Protection and Privacy of your Personal Information
PROTECTION AND PRIVACY OF CLIENT’S PERSONAL INFORMATION
Maryvale adheres to all legislative and regulatory requirements of the Child, Youth and Family Services Act (Ontario revised 2017) and the Personal Health Information Protection Act (Ontario 2004).
Maryvale is responsible for personal information under its control. Maryvale staff members shall demonstrate their accountability for individual privacy rights and compliance by respecting the fundamental principles and rules for the collection, use, disclosure, retention and disposal of personal health information (PHI). They will also be required to adhere to all Maryvale privacy and security policies, procedures and guidelines relating to privacy, as well as their own professional governing bodies or associations.
Information of diagnostic or treatment importance is to be shared, with integrity, amongst those responsible for providing direct service, and those holding consultative, supervisory and administrative positions related to treatment for the client. The withholding of information from appropriate members of the treatment team or supervisory staff may negatively affect the outcome of treatment and therefore, can be equally serious.
Maryvale staff members are responsible for reporting any known breach of privacy immediately to the privacy officer. Any breach resulting from the negligence of policies or procedure will be taken as a serious offence and any privacy breaches involving regulated health professionals will be reported to their respective colleges.
Maryvale staff are trained in the privacy policies and practices and this information is reviewed as part of their regular performance appraisal.
- Maryvale considers the following types of information to be confidential:
- Personal information and personal health information regarding clients and their families
- Personal information, personal health information, employment information and compensation information concerning staff and affiliates
- Information regarding Maryvale operations not publicly disclosed by Maryvale
- This policy applies whether information is verbal, written, electronic or in any other format.
- Clients have the right to have control over their own personal health information – how it is collected, used and
- Clients have the right to know why we are collecting their information and how it will be used
- Clients have the right to withdraw consent at any time unless the collection use or sharing is required by
- Every staff member must:
- Be familiar with and follow Maryvale policies and procedures regarding use, collection, disclosure, storage and destruction of confidential information
- Collect, access and use confidential information only as authorized and required to provide care or perform assigned
- Divulge, copy, transmit or release confidential information only as authorized and needed to provide care
- Make use of passwords to access computer system and assume responsibility for activity undertaken using their secure passwords
- Identify confidential information as such when sending e-mails or faxes and provide direction to the recipient if they receive a transmission or e-mail in
- Discuss confidential information only with authorized individuals who require it to provide
Personal Health Information (PHI) includes (such as):
- Information such as the name of the youth, age, gender, presenting problems, strengths, needs, developmental history, medical history, previous assessment results, previous professional involvement, current settings/placements, parent observations/perceptions of the youth, teacher/childcare/other professional observations/perceptions of the
- Information about the parent(s)/guardians such as, name, address, telephone number, marital status, custody/guardianship arrangements, country of birth, stressors/risk factors, social support, perceptions of service needs/desires.
- Information about the family such as, the number of siblings, others living in the home, languages spoken in the home, emergency contact
- PHI can be verbal, written or
Personal Health Information (PHI) is needed to:
- Create files for individuals who are ‘registered’ to receive services from the agency.
- Assist in understanding the needs presented by the child or youth and
- Inform development of service plans and make referrals to appropriate
- Coordinate plans and services with other service providers with
- Help identify the need for further specialized
- Identify strengths on which to
- Ensure parents or guardians can be contacted or communicated withwhen
- Allow for analyses of trends in service provision over
- Facilitate the service delivery process from intake to discharge from the
- Assist in quality assurance and program evaluation activities.
Client’s Personal Health Information (PHI) is Protected/Safeguarded:
- We make every effort to ensure that personal health information is kept secure from loss, theft or unauthorized use.
- Client files containing personal information are locked and access is
- Files are audited to ensure they are current and complete.
- Computerized information is protected with passwords and access is
- Computerized information is backed up to protect against
- Computers are set up to lock in a timely way when not in active
- Reports containing personal health information are not sent via electronic mail unless an emergency/urgent matter requires this action and only under the direction of a Manager. Staff will adhere to electronic protocol to protect client confidentiality and clients will be notified as soon as
- All Maryvale staff, students and volunteers sign an ‘Oath of Confidentiality’ indicating information obtained in the course of their work will be held
- Files for youth receiving service in any program are retained for 10 years after service termination and your (your child’s) 18th birthday and an electronic copy is retained for 60 years after service termination.
*Privacy related to Electronic Communication:
- Electronic communication is a form of communication used between the client and therapist via text message or email. Electronic communication provides clients with a convenient and familiar form of interaction that can be used to book, reschedule, or cancel appointments.
- Electronic communication will only be used for booking, rescheduling or cancelling appointments unless an emergency/urgent matter arises and only with the support of a Manager can the exception be made.
- There are limits to confidentiality associated with using electronic communication that are outside Maryvale’s
- Electronic communication is associated with the following potential risks:
- Mobile device is stolen or
- Increased number of individuals with access to personal mobile
- Technological malfunctions may interrupt communication.
- Emails may be misdirected if addresses are imputed
- Text messages are stored on servers that may be
- Internet administrators have access to information processed through internet traffic.
- A crisis plan will be developed with the client to ensure the appropriate service is contacted in the event of a Staff may respond to electronic messages by directing clients to the crisis resource previously discussed. Maryvale staff will intend to respond within regular business hours between Monday and Friday, 8:30 a.m. to 4:30 p.m.
- All information communicated electronically will become part of the client record and will be handled in the same
- Obtaining and Releasing Information and Limits of Confidentiality:
What is talked about during sessions remains confidential (will not be shared with others without the client’s informed consent).
However, there are some exceptions where staff are legally required to contact someone in order to ensure the client and others are safe:
- If a client tells staff they want to hurt themselves, kill themselves or harm themselves and are reporting that those thoughts are strong and they might not be able to ignore them, staff will need to tell someone (parent/guardian) to keep the client safe.
- Certain types of self-harm may not fall into this category, however, if there comes a point where staff are concerned for the client’s safety or life due to self-harming, staff will need to tell someone to keep the client
- If a client tells staff they are in an unsafe situation or someone is harming them or making them feel
- If a client tells staff that a child under the age of 16 is being harmed or is at risk for being harmed, whether the client is involved or not. Sometimes this can extend to individuals under the age of 18 depending on the
- If the client has serious intentions (planning) to harm someone
- If there is a time when a client is involved in a legal case and Maryvale staff are asked for a client’s health information by the Court for the purposes of the
- Public safety exception – the Supreme Court of Canada has recognized that personal health information may be disclosed to police when there is a reason to believe there is an imminent risk of serious bodily harm (serious psychological harm is included in the term serious bodily harm) or death to an identifiable person or group of
- If the client tells staff they have been touched or talked to inappropriately by a health care provider who is covered by the Regulated Health Professions Act (e.g. physicians, psychologists) and give the name of this
Access to Personal Health Records:
- Clients or the Substitute Decision Maker (SDM) have the right of access to records of their own personal health information or may also provide consent for others to have access by giving verbal or written consent. Written consent is most often captured using the Authorization for Obtaining/Releasing Information form. (see Appendix B)
- When personal health information is requested with proper consent, the information shared is documented in the clinical file either as a note or noted on the Personal Health Information request form. (see Appendix C)
- All verbal requests for access require the verification of identity by providing identifying details such as their date of birth, date(s) of involvement in service and health card number.
- A client can request access, copies and/or corrections to their personal health record or withdraw or restrict consent for any/all of the uses above by contacting Maryvale (subject to legal exceptions). All written requests for access will be responded to within 30 days.
- Access can be denied if the file is subject to a legal proceeding or court order, and/or in the judgment of the agency’s Executive Director, access could result in risk of serious harm to an individual or would violate the privacy of another
- All necessary corrections following a client’s review of the personal information will be made without
- Requests for changes can be denied if the request pertains to a document not originally created by the agency and/or if the change pertains to a professional opinion or observation made about the client that was made in good
- Clients or the SDM can prepare a ‘Statement of Disagreement’ if requests for changes are denied, that must be included in the
- If required, a copy of the statement of disagreement will be provided to any person or organization to which information was previously
- No fee is charged by Maryvale for disclosure of information. Requests for information for hospital files are directed to Windsor Regional Hospital Health Records and that organization maintains a fee scale which is available on the web
- Requests for access or changes to personal health information that are denied can be registered as complaints with the Ontario government’s Privacy Commissioner (1-800- 387-0073).
- If for any reason there has been unauthorized access, disclosure, theft or loss of a client’s personal health information they will be
- Complaints about Maryvale’s personal information practices (including requests for
access and changes to information) can be registered with the Ontario government’s Information and Privacy Commissioner at 1-800-387-0073.
- Complaints about a determination of capacity may contact the Consent and Capacity Board at 1-866-777-7391
If a client has any concerns or questions regarding these matters or if they would like a copy
of Maryvale’s policy on the Protection and Privacy of Client’s Personal Information, they can ask for Maryvale’s Privacy Officer:
Kathy Morneau, Program Manager firstname.lastname@example.org
(519) 258-0549 ext. 2571