PHIPA protects your privacy by giving you the ability to give, refuse or withdraw consent to the collection, use and/or disclosure of your own personal health information. The Act allows two forms of consent; express and implied. Woodingford Lodge largely operates within the realm of assumed implied consent. For example, we assume that we have your permission to share your personal health information with other health care providers, including doctors, nurses, social workers and therapists who assist in the provision of your care. This arrangement is referred to as the “circle of care”.

Sometimes we are not allowed to rely on implied consent. For example, any sharing of personal health information with other health care providers for purposes other than health care or with persons or organizations that are not health care providers (such as insurers) requires your express consent. This means that staff must obtain explicit verbal permission or written authorization from you or your substitute decision-maker prior to such disclosures.

PHIPA also allows you to withhold or withdraw consent to the collection, use or disclosure of all or some of your personal health information. Just be aware that this may limit our ability to provide care.

Woodingford Lodge staff may collect your personal health information directly from you or from a person acting on your behalf such as a substitute decision-maker. We may also collect personal health information about you from other sources if your consent has been obtained or if the law permits or requires the collection. However, we will only collect your personal health information to support purposes allowed by law and will not collect more information than is reasonably necessary.

The staff at Woodingford Lodge may use your personal health information for the following purposes:

• the provision or assisting in the provision of health care;
• assessing the capacity of a resident to make health care and other important decisions;
• facility administration and management;
• strategic planning, evaluation and monitoring related to service delivery and quality of care;
• processing payments for the provision of goods or services;
• compliance with legal and regulatory requirements; and
• any other purposes permitted or required by law.

From time to time, we may communicate about your care with your other health care providers, including collecting, using, and disclosing your personal health information through electronic medical information systems (sometimes called electronic health records, eHealth records, electronic medical records, etc.). If you would like more information about the electronic medical information systems we use, please speak with our Legislative Services Coordinator.

Your personal health information is private. We cannot and will not disclose it without your consent unless we are allowed or required by PHIPA or another law. PHIPA permits the sharing of personal health information without consent for a number of purposes:

• with other health care professionals for the provision of health care when it is not reasonably possible to obtain your consent, for example you are seriously ill or mentally incapacitated;
• to determine provincial funding or other payments to the County of Oxford for the provision of services;
• to contact a relative, friend or potential substitute decision-maker if you are injured, incapacitated or ill and unable to give consent personally;
• to notify visitors of the fact that you are a resident, your location in the facility, and your general health status (you have the right to object to this disclosure in whole or in part);
• to inform a relative or friend that a resident is deceased and the circumstances of the death if appropriate;
• to give the spouse/partner, sibling or child of a deceased person information required to assist them in making decisions about their own health care;
• determining or verifying the eligibility of an individual to receive coverage for health related services;
• to a person carrying out an audit, inspection or investigation authorized by warrant or by law;
• to eliminate or reduce a significant risk of serious bodily harm to a person or group of persons;
• for the purpose of a legal proceeding or pursuant to a summons, subpoena or court order;
• to report suspected cases of abuse;
• to report certain diseases to the public health department; and
• to report certain other information, such as health conditions that make you unfit to drive.

In these situations, the disclosure of personal health information is authorized by law and Woodingford Lodge is not required to obtain your consent.

The PHIPA requires a health information custodian to protect personal health information in its custody or control and to ensure that those records are retained, transferred and disposed of in a secure manner. At the County of Oxford, we employ physical, organizational, procedural and technological safeguards to protect your personal health information against loss, theft and unauthorized access, copying, modification, use, disclosure and disposal. The safe storage of your personal health information involves not only the physical security of your paper health records, such as locked filing cabinets and restricted office access, but also the technological security and administrative controls necessary to protect electronic records such as complex passwords. These technological controls also include the encryption of your personal health information being transported on laptops, tablets or any other removable storage media, such as USB keys or memory sticks.

Woodingford Lodge staff that come into contact with your personal health information are aware of its sensitive nature and are required to sign a confidentiality agreement as a condition of employment. Confidentiality is considered to be breached when an employee releases or discusses the personal information of a client, patient or resident with any third party, including other staff members, without consent from the individual to whom the information relates, unless it falls under one of the legally permitted uses/disclosures. Breaches of confidentiality include accessing personal information without authorization and without a need-to-know. Disciplinary action up to and including termination of employment may be taken against any employee who breaches the confidentiality agreement.

Both paper and electronic records are retained and destroyed in accordance with the County of Oxford’s Records Retention By-law #4957-2008. Confidential waste material (like your personal health information) is deposited into secure shredding consoles or otherwise disposed of in a manner that preserves the confidentiality of the information contained in the records.

Woodingford Lodge has an obligation to notify you at the first reasonable opportunity if your personal health information is lost, stolen or accessed by unauthorized persons.

Any person can make a request for access to records. Individuals who wish to view or obtain a copy of their own personal health records are encouraged to first contact the department that holds the information.

The procedure for making a formal access request under the PHIPA is as follows:

• All requests are to be made in writing and forwarded to the attention of the Legislative Services Coordinator, Department of Corporate Services, County of Oxford, 21 Reeve Street, P.O. Box 1614, Woodstock, Ontario, N4S 7Y3. A Request to Access Personal Health Information form is available for use by the public, but a simple letter will suffice as long as it specifies that a request is being made under the Act.
• The requester must provide sufficient detail to enable the Legislative Services Coordinator, upon a reasonable effort, to identify the requested record(s).
• Fees may apply to processing your request and will applied in accordance with the County’s Fees and Charges By-law
• Photo identification bearing a signature is required in order to assist in verifying the identity of the requester.

The Act requires that the municipality issue a decision letter within 30 days of receipt of the request. This means that the County must either grant access to the requested record(s) or notify the individual that access is denied along with a reason for the refusal

Pursuant to Sec. 55 of the Act, you have the right to challenge the accuracy and completeness of your own personal health information held by the County if you believe there has been an error or omission.

Woodingford Lodge staff will make every effort to ensure that your personal health information is accurate, complete and up-to-date. If it is demonstrated to our satisfaction that your information is outdated, incomplete or inaccurate, it will be severed from the record and corrected by staff.

If there is a dispute about the accuracy or completeness of the information in the record, the requester may attach an explanatory note or statement of disagreement to the information reflecting any correction that was requested but not made. If this is not satisfactory, the requester has the right to appeal.

We encourage you to first direct questions, comments or complaints about County of Oxford information handling practices, or about our alleged contraventions of the PHIPA or its regulations, to the Legislative Services Coordinator (contact information below) who will investigate and attempt to resolve all complaints.

If not satisfied, you also have the right to address complaints and concerns to the IPC, the impartial body that oversees compliance with PHIPA, at the following address:

Registrar

Information and Privacy Commissioner of Ontario
Suite 1400 - 2 Bloor St. E.
Toronto, ON
M4W 1A8

For more information, please contact the IPC at 416-326-3333 or toll free at 1-800-387-0073 or visit their website at www.ipc.on.ca.

For more information about access and privacy at the County of Oxford, please contact the Legislative Services Coordinator, Department of Corporate Services at 21 Reeve Street, P.O. Box 1614, Woodstock, ON, N4S 7Y3 or (519) 539-9800 (ext. 3017) or clerksoffice@oxfordcounty.ca