Our policy, our promise
Protection of Personal and Personal Health Information
- What is personal and personal health information?
- Why does CBI Health Group need to collect use and disclose your personal or personal health information?
- Giving your consent
- Withdrawing your consent
- Safety and Accuracy of Personal or Personal Health Information
- Right of Access
- Right to request correction or amendment
- Right to complain to the Chief Privacy Officer for CBI Health Group, federal or provincial Privacy Commissioner
About Privacy Laws
Generally speaking commencing January 1st 2004 The Personal Information Protection and Electronic Documents Act (PIPEDA) applied to all organizations in Canada that collect, use or disclose personal information in the course of doing business. Quebec (Act Respecting the Protection of Personal Information in the Private Sector), British Columbia (Personal Information Protection Act – PIPA), Alberta (Personal Information Protection Act - PIPA) and Ontario (Personal Health Information Protection Act – PHIPA)) have enacted provincial legislation that has been deemed substantially similar to the federal legislation (PIPEDA) and organizations in these provinces have been granted exemption from PIPEDA, except with respect to the transmission of data across borders when PIPEDA still applies. Saskatchewan (Health Information Protection Act- HIPA) and Ontario's provincial privacy legislation (PHIPA) do not apply generally to the private sector, as PIPEDA does, but rather only regulate health information. New Brunswick has also enacted private sector and health privacy legislation effective September 1st 2010, the Right to Information and Protection of Privacy Act (RTIPPA), and the Personal Health Information Privacy and Access Act (PHIPAA).
The existence of multiple laws dealing with the protection of information and privacy creates a complex framework from within which CBI Health strives to provide the best possible care to our clients and at the same time understand and respect your privacy rights.
The protection of personal and personal health information is an important principle to CBI Health and its affiliated and partnership organizations. CBI Health is committed to collecting, using, and disclosing personal and personal health information responsibly and ONLY to the extent necessary for the services we provide.
Personal information (PI) includes any identifying information about you. CBI Health Group collects personal information from you such as your name, date of birth, address, email and phone contact information and when you offer it as a means of payment, your credit card information (please note credit card information is not retained after a transaction is completed).
Personal Health Information (PHI) is any identifying information in writing or spoken about your physical or mental health; the provision of your health care; the eligibility or payment for your health care; the identity of the provider of your health care; and includes your health card number (a health care provider who does not use your health card for an authorized purpose cannot ask for the number).
CBI Health Group collects and generates personal and personal health information in the course of providing you with the services you, or someone else requests.
CBI Health Group has designated a Chief Privacy Officer to be accountable for the organization's compliance with the applicable privacy legislation, including the ten privacy principles set out in PIPEDA and other legislation: accountability; identifying purposes; consent; limiting collection; limiting use, disclosure and retention; accuracy; safeguards; openness; individual access and challenging compliance.
The Chief Privacy Officer for CBI Health is assisted by seven Regional Privacy Officers across Canada, who works with your local facility to receive and respond to questions about CBI Health Group policies or practices with respect to personal or personal health information and requests for access or amendments to personal or personal health information. For information on how to contact the Chief Privacy Officer or Regional Privacy Officer please ask your local CBI facility or contact CBI Health Group Corporate Office (contact information may be found at the end of this notice).
- To provide assessment, treatment or other services related to your injury or illness, functional restriction, disability or impairment and / or your claim for compensation or benefits.
- To obtain payment for the assessment and/or treatment or other services we provide, and determine any entitlement to insurance coverage or other benefits
- To identify treatment outcomes and / or the extent of services provided, and share this information with CBI Health Group, payers (for example your insurance company, WCB/WSIB, CCACs) and referral sources (for example your doctor).
CBI Health Group also compiles information for its database that does not identify you (this is neither personal nor personal health information). The anonymous database is used to compile statistics for quality improvement initiatives, for example improving overall performance in different programs, and clinical outcomes research.
CBI Health Group may also collect, use or disclose your personal or personal health information if required by law to do so.
Your consent must be freely given. You need to understand the purposes for which CBI Health Group will collect, use or disclose your personal or personal health information before you give your consent and understand that you are able to withhold consent or may withdraw your consent, in whole or in part, after it has been given. You also need to understand the potential consequences of such refusal or withdrawal, which may include the inability of CBI Health Group to provide you with assessment, treatment or other services.
CBI Health Group will make all reasonable efforts to ensure that the purposes for which the information will be used are identified to you so that you can provide knowledgeable consent. In the clinics you will be asked to read and sign a consent form. If you are unable to read the consent, a verbal explanation will be provided so that you can reasonably understand how your personal or personal health information will be collected, used or disclosed. In other care settings, for example when receiving services in your home, you will be given a Privacy Notice to read with your family member or substitute decision maker, after an opportunity to ask questions, you can provide verbal consent and we will note your consent in your chart.
You have the right to withdraw your consent to the collection, use or disclosure of personal or personal health information in whole or in part, at any time upon providing reasonable written notice to the manager of the facility you are attending or to the care provider who visits you at home. The health care provider is responsible for informing you of any potential consequences that may result from the withdrawal of your consent, prior to you making such a decision (for example it may limit the ability of CBI Health Group to provide you with assessment, treatment or other services).
If you withdraw your consent it is not retroactive, and does not apply to personal or personal health information already collected, used or disclosed by CBI Health Group.
We will strive to keep your personal or personal health information as accurate, complete and up-to-date as is necessary for the purposes for which it is to be used. If you return for a further course of treatment or service, the personal or personal health information in your file will be updated at that time.
CBI Health Group has established a variety of safeguards to protect personal and personal health information in its care, including organizational (for example: training CBI personnel about privacy obligations and having all personnel annually sign a "Confidentiality Obligation Agreement", performing an annual audit of privacy practices), physical (for example: locking filing cabinets, central filing of active charts, safe storage requirements for archived files, security systems) and technological safeguards (for example: encryption of mobile data devices, virus protection, computer backup, password entry to computer system).
CBI Health Group will retain your personal or personal health information for the time necessary to fulfill the purposes for which it was collected and to comply with its legal obligations and to meet regulatory requirements.
You may request access to your personal or personal health information by written request addressed to the manager or supervisor of the facility or program you are attending. You may also provide the written request to your care provider visiting you at home. If you require assistance in preparing the request, CBI personnel will help you.
CBI Health Group will provide a response to your request within 30 days, either providing access to the requested information, or providing a written notice of why an extension of the time to respond is required, or providing you with written reasons why access has been denied.
If your request for access is delayed or denied, you will be provided with information about the recourse available through the Chief Privacy Officer for CBI Health Group, the provincial or federal Privacy Commissioner (for contact information see the end of this notice).
There is no charge to look at a copy of your record however it is suggested that you do so when your therapist or care provider can be present to go over the material with you (and your family if required) to explain any medical or technical terms to avoid any misunderstanding and misinterpretation.
If you want to receive a copy of your information held by CBI Health, you will be informed of the fees ahead of time. The charge will depend on the number of pages you have requested, the location (if the record has to be retrieved from a records storage facility), the complexity and time it takes to recreate the record from an electronic records system etc. All fees associated with a request for copies of personal health information are calculated on a cost recovery basis.
You have the right to request the correction or amendment of any personal or personal health information held by CBI Health, if its accuracy and completeness is challenged and found to be deficient. CBI Health is obliged to correct a record that is not accurate or complete, unless current CBI personnel did not create the record, or the information to be amended consists of a professional opinion made in good faith.
If CBI Health does not agree to your request to correct or amend your personal or personal health information, this disagreement will be noted in your record, and your written request for the correction or amendment as well as the reasons for the refusal to amend will be included in your file.
When your personal or personal health information has been corrected or amended, or when a disagreement regarding amendment has occurred, all parties that have received the original personal or personal health information may be informed of the changes or informed of the disagreement if it is relevant to do so, and you instruct CBI Health personnel to take that action.
You have the right to address a complaint to the Regional Privacy Officer or Chief Privacy Officer for the CBI Health Group if you believe CBI Health is not in compliance with its policies and procedures related to the handling and protection of your personal or personal health information. The complaint must be put in writing and given to the manager / supervisor of the facility or program you are attending, or to your home health care provider, who will promptly inform the Regional Privacy Officer or Chief Privacy Officer. The Regional Privacy Officer or Chief Privacy Officer will investigate all complaints related to CBI Health's management of personal and personal health information.
When necessary the Regional Privacy Officer or Chief Privacy Officer will work directly with the Director or Vice President of Operations, manager/supervisor and personnel involved, to implement corrective actions. This may involve training or notification of changes to privacy practices throughout the organization.
The Regional Privacy Officer or Chief Privacy Officer will follow up with you to describe the actions taken and to determine if you are satisfied that your concerns have been resolved. If you are not satisfied, you may make a complaint to the provincial or federal Privacy Commissioner (depending on the legislation and subject matter of the complaint) using the contact information provided below. The Chief Privacy Officer for CBI Health Group can help you determine the correct Privacy Commissioner's office to contact in your situation.
Chief Privacy Officer
Tel: (416) 231 0078 Ext 228
Ann Cavoukian Ph.D
Gary Dickson QC
Maria C. MacDonald