TOPIC:
Client Privacy and the Protection of Client Personal Information
PURPOSE:
To outline PCAAT’s methods to ensure that client personal information is private and confidental.
POLICY:
PCAAT will comply with relevant privacy and confidentiality legislation regarding client personal information.
1.0 PROCEDURE
1.1 Accountability
PCAAT is responsible for personal information under its control and has designated individual(s) to be accountable for PCAAT’s compliance with the following privacy principles
Accountability for PCAAT’s compliance with the privacy policy rests with the Chief Privacy Officer, although other individuals within PCAAT are responsible for the day-to-day collection and processing of personal information. All staff share responsibility for adhering to the policies and procedures.
1.1.2 The name of the Chief Privacy Officer designated by PCAAT to oversee compliance with its privacy policy is available upon request.
1.1.3 PCAAT is responsible for personal information in its possession or custody, including information used by all employees, volunteers and other agents.
1.1.4 PCAAT is responsible for ensuring that its agents are informed by the information practices and know their responsibilities relating to the collection use and disclosure of personal information.
1.1.5 PCAAT has written information practices in place that describe the group’s information management practices. These practices are available to the public.
1.1.6 PCAAT has policies and practices in place to receive and respond to complaints and inquiries.
1.2 Identifying Purposes
PCAAT will identify the purposes for the collection of personal information at or before the time the information is collected. The purposes of collection include:
1.2.1 The identified purposes are specified at or before the time of collection to the individual from whom the personal information is collected. Depending upon how the information is collected, this can be done orally or in writing. Upon intake/admission, for example, a notice or brochure identifying the purposes may be posted or given to the individual.
1.2.2 When personal information that has been collected is to be used or disclosed for a purpose not previously identified for which consent is required, the new purpose will be identified prior to use or disclosure. Unless the new purpose complies with the purposes identified, the consent of the individual will be obtained before the information is used for another purpose.
1.2.3 Staff collecting personal information will be able to explain to individuals the purposes for which the information is being collected.
1.3 Consent
The knowledge and consent of the individual are required for the collection, use or disclosure of personal information, as noted below.
Note: In certain circumstances personal information can be collected, used, or disclosed without the knowledge and consent of the individual. For example, legal, medical, or security reasons may make it impossible or impractical to seek consent. Acquiring consent may be impossible or inappropriate when the individual is a minor, cognitively impaired, seriously ill or psychotic and the Substitute Decision Maker is not available. PCAAT will follow the rules provided in applicable privacy/confidentiality legislation.
1.3.1 Consent may be express or implied.
1.3.2 When PCAAT receives personal information from the individual, the individual’s Substitute Decision Maker, or another service provider or health information custodian for the purposes of providing service, PCAAT will assume that the individual implies consent to collect, use and disclose the information as necessary for that purpose unless the individual has expressly withheld or withdrawn consent.
1.3.3 When a person’s consent is required for collecting, using or disclosing personal information, it will be knowledgeable, relate to the information, and not be obtained through coercion or deception. A consent is knowledgeable if it is reasonable to believe, in the circumstances, that the individual knows the purposes of the collection, use or disclosure, and that the individual may provide or withhold consent.
1.3.4 A consent to the disclosure of personal information about an individual by PCAAT to an external service provider will be expressed. If PCAAT discloses personal information to another health information custodian for a purpose other than for providing service, consent will also be expressed.
1.3.5 Typically, PCAAT will seek consent for the use or disclosure of the information at the time of collection. In certain circumstances, consent with respect to use or disclosure may be sought after the information has been collected but before use, e.g., where the PCAAT has collected information from an external health care or service provider identifying a request for admission to our organization.
1.3.6 Consent can be given by the individual or an authorized Substitute Decision Maker if the individual is incapable. PCAAT will follow the rules outlined in relevant legislation for obtaining consent on behalf of incapable individuals or for an individual who has died.
1.3.7 A consent may be withdrawn by the individual who gave it at any time by providing notice to PCAAT.
1.4 Limiting Collection
The collection of personal information shall be limited to that which is necessary for the purposes identified by PCAAT. Information will be collected by fair and lawful means.
1.4.1 PCAAT will only collect personal information for lawful purposes permitted by legislation.
1.4.2 PCAAT will not collect personal information if other information can serve the purpose.
1.4.3 PCAAT will not collect personal information indiscriminately. Both the amount and the type of information collected will be limited to that which is necessary to fulfill the purposes identified.
1.4.4 Personal information will be collected by fair and lawful means.
1.4.5 Information may be collected indirectly without the consent of the individual in certain circumstances when the information is reasonably necessary for the provision of service to the individual. These circumstances include: where it is not reasonably possible to collect the information from the individual in a timely manner; where it is not reasonably possible to rely on the information from the individual as accurate; where another Act permits the collection.
1.5 Limiting Use, Disclosure, and Retention
Personal information shall not be used or disclosed for purposes other than those for which it was collected, except with the consent of the individual or as required by law. Personal information will be retained as long as necessary for the fulfillment of the purposes.
1.5.1 PCAAT will use and disclose personal information for lawful purposes permitted or required by Personal Health Information Protection Act, 2004 (PHIPA); Child, Youth and Family Services Act (CYFSA Part X); and by other Acts.
1.5.2 PCAAT will not use or disclose personal information if other information can serve the purpose.
1.5.3 PCAAT will not use or disclose personal information indiscriminately. Both the amount and the type of information used and disclosed will be limited to that which is necessary to fulfill the purposes identified.
1.5.4 PCAAT will use and disclose personal information for the purposes identified. If PCAAT uses or discloses personal information for a new purpose, it will document this purpose and obtain consent.
1.5.5
If personal information is used to be disclosed without an individual’s consent in a circumstance that requires consent, PCAAT will make a note of such use and/or disclosure and inform the individual of the use or disclosure at the first reasonable opportunity. PCAAT will keep the note as part of the record about the individual or in a form that is linked to those records.
1.5.6 PCAAT may disclose personal information to a health care provider if the disclosure is reasonably necessary for the provision of health care and it is not reasonably possible to obtain consent in a timely manner.
1.5.7 PCAAT may disclose personal information where the disclosure is necessary for the purpose of eliminating or reducing a significant risk of serious bodily harm to an individual, a person or group of persons.
1.6 Accuracy
PCAAT will take reasonable steps to ensure personal information is as accurate, complete, and up to date as is necessary for the purposes for which it is to be used.
1.6.1 Information shall be sufficiently accurate, complete, and up to date to minimize the possibility that inappropriate information may be used to make a decision about an individual.
1.6.2 Personal information that is used on an ongoing basis, including information that is disclosed to third parties, will generally be accurate and up to date, unless limits to the requirement for accuracy are clearly set out.
1.6.3 PCAAT will not routinely update personal information, unless such a process is necessary to fulfil the purposes for which the information was collected.
1.7 Safeguards
Personal information will be protected by security safeguards appropriate to the sensitivity of the information.
1.7.1 PCAAT’s security safeguards will protect personal information against loss or theft, as well as unauthorized access, disclosure, copying, use, or modification. PCAAT will protect personal information regardless of the format in which it is held, e.g., verbal, paper or electronic.
1.7.2 PCAAT ensures that the records of personal information in its custody and control are retained, transferred and disposed of in a secure manner.
1.7.3 The methods of protection include:
Physical measures, for example, locked filing cabinets and restricted access to offices.
Organizational measures, for example, acceptable use policies of PCAAT’s communication systems, limiting access to information on a “need-to-know” basis; and
Technological measures, for example the use of user identification and passwords to access PCAAT’s information systems.
1.7.4 PCAAT makes its member employees, volunteers and other agents aware of the importance of maintaining the confidentiality of personal health information. As a condition of membership and employment, all PCAAT employees must sign a confidentiality agreement and agree to adhere to the information practices.
1.7.5 Care is taken in the disposal or destruction of personal information, to prevent unauthorized parties from gaining access to the information.
1.7.6 PCAAT will notify an individual at the first reasonable opportunity if personal information is stolen, lost or accessed by unauthorized persons
1.8 Openness
PCAAT will make available to individuals specific information about its policies and practices relating to the management of personal information.
1.8.1 PCAAT sets out its information practices in writing and makes this information available to the public. This information is made available in a form that is generally understandable.
1.8.2 PCAAT will make information on its policies and practices available via the PCAAT website, posting the information in accessible locations at all programs, and providing the information on request.
1.9 Individual Access
Upon request, an individual will be informed of the existence, use and disclosure of his or her personal information and will be given access to that information. An individual will be able to challenge the accuracy and completeness of the information and have it amended as appropriate.
Note: In certain situations, PCAAT may not be able to provide access to all the personal information that it holds about an individual. Exceptions to the access requirement will be limited and specific. The reasons for denying access will be provided to the individual upon request. Exceptions may include: access could reasonably be expected to result in a risk of serious harm to the treatment or recovery of the individual or a risk of serious bodily harm to an individual or group of individuals; information that is prohibitively costly to provide; information that contains references to other individuals; information that cannot be disclosed for legal reasons; and information that is subject to solicitor-client or litigation privilege.
1.9.1 PCAAT will provide an individual with access to their record of personal information, except in limited circumstances. If PCAAT refuses an access request, the individual is entitled to make a complaint to the Office of the Information and Privacy Commissioner of Ontario.
1.9.2 PCAAT will provide a request form to enable the individual to access their record within 30 days.
1.9.3 PCAAT may charge the individual seeking access a fee. The fee is $25.00 for the first 20 pages, and then $0.25 per page thereafter. PCAAT believes its fees to be reasonable.
1.9.4 An individual will be required to provide sufficient written information to permit PCAAT to provide an account of the existence, use, and disclosure of personal information. The information provided shall only be used for this purpose.
1.9.5 An individual may request PCAAT to correct their personal information if they believe that the record is in accurate or incomplete. An individual must successfully demonstrate the inaccuracy or incompleteness of personal information and give PCAAT the necessary information to correct the record.
1.9.6 PCAAT will notify persons to whom the record was previously disclosed of the correction except where the correction would not affect the provision of services or other benefits.
1.9.7 PCAAT is not required to correct personal information that consists of a record that was not originally created by the PCAAT if PCAAT does not have sufficient knowledge, expertise or authority to correct the record or the record consists of a professional opinion made in good faith about the individual.
1.9.8 When PCAAT is unable to make a correction, PCAAT will inform the individual of the refusal, provide reasons and inform the individual of the right to appeal the refusal or the right to attach a statement of disagreement to the individual’s personal information.
1.10 Challenging Compliance
An individual will be able to address a challenge concerning compliance with the above principles to PCAAT’s Chief Privacy Officer.
1.10.1 An individual who has grounds to believe that PCAAT has contravened privacy legislation may make a complaint in writing. PCAAT has complaint forms throughout each program. PCAAT will respond to all complaints or inquiries about its information practices relating to the handling of personal information. If an individual wants to complain to the Information and Privacy Commissioner, PCAAT will inform the individual how to lodge the complaint.
1.10.2 If a complaint is found to be justified through an internal or external complaint review process, PCAAT will take appropriate measures, including, if necessary, amending its information practices.
3.0 REFERENCE SOURCES
CSA Model Code for the Protection of Personal Information (1996)
Child, Youth, and Family Services Act, Part X (2018)
Personal Health Information Protection Act (2004)
APPROVED BY: PCAAT Member Committee Meeting
EFFECTIVE DATE: September 3, 2025
We handle and protect your personal health information in accordance with Ontario’s Personal Health information Protection Act, 2004 (PHIPA
Child and Family Services Act (CFSA) Part X, and any other laws that we are required to follow. We provide training, follow established policies, and take other steps to ensure that our staff and anyone else acting on our behalf protects your privacy.
We want to provide you with the best service possible. In order to provide that service, PCAAT needs to collect and use information about you, including your personal health information. We only collect the information we need in order to determine your service and support needs. The personal information we collect may include:
Collection, Use, and Disclosure of Personal Health Information
Your request for care from us implies consent for our collection, use, and disclosure of your personal information for the following purposes:
From time to time, we may communicate about your care with your other health care and service providers, including collecting, using, and disclosing your personal health information through electronic medical information systems (sometimes called electronic health records, eHealth records, electronic medical records, etc.). If you would like more information about the electronic medical information systems we use, please speak with our Privacy Officer.
Any use of your personal health information other than those mentioned above would require your express consent.
You have the right to consent to how your personal information is collected, used and shared. However, there are specific situations where information can be shared without your consent as required by law, such as:
Your information is kept in a secure and well-protected place. Your information will only be viewed by those involved in providing services to you. All PCAAT staff have signed contracts that require them to keep your information confidential and safe.
Your Rights and Choices
Privacy legislation (e.g. PHIPA, CFSA Part X) provides you with certain rights related to your personal information under our custody or control. Please communicate with our Privacy Officer for more information related to your rights:
Our Privacy Contact
For more information or to raise a concern about our privacy practices, please contact PCAAT at: PCAAT@gsch.ca
The Information and Privacy Commissioner of Ontario
The Information and Privacy Commissioner of Ontario is responsible for making sure that privacy law is followed in Ontario. For more information about your privacy rights, or if you are unable to resolve an issue directly with our Privacy Contact and wish to make a complaint, contact:
Information and Privacy Commissioner of Ontario
2 Bloor Street East, Suite 1400
Toronto, ON M4W 1A8
Email: info@ipc.on.ca
Toll Free:1-800-387-0073
TDD/TTY: 416-325-7539