CPRI privacy and information management practices
Learn how the Child & Parent Resource Institute (CPRI) keeps your personal health information safe and confidential.
About CPRI
The Child and Parent Resource Institute (CPRI) is committed to keeping your personal health information safe and confidential. The privacy of our clients is very important to us.
As a Health Information Custodian (HIC) CPRI is governed by the Personal Health Information and Protection Act, 2004 (PHIPA). This provincial legislation protects your personal health information and governs the way personal health information may be collected, used and disclosed within the health sector.
Please contact us if you have any questions or concerns about your privacy at CPRI.
Clients, families and visitors
The Child and Parent Resource Institute (CPRI) is responsible for personal health information under its control and is committed to a high standard of privacy for the information practices throughout the organization. CPRI’s information practices are based on the 10 privacy principles outlined within Ontario’s privacy legislation – The Personal Health Information and Protection Act, 2004 (PHIPA).
At CPRI, we respect our clients’ rights regarding personal health information, including the right to:
- consent to, refuse, or withdraw your consent for the collection, use, and disclosure of personal health information (PHI)
- access your own personal health information and/or request corrections be made to your personal health information
- be notified of any breach of your personal health information,
- submit a complaint regarding CPRI’s information practices, including the collection, use, and disclosure of your personal health information
CPRI’s privacy department is responsible for:
- advocating for client and staff privacy within the organization
- acting as the privacy experts within the organization and coordinating with the Ministry’s Access & Privacy Office as required
- facilitating the implementation of privacy legislation and principles
- conducting internal audits of personal health information records and the organization’s processes to ensure compliance
- developing privacy related policies and procedures for the organization
Privacy principles
The CPRI follows 10 privacy principles.
Principle 1 – Accountability for personal health information
The Child and Parent Resource Institute (CPRI) is responsible for personal health information relating to clients, staff and affiliates (affiliates include volunteers, placement students, and contracted individuals who are not paid by CPRI but have a working relationship with the organization).
CPRI facilitates compliance with the Personal Health Information and Protection Act, 2004 (PHIPA) by:
- implementing policies and procedures to protect personal health information, as well as all other confidential information under the organization’s control
- responding to complaints and inquiries
- coordinating ongoing education for CPRI staff and affiliates about privacy policies and practices
Principle 2 – Identifying purposes for the collection of personal health information
The Child and Parent Resource Institute (CPRI) will identify the purposes for which personal health information is collected at or before the time of collection. These purposes will be conveyed primarily by means of this website and/or by CPRI staff directly.
The primary purpose to collect, use, and share personal health information is to provide clinical services and facilitate the transition of care. We also use information for administrative purposes, research, teaching, quality improvement, and to comply with legal and regulatory requirements.
Principle 3 – Consent for the collection, use and disclosure of personal health information
We rely on your implied consent for some purposes, e.g. collecting your personal health information directly from you, but will seek your express consent for other purposes, e.g. disclosing your personal health information to another service provider.
Clients have the right to know why CPRI is collecting personal health information and how it is being used.
Clients also have the right to withdraw consent at any time, unless the collection, use or disclosure is required or permitted by law.
CPRI will only disclose personal health information with express consent of the client or their Substitute-Decision Maker (SDM), unless otherwise required or permitted by law. The following is a list of situations in which CPRI may release personal health information without consent, if it is not reasonably possible to obtain consent prior to disclosure:
- if there are reasonable grounds to believe that an individual is at risk of causing serious bodily harm to themselves
- if there are reasonable grounds to believe that an individual is at risk of causing serious bodily harm to others
- for the purposes of determining, assessing, or confirming capacity
- to a College within the meaning of the Regulated Health Professions Act, 1991
- for the purpose of the administration or enforcement of the Act
- if an individual under the age of 18 has been harmed or not cared for
- if an individual discloses sexual harassment by a Regulated Health Professional
- if the CPRI clinical team works with another CPRI clinical team for treatment purposes
- if a court orders records, or if records are looked at for any other legal reasons
Principle 4 – Limiting collection of personal health information
The Child and Parent Resource Institute (CPRI) may only collect the information that is necessary to fulfill the identified purpose(s).
Principle 5 – Limiting use, disclosure and retention of personal health information
Personal health information may only be used for the purpose(s) for which it was collected, except in cases in which consent has been obtained or the use is required or permitted by law.
The amount of personal health information disclosed may not exceed the amount required to fulfill the purpose(s) of disclosure.
Personal health information under the custody and control of the Child & Parent Resource Institute (CPRI) is retained only as long as necessary, and is securely destroyed in accordance with legislation, as well as with both Ministry-wide and organizational policies, procedures, and retention schedules.
Principle 6 – Ensuring accuracy of personal health information
The Child and Parent Resource Institute will make every effort to ensure the information within our custody and control is accurate, complete, and up-to-date.
Clients have the right to request corrections to any record of personal health information under the custody and control of CPRI, if they believe the personal health information recorded in the record is inaccurate.
Correcting your personal information
Principle 7 – Ensuring safeguards for personal health information
The Child and Parent Resource Institute applies security safeguards appropriate to the sensitivity of personal health information to aim to protect it against loss, theft, unauthorized access, disclosure, copying, use, or modification – in all formats (physical, electronic, etc).
Protection may include physical security measures (for example, locked filing cabinets and restricted office access), technological security measures (for example, use of passwords, encryption, and individual staff user accounts), and administrative security controls (for example, staff training, regular audits, and signing confidentiality agreements).
All CPRI staff are required to attend/complete annual privacy training and must sign a confidentiality agreement as a condition of employment.
Principle 8 – Organizational transparency
The Child and Parent Resource Institute (CPRI) makes information about the organization’s privacy and information management practices publicly available on this CPRI webpage, as well as through various notices provided at registration and/or service initiation points. Information available includes:
- a summary of CPRI’s privacy and information procedures and practices
- contact information for the organization’s Privacy Lead, to which complaints or inquiries can be forwarded
- the process for a client to access their personal health information held by CPRI
- a description of the type of personal health information held by CPRI, including a general explanation of its use, and common examples of how the information may be shared
Principle 9 – Individual access to personal health information
Upon submitting an access request to the Child and Parent Resource Institute (CPRI) Clinical Records department a client will be granted access to their personal health information, with limited and specific exceptions. Access will be provided within a reasonable timeframe, as governed by the Personal Health Information Protection Act, 2004 (PHIPA).
Examples of cases in which access may be limited or denied include: personal health information relating to another individual, personal health information which presents a risk of harm to the individual if released, personal health information with access restrictions as defined by other acts, etc.
An individual must provide sufficient information in order for CPRI to identify the existence of personal health information. Should CPRI require additional information to process a request, the staff responsible for responding to the request will contact the requestor to advise what additional information is required.
Principle 10 – Challenging compliance with the organization’s policies and practices
The Child and Parent Resource Institute (CPRI) has procedures in place to receive and respond to complaints or inquiries about privacy and information management policies and practices. An individual may contact the CPRI Privacy Lead with any potential privacy and information management complaints and/or inquiries.
Protecting your privacy
The Child and Parent Resource Institute (CPRI) is committed to protecting your personal health information. You will be notified if your information is lost, stolen, and/or collected, used, or disclosed without authority.
If you think that your information has been used inappropriately, please contact the CPRI Privacy Lead and your concerns will be investigated.
CPRI will investigate all complaints. Following the investigation of a complaint, CPRI will take appropriate measures as determined by the results of the investigation, including, if appropriate, amending policies and practices and/or notifying the Information and Privacy Commissioner of Ontario (IPC).
If at any time you are not satisfied with the outcome of an inquiry to the CPRI Privacy Lead, you may contact the Information and Privacy Commissioner of Ontario (IPC) at:
Lock box/denial of access
You may request that your personal health information not be used for specific purposes and/or that specific Child and Parent Resource Institute (CPRI) staff members not be given access to your information.
In such cases, CPRI will obtain express consent for any staff to be provided access to your personal health information; in all formats.
Collection of personal health information
To provide clients with an exceptional quality of care, CPRI collects both personal information and personal health information. Your name, date of birth, address, and Health Card Number are examples of personal information. Your medical history, records of clinical interventions, and lab results are examples of personal health information.
Records of personal information are governed by provincial privacy legislation called the Freedom of Information and Protection of Privacy Act, 1990 (FIPPA). Records of personal health information, including records of personal health information that include personal information, are also governed by provincial legislation called the Protection of Personal Information Act, 2004 (PHIPA).
Only the amount of information determined to be necessary for the purpose(s) identified will be collected. Information will be collected directly from you, form third parties with consent of the individual, and/or as otherwise permitted or required by law.
Use of personal health information
The information the Child and Parent Resource Institute (CPRI) collects is used:
- to fulfill the purpose(s) for which it was collected or created
- to plan and deliver quality programs or services within the organization
- to review, evaluate, and/or monitor the services we provide, for the purposes of risk management and quality improvement
- to educate and/or train CPRI clinical team members for the purposes of providing services
- to provide appointment letters and/or service-related communications
- to seek an individual’s consent, or the consent of the Substitute-Decision Maker (limited to name and contact information)
- to obtain payment for the provision of health care services
- as otherwise required or permitted by law and to comply with our legal and regulatory requirements
If your personal health information is used for any other purpose(s), express consent will be obtained prior to the use.
Disclosure of personal health information
The Child and Parent Resource Institute (CPRI) may share your personal health information internally, with CPRI staff, for the purposes described in use of personal health Information.
CPRI will obtain your express consent prior to releasing your health information in all cases, unless otherwise required or permitted by law; as described in Principle 3 – Consent for the Collection, Use, and Disclosure of Personal Health Information.
CPRI may share your health information with:
- health care providers at hospitals, community agencies, etc. who become part of your community treatment team for the purposes of continuing your care (i.e. Family Physician, Community Case Manager, etc.)
- payment agencies, such as OHIP
- school boards and/or specific schools involved in providing your education
- additional recipients as requested by you, or as discussed with the CPRI staff involved in providing services to you
Access your personal health information
An individual may view, or request a copy of, their own personal health information under the custody and control of the Child and Parent Resource Institute (CPRI). A Substitute Decision Maker (SDM) may also request access to the personal health information of an individual, in cases when the individual is deemed to lack the capacity to provide consent.
The Clinical Records department at CPRI oversees the storage, retention, access, and correction of personal health information. The Clinical Records department respects and maintains the confidentiality of your personal health information through ensuring adherence to all legislative requirements and organizational privacy and information management practices.
Every effort is made to process your request within a timely manner; should circumstances prevent us from being able to provide access within 30 days, a notice of extension will be sent to the requestor indicating when to expect access to the record.
Requesting a copy of your personal health information
Individuals may obtain a copy of their own personal health information under the custody and control of CPRI by submitting a written request to the Clinical Records department.
Requesting to view your personal health information
Individuals may request to view their own personal health information at CPRI by submitting a written request to the Clinical Records department.
Obtaining a copy of your personal health information or the personal health information of another individual
Consent for the collection, use, and/or disclosure of personal health information is obtained from the client, regardless of age; if the client is capable of understanding the information presented to them and the impact of consenting or declining. If the client is deemed to not be capable, consent will be obtained from the Substitute Decision Maker (SDM) who may be:
- the individual’s legal guardian or their guardian of property
- the individual’s attorney for personal care or for property
- the individual’s representative appointed by the Consent and Capacity Board
- the individual’s spouse or partner
- a child or parent of the individual, or a children’s aid society or other person who is lawfully entitled to give or refuse consent in the place of a parent
- a parent of the individual with only a right of access
- a brother or sister
- any other relative
In the case of a conflict, the capable client’s decision prevails with respect to the collection, use, and/or disclosure of their personal health information.
Obtaining a copy of your personal health information for a third party
If you require a copy of your personal health information to be released to a lawyer, insurance company, community agency, or any other third party, please have the requesting party send their request and completed consent form (or appropriate authorization in lieu of consent – i.e. Court Order) to the Clinical Records department.
Correct your personal health information
By law, the Child & Parent Resource Institute (CPRI) must ensure that records are complete and up-to-date. You have a right to request a correction to your personal health information if you believe it has been recorded inaccurately/incorrectly.
Errors that require a correction request typically include personal health information that has been incorrectly documented (e.g. Details of the client’s history recorded within the record of personal health information). Errors that are administrative in nature, such as the spelling of your name or an update to your current address, can be corrected by contacting the Clinical Records department.
Please note: CPRI will not correct professional opinions or observations, documented within your record, when such opinions or observations were made in good faith by CPRI service providers.
Individuals may request to have their own personal health information corrected by submitting a written request to the Clinical Records department.
The Clinical Records department will review your request with the staff and/or department responsible for the creation of the record. It is the responsibility of the staff and/or department to make a decision about the corrections request.
Every effort is made to process your request within a timely manner; should circumstances prevent us from being able to provide a response within 30 days, a notice of extension will be sent to the requestor indicating when to expect a response to the correction request.
Distribution of corrected personal health information
If a record containing personal health information is corrected, the corrected version will be distributed to any party who received the original record, if it was distributed within the past year. CPRI will ensure that valid consent is obtained prior to distributing the corrected record. If CPRI no longer has valid consent to share the personal health information, the Clinical Records department will request new consent prior to releasing the corrected record(s) to the original recipients.
Attachment of a notice of disagreement
Should a request for correction of personal health information be denied (for example, if the request related to a clinical observation made in good faith by a CPRI service provider), the Clinical Records department will provide the individual with the opportunity to attach a Notice of Disagreement to their original record of personal health information.
Upon the request of the individual, the Clinical Records department will send out a copy of the original record, along with the attached Notice of Disagreement, to any individual who received a copy of the original record within the previous year.
Contact information
CPRI Privacy Lead
Telephone:
Email: CPRILegal@Ontario.ca
Clinical Records Department
Telephone:
Fax:
Email: mcys.CPRIclinicalcarec@ontario.ca
Contact the Information and Privacy Commissioner of Ontario (IPC)
Individuals have the right to submit a complaint to the Information and Privacy Commissioner of Ontario if they believe that the Child & Parent Resource Institute has violated their rights, in regards to privacy and information management.
Email: info@ipc.on.ca
Mail: Information and Privacy Commissioner of Ontario, 2 Bloor Street East
Suite 1400 Toronto, Ontario
M4W 1A8