual exercising their discretion is very important in this regard. Please remember to protect other patient’s privacy and keep all personal health information you might inadvertently overhear at Bridgepoint Health confidential.
Top
Where is my Bridgepoint Health patient record stored, and for how long?
In general, patient records are kept in the Health Records Department or in a secure offsite storage facility for ten years past the date of last admission. For the purpose of research, some patient groups’ medical records may be kept for a longer period of time.
What is the Ontario Personal Health Information Protection Act?
The Personal Health Information Protection Act, 2004 (PHIPA) is Ontario's new health-specific privacy legislation. PHIPA governs the manner in which personal health information may be collected, used and disclosed within the Ontario health care system. It will also regulate individuals and organizations that receive personal health information from health care professionals.
PHIPA creates a consistent approach to protecting personal health information across the health care system. By providing a level playing field for all health care professions, PHIPA builds upon and codifies many of the existing high standards and protections enshrined in the common law, various professional codes, policies and guidelines. These legislated rules were designed to give individuals greater control over how their personal health information is collected, used or disclosed. They provide health care professionals with a flexible framework to access and use health information as necessary in order to deliver adequate and timely health care. In addition, PHIPA confirms a patient's existing right to access one's own personal health information and provides a means for redress through the Office of the Information and Privacy Commissioner of Ontario (IPC) when privacy rights relating to personal health information have been violated.
To whom does PHIPA apply?
PHIPA applies to a wide variety of individuals and organizations within the health care sector defined as health information custodians, such as Bridgepoint Health. PHIPA also applies to agents who are authorized to act for or on behalf of a health information custodian.
Top
What is the purpose of PHIPA?
PHIPA establishes a set of uniform rules about the manner in which Bridgepoint Health and other individuals and organizations in the health care sector may be collect, use or disclose personal health information, and includes provisions that:
- Require patient consent for the collection, use and disclosure of personal health information, with necessary but limited exceptions that would allow health care providers to provide efficient care;
- Require that health information custodians, such as Bridgepoint Health, treat all personal health information as confidential and keep it secure;
- Strengthen an individual's right to access his/her personal health records, as well as the right to correct errors;
- Give a patient the right to instruct health information custodians not to share any part of his/her personal health information with other health care providers;
- Establish clear rules for the use of personal health information for fundraising or marketing purposes;
- Set guidelines for the use and disclosure of personal health information for research purposes;
- Ensure accountability by granting an individual the right to complain to the IPC about the practices of a health care organization; and,
- Establish remedies for breaches of the legislation.
What is personal health information?
Under the Personal Health Information Protection Act, “personal health information” means identifying information about an individual in oral or recorded form, if the information:
- Relates to the physical or mental health of the individual, including information that consists of the health history of the individual’s family.
- Relates to the providing of health care to the individual, including the identification of a person as a provider of health care to the individual.
- Is a plan of service within the meaning of the Long-Term Care Act, 1994 for the individual.
- Relates to payments or eligibility for health care in respect of the individual.
- Relates to the donation by the individual of any body part or bodily substance of the individual or is derived from the testing or examination of any such body part or bodily substance.
- Is the individual’s health number.
- Identifies an individual’s substitute decision-maker.
Personal health information does not include identifying information about an employee or agent of a health information custodian that is not maintained for the purpose of the provision of health care.
Top
What is a health information custodian?
A health information custodian is a listed individual or organization under PHIPA that, as a result of their power or duties, has custody or control of personal health information, such as Bridgepoint Health. Examples of health information custodians include:
- Health care practitioners, including doctors, nurses, pharmacists, psychologists and dentists;
- Hospitals;
- Psychiatric facilities;
- Pharmacies;
- Laboratories;
- Nursing homes and long-term care facilities;
- Retirement homes and homes for special care;
- Community care access centres;
- Ambulance services;
- Boards of health;
- The Minister of Health and Long-Term Care; and
- Entities prescribed by regulations that are not defined as health information custodians but are permitted to collect personal health information from health information custodians for the purpose of health planning and management.
Top
What is an agent?
PHIPA defines an agent to include any person who is authorized by a health information custodian to perform services or activities on the custodian's behalf and for the purposes of that custodian. Examples of an agent at Bridgepoint Health may include an individual or company that contracts with, is employed by or volunteers for Bridgepoint Health and, as a result, may have access to personal health information. PHIPA permits Bridgepoint Health to provide personal health information to our agents only in situations where Bridgepoint Health is permitted to collect, use, disclose, retain or dispose of the information. For example, an agency relationship under PHIPA includes a nurse who is employed by, or a medical student who volunteers at, Bridgepoint Health.
An agency relationship may also include a physician who is not employed by Bridgepoint Health but provides services at Bridgepoint Health and uses the organization’s equipment or facilities. In such cases, Bridgepoint Health is permitted to authorize the agent to handle or deal with personal health information on its behalf so long as the agent complies with PHIPA and the Bridgepoint Health Privacy Policy.
Top
What is meant by circle of care?
The “circle of care” is not a defined term under PHIPA. It is a term of reference used to describe health information custodians and its authorized agents who are permitted to rely on an individual’s implied consent when collecting, using, disclosing or handling personal health information for the purpose of providing direct health care. For example, at Bridgepoint Health, the circle of care includes: the attending physician and the health care team (e.g., residents, nurses, technicians, clinical clerks and employees assigned to the patient) who have direct responsibilities of providing care to the individual.
Depending on a patient’s ongoing health care needs the circle of care may also include his or her family physician or a community care access centre.
In a physician’s office, the circle of care includes: the physician, the nurse, a specialist or other health care provider referred by the physician and any other health care professional selected by the patient, such as a pharmacist or physiotherapist.
The circle of care does not include:
- A physician who is not part of the direct or follow-up treatment of an individual;
- A medical officer of health or a board of health;
- An evaluator under the Health Care Consent Act, 1996;
- An assessor under the Substitute Decisions Act, 1992;
- The Minister of Health and Long-term Care, together with the Ministry of Health and Long-Term Care; and
- Any other person prescribed in the proposed Regulation.
Top
What rights do I have as a patient under PHIPA?
You can expect to be well informed about how your personal health information will be collected, used and disclosed by Bridgepoint Health. You can also expect the administrative, technical and physical safeguards relating to your personal health information to continue to be in place. PHIPA gives you the right to:
- Understand the purposes for the collection, use and disclosure of personal health information;
- Refuse or give consent to the collection, use or disclosure of personal health information, except in circumstances specified in PHIPA;
- Withdraw consent by providing notice to the health information custodian;
- Request access to one's own personal health information;
- Request corrections to be made to one's own personal health information;
- Complain to the IPC about a custodian's refusal to give access to all or part of a health record; and
- Complain to the IPC about any breach of PHIPA in the manner in which personal health information has been collected, used, disclosed or handled. PHIPA establishes a formal process for individuals to access and correct their own personal health information with time frames and rights of complaint and appeal if an access or correction request is denied.
What is the difference between express and implied consent?
Express consent to the collection, use or disclosure of personal health information by a health information custodian is explicit and direct. It may be given verbally, in writing or by electronic means. Implied consent permits a health care provider to infer from the surrounding circumstances that an individual would reasonably agree to the collection, use or disclosure of his/her personal health information. For example, when a patient presents at Bridgepoint Health to receive health care, we can reasonably assume that we have the patient’s consent to collect, use, and disclose their personal health information for the purpose of providing health care.
Top
If I have more questions, whom do I ask?
If you have any questions, please contact the Bridgepoint Chief Privacy Officer at privacyoffice@bridgepointhealth.ca or by phoning 416-461-8252 ext. 1321.
Top |
|
| | | |