Privacy Policy & HINP Statement

CCFHT PRIVACY POLICY

 

PURPOSE AND SCOPE

Cottage Country Family Health Team (CCFHT) is dedicated to quality patient care and improving the health status of our communities. A patient’s right to privacy is balanced with CCFHT’s obligation to provide effective health care treatment. This policy specifies CCFHT’s information practices related to the protection of the privacy and confidentiality of the personal health information of all our patients that is in our possession and control.

This policy applies to CCFHT’s employees: a team of interdisciplinary healthcare providers including Nurse Practitioners, Registered Nurses, Registered Practical Nurses, Mental Health Therapists, a Pharmacist, a Dietitian, and their administrative support staff.

POLICY

CCFHT maintains privacy in compliance with the Personal Health Information Protection Act (PHIPA) 2004, which establishes rules for the collection, use and disclosure of personal health information about individuals that protects the confidentiality of that information and the privacy of individuals with respect to that information while facilitating the effective provision of health care.

Protecting the privacy and the confidentiality of patient personal health information (PHI) is important to CCFHT. This policy reflects CCFHT’s compliance with fair information practices, applicable laws and standards of practice.

CCFHT is responsible for the PHI under its control and will, in good faith, endeavour to ensure that all PHI be maintained private, confidential and secure.

The information practices adopted by CCFHT to protect the privacy and confidentiality of the information collected, used, or disclosed are described below. These practices are closely interrelated and should be interpreted as such.

1. Accountability:

CCFHT is responsible for any personal health information in its possession.  A privacy officer is appointed to oversee the compliance to this policy, related procedures and legislation.

2. Identifying Purposes:

Personal health information related to patients is collected, used, disclosed and retained for the purposes of:

  • Providing patient care or assisting with the provision of patient care.
  • Administration of the health care system.
  • Research, teaching, statistics, and fundraising as permitted by law.
  • To meet legal and regulatory requirements.

3. Consent:

The knowledge and consent of the individual is required for the collection, use or disclosure of personal health information.  CCFHT will inform its patients and make reasonable effort, through reasonable means (i.e. publication on the website, signage, information brochures etc.), of the purposes for which CCFHT will be collecting, using or disclosing their personal health information, and patient’s and client’s privacy right with regards to their personal health information in CCFHT’s possession. Patients’ implied consent will be assumed for the collection, use and disclosure of the personal health information for the purpose communicated to the patients. Express consent will be obtained for the collection, use and disclosure of the personal health information for any purposes other than those communicated, unless the collection, use and disclosure of the personal health information without consent is permitted by law.

4. Limiting Collection:

CCFHT will limit the amount and the type of personal health information collected to that which is necessary to fulfil the purposes identified. All information will be collected by fair, lawful and indiscriminate means.

5. Limiting Use, Disclosure and Retention:

Personal health information will not be used or disclosed for purposes other than those which it was collected, except with the consent from the individual or as required by law.  Personal health information will be retained only for as long as is necessary for the fulfilment of those purposes or as required by law (i.e. legislative requirements with respect to retention periods of personal health information).

6. Accuracy: 

CCFHT will take reasonable steps to ensure that personal health information is accurate, complete and relevant as possible and as is necessary for the purpose for which it is intended, to minimize the possibility that inappropriate information may be used for a specified purpose.

7. Safeguards – Protecting Patient Information:

CCFHT has security safeguards in place to protect personal health information against loss, theft, unauthorized access, disclosure, copying, use, or modification regardless of the format in which it is held. Care will be used in the disposal or destruction of personal information, to prevent unauthorized persons gaining access to the information.

8.  Openness:

CCFHT will make available to its patients, information regarding the policies and practices relating to the management of personal health information in a format that is generally understandable.

9. Access and Correction:

Upon request, a patient or client will be informed of the existence, use and disclosure of personal information and will be granted access to that information, unless the Nurse Practitioner and/or the privacy officer deems that access to that information could be harmful to the patient or a third party.

Patients will be able to challenge the accuracy and completeness of the information and have it amended as appropriate.

10. Challenging Compliance with the Privacy Policy:

The patient and client can inquire and complain about CCFHT’s privacy practices. The privacy officer will respond to the inquiries and investigate all complaints. If a complaint is found to be justified, appropriate measures will be taken, including amending policies and practices if necessary.

 

Health Information Network Provider (HINP) Statement

 

About This Statement

Cottage Country Family Health Team (CCFHT) acts as a Health Information Network Provider (HINP) under Ontario’s Personal Health Information Protection Act, 2004 (PHIPA) and Ontario Regulation 329/04.

This Statement describes the electronic information technology services CCFHT provides to affiliated Health Information Custodians, the safeguards we have implemented to protect personal health information, and our responsibilities as a Health Information Network Provider.

This Statement supplements CCFHT’s general Privacy Statement, which explains how personal health information is collected, used, disclosed and protected in the delivery of health care.

Availability of the Statement

This Statement of Information Practices and Services is made publicly available in accordance with Ontario Regulation 329/04. It is available on the CCFHT website and may also be requested from our Privacy Officer.

Our Commitment

CCFHT is committed to protecting the privacy, confidentiality, availability, integrity and security of the personal health information entrusted to us. We recognize that patients, affiliated Health Information Custodians, and our community expect personal health information to be handled responsibly and in accordance with PHIPA.

As a Health Information Network Provider, CCFHT supports the secure electronic exchange and management of personal health information while ensuring appropriate safeguards are in place to protect that information.

Our HINP Services

CCFHT provides electronic information technology services that enable affiliated Health Information Custodians and authorized health care providers to securely collect, use, disclose, retain and access personal health information as part of providing health care.

These services include, but are not limited to:

  • Hosting and maintaining the Electronic Medical Record (EMR) environment;
  • Supporting secure electronic access to patient information by authorized users;
  • Maintaining servers and related information technology infrastructure;
  • Managing user accounts and role-based access permissions;
  • Supporting the secure electronic transmission of personal health information where authorized;
  • Maintaining audit logging capabilities within the EMR environment;
  • Supporting business continuity, information security and system availability.

When acting as a HINP, CCFHT does not use personal health information for its own purposes. Access to personal health information is limited to what is reasonably necessary to provide and support these services and is only permitted where authorized by law and applicable agreements.

Protection of Personal Health Information (PHI)

CCFHT has implemented administrative, technical and physical safeguards designed to protect personal health information against unauthorized access, use, disclosure, copying, modification, loss or destruction, and to preserve the confidentiality, availability and integrity of the information entrusted to us.

Examples of these safeguards include:

  • Role-based access controls and unique user accounts;
  • Password management and user authentication requirements;
  • Confidentiality agreements for employees, Health Information Custodians and other authorized agents;
  • Privacy orientation and ongoing education;
  • Secure facilities and restricted access to information systems;
  • Encryption and other appropriate technical safeguards;
  • Audit logging and monitoring of electronic access;
  • Procedures for secure retention, archiving and destruction of records;
  • Privacy breach response and incident management procedures;
  • Ongoing privacy risk management and continuous improvement activities.

CCFHT regularly reviews its privacy and security practices to support compliance with PHIPA and to strengthen the protection of personal health information.

Access to Personal Health Information (PHI)

Only individuals who have been authorized to access personal health information and who require access to perform their responsibilities are permitted to access information maintained within CCFHT’s electronic systems.

All employees, Health Information Custodians, other authorized agents and third-party service providers with access to personal health information are required to comply with PHIPA, applicable service agreements, and CCFHT’s privacy and security policies.

Auditing & Monitoring

CCFHT maintains electronic audit logs and conducts periodic monitoring and auditing of access to electronic medical records and other information systems to help protect personal health information.

Audit information may be used to:

  • Verify that access to personal health information is appropriate and authorized;
  • Detect unauthorized access, use or disclosure;
  • Investigate suspected privacy or security incidents;
  • Support compliance with PHIPA, applicable agreements and organizational policies.

Where required by law or applicable agreements, audit information may be made available to participating Health Information Custodians (HICs)

Privacy Incidents & Breaches

CCFHT maintains procedures for responding to actual or suspected privacy and security incidents involving personal health information.

When a privacy or security incident is identified, CCFHT will:

  • Take immediate steps to contain the incident where appropriate;
  • Assess the nature and scope of the incident;
  • Investigate the circumstances;
  • Take reasonable steps to reduce the risk of future occurrences;
  • Notify affected Health Information Custodians at the earliest reasonable opportunity where required;
  • Fulfill applicable notification and reporting obligations under PHIPA.

Privacy and Security Assessments

CCFHT conducts privacy and security assessments, including Privacy Impact Assessments (PIAs) and Threat Risk Assessments (TRAs), as appropriate for new or significantly changed electronic information systems and services.

Third-Party Service Provdiders

Where CCFHT retains third-party service providers to support the electronic services it provides, those service providers are required to comply with privacy and security obligations that are consistent with PHIPA and CCFHT’s contractual requirements.

Related Privacy Information

This Statement describes CCFHT’s role as a Health Information Network Provider.

Additional information about how Cottage Country Family Health Team collects, uses, discloses, retains and protects personal health information is available in CCFHT’s Public Privacy Statement and related privacy policies. These documents are available upon request and, where applicable, through the CCFHT website.

Contact Us

If you have questions about this Statement or CCFHT’s privacy practices, please contact:

Privacy Officer/Executive Director:  Lauren Parsons

Mail: 205 Hiram St., Suite 2, Bracebridge, ON, P1L 2C1 / Tel: 705-646-9044 Ext 101 / Fax: 705-646-9052 / Email: