MOMIJI HEALTH CARE SOCIETY
Developer:
I.T. Manager

Category:
Information
TechnologyDomain:
GeneralAdministration

Effective Date:
February 2021

Subject Title:
Personal Health Information –Policy Overview and Definitions

Approval:Management
Committee

Last Reviewed:
February 2021

Next Review:

Pages:

Supersedes:
N/A

Policy #:3

PURPOSE
Momiji Health Care Society (MHCS) collects, uses and discloses personal health information(PHI) of clients for the purpose of providing coordinated services. This policy outlines
requirements for how and when PHI can be collected, used and disclosed. This policy also sets
out the principles MHCS follows in relation to PHI it receives.
DEFINITIONS:Agent: Includes any person who is authorized by MHCS to collect, use or disclose PHI on
MHCS behalf for the purposes of performing services or activities for or on behalf of MHCS.
Agents at MHCS include, but are not limited to, all employees including board of directors andcontract employees, physicians, volunteers, students, researchers, clients , consultants, program
instructors, vendors, contractors, and other workers at MHCS.
Client: A person who receives services from or a tenant at MHCS.
Collect: As taken from the Personal Health Information Protection Act, 2004, Section 2.
Collect, in relation to PHI , means to gather, acquire, receive or obtain the information by anymeans from any source, and “collection” has a corresponding meaning;
Consent: The permission from a client or his/her Substitute Decision Maker (SDM) to collect,
use or disclose PHI on the Client’s behalf. To be valid under PHIPA, a consent must:
1. Be that of the Client or the Client’s Substitute Decision Maker (SDM);
2. Relate to the information in question;
3. Not be obtained through deception or coercion; and4. Be knowledgeable
Disclose: As taken from the Personal Health Information Protection Act, 2004, Section 2.
Disclose, in relation to PHI in the custody or under the control of a HIC or a person, means tomake the information available or to release it to another HIC or to another person, but does notinclude to use the information, and “disclosure” has a corresponding meaning;Express Consent: As adapted from the Information Privacy Commissioner of Ontario.
Express consent is given either verbally or in writing, to a custodian to collect, use or disclose aclients’ PHI . It confirms an agreement in clear terms.
Health Information Custodian (HIC): A person or organization described in one of thefollowing paragraphs who has custody or control of PHI as a result of or in connection withperforming the person’s or organization’s powers or duties or the work described in theparagraph, if any:
1. A health care practitioner or a person who operates a group practice of health carepractitioners.
2. A service provider within the meaning of the Home Care and Community Services Act,
1994 who provides a community service to which that Act applies [...]
3. Any other person prescribed as a HIC if the person has custody or control of PHI as aresult of or in connection with performing prescribed powers, duties or work or any
prescribed class of such persons.
Implied Consent: As adapted from the Information Privacy Commissioner of Ontario.
Implied consent is understood to be consent that one concludes has been given based on what anindividual does or does not do in the circumstances. It occurs when an action occurs by aknowledgeable client or SDM indicating that consent has been given.
Personal Health Information (PHI): As taken from the Personal Health Information
Protection Act, 2004, Section 4(1).
PHI means identifying information about an individual in oral or recorded form, if theinformation,
1. Relates to the physical or mental health of the individual, including information thatconsists of the health history of the individual’s family,
2. Relates to the providing of health care to the individual, including the identification of aperson as a provider of health care to the individual,
3. Is a plan of service within the meaning of the Home Care and Community Services Act,
1994 for the individual,
4. Relates to payments or eligibility for health care, or eligibility for coverage for healthcare, in respect of the individual,
5. Relates to the donation by the individual of any body part or bodily substance of theindividual or is derived from the testing or examination of any such body part or bodilysubstance,
6. Is the individual’s health number, or
7. Identifies an individual’s substitute decision maker2Personal Information (PI): Any information that identifies an individual and relates to his/her
physical or mental health, including information about family health history, and any informationthat identified the individual’s Substitute Decision Maker.
Use: As taken from the Personal Health Information Protection Act, 2004, Section 2.
Use, in relation to PHI in the custody or under the control of a HIC or a person, means to view,
handle or otherwise deal with the information, subject to subsection 6 (1), but does not include todisclose the information, and “use” as a noun, has a corresponding meaning.
POLICYMHCS as a health information custodian (HIC) under the Ontario Personal Health Information
Protection Act, 2004 (PHIPA) collects, uses, and discloses PHI and is required to protect theprivacy, confidentiality and security of all personal health information of clients.
PROCEDURES
Privacy Officer● Respond to inquiries from staff and the public regarding MHCS privacy protocols, andpractices, including PHIPA and PIPEDA (Personal Information Protection and ElectronicDocuments Act) requirements.
● Assist in the development and delivery of privacy education and training for MHCS
agents regarding their responsibilities under privacy laws and policies, protocols andprocedures.
● Receive and respond to privacy complaints on behalf of MHCS.
● Inspect privacy incidents and/or suspected and actual privacy breaches.
● When required, seek help with a Legal Office regarding legal interpretations, obligations
and investigations of privacy breaches.
● Review and monitor compliance of MHCS’s policy with PHIPA/PIPEDA on a regularbasis.
All employees● Comply with this policy and related procedures and practices for the collection, use anddisclosure of PHI/PI.
● Review and sign MHCS Statement of Confidentiality form.
● Ensure that a Client’s privacy is maintained in accordance with this policy and ensure theconfidentiality, integrity and availability of PHI/PI.
● Report all actual or suspected privacy breaches to the MHCS Privacy Office (PO).
● Employees are expected to consult with the PO about privacy obligations, practices, andexpectations around the security and management of client/patient PHI/individual’s PI,
when necessary.
3