Privacy Policy

TABLE of CONTENTS

Section Title

1. Who We Are

2. Accountability: Our Responsibilities and Commitment to

Protecting your Privacy

3. What Personal Information We Collect & Why

4. Consent

4.1. Placing Conditions on or Restricting Consent

4.2. Withholding or Withdrawing Consent

4.3. When an Individual is Unable or Incapable of Providing Consent

5. Limiting the Collection, Use, Disclosure and Retention of Personal Information

5.1. Limiting the Collection of Personal Information

5.2. Limiting the Use and Disclosure of Personal Information

5.3. Retention

6. Accuracy of Your Personal Information

7. Safeguards- How We Protect Your Personal Information

8. Openness

9. Individual Access to Personal Information about Themselves

9.1. Correcting Personal Information

10. Changes to Our Privacy Policy & Privacy Officer Contact Information

The privacy of personal information is a valued and important principle to CMA Imagng, o/a Canadian Diagnostic Network. We collect, use and disclose personal information according to the regulations and guidelines established by the Personal Health Information Protection Act (PHIPA). The standards of PHIPA are included as an integral component of our organization’s policies and procedures, ensuring the individuals’ rights to privacy in regards to the obtainment and use of personal information. In many ways PHIPA simply builds on our existing professional regulations, policies, guidelines and practices.

1. WHO WE ARE

CMA Imaging, o/a Canadian Diagnostic Network is a privately owned, independent health service facility providing a variety of medical services, examinations and procedures in order to assist in the diagnosis and treatment of the patients of referring medical physicians. Because we provide a wide range of health care services, we often deal with a number of other health care and health service providers and third parties. These include hospitals, family physician practices, walk-in medical facilities, specialists, laboratories, the Ministry of Health for Ontario, Cancer Care Ontario, and other independent health facilities. In order to provide care and treatment for the patient, these affiliates and third parties may require limited access to personal information. We restrict their access to only the personal information that is required to provide the patient with an adequate level of health care, service, diagnosis and/or treatment, with the patient’s authorization. Any affiliates or third parties we work with have assured us that they follow privacy procedures according to their own established policies under the Personal Health Information Protection Act and/or the Personal Information Protection and Electronic Documents Act.

2. ACCOUNTABILITY- Our Responsibilities and Commitment to Protecting Your Privacy

We accept responsibility for collecting and handling any personal information of an individual. A specific Privacy Officer has been appointed, in charge of ensuring our adherence to PHIPA and to handle any questions or concerns raised by the public. The Privacy Officer has the support of other staff members and has been given the authority to intervene in privacy issues. The Privacy Officer is responsible for analyzing existing procedures and making sure they coincide with PHIPA at both the written stages of the policy and the execution and implementation of the policy. Our Privacy Officer’s name as well as their contact information is provided below. Our staff have been informed and trained regarding our privacy and policy procedures. They know how to respond to public inquiries, are able to explain the concept of consent, are able to provide information for how an individual may go about requesting access to their personal information, understand that concerns regarding privacy are to be dealt by the Privacy Officer and are aware of the security measures taken to protect personal information. Policies and procedures for our organization have been created and implemented to protect personal information. Firstly, individuals are made aware what personal information is required and why we require that personal information by accessing our entire Privacy Policy, which is readily available on our website. We limit the collection, use and disclosure of personal information by only providing it to the referring physician and other health care providers according to our professional standards of practice and/or as authorized by the individual (the patient). We do our best to ensure that the personal information collected is complete, accurate and up-to-date. Security measures have been implemented to protect personal information from any potential external threats. We also try to be as open and transparent as possible in regards to how we collect, handle, use and disclose personal information. All these measures will be explained in greater detail throughout our Private Policy.

3. WHAT PERSONAL INFORMATION we COLLECT and WHY

Personal health information refers to identifiable personal information, which may be factual or subjective. It is information about an individual’s health or healthcare history regarding an individual’s physical or mental condition, including family medical history; the provision of healthcare to an individual; long-term healthcare services; payment or eligibility for healthcare; and the identity of a healthcare provider or substitute decision-maker for an individual. In accordance with Regulations made under the Independent Health Facilities Act, our organization is required to create and/or keep a health record relating to the health services provided in our facility for each individual who is or was a patient. Upon arrival at the clinic, the patient will be asked to complete the information on the requisition, or if they have had a previous visit, they will be asked to confirm their personal information. If an individual is not comfortable disclosing this information, they should inform the front desk and we will do our best to make other arrangements; however, if the patient does not provide certain personal information, the provision of health services may be interrupted or denied. We only collect personal information that is important to the creation of a health file and in the function and operation of our facility. The personal information that is collected is meant enhance the efficiency and quality of care we provide. Personal health information includes the following:

• The patient’s full name as it appears on the health card or any health insurance documents (i.e. federal health insurance)
• Date of birth
• Sex and salutation
• Address
• Phone number
• Information regarding the method of payment (i.e. OHIP number, federal health coverage information, other provincial/territorial coverage or private billing information)
• Physical attributes like weight and height
• A written record of the order for examination(s) or test(s) (requisition)
• Any clinical information in relation to the specific procedure the individual is having (this is filled out by the referring physician on the requisition)
• Previous medical examinations
• Medical history, including family medical history
• The identification of a substitute decision-maker
• Any results, tests or imaging media from examinations Previous diagnostic reports from other health facilities (i.e. mammography films and reports)
• Prescription medicines
• Referring Physician This information is entered into our own, secure patient database and is used to compile a patient’s confidential health file at our facility. This database of individual personal information is not shared with anyone outside of our organization and our affiliates. We require this information for the following:
• To deliver effective, efficient and high quality health services to our patients
• To create a health file at our facility
• To identify our patients
• For billing and reimbursement purposes, to collect unpaid accounts and process payments in general
• In order to perform the various administrative functions of our facility
• Security reasons to prevent false and fraudulent identification
• In order to perform the procedure or examination accurately and effectively
• For contact information in order to communicate with our patients. This may be needed if the patient is having a special procedure which requires a scheduled appointment or needs additional views, and/or to book and confirm appointments
• Provides a means of communication between physicians and other healthcare professionals involved in providing health care to the patient
• To provide accurate information and findings to health care providers involved in the care of a particular patient
• To meet audit regulations and to comply with the law (e.g. Canada Health Act, Independent Health Facilities Act) and regulatory requirements of the College of Physicians and Surgeons of Ontario

Generally, the personal health information is collected, used and disclosed in order to provide the individual with an adequate level of health service and to ensure accurate medical diagnosis.

4. CONSENT

Our organization believes that consent is extremely important when collecting, handling and disclosing personal information of an individual. According to the guidelines established by PHIPA, we must obtain an individual’s “knowledgeable consent” to collect, use and disclose personal information. Knowledgeable consent means that an effort must be made to make an individual aware of what personal information is being collected by our organization, how we plan to use it, and how it will be disclosed. An individual must be informed of their rights to withhold and withdraw consent. Under PHIPA, consent is considered valid if it is knowledgeable, voluntary, related to the information in question, and is given by the individual or an authorized decision-maker. Consent can be implied for the collection, use or disclosure of personal health information in order to provide healthcare or assisting in providing care A patient’s circle of care refers to individuals, activities and services provided, which are related to the care and treatment of a particular patient. Subsequently, it includes health care providers such as doctors, as well as other related activities, such as diagnostic imaging. More simply, it refers to all health-related people, procedures and services provided to adequately diagnose and treat a particular patient. This means personal health information might need to be shared with other healthcare providers for the purpose of providing care. Other healthcare providers may include, but are not limited to hospitals, specialists, surgeons, and other diagnostic imaging facilities. Consent can be implied through a patient’s conduct and behavior with our facility. For example, consent is implied for the collection, use and disclosure of personal health information for purposes related to an individual’s healthcare (as mentioned above), if you attend our facility for any health-related services. PHIPA also outlines various circumstances where express consent of an individual is required. Express consent is explicit and direct and may be given verbally, in writing or electronically. Circumstances where express consent is required:

• When disclosing personal health information to an individual or organization outside the circle of care (e.g. an insurance provider)
• When information is disclosed by our organization to another for any reason other than providing or assisting in providing healthcare
• If we collect, use or disclose personal health information other than an individual’s name and mailing address for fundraising purposes, for marketing research or activities and/or for research purposes, unless certain conditions and restrictions have been met PHIPA permits certain disclosures of personal health information without consent. These include:
• When it is necessary to provide healthcare and is not possible to collect information directly from the patient, either in a timely manner or when there are reliability issues
• When contacting a friend or relative
• When confirming the patient is in the facility
• When there is a risk bodily harm
• When there are audits and accreditations

4.1 PLACING CONDITIONS ON or RESTRICTING CONSENT

An individual has the right to restrict our organization from sharing all or any part of his/her personal information. This means the individual has the right to tell our organization not do disclose certain personal health information to another custodian. It should be noted that if an individual instructs our organization not to disclose part of their personal health information to another health information custodian, we are required to inform the receiving health information custodian that some personal health information is unobtainable. More simply, a patient has the right to exercise the restriction of sharing or disclosing personal information at any time, albeit pre or post. However, when a patient exercises this, it is our legal obligation to tell the third party that information has been “locked” by the patient. Moreover, there is significant chance that the medical report of the patient will be incomplete. According to our Privacy Policy, the report will include the clause, “The information contained in this report is incomplete. It was affected by the patient’s right to withhold information from other parties. The information that is being withheld is only available from the patient.” Our policy requires a patient wishing to restrict/limit access to his/her personal health information to complete, sign and date a form, which instructs them of their specific rights, and outlines the limitations of this right in this particular area. We are permitted to disclose any information to a recipient custodian when in our professional opinion, the disclosure is needed to eliminate or reduce this risk of bodily harm to an individual or group of people. Also, an individual’s conditions or restrictions may not impede the collection, use or disclosure of personal health information that is required by other laws such as the Canada Health Act, the Independent Health Facilities Act and/or professional or institutional practices as outline by the College of Physicians and Surgeons of Ontario.

4.2 WITHHOLDING or WITHDRAWING CONSENT

An individual can withdraw his/her consent at any time for the collection, use or disclosure of his/her personal health information by providing notice to our organization. Withdrawal of consent applies to both implied and express consent. It should be noted that withdrawing consent is not retroactive. More simply, if information has been disclosed based on implied or express consent, we are not required to recover the information that has already been disclosed. In the case of an individual refusing or withholding or withdrawing consent, our organization’s protocol is determined by professional standards of practices. Our policy is to refuse health services if a patient withholds and refuses to disclose personal health information that we require in the function and operation of our facility. This means, in some situation, depending on the information the patient withholds or withdraws, the provision of the health service may be denied. If a patient withdraws consent, the patient will be informed of the consequences. In some situations, this could result in the interruption or denial of certain health services. The existing records of the patient in question will be retained as required by the regulations and standards of practice established under the Independent Health Facilities Act. This maintains patient safety and ensures that audit and regulatory requirements have been met. We will record the withdrawal of consent as part of the patient’s existing file and will inform those to whom the personal information had been disclosed.

4.3 WHEN an INDIVIDUAL IS UNABLE or INCAPABLE of PROVIDING CONSENT

In general, PHIPA assumes that individuals are capable of making decisions pertaining to the collection, use and disclosure of their own personal health information, if they are able to comprehend the consequences of providing, withholding or withdrawing their consent. If we believe an individual is incapable of providing consent, PHIPA allows a substitute decision-maker like a relative, spouse, child’s parent, or Public Guardian and Trustee.

5. LIMITING the COLLECTION, USE, DISCLOSURE and RETENTION of PERSONAL INFORMATION

5.1 LIMITING the COLLECTION of PERSONAL INFORMATION

The personal information collected is necessary for the function and day-to-day operations of our organization. Personal information is collected with discretion and confidentiality. The collection of personal health information is limited to that which is necessary for the purposes outlined in section 3 of our Privacy Policy. The Ministry of Health for the province of Ontario, under the Independent Health Facilities has established regulations in regards to what personal information can be and needs to be collected to compile a health record within the facility. Personal information collected is typically used for administrative and billing purposes, to perform the examination, and to ensure accurate diagnosis and communication among the health care providers for the particular patient. More specific and detailed purposes for collecting personal information can be found in our Privacy Policy under the section 3. Personal information that is not essential to the purposes of collection, use or disclosure need not be provided and will not be collected as part of the patient’s health record at our facility. Although PHIPA requires the collection of personal health information to be directly from the patient, there are certain circumstances where our facility may be able to collect personal information indirectly. Exceptions to the direct collection of personal health information are as following:

• When the individual consents
• When the collection is necessary for providing healthcare and it is not possible to obtain the information directly from the individual in a timely manner
• When we collect personal information for research purposes (provided that certain conditions are met)
• When the indirect collection is required or permitted by law
• When the indirect collection is required for the purpose of health planning for a particular patient or management
• Risk and error management
• Processing claims for payment under any other Act or program administered by the Minister
• When the Information and Privacy Commissioner authorizes the indirect collection

5.2 LIMITING the USE and DISCLOSURE of PERSONAL INFORMATION

Personal information collected will not be used or disclosed for any purposes other than those for which it was originally collected. More specifically, personal information will only be used or disclosed for the purposes outlined in section 3 of our Privacy Policy. If personal information needs to be used or disclosed for any reason other than the purposes outlined in section 3, the individual in question must consent to the use or disclosure of their personal information, or the use or disclosure must be authorized under the Personal Health Information and Protection Act. Consent for the use and disclosure of an individual’s personal information is not necessary when/if:

• There is an emergency situation where the patient is physically or mentally unable to consent, or consent cannot be attained quickly, and it is in the best interest of the patient to use or disclose personal information
• Information is discussed for the care and treatment of the patient without circle of care (i.e. if a health professional receives a request from another health professional to access an individual’s personal information in order to adequately provide that individual with health care or assist in providing the individual with healthcare/treatment)
• Other circumstances previously outlined in section 4 of our Privacy Policy

5.3 RETENTION

Our retention policies for patient records coincide with the guidelines established under the Independent Health Facilities Act. Maximum and minimum retention periods have been established based on these guidelines. When a patient’s health record is purged, imaging media is destroyed, paper records or documents are shredded and electronic computer files containing information are erased from the computer’s hard drive. Information that does not have a specific purpose or no longer fulfills its intended purpose will be destroyed or disposed accordingly. Instructions for the retention of personal information in the patient’s health record, as well as the proper way to dispose or discard the personal information is included in our policy and procedures manual for employees. Following these guidelines and regulations ensure that an individual’s personal information is not stored or kept unnecessarily, and protects the patient’s privacy rights.

6. ACCURACY of YOUR PERSONAL INFORMATION

We will do our best to ensure that personal information is as accurate, complete and up-to-date as possible. This will reduce the chances of incorrect personal information being used or disclosed to third parties. However, personal information will only be up-dated based on necessity and only to fulfill the required purposes. Certain personal information such as the patient’s name, address, phone number and OHIP or other billing information (commonly referred to as “factual information”) will be up-dated directly on our secured patient database when the patient comes in for an examination. Because our patient database is separate and for our facility’s use only, certain personal information is not automatically up-dated when an individual up-dates their information with OHIP. Also, when we receive personal information from third parties, we will make sure that the information is complete. The patient cannot demand that their record be changed instantly; instead, they can seek correction and change, which will then be taken into consideration and reviewed by the Privacy Officer who will determine whether or not the change should be made.

7. SAFEGUARDS- How We Protect Your Personal Information

Given the sensitive nature of the personal information we collect and use, confidentiality has always been a strong pillar of our organization’s set of values. Privacy and confidentiality have always been an important value in the provision of health services and our organization is no exception. We believe in protecting and securing an individual’s personal information from unauthorized and inappropriate access. Information will be safeguarded from unauthorized access, use, disclosure, copying or modification. Personal information, regardless of the format will be protected. We have implemented a variety of security safeguards to protect personal information. These security measures seek to ensure no unauthorized parties dispose, obtain access to, modify or destroy an individual’s personal information. This is a brief summary of the security measures we have taken:

• Physical Measures: Physical measures are taken to protect and secure personal information. These include, but are not limited to physical barriers separating patient areas and employee areas, locked filing cabinets and storage facilities, restricting access to certain areas of the facility and the use of burglar alarm system.
• Technological Measures: Technological tools are also used to protect personal information. These include passwords for all computers used to enter and store personal information, passwords for certain software programs used for the collection and retention of personal information and firewalls to restrict access and prevent unauthorized and inappropriate use and disclosure. In addition, computers are kept in designated “employee-only” areas.
• Organizational Controls: Organization controls are used to protect an individual’s personal information. Access to personal information is limited and restricted, based on “need-to-know” basis for employees and any third parties involved in the care and treatment of an individual. Staff is trained to collect, use and disclose personal information only to complete outlined purposes. Employees must agree to the terms of a confidentiality agreement, which clearly instructs that the personal information of patients is confidential, and must be protected from unauthorized access, use, disclosure, copying and modification.

Personal information is retained only for the time period required by the regulations made under the Independent Health Facilities Act; this ensures that personal information is not kept unnecessarily. When discarding personal information, we are guaranteed that it is done responsibly. For example, personal information recorded on paper is shredded so personal information of a patient is no longer comprehensible. Our security measures have been developed and implemented based on the nature and sensitivity of the personal information we collect, use and disclose, the amount of information we collect and retain, to whom we disclose the information to, the form of the information (electronic, imaging media, paper, files, etc.) and how we store the information. Our Privacy Officer and senior levels of management will periodically review our security measures and up-date and modify them if necessary.

8. OPENNESS

We want patients, referring physicians, third parties and employees to be informed of our policies and practices for the management and use of personal information. We try our best to make our privacy policies and procedures as transparent as possible. There are a number of ways we ensure openness and transparency in regards to our privacy policy and practices:

• By posting our entire privacy policy on our web page. This makes our privacy policy readily available to the public.
• Staff trained specifically to deal with public inquiries, concerns, questions and complaints
• Contact information of the Privacy Officer is posted on the website and can also be obtained from our office to deal with any other inquiries

Our policies regarding how we collect use and disclose personal information are understandable, consistent and readily available to the public. We strongly believe that our patient should know about their privacy rights. Therefore, we try to be as open and as transparent in regards to Privacy practices.

9. Individual Access to their Personal Information

Under PHIPA, patients have the general right to access their personal health information. Laws explicitly state that the original documents are to be retained by us; however, having copies is your right. A patient can request access to their personal health information by putting their request in writing. A patient’s right to personal information is not unconditional (see below). According to PHIPA, we as health information custodians have 30 days to respond to the written request. Extensions beyond 30 days are allowed if fulfilling the request in 30 days obstructs the operation of our facility or when consultations with outside sources are required in order to meet the terms of the patient’s request. If this is the case, it is our policy to inform the patient, in writing, that we have received their request, but there will be a delay and outline the reasons for the delay. Our policy also requires that the patient requesting access fill out two access forms within our facility. These forms are needed for administrative purposes and so requests for access to and release of personal health information are properly recorded and documented as part of the patient’s health record. It should also be noted that requesting access to personal health information and the release of such information is not covered under the Ontario Health Insurance Program (OHIP). A patient’s rights to access their personal information are not unconditional. We can refuse access in limited situation, such as:

• Providing access would mean disclosing information about another individual, unless the other individual has consented
• When the information in question is subject to legal privilege
• When providing information could threaten the life or security of another individual
• Another law prohibits the disclosure of the information
• If providing access to personal information would reveal confidential commercial information

If we deny your request for access to personal information, we will explain why.

9.1 Corrections to Personal Health Information

If a patient believes that their personal health information is incomplete or erroneous, the individual has the right to request that we correct their file. A patient who wants to correct his/her personal health information must submit a written request to us. We will look into the request and respond within 30 days of receiving any such request. If replying within 30 days interferes with our daily operation, or if we need time to investigate the request and consult with third parties regarding the request we will inform the patient that we need more time and why we need more time. We will change and correct personal information after the individual has demonstrated to our satisfaction that the record is inaccurate or incomplete and provides us with the relevant information needed to correct the record. We will correct information responsibly and based on our existing standards of professional practice. Requests to correct personal information are limited to factual personal information and do not apply to professional opinions developed by our healthcare professionals. If correction is refused on such a basis, we will inform the patient of the refusal and the reasons for the refusal.

10. Changes to our Privacy Policy and Our Privacy Officer’s Contact Information

We will periodically review our privacy policies and procedures. We reserve the right to make amendments to our Privacy Policy in the future. Any specific inquiries and concerns can be directed to our appointed Privacy Officer. Written inquiries, concerns or requests can be in the form of a mailed letter, an e-mail or fax. Please direct the written request to our Privacy Officer. Our Privacy Officer can be contacted at:

Attention: Mrs. Lisa Simpson

Email: [email protected]

CDN Imaging

1 Centrepointe Dr

Nepean, ON K2G 6E2

We take your privacy inquiries, concerns and requests very seriously. We will respond to you in a timely manner and to the best of our ability. If you are not satisfied with our response, the Information and Privacy Commissioner of Ontario can be reached at:

2 Bloor Street East, Suite 1400

Toronto, Ontario, M4W1A8

(416) 326-3333 1-800-387-0073 Website: www.ipc.on.ca