Privacy

Patients should have an understanding of how their personal health information will be collected, used and disclosed and how they may access their health records. If a patient requests a copy of his or her record, a copy should be provided within a reasonable time period. A fee may be charged to recover costs, but should be reasonable.

Patient consent is needed before releasing information to another person—except in certain circumstances. These circumstances and the responsibilities of health information custodians (HICs) related to the collection, use and disclosure of personal health information are outlined in the Personal Health Information Protection Act (PHIPA) available at www.e-laws.gov.on.ca.

Resources are available on the College website at www.collegept.org and the Office of the Information and Privacy Commissioner of Ontario website at www.ipc.on.ca.

There are three groups of people who are able to access patient records without explicit 
patient consent:

- The patient or their authorized representative. Patients and anyone to whom they give consent should be able to access the record throughout the retention period.

- The care providers within the "circle of care." Circle of care is not a defined term under the Personal Health Information Protection Act (PHIPA). It is a term used to describe Health Information Custodians (HICs) and authorized agents who are permitted to rely on an individual’s implied consent when collecting, using or disclosing personal health information to provide direct health care. For more information about circle of care, please visit the Office of the Information and Privacy Commissioner of Ontario website.

- An authorized assessor or investigator from a College established under the Regulated Health Professions Act (RHPA). Authorized investigators, assessors or representatives of the College of Physiotherapists of Ontario, as well as authorized investigators from another College established under the RHPA are permitted to access patient records in order to fulfill their obligations under the RHPA.

Records should be stored in a secure environment to safeguard their integrity and confidentiality. This applies equally to paper and electronic records. Reasonable measures should be implemented to protect health information from loss, theft, unauthorized access, use or disclosure and tampering including copying, modification or disposal.

This includes all components of the patient record such as attendance records, sign in sheets and exercise programs. 

Some examples include ensuring:

- Physical security (locked file cabinets, restricted office access, office alarm systems)

- Technological security (password protection, encryption, virus protection, firewalls)

- Administrative controls (security clearances, access restrictions, staff training and confidentiality agreements)

Yes. According to the Personal Health Information Protection Act (PHIPA), the patient has the right to identify anything within the record that may be inaccurate, incomplete or misleading and to request correction of the record.

However, you need only make changes to a patient record if you have confirmed there was an error. There is no expectations for a physiotherapist's judgement to be modified unless based on new factual information.

Visit the Office of the Information and Privacy Commissioner of Ontario website to learn more.

1. Find out who the health information custodian (HIC) is in your organization. If you are not the HIC for your clinic, report the loss to the HIC. Hospitals, primary care teams, long-term care homes, pharmacies and community agencies are all considered HICs.

2. Once reasonable attempts have been made to locate the file, the HIC has a duty to notify the patient at the first ‘reasonable opportunity’ that the file has been lost.

3. You and the HIC should determine whether the privacy policies and processes of the organization were followed.

4. Next, the HIC must determine if this is a one time occurrence or if it is part of a pattern of errors, what the impact on the patient could be, and whether the loss of a record could happen again. Make note of the findings of the review.

Not all privacy breaches need to be reported to the Information and Privacy Commissioner of Ontario. If the lost chart is a one time occurrence, was not intentional and not a pattern, the matter can be internally managed. Debrief the issues with your team. Share the lessons learned so that you can build a positive culture around privacy safeguards in your workplace.

5. All professionals must be diligent in scanning, storing and transferring records. The HIC must ensure that there are policies and processes in place to protect patient’s health records and that all staff are aware of necessary steps to follow if there is a loss or breach of a patient’s information.

Patient consent is required before releasing information to another person – except in certain circumstances (for example, in an emergency). In some cases, consent must be expressly obtained and in other cases it can be implied or assumed. 

Express consent is required where personal health information is disclosed to a person who is not a health information custodian (such as a police officer) or it is disclosed for a purpose other than providing health care (for example, fundraising or marketing).

Implied consent means the patient's behaviour implies that they consent (for example, a patient rolls his shirt sleeve up and presents his arm for your examination or when a client answers questions about his or her health history on an intake form), or the situation is such that consent can be assumed (for example, to provide ongoing health care). 

Health professionals can assume that they have an individual’s consent to collect, use or disclose personal health information for the provision of health care if the following conditions are met:

• The information was received from the individual (or substitute decision-maker), or another health information custodian.

• The information is collected, used or disclosed for the purpose of providing health care to the individual.

• If information is being disclosed, it must only be disclosed to another health information custodian.

• The individual has not withheld or withdrawn consent.

This is commonly referred to as sharing personal health information within the circle of care.

Consent is not required in the following circumstances:

- In an emergency

- If there is a significant risk of serious bodily harm

- In the context of a legal proceeding if the custodian or agent is a party or witness

- Records are released to a regulatory College (for example, in the context of an investigation of a complaint)

No. Individuals may consent verbally. But you should document in the individual’s health record that verbal consent was obtained.

Under the health privacy laws, patients can withhold or withdraw their consent to the collection, use or disclosure of their personal health information. They can also provide express instructions to not to use or disclose their personal health information (or put it in a lock box). This includes:

- Not collecting, using or disclosing a particular item of information (for example, a diagnosis).

- Not collecting, using or disclosing their entire health record.

- Not disclosing any personal health information to a particular person or group.

Although it is up to the patient to decide what (if any) personal health information to lock, and to whom the lock should apply, you should discuss with the patient how locking personal health information might affect their health care.

IPC Lock Box Fact Sheet

1. Report the breach to the Health Information Custodian (HIC).

2. Follow the privacy breach protocol and attempt to locate the lost file or contain the privacy breach.

3. The HIC must notify the patient of the privacy breach, the steps taken to contain the breach or locate the list file, and the fact that they may make a complaint to the Information and Privacy Commissioner of Ontario.

4. You and the HIC should determine whether the privacy policies and processes of the organization were followed.

5. Determine if this is a one-time occurrence or if it is part of a pattern of errors, what the impact on the patient could be, and whether the breach could happen again. 

6. Document the findings of the review.

7. Notify the Information and Privacy Commissioner of Ontario if the breach meets their reporting threshold. If the loss or breach is a one-time occurrence, was not intentional and not a pattern of errors, the matter can likely be internally managed.

8. Debrief the issues with your team. Share the lessons learned so that you can build a positive culture around privacy safeguards in your workplace.

If you are the Health Information Custodian (HIC) you must can either retain the records and store (and later dispose of) them safely, or transfer custody of the records to a new HIC.  

You must notify individuals when you are transferring their health records to a successor.

IPC - Avoiding Abandoned Health Records

Group practices should have formal written agreements in place that identify the custodian and obligations of each person when there is a change in practice.

Yes, as long as you ensure appropriate safeguards are in place. Check out the resource below from the Information and Privacy Commissioner of Ontario and learn all about the privacy, security and compliance considerations. 

IPC -Thinking About Clouds

Email offers many benefits, but it also poses risks to the privacy of individuals and to the security of personal health information. Before using email to communicate, you should evaluate the risks and take steps to ensure that personal health information is protected from theft, loss and unauthorized use or disclosure.

IPC - Email Fact Sheet

You can rely on the patient’s implied consent if:

• The information was received from the patient (or substitute decision-maker) or another health information custodian.

• The information is collected, used or disclosed for the purpose of providing health care to the individual.

• If information is being disclosed to another health information custodian.

• The individual has not withheld or withdrawn consent.

No, but it's a good learning opportunity for staff. As the designated Health Information Custodian (HIC) you must first determine that the loss or unauthorized use or disclosure of personal health information is significant after considering all relevant circumstances. You must consider whether the personal health information is sensitive, whether the loss or unauthorized use or disclosure involved a large volume of personal health information or many individuals’ personal health information and whether more than one HIC or agent was responsible. If you determine that the access was not intentional, significant or part of a pattern then a report does not have to be made.

Remember that HICs are now required to report statistics relating to health privacy breaches annually to the Information and Privacy Commissioner of Ontario so keep a list of any potential privacy breaches. The online statistics submission website will be opened each year for health information custodians across Ontario to submit their statistics.

Yes. The Missing Persons Act, 2018 came into effect on July 1, 2019, changing what information police can request or access when investigating missing persons in Ontario. The new power is designed to assist in cases where no criminal activity is suspected.

1. You have relevant records

2. The records would help locate a missing person

3. Time is sensitive and the missing person would be harmed or the records destroyed if not produced immediately 

Yes, a patient can request a copy of their electronic health record. If a patient requests a copy of his or her record, a copy should be provided within a reasonable time. A fee may be charged to recover costs but should be reasonable.  Ideally this fee should be included on the fee schedule at your clinic.

Before using email to send a record, you should evaluate the risks and take steps to ensure that personal health information is protected from theft, loss and unauthorized use or disclosure. Custodians should use encryption for emails to and from patients that contain personal health information. This includes by encrypting or password-protecting document attachments and sharing passwords separately through a different channel or message. If the use of encryption is not feasible, custodians must determine if the use of unencrypted email is reasonable in the circumstances after considering all relevant factors, including the sensitivity of the information, the purpose of the transmission, and the urgency of the situation.

(Please see IPC’s Fact Sheet: Communicating Personal Health Information by Email.)

Practitioners should always consider whether it is necessary to store personal health information on a mobile device (such as a USB key) or whether an alternative, such as de-identifying the information or accessing the information through a secure remote connection, would suffice.  If it is necessary to store personal health information on a mobile device, the information must be secured using “strong encryption.” Password protection is not enough. 

The Information and Privacy Commissioner of Ontario has stated that if personal health information on a mobile device is appropriately encrypted, the loss or theft of that device would not constitute a privacy breach.

To assist custodians in choosing virtual visit solutions, Ontario Health has developed a Virtual Visits Solution Standard. This provincial standard was developed to help custodians and vendors deliver secure virtual health care by using “safe, secure and interoperable platforms”.*

The standard sets out the mandatory requirements that must be satisfied for a product or service to be designated as a verified solution by Ontario Health. As solutions are verified, a list of them will be published online to help guide custodians in making their selection.

Custodians should consider how the solutions they are considering procuring for virtual health care integrate with their overall information management infrastructure. They must ensure the solutions they use comply with applicable interoperability specifications established by Ontario Health.

Custodians who engage third-party service providers in the delivery of virtual care should ensure, through contractual agreements, that the service providers comply with the privacy and security measures to satisfy the requirements set out in PHIPA. Among other contractual undertakings, the service provider should agree to:

 •  immediately notify the custodian in the event of a privacy breach
 •  undergo periodic security audits at the request of the custodian
 •  restrict access to personal health information by employees or any person acting on   their behalf on a need-to-know basis
 •  securely return or destroy information at the end of the agreement

Custodians should not engage the services of providers that require, as a condition of service, that individuals register with the service provider or accept terms of service and privacy policies that require collection, use, or disclosure of personal information or personal health information for purposes unrelated to the custodians’ provision of care.

* Custodians remain responsible for ensuring that they continue to comply with the requirements of PHIPA when using a virtual care solution provided by a vendor who has participated in Ontario Health’s Virtual Visits Solution Standard verification process.

Taken directly from the IPC’s Privacy and Security Considerations for Virtual Health Care Visits

Before booking a virtual visit, custodians should determine if a virtual visit is even appropriate, considering their patient’s needs, computer and technical requirements, the purpose of the visit, and relevant regulatory guidance.

Custodians should also consider both the risks and benefits of holding the visit virtually rather than in person. This includes practical mobility and accessibility factors for their patients, as well as their own ability to uphold their obligation to protect the privacy and security of the patient’s personal health information in a virtual setting.

Using plain language, custodians should inform their patients of the limitations and risks of virtual care visits, including potential privacy breaches resulting from physical or electronic eavesdropping, hacking and software exploits, technical failures, and configuration errors.

Custodians must have the patient’s consent to collect, use, and disclose personal health information through virtual care technologies and services. Custodians should document the discussion of the limitations and risks of virtual care visits, including the potential for privacy breaches, and the consent obtained. The patient should be informed that they can withdraw this consent at any time.

Taken directly from the IPC's Privacy and Security Considerations for Virtual Health Care Visits

Custodians must put in place technical, physical, and administrative safeguards to protect personal health information. Proper planning is crucial for ensuring virtual visits are as private and secure as possible.

Custodians should avoid using personal email, unencrypted text messaging, or free cloud-based videoconferencing platforms to communicate with patients. These platforms raise serious privacy risks. Custodians should have safeguards in place to protect personal health information through secure email, messaging, or conferencing systems that have been vetted and approved for use by their organization. Some examples of safeguards include:

Technical safeguards:

 •  use only organization-approved email, messaging, or videoconferencing accounts, software, and related equipment
 •  use firewalls and protections against software threats
 •  regularly update applications with the latest security and anti-virus software
 •  use only organization-approved email, messaging, or videoconferencing accounts, software, and related equipment

 •  encrypt data on all mobile and portable storage devices, both in transit and at rest *
 •  maintain, monitor, and review audit logs
 •  use and maintain strong passwords
 •  review and set default settings to the most privacy protective setting
 •  verify and authenticate a patient’s identity before engaging in an email exchange, chat, or videoconference

Physical Safeguards: 

 • keep all technology containing personal health information, such as desktop computers and servers, in a secure location
 • keep portable devices containing personal health information, such as smartphones, tablets, and laptops, in a secure location, such as a locked drawer or cabinet, when they are unattended
 • restrict office access, use alarm systems, and lock rooms where equipment used to send, receive or store personal health information is kept
 • do not lend technology containing personal health information to anyone without authorization
 • ensure there are no unauthorized persons in attendance or within hearing or viewing distance
 • physically segregate and restrict access to servers to only authorized persons

Administrative Safeguards: 

 •  ensure employees and other agents are properly trained to use secure email, messaging, and videoconferencing platforms
 •  adopt a robust system of access controls and regularly maintain authorizations on a need-to-know basis
 •  ensure employees and other agents are well aware of their ongoing obligation to avoid collecting, using or disclosing more personal health information than is necessary
 •  ensure confidentiality agreements contain explicit provisions dealing with employees’ and other agents’ obligations when using secure email, messaging, or videoconferencing to deliver virtual health care
 •  ensure employees and other agents are properly trained to use secure email, messaging, and videoconferencing platforms

Safeguarding against privacy and security risks in virtual care is an ongoing obligation. Custodians should continue to monitor for and address cybersecurity threats, for example by:

 •  updating software regularly
 •  providing ongoing security training to employees and other agents to support the detection of phishing attempts
 •  conducting regular threat risk assessments

* The IPC does not consider the loss or theft of an electronic device containing encrypted personal health information to be a privacy breach (a term that encompasses security breaches involving personal health information) where the risks of unauthorized access to unencrypted information are demonstrably low. However, whether or not the information is encrypted, custodians should require employees and their other agents to report any such loss or theft. This will enable custodians to determine, on a case-by- case basis, whether the information was properly protected.

Taken directly from the IPC’s Privacy and Security Considerations for Virtual Health Care Visits

One of the unique challenges for custodians using email to communicate with their patients — particularly when they cannot see or hear the patient — is to ensure the exchange is with the correct person. Custodians should verify the recipient’s identity and correctly address emails or messages to avoid misdirection. One approach is to send a test message in advance and ask for confirmation to ensure the message reaches the intended recipient.

Further safeguards to use when communicating personal health information by email include:

 •  providing a notice in an email that the information received is confidential
 •  providing instructions to follow if an email is received in error
 •  communicating by email from professional rather than personal accounts because personal accounts may have weaker security levels and may be more susceptible to compromise
 •  confirming an email address is up to date
 •  ensuring that the recipient’s email address corresponds to the intended address
 •  regularly checking pre-programmed email addresses to ensure that they are still correct
 •  restricting access to the email system and to email content on a need-to-know basis
 •  informing patients of any email address changes
 •  acknowledging receipt of emails
 •  minimizing the disclosure of personal health information in subject lines and message contents to the greatest extent possible
 •  ensuring strong access controls to email accounts used by custodians
 •  recommending that patients use a password-protected email address that only they can access

Custodians should also ensure compliance with the safeguards specified in any other policies and procedures, including those related to using personal devices in the workplace.

Patients should be registered through a secure messaging solution that authenticates their identity before accessing their messages.

Custodians should use encryption for emails to and from patients that contain personal health information. This includes by encrypting or password-protecting document attachments and sharing passwords separately through a different channel or message. If the use of encryption is not feasible, custodians must determine if the use of unencrypted email is reasonable in the circumstances after considering all relevant factors, including the sensitivity of the information, the purpose of the transmission, and the urgency of the situation (please see IPC’s Fact Sheet: Communicating Personal Health Information by Email). Custodians are also expected to use encryption when emailing personal health information to other custodians.

Custodians’ employees, other agents, and patients should be reminded of the risks associated with phishing to avoid falling prey to malware, spyware, or other forms of social engineering. Phishing is an online attack in which an attacker — using both technological and psychological tactics — sends a message designed to trick the recipient into revealing confidential information or downloading malware. Phishing attacks often imitate legitimate sources and work by exploiting people’s trust, curiosity, fear, and desire to be helpful and efficient. Recipients should be cautious when faced with messages that are unexpected or contain suspicious attachments or links.

Custodians should store personal health information on email servers only for as long as is necessary to serve the intended purpose. For example, if email communication is documented in the patient’s record, it may not be necessary to retain duplicate copies of the information on an email server. Likewise, custodians should ensure that all copies of emails containing personal health information on portable devices are securely deleted when they are no longer needed and are documented in the patient’s record.

For best practices, please see the IPC’s fact sheets Communicating Personal Health Information by Email and Protect against Phishing.

Special considerations for videoconferencing

When using videoconferencing platforms to deliver care, custodians should take additional steps to prepare the patient for their virtual visit. For example, the custodian could ask about captioning or screen reader requirements to address accessibility concerns and review the steps the patient can take to protect their privacy.

As a best practice, both the custodian and the patient should join the videoconference from a private location using a secure internet connection. This includes using a closed, soundproof room or an

otherwise quiet and private place and having window coverings where and as appropriate. Use headphones rather than the speaker on the device to prevent being overheard by others, and be mindful of where screens are positioned.

Once logged into the videoconference, the custodian should check the meeting settings to ensure the meeting is secure from unauthorized participants. If the software or application can record the meeting, this feature should only be used when it is necessary and the patient provides express consent.

At the start of an initial visit, the custodian should verify the identity of the patient. In the event of a new patient encounter, the custodian should compare the patient’s image with a photo on file or ask the patient to  hold up their health card to the camera for confirmation.

The custodian should introduce themselves and any others who are present on the custodian side of the interaction and ensure the patient consents to the presence of any additional individuals. The custodian should also inquire if anyone is accompanying the patient and confirm the consent of the patient.

When videoconferencing, custodians must use sufficiently high-quality sound and resolution to ensure they are able to collect information (including verbal and non-verbal cues) that is as accurate and complete as is necessary for the purpose of providing health care.

Taken directly from the IPC’s Privacy and Security Considerations for Virtual Health Care Visits