Accreditation 2023 - Risk Assessment

Privacy by Andrew Keck

PRH recognizes our responsibility to protect patient’s privacy and is committed to protecting the confidentiality, and security of all personal health information (PHI) to which it’s entrusted. Personal health information can be found can be found in many forms, including: paper documents (eg. Charts, printouts & written notes), electronic files (eg. Electronic records, spreadsheets, secure messages etc.), and conversations (eg. With patients, family & staff). PRH treats all PHI with the utmost respect and sensitivity in accordance with the Ontario Personal Health Information Protection Act, 2004 (PHIPA), privacy best practices and policy.

Patients have a right to have their personal health information protected. Protecting patient privacy is also a legal requirement, a research standard, a contractual obligation as well as a professional ethical obligation. Privacy is critical to maintaining strong relationships with our patients, who trust that their care providers will use their information to make accurate diagnosis and plan effective treatment. You must understand your obligations with respect to the use of personal health information. Click here to collect the Q-Tip.

Did you know that the term “Circle of Care” is not a defined term under the Personal Health Information and Protection Act, 2004 (PHIPA)?  However, we frequently use the term, so what specifically are we referring to concerning privacy? “Circle of Care” describes the ability of certain custodians to assume a patient’s implied consent to collect, use or disclose personal health information for providing health care.

The “Circle of Care” may include the doctors, nurses, pharmacists, physiotherapists, clinical clerks and employees assigned to your health care. Custodians who are not part of your direct or follow-up treatment are not included within the "Circle of Care". 

An important privacy consideration regarding PHIPA is whether everyone within the "Circle of Care" is defined as a "health information custodian". Only those defined as a health information custodian as per the Act can collect, use, or disclose PHI using implied consent. 

A heath information custodian is described in PHIPA as a person or organization that has custody or control of your PHI. Some examples of health information custodians are: 

• Long-Term Care Homes.
• Health Practitioners.
• Hospitals.
• Laboratories.
• Pharmacists.
• Ambulance Services. 

Implied vs Express Consent:

• Express consent either is given verbally or inwriting, to a custodian to collect, use or disclose your personal health information.

• Implied consent is not defined in PHIPA; however, it is understood to be consent that one concludes has been given based on what an individual does or does not do in the circumstances.

For example, it is reasonable for a custodian to conclude that you have consented to the disclosure of your personal health information to another custodian for the purposes of providing or assisting in providing health care.

How can you support privacy best practices at PRH?

Prevent privacy breaches by: 

• Always conduct a positive patient identification before mailing, faxing, sending documentation, or discussing PHI with a patient

• Always double checking the “To” field when submitting electronic information from the organization to another

• Always ensure patient information/patient records are secured, both paper/electronic format

• Log out of computer sessions when stepping away from your desk

• Never share passwords or keys

• Do not access your own health records using your PRH access (you can access your own health record by requesting your records through the  PRH Release of Information Office)

• Do not access the health records of your friends or family, coworkers, or anyone of interest unless you are a health information custodian in the circle of care

• Never discuss patient cases with anyone outside of the circle of care unless you have the proper consent to do so.

• Complete your Privacy and Security training

• Review PRH privacy policy documents

Contact the Privacy Officer Andrew Keck (ext. 6578) and your manager immediately and complete an incident report in RIMS when you know or suspect there has been a privacy breach. 

More information on processes, procedures and policies related to privacy can be found in the following, “Privacy – Breach Management Policy and Operating Practices”, “Remote Access”, “Privacy and Confidentiality”, “Information Security”, “Information Systems Applicable Use”, “Email Use”, and “Social Media” in the policy & procedure manual on the intranet.