Protection of the privacy of personal information is an important principle to South City Physiotherapy. South City is committed to collecting, using and disclosing personal information responsibly, and only to the extent necessary for the safe and effective provision of the goods and services its clients require.
WHAT IS PERSONAL INFORMATION?
Personal information is any information pertaining to an identifiable individual. This can include information relating to their personal characteristics (e.g., gender, age, income, home address or phone number, ethnic background, family status), and their health (e.g., health history, health conditions, health services received by them). Personal information is to be contrasted with business information (e.g., an individual’s business address and telephone number), which is not protected by privacy legislation.
WHO WE ARE
South City Physiotherapy employs the services of a number of health care practitioners, and a variety of support staff. Its team of health care practitioners includes registered physiotherapists, osteopathic manual practitioners, registered massage therapists, and a pedorthist. Its support team includes kinesiologists, physiotherapy assistants, and administrative personnel. Additionally, South City uses a number of consultants and agencies that may, in the course of their duties, have limited access to personal information held by South City. These include but are not limited to computer consultants, office security and maintenance personnel, bookkeepers and accountants, temporary workers to cover vacations or leave of absences, credit card companies, website managers, cleaners, and legal counsel. Access to personal information held by South City, is restricted as much as is reasonably possible. All persons with any measure of access are required to follow appropriate privacy principles.
WHY WE COLLECT PERSONAL INFORMATION
Like all physiotherapy clinics, South City Physiotherapy collects, uses, and occasionally discloses personal information in the service of its clients.
The primary reason for the collection of personal client information, is to enable and facilitate the provision of health care treatments. For example, South City collects information about a client’s health – including personal and family history, physical condition, level of functionality, and social situation – in order to help it accurately assess a client’s condition, present appropriate options, and provide the elected treatments.
Another primary reason for the collection of personal information, is to establish baselines, so that in providing ongoing health services South City can more easily identify and quantify changes that occur over time.
South City always seeks to collect personal information directly from, and with the express consent of its clients. The only exceptions to this rule are when the client is a minor child, or in an emergency (e.g., the client is unconscious). Common sense is applied to this rule however, and South City seeks to be reasonable with clients asking for example that it obtain from, or provide certain personal information to a third part on their behalf.
Regarding Contract Staff, Volunteers, and Students
For persons contracted to perform services for South City Physiotherapy (e.g., temporary workers), South City’s primary purpose for collecting personal information is to ensure it can contact them in the future as required for business purposes (e.g., sending out paycheques, year end tax documents), or to offer additional contracts for service.(e.g., for new assignments).
Examples of the types of personal information collected for those purposes include home addresses, telephone, and SIN numbers.
RELATED AND SECONDARY PURPOSES
(for the collection of personal information)
Like most organizations, South City Physiotherapy also collects, uses and discloses information for purposes related to, or secondary to its primary purposes. The most common examples of related and secondary purposes are as follows:
(a) To invoice clients for goods or services that were not paid for at the time of delivery, to process credit card payments, or to collect unpaid or overdue accounts.
(b) To advise clients that their product or service should be reviewed (e.g., to ensure a product is still functioning properly and appropriate for their then current needs and to consider modifications or replacement).
(c) To advise clients and others of special events or opportunities (e.g., a seminar, development of a new service, arrival of a new product) that is available.
(d) Client and other files are reviewed for the purpose of ensuring that high quality services are provided, and of assessing the performance of clinic staff. In addition, external consultants (e.g., auditors, lawyers, practice consultants, voluntary accreditation programs) may on behalf of South City perform audits and continuing quality improvement reviews, including reviewing client files and interviewing clinic staff.
(e) Physiotherapists are regulated by the College of Physiotherapists of Ontario who may inspect clinic records and interview clinic staff as a part of their regulatory activities in the public interest. In addition, as professionals, clinic staff will report serious misconduct, incompetence or incapacity of other practitioners, whether they are associated with South City or another clinic.
(f) South City believes it has an obligation to report information suggesting serious illegal behaviour to the authorities.
(g) External regulators have their own strict privacy obligations. Sometimes these reports include personal information about clients, or other individuals to support a given concern (e.g., improper services). Various government agencies (e.g., Canada Customs and Revenue Agency, Information and Privacy Commissioner, Human Rights Commission, etc.) have the authority to review clinic files and interview staff as a part of their mandates. In these circumstances, South City may consult with professionals (e.g., lawyers, accountants)
(h) The cost of some goods/services provided by the clinic to clients is paid for by third parties (e.g., OHIP, WSIB, private insurance, Assistive Devices Program.) These third-party payers often have client consent or legislative authority to direct South City to collect and disclose to them certain information in order to demonstrate client entitlement to this funding.
(i) Clients or other individuals South City deals with may have questions about goods or services provided, after they have been received. The clinic also provides ongoing services for many of its clients over a period of months or years for which previous records are helpful. Client information is retained for ten years after the last contact to enable the clinic to respond to those questions and provide these services. (Compliance with College regulations also requires us to retain our client records).
(j) If South City Physiotherapy or its assets were to be sold, any prospective purchaser would want to conduct a “due diligence” review of the Clinic’s records to ensure that it was a viable business, and that its operations had been honestly portrayed to the purchaser. This due diligence might involve some review of accounting and service files. No prospective purchaser would be able to remove or record personal information. Further, before being provided access to any files, any prospective purchaser would be required to sign a confidentiality agreement. Only a reputable prospective purchaser who had already entered a conditional agreement to purchase the organization’s business or its assets would be provided access to personal information, and only for the purpose of completing their due diligence search prior to closing the purchase.
Any client can choose not to be part of some of these related or secondary purposes (e.g., by declining to receive notice of special events or opportunities, or by paying for services in advance). South City Physiotherapy does not however have any option regarding compliance with the directives of some external regulatory bodies.
PROTECTING PERSONAL INFORMATION
South City Physiotherapy understands the importance of protecting personal information. For that reason, the following steps have been taken:
(a) Paper information is always either under the direct personal supervision of an authorized individual, or secured in a locked or restricted area.
(b) Electronic hardware is always either under the direct personal supervision of an authorized individual, or secured in a locked or restricted area. Additionally, passwords are used on all computers.
(c) Paper information is only ever transmitted through sealed, addressed envelopes or boxed and maintained in secure storage by reputable companies.
(d) Electronic information is always transmitted either through a direct line or it is anonymized or encrypted before transmission.
(f) External consultants and agencies with access to personal information must enter into privacy agreements with South City Physiotherapy.
RETENTION & DESTRUCTION OF PERSONAL INFORMATION
South City Physiotherapy needs to retain personal information for some time to ensure that it can respond to questions clients or external regulatory bodies might have about the services provided. (Client files must be maintained for ten years after the last treatment, other business files for seven years). In the interest of protecting personal privacy, South City does not keep personal information longer than it is required to by regulation.
Paper files containing personal information are destroyed by shredding. Electronic information is destroyed by deleting it and, before hardware is discarded, any hard drives are physically destroyed. Alternatively, if requested by a client to do so, South City will turn some of, or the entire client file over to the client.
ACCESS TO YOUR INFORMATION
With few exceptions, individuals have the right to see what personal information South City or any other organization may hold about them.
South City is always happy to identify what records it holds regarding an individual. Due to the medical nature of its clinic practice, it is also always willing to help individuals understand any information held (e.g., short forms, technical language, etc,).
In cases where the South City staff member receiving a request for access to personal information, does not personally know the identity of the person making the request, the identity of the person making the request must be confirmed before access is provided. South City reserves the right to charge a nominal fee for such requests.
If there are any issues with a verbal request for access to personal information, South City will require that the request be put in writing. If South City still cannot comply with the request for access, it will, within 30 days, provide a written response detailing why access cannot be provided.
If an individual believes there is a mistake or incorrect information being maintained in South City Physiotherapy’s files, that individual has the right to ask that the information be corrected. (This applies to factual information, and not to any professional opinions South City and or its professional staff may have formed.)
In such a case, an individual may be asked to provide documentation supporting the claim that information contained in South City files is incorrect. Where South City agrees that an error has been made, South City will make any required correction and update any person or organization to whom this incorrect information was disclosed. If South City does not agree that an error has been made, South City will still agree to include in its files a brief statement from the dissenting individual on the point, and will forward that statement to any person or organization who received the original information now in dispute.
COMMENTS, CONCERNS, & QUESTIONS
Our Information Officers, Shelley, Stacey, or Caitlin can be reached at:
620 Scottsdale Drive
Guelph, ON, N1G 3M2
Phone (519) 763-2885 Fax (519) 763-8745
They will attempt to answer any questions or concerns you might have.
If any individual wishes to make a formal complaint about the privacy practices of South City Physiotherapy, they may do so, in writing, to any one of our Information Officers. One of them will acknowledge receipt of the complaint; ensure that it is investigated promptly; and that in a timely manner, the complainant is provided with a formal written response.
If any individual has a concern about the professionalism, competence, or conduct of any of South City Physiotherapy’s professional staff, we ask that you contact our Clinic Director – Francine Doré to discuss those concerns with her.
Francine Doré – Clinic Director
Telephone 519.763.2885 Email email@example.com
If this approach fails to satisfy any concerns, a complaint can be registered with the regulatory body that oversees all Physiotherapy clinics in Ontario:
College of Physiotherapists of Ontario
230 Richmond St. W. 10th Floor
Toronto, ON, M5V 1V6
Phone (416) 591-3828 / Toll-Free 1-800-583-5885 / Fax (416) 591- 3834
E-mail firstname.lastname@example.org Web www.collegept.org
This policy is made under the Personal Information Protection and Electronic Documents Act. This complex Act provides some additional exceptions to the privacy principles that South City Physiotherapy subscribes to – but that are too detailed to set out here. In summary – there are some rare exceptions to the commitments set out above.
For more general inquiries, the Privacy Commissioner of Canada oversees the administration of the privacy legislation in the private sector. The Commissioner also acts as a kind of ombudsman for privacy disputes. The Privacy Commissioner can be reached at:
112 Kent Street / Ottawa, Ontario/ K1A 1H3
Phone (613) 995-8210 / Toll-Free 1-800-282-1376 / Fax (613) 947- 6850