Staff Development
and Health Sciences Library
<Return to Privacy Links page
Privacy of Personal Health Information Policy
The Brant Community Healthcare System shall comply with the 10 CSA principles for the privacy of personal health information.
The Brant Community Healthcare System mission is to provide excellent healthcare to our community. The patient's right to privacy and securing information will be balanced with the delivery of effective healthcare.
Personal Health Information is to be collected, used, disclosed, and safeguarded as indicated in the following privacy principles.
Principle #1 – Accountability for Personal Health Information
The BCHS is responsible for all personal health information in its possession or custody, including information transferred to a third party for processing.
The Chief Privacy Officer is the person responsible for compliance with these principles and will oversee the Hospital's compliance with this policy, related procedures and the Privacy legislation. The Chief Privacy Officer will be made known to Hospital stakeholders and the public.
Principle #2 - Identifying Purpose
BCHS will define the purposes for which personal health information is being collected, used, disclosed and retained prior to being collected.
Personal Health Information related to the Hospital's patients is collected, used, disclosed, and retained for the following purposes; to serve as a means of ongoing communication amongst healthcare providers; to monitor the patient's progress and evaluate the response to the healthcare provided; to make decisions about patient treatment plans and follow-up care; as proof of what was done by whom and when during the patients healthcare encounter; comply with legal and regulatory requirements; for quality assurance, risk management, and outcome measurement activities; for strategic planning, decision making, allocation of human and financial resources.
Principle #3 – Consent
The knowledge and consent of the individual is required for the collection, use, disclosure and retention, except where inappropriate. BCHS will provide notice to its patients through brochures, notices, website the purposes for which the hospital will be using their personal health information. Specifically for direct patient care; administration of the hospital and health care system; complying with legal and regulatory requirements; health care databases, registries and related statistical research.
NOTE: Some circumstances allows for the collection, use or disclosure without the knowledge and consent of the individual. For example, legal, medical, or security reasons may make it impossible to seek consent. When information is being collected for the detection and prevention of fraud or for law enforcement, seeking consent of the individual might defeat the purpose of collecting the information. Seeking consent may be impractical or inappropriate when the individual is a minor, seriously ill, or mentally incapacitated.
Consent is required for the collection of personal health information and the subsequent use or disclosure of the information. In some situations, written consent with respect to use or disclosure may be sought after the information has been collected.
Consent may be implied or expressed.
Implied consent for disclosing information will be used for designated individuals who are within the circle of care. For example, to physicians involved in your care, nurses, allied health professionals, technologists in diagnostic departments; clerical/administrative staff responsible for capturing, coding, filing, retrieving and otherwise managing medical records.
Expressed consent is required for disclosing outside of the circle of care. For example, to third party insurance companies lawyers. Expressed consent will be required for disclosing personal health information to other individuals related to the patient, such as family members, friends, and/or partners. Where the patient is deemed unable or incapable of making their own decision consent will be obtained from the substitute decision maker for both release of information and consent to treatment.
Responding to General Inquiries: The hospital may receive phone calls from concerned individuals regarding our patients. Hospital staff will only provide to the caller the general health status of the patient (e.g., stable, poor, criticial).
The patients' location at the hospital will not be provided until consent has been given at the first foreseeable opportunity.
Patient that do not wish for this general information to be disclosed, can inform hospital staff who will ensure the patient's right to privacy. There are some situations that the above information will not be released to anyone. For example, patients that are being treated for sexual assault or domestic violence are completely confidential in order to ensure the personal safety of the patient.
This principle requires ‘knowledge and consent'. The BCHS will make a reasonable effort to ensure that all individuals are advised of the purpose for which personal health information is used. In order to make the consent meaningful, the purpose will be known in such a manner that the individual can understand how the information will be collected, used and disclosed.
Principle #4 - Limiting Collection
The BCHS will limit the collection of personal health information to that which is necessary for the purposes. Information shall be collected by fair and lawful means.
Information shall be collected by fair and lawful means.
BCHS will not collect personal health information indiscriminately. The amount and type of personal health information collected will be limited to that which is necessary to fulfil the purposes identified.
Principle #5 – Limiting Use, Disclosure, and Retention
Personal health information will not be used or disclosed for purposes other than those for which it was collected, except with consent from the individual or as required by law.
Specifically, collection, use or access to personal health information by staff members is strictly on a need-to-know basis to perform their assigned job duties.
Personal health information will only be retained for as long as is necessary for the fulfillment of those purposes or as required by law. For example, legislative requirements with respect to retention periods of personal health records.
Personal health information that is no longer required to fulfill the identified purposes will be destroyed or made anonymous. Personal health information will be destroyed according to the level of sensitivity. For example, paper medical records will be destroyed through the use of a shredding service with appropriate documentation of completion.
Principle #6 – Accuracy
Personal health information will be as accurate, complete, and up-to-date as is necessary for the purpose for which it is used.
Information willl be sufficiently accurate and up-to-date to ensure that decisions about the individual's plan for service are based on true information.
Personal health information will routinely be updated on contact with the individual, including additions, deletions or changes.
Principle #7 – Safeguards
Personal health information will be protected through security safeguards appropriate to the sensitivity of the information.
BCHS will protect the information against loss or theft, and safeguard against unauthorised access, disclosure, copying, use or modification.
Extreme care will be taken during the disposal and/or destruction process to prevent unauthorised parties from gaining access to the information.
Principle #8 – Openness
BCHS will make readily available to all individuals specific information about its policies and procedures relating to the management of personal health information.
Policies and practices will be available without unreasonable effort and in the format that is easily understandable.
Principle #9 – Individual Access
Upon request, an individual will be informed of the existence, use, and disclosure of their personal health information and will be given access to that information.
The individual will be able to challenge the accuracy and completeness of the information and have it amended accordingly.
Note: some circumstances may result in the hospital's not being able to provide access. Exceptions to access requirements will be limited and specific. Reasons for denying access will be provided to the individual upon request. Exceptions may include, information that is prohibitively costly, information that contains references to other individuals, information that cannot be disclosed for legal, security, or commercial proprietary reasons, and information that is subject to solicitor-client or litigation privilege, where the physician has confirmed that the information may be detrimental to the individuals health.
The BCHS will respond to an individual request within 30-days of a written request and at minimal cost to the client. Information requested will be provided or made available through a controlled process and understandable format. For example, if the hospital uses abbreviations or codes for recording, these will be explained. The controlled process will include measures to ensure original information is not altered, deleted or appended without Hospital supervision and approval.
When an individual successfully challenges the inaccuracy or incompleteness of information, BCHS will amend the information as required. Depending on the nature of the information challenged, amendment involves the correction, deletion, or addition of information. Where appropriate the amended information will be shared with third parties having access to the information in question.
Principle #10 – Challenging Compliance
An individual will be able to address a challenge concerning compliance with the above principles to the Chief Privacy Officer.
Procedures are in place to receive, respond and monitor complaints or inquiries about the BCHS policies and procedures relating to the handling of personal health information. The complaint procedure will be easily accessible and simple to use.
BCHS will inform individuals who make inquiries or lodge complaints of the existence of relevant complaint procedures.
BCHS will investigate all complaints. If the complaint is justified, the BCHS will take appropriate measures, including, if necessary, amending its policies and practices.
Disciplinary Action
Disciplinary action for violation of this Policy may include, but is not limited to, termination or suspension of employment and or privileges of the offender. In cases involving less serious violations, disciplinary action may consist of a warning or reprimand and/or suspension any privileges. Remedial action may also include counselling, changes in work assignments, or other measures designed to prevent future misconduct.
This policy applies equally to every individual in the organization both during on-duty hours and off-duty hours.
|
