Personal health information is information that identifies you and relates to your health or health care. This may include: 

• your name, date of birth, address, and contact information 

• your health history, diagnoses, and treatment records 

• your OHIP number or other health card number 

• records of the care and services we provide to you 

• information from other health care providers involved in your care 

We collect, use, modify, and disclose your personal health information only as permitted or required by PHIPA. We collect only as much information as is reasonably necessary and will not collect, use, or disclose your information if other information will serve the purpose. 

We may collect, use, modify, or disclose your personal health information for the following purposes: 

• providing, coordinating, and managing your health care 

• communicating with other health care providers within your circle of care 

• processing accounts and verifying eligibility for provincial health coverage 

• meeting legal and regulatory obligations 

• quality improvement, risk management, and error prevention activities 

• teaching and training health care providers, where required 

• as otherwise permitted or required by law 

We do not use or disclose your personal health information for fundraising or marketing purposes without your express consent. 

Under PHIPA, your consent may be express (given verbally or in writing) or implied (reasonably inferred from the circumstances). 

When you receive care at Possibilities Clinic, we may rely on your implied consent to collect, use, and share your personal health information within your circle of care—the health care providers and staff who need your information in order to provide or support your care. 

Express consent is required when your personal health information is disclosed to a person or organization that is not a health information custodian (such as an insurance company, employer, or lawyer), or for purposes other than providing health care. 

You have the right to withdraw or withhold your consent at any time. You may instruct us not to disclose some or all of your personal health information to specific providers or for specific purposes. If you choose to restrict the sharing of your information, we will discuss with you how this may affect the care you receive. 

Where a patient is unable to provide consent due to incapacity, a substitute decision-maker may consent on their behalf in accordance with PHIPA and the Health Care Consent Act, 1996. A substitute decision-maker is determined according to a hierarchy set out in the legislation and may include a guardian, attorney for personal care, or a family member. The substitute decision-maker must act in the best interest of the individual. 

Under PHIPA, the clinic is responsible for the actions of its agents—anyone who acts on our behalf in relation to personal health information. Our agents include employees, contractors, and service providers who perform administrative, technical, or clinical support functions. 

We require all agents to comply with our privacy and security practices. Each agent is permitted to access only the personal health information that is necessary for the performance of their duties. All agents must sign confidentiality agreements and receive privacy training. Agents are required to notify us immediately of any breach or suspected breach of personal health information. 

We take reasonable steps to protect your personal health information against theft, loss, and unauthorized access, use, disclosure, copying, modification, or disposal. We maintain administrative, technical, and physical safeguards, including: 

• administrative controls such as privacy policies, confidentiality agreements, staff training, and procedures for responding to privacy breaches 

• technical controls such as encryption, password protection, role-based access controls, and electronic audit logs that record who accesses your health records and when 

• physical controls such as locked facilities and restricted access to areas where records are stored 

We require all staff and agents acting on our behalf to comply with our privacy and security practices and to report any suspected breach immediately. 

We retain your personal health information for as long as necessary to fulfil the purposes for which it was collected and to comply with applicable legal and regulatory requirements. At a minimum, medical records of adult patients are retained for at least 10 years from the date of the last entry in the record, as required by the regulations under the Medicine Act, 1991. For patients who are minors, records are retained for at least 10 years after the patient reaches or would have reached the age of 18. 

We may use email and text messages (SMS) for non-clinical purposes such as appointment reminders and general administrative matters. We do not include detailed health information in email, text messages, or voicemail. Where we need to discuss clinical details, we use secure methods of communication. 

You have the following rights with respect to your personal health information: 

Access. You may request access to your records of personal health information. We will respond within 30 days of receiving your request. In some circumstances, we may extend the response period by an additional 30 days, in which case we will provide you with written notice and the reason for the extension. A reasonable cost-recovery fee may apply for copies. We use the Ontario Medical Association’s guide as a reference for these costs. 

Correction. If you believe your record contains an error or is incomplete, you may request a correction. If we are unable to make the correction, we will provide you with a written explanation and attach your statement of disagreement to the record. 

Consent. You may give, withhold, or withdraw your consent to the collection, use, or disclosure of your personal health information, subject to certain legal exceptions. 

Notification. If your personal health information is used or disclosed in a manner that falls outside the practices described in this statement, or if your information is stolen, lost, or accessed by an unauthorized person, we will notify you at the first reasonable opportunity. Where a breach meets the threshold for reporting, we will also notify the Information and Privacy Commissioner of Ontario. 

Complaint. You have the right to make a complaint about our information practices. You may contact our Privacy Contact Person (listed below). You also have the right to make a complaint to: 

Information and Privacy Commissioner of Ontario 

2 Bloor Street East, Suite 1400, Toronto, ON  M4W 1A8 

Telephone: 1-800-387-0073 

Website: www.ipc.on.ca 

If your complaint involves a regulated health professional, you may also file a complaint with the applicable regulatory College, such as the College of Physicians and Surgeons of Ontario (CPSO) or the College of Psychologists of Ontario (CPO). 

Our Privacy Contact Person is responsible for responding to inquiries about our information practices, assisting with access and correction requests, and receiving complaints. You may reach our Privacy Contact Person as follows: 

We may update this statement from time to time to reflect changes in our information practices or legal requirements. The current version will be available at our clinic. We encourage you to review this statement periodically.