Privacy at Women’s College Hospital
At Women’s College Hospital (WCH) we respect the confidentiality and sensitivity of our patients’ personal health information. We are committed to protecting personal health information under the custody or control of WCH in accordance with the Ontario Personal Health Information Protection Act, the guiding privacy principles set out by the Canadian Standards Association’s Model Code for the Protection of Personal Information, and privacy best practices.
As a provider of healthcare services to the residents of Toronto and the Greater Toronto region, WCH collects, uses, discloses, retains and safeguards personal health information and is a health information custodian under the PHIPA. Access to patient information is provided to only those that require access to provide or assist in providing care to a patient or as permitted by law.
Privacy
To provide the best possible care to you, it is necessary for us to collect, use and disclose patient information. To guard against any unauthorized collection, use or disclosure of personal health information, your personal health information is appropriately safeguarded through several measures including data encryption, regular monitoring / auditing of our electronic systems, investigating complaints, and mandatory annual privacy training for all staff and physicians.
Privacy Frequently Asked Questions (FAQs)
The Personal Health Information Protection Act, 2004 (PHIPA) is Ontario’s privacy legislation which applies to the healthcare organizations that have personal health information in their custody or control. PHIPA governs the way personal health information may be collected, used, and disclosed within the health-care system. PHIPA also confirms a patient’s right to access one’s own personal health information
PHI is any information that identifies an individual AND information about:
• their physical or mental health; family health history
• provision of health care or identification of their care provider
• payments or eligibility for health care
• donation of body part or body substances, or derived from testing or exam of such
• Health card number, identification of a substitute decision maker
A health information custodian (HIC) includes persons or organizations defined within the PHIPA who have custody or control of PHI due to the work they do. Some examples of HICs include: hospitals, family clinics, independent practitioners, mental health facilities, pharmacies, laboratories, the Ministry of Health and Long Term Care (MOHLTC).
As a public hospital, Women’s College Hospital (WCH) is a health information custodian
We collect and use PHI to provide the best possible care for our patients, and use it for optimizing the operations and activities of the hospital and our health care system.
Unless you tell us not to, your PHI is disclosed to care providers outside of WCH who are involved in your ‘circle of care’, only if the information is needed to provide you with care or assess whether it is appropriate to provide you with care (for example, to refer you).
Often we use electronic systems that are shared (accessible) by health-care organizations across Ontario. When you are referred to or go to visit a new care provider, these systems allow us to share your PHI with your care providers at other institutions and to see the information that they produce about you. These systems securely share electronic information to provide timely and coordinated patient care.
At WCH, the following shared electronic systems are used to support patient care:
System | Operator | Description |
Connecting Ontario (cON) | Ontario Health | ConnectingOntario (cON) is a central repository that stores core elements of patient’s health records (e.g. common diagnostic test results, discharge summaries) that another provider could use for continuity of care. The system is used for patients of any age, experiencing all types of conditions. For more information please visit the ConnectingOntario website. |
Ontario Laboratory Information System (OLIS) | Ontario Health (on behalf of the Ministry of Health and Long-Term Care) | Ontario Laboratories Information System (OLIS) allows hospitals and community laboratories to share laboratory, cytology and pathology test results. For more information please visit the eHealth Ontario website. |
Digital Health Drug Repository (DHDR) | Ontario Health (on behalf of the Ministry of Health and Long Term Care) | Digital Health Drug Repository (DHDR) allows care providers to see medications recorded in MOHLTC repositories. For more information please visit the eHealth Ontario website. |
Hospital Diagnostic Image Repository Services (HDIRS) | Scarborough Health Network | Hospital Diagnostic Image Repository Services (HDIRS) allows hospitals to share diagnostic images and results. This protects patients because it avoids duplication of tests and may decrease the expose of patients to radiation. |
Resource Matching & Referral (RM&R) | University Health Network (on behalf of the Toronto Central LHIN) | Resource Matching & Referral (RM&R) allows care providers to match patients to the right health care and community services, through referrals and the transmission of some information to support the referral. For more information please visit the RM&R website. |
Electronic Child Health Network (eCHN) | eCHN/SickKids | Child Health Network (eCHN) is for children’s medical records. About 40 hospitals in Ontario provide eCHN with laboratory results, doctor’s notes, X-rays and visit information. Community pediatricians may have access to the system. For more information please visit the Electronic Child Health Network website. |
EPIC CareEverywhere | EPIC Care Everywhere is an EPIC feature that allows WCH to share data with other hospitals that use EPIC as a health information system to provide patients with more comprehensive care. When a patient transitions their care from a hospital that uses EPIC to WCH – or vice versa – the module will share their clinical and encounter summaries with their new care provider. | |
Health Report Manager (HRM) | OntarioMD | Community-based physicians and nurse practitioners who use certain EMRs in their practice can receive hospital reports through HRM, rather than in the mail or through fax. For more information please visit the OntarioMD website. |
You can read more on how the hospital collects, uses, and discloses PHI through our Privacy Poster.
The “circle of care” refers to a group of healthcare professionals providing direct care to a patient and who may rely on implied consent of that patient to handle their PHI to provide care.
The patient’s implied consent does not apply in cases where a HIC is aware that an individual has expressly withheld or withdrawn their consent. Similarly, consent may never be implied for an individual who has specified that their PHI may not be collected, used, or disclosed.
The circle of care includes: Physicians, residents, nurses, technicians, allied health staff, and administrative staff, who are either providing or assisting in the provision of care to a patient within and outside the hospital.
Express consent to the collection, use or disclosure of a patient’s PHI by a HIC is consent that has been clearly and explicitly given by the patient. Express consent may be provided either verbally, electronically, or in writing.
Implied consent to the collection, use or disclosure of the patient’s PHI is consent that a HIC concludes has been given by the patient. For example, when a patient discloses their PHI for the purposes of a referral to a specialist, the specialist can reasonably assume the patient’s consent to the collection and use of this information.
A consent directive, also known as a “lockbox” is a term used to describe a patient’s right to not have their personal health information disclosed to another health information custodian (HIC) for the purposes of care. Patients can apply a consent directive in local and specified shared systems.
If you wish to apply a consent directive contact the Health Information Management Department:
Tel: 416-323-6098
Email: requestforrecords@wchospital.ca
With limited exceptions, individuals have the right to access their own PHI held by a HIC.
Patients may request access to your own PHI held by WCH by submitting a completed Health Information Department Accessing Personal Health form to the Health Information Department.
Requests to disclose a copy of your health record to a 3rd party or another health care provider can be made by completing the Consent to Disclose Personal Health Information form and submitting it to the Health Information Management Department.
Patients can also choose to sign up for myHealthRecord, which is WCH’s online patient portal which gives patients access to their health information online.
Yes. If you are a Substitute Decision Maker (SDM), you have the same right of access to the patient’s record as the patient would. You may be asked to provide information to verify your status as the patient’s Substitute Decision Maker.
In accordance with provincial legislation, health records are retained for a minimum of 10 years.
You may contact the Privacy Office at: 416-323-7702 or email: privacy@wchospital.ca for more information. Please do not include personal health information in these emails.
Freedom of Information and Protection of Privacy Act (FIPPA)
The Freedom of Information and Protection of Privacy Act (FIPPA) is two-fold in its mandate. First it provides a right of access to information under the control of government organizations in accordance with the following principles:
- information should be available to the public
- exemptions to the right of access should be limited and specific
- decisions on the disclosure of government information may be reviewed by the Information and Privacy Commissioner.
Secondly, the Act protects personal information held by government organizations and provides individuals with a right of access to their own personal information.
If you would like to make a Freedom of Information request, please print the Request Form along with a $5.00 cheque payable to Women’s College Hospital and send it in to the attention of the Privacy Office. If you have any questions or concerns about making a request or your privacy at WCH, please contact us at 416-323-7702.
The Directory of Records and Personal Information Bank list and provide general descriptions of the types of records and information held by Women’s College Hospital. These documents can typically assist the public with information searches and initiating requests for records.
Freedom of Information FAQs
Yes. Many health-related organizations and agencies are subject to FIPPA, including public hospitals in Ontario, Home and Community Care Support Services (formerly LHINs), the Ministry of Health and Long-Term Care, and other provincial institutions involved in the delivery of care.
Any person, organization, or company can make a request for access to records. There are no restrictions related to a person’s citizenship or place of residence.
No. The Hospital is permitted to ask for the purpose of a request if this will assist in identifying the specific records that you may be looking for, however, you have no obligation to provide reasons. When we ask you “why?” you want a particular record, it is merely a mechanism to try and narrow down the request so we can properly assist you in finding the exact document you are looking for.
FIPPA will apply to “records” that have been in the “custody or control” of a hospital since January 1, 2007, unless the record is subject to an express exclusion under the Act. FIPPA describes “records” as any information whether it is recorded in hard or soft copy, whether it’s in a paper file or on a computer.
A person can make a FOI request to the hospital by completing a Request Form providing a $5.00 application fee payable to Women’s College Hospital, and submitting this to the attention of the Privacy Office at the hospital.
Yes. In addition to the $5.00 application fee, other fees may be applicable depending on the search time in retrieving a record, redacting portions of it, or photocopying pages of the record for the requester.
Yes. The decision to refuse access to a record will be made by the Hospital’s Privacy Office in conjunction with other relevant staff and advisors. It is important to understand that the hospital cannot simply refuse access to a record in our custody or control unless we have clearly laid out the exemptions we are claiming under the Act to deny access. Once we deny access to a record (or partial access to a record), you have the right to appeal our decision to the Office of the Information and Privacy Commissioner/Ontario (IPC). The IPC will then determine if we have made a reasonable argument for denying access under the Act.
Where the Act states a type of record is excluded, requesters do not have a right to access those records. For example, records that relate to:
- employment
- labour relations
- the appointments or privileges of health professionals
- regulated health professionals’ private practice records
- research records
- teaching records
- hospital foundation records
- charitable donation records
- abortion records
It will be up to the hospital’s Privacy Office to determine whether a record falls into one of these categories.
No. Personal health information (PHI) records are subject to the Personal Health Information Protection Act, 2004 (PHIPA). Such records will not be released under FIPPA.
The Information and Privacy Commissioner (IPC) provides an independent review of the decisions and practices of institutions covered by FIPPA. To safeguard access and privacy rights established under FIPPA, the IPC has the following key roles:
- ensuring that institutions comply with FIPPA
- researching access and privacy issues
- investigating privacy complaints related to personal information under FIPPA
- issuing writing public reports following investigations and any recommendations
- resolving appeals when institutions refuse access to information
- issuing orders to resolve issues and requiring institutions to disclose records
- educating the public about Ontario’s access and privacy laws.
For more information about the IPC, please visit their website at http://www.ipc.on.ca/
Yes. The Hospital must submit an annual report to the IPC. The report must set out:
- the number of access requests received
- the number of requests refused, the provisions of the Act relied upon for refusal, and the number of times each provision was relied upon
- the number of appeals commenced for each provision of the Act
- the number of times personal information was used or disclosed for a purpose not included in the stated uses and purposes set forth in section of the Act relating to Personal Information Banks
- the amount of fees collected for FOI requests
- any other information indicating efforts by the institution to put into practice the purposes of the Act.
Making a Freedom of Information Request
If you would like to make a Freedom of Information request, please print the Request Form (.pdf), along with a $5.00 cheque and send it in to the attention of the Freedom of Information Office. If you have any questions or concerns about making a request or your privacy at WCH, please contact us at 416-323-7702.
Freedom of Information and Protection of Privacy Act
The Freedom of Information and Protection of Privacy Act (FIPPA) is twofold in its mandate. First it provides a right of access to information under the control of government organizations in accordance with the following principles:
- information should be available to the public
- exemptions to the right of access should be limited and specific
- decisions on the disclosure of government information may be reviewed by the Information and Privacy Commissioner.
Secondly, the Act protects personal information held by government organizations and provides individuals with a right of access to their own personal information.
Freedom of Information Resources
Location & Contact Information
Privacy Department
Women’s College Hospital
76 Grenville Street,
Toronto, ON M5S 1B2
Email: privacy@wchospital.ca
Phone: 416-323-7702
Access to Health Information
Patients may access their health information by contacting the Health Information Department at 416-323-6098
For more information about your privacy rights, or if you are unable to resolve a problem directly with our hospital, contact:
Information and Privacy Commissioner of Ontario
2 Bloor St. E., Suite 1400, Toronto, ON, M4W 1A8
Phone: 416-326-3333 Toll-free: 1-800-387-0073
Email: info@ipc.on.ca