PRIVACY POLICY AND PROCEDURE

POLICY CATEGORY
Administration
POLICY TITLE
Privacy Policy and Procedure
POLICY NUMBER
A-02
APPROVED BY
Melanie Manuala, Director
APPROVAL DATE
January 1, 2019.
EFFECTIVE DATE
February 1, 2019
REVISION DATE
February 1, 2020
VERSION 
1
Accreditation Canada Primer Standard
Standard 5.1: Information management policies that comply with relevant legislation and guidelines are developed and implemented.

1.0

PURPOSE

1.01
The purpose of this policy is to affirm Creative Therapy Associates’ commitment to managing information responsibly to support quality service delivery. All team members understand the importance of protecting personal information and exercising due diligence when collecting, using and disclosing such information. In addition, transparency in information management practices is considered an integral aspect of this policy.
1.02

Creative Therapy Associates provides Applied Behaviour Analysis (ABA) therapy, behavioural therapy, Speech-Language Pathology and Occupational Therapy services to clients of all ages throughout Northwestern Ontario. These services are often provided on behalf of community agencies including the Children’s Centre of Thunder Bay, George Jeffrey Children’s Centre, Thunder Bay Catholic District School Board, Dilico Anishinabek Family Care, North West Local Health Integration Network, Veteran’s Affairs, Workplace Safety Insurance Board and Options Northwest. Our Speech-Language Pathologists are registered members of the College of Audiologists and Speech-Language Pathologists of Ontario and our Occupational Therapists are registered members of the College of Occupational Therapists of Ontario. As such, they are subject to the legal requirements of these colleges according to the provision of the Regulated Health Professions Act.

1.03
Our therapists are supported by administrative team members, which also have access to the personal information we hold. We restrict as much as is reasonably possible their access to such personal information.
1.04
We are also involved with a number of individuals and agencies that may in the course of their duties have limited access to the personal information we hold. These may include lawyers, accountants, bookkeepers, computer consultants and students. We restrict as much as is reasonably possible their access to such personal information and have their assurance that they will follow appropriate privacy practices.
1.05

Our primary purpose for collecting, using and disclosing personal information is to serve our clients and provide the best care as it relates to Applied Behaviour Analysis therapy,  Speech-Language Pathology and Occupational Therapy Services.

1.06
We also collect, use and disclose personal information for purposes related to or secondary to our primary purpose. These would include:
  • Invoicing for goods and services, including processing credit card payments and collecting unpaid accounts;
  • Reviewing client files to ensure that we are providing high quality services including assessing the performance of our team;
  • Fulfilling regulatory requirements of the College of Audiologists and Speech Language Pathologists of Ontario, and the College of Occupational Therapists of Ontario who may inspect our records and interview our staff as part of their regulatory activities in the public interest.
  • Fulfilling contractual requirements of community agencies that may inspect our records to ensure compliance with regulatory standards.
  • In addition, as professionals, we will report serious misconduct, incompetence or incapacity of other practitioners, whether they belong to other organizations or our own.
  • Also, Creative Therapy Associates will report information suggesting serious illegal behavior to the authorities. External regulators have their own strict privacy obligations. Sometimes these reports include personal information about our clients, or other individuals, to support the concern (e.g., improper services).
  • Also, like all organizations, various government agencies (e.g., Canada Customs and Revenue Agency, Information and Privacy Commissioner, Human Rights Commission, etc.,) have the authority to review our files and interview our staff as part of their mandates. In these circumstances, we may consult with professionals (e.g., lawyers, accountants) who will investigate the matters and report back to us;
  • The cost of some goods/services provided by CTA to clients is paid for by third parties (e.g., WSIB, private insurance, Assistive Devices Program). These third-party payers often have your consent or legislative authority to direct us to collect and disclose to them certain information in order to demonstrate client entitlement to this funding;
  • Educating our team members and students as we value the education and development of current and future professionals;
  • In the event that CTA were to be sold, the potential purchasers, practice brokers or advisors would want to conduct a review or audit of the practice in order to ensure its viability. Access would be provided under these circumstances to reputable, committed purchasers who have agreed to abide by guidelines regarding the protection of personal information;
  • Assisting this office to comply with all regulatory requirements; and
  • General compliance with the law.

1.07
With only a few exceptions, clients have the right to see what personal information we hold about them and they can request access. The identification of records and clarification regarding any information that is not clear can be provided but identify should be confirmed, if the client is not known, prior to granting access. CTA reserves the right to charge a nominal fee for such requests.
1.08
If the client believes there is a mistake in the information, they have the right to ask for it to be corrected. This applies to factual information and not to any professional opinions team members may have formed. CTA management may request that the client provide documentation that the records are wrong. Where it is agreed upon that CTA made a mistake, the privacy officer will make the correction and notify anyone to whom the information was sent. If there is not agreement that CTA has made a mistake, a brief statement from the client on the point will be included in the file and forwarded to anyone anyone else who received the earlier information.
1.09

The Privacy Officer, Karli Atkinson, can be reached at (807) 624-2590 to address any questions or concerns. If a client wishes to make a formal complaint about CTA privacy practices, it can be made in writing and directed to the Privacy Officer identified above. The receipt of the complaint will be acknowledged, the issue will be investigated promptly and the client will be provided with a formal decision and reasons in writing.

1.10
The client must also be advised of their right to file a complaint with the Information Privacy Commissioner. If the client indicates interest in doing so or has additional questions, the client can be directed to:
Information and Privacy Commission Ontario, Canada
2 Bloor Street East, Suite 1400
Toronto, Ontario M4W 1A8
CANADA
Telephone: (416) 326-3333 or 1 (800) 387-0073
Fax: (416) 325-9195
TYY: (416) 325-7539
www.ipc.on.ca
1.11
This statement of policy and procedure will establish guidelines for all team members to follow when collecting, using and disclosing personal information in the context of service delivery and related operations.

2.0

POLICY STATEMENT

2.01
The owners of Creative Therapy Associates are committed to protecting the personal information of clients and exercising due diligence when collecting, using and disclosing such information in the context of service delivery and related operation.
2.02
All team members have an important role in promoting and supporting the implementation of this policy and related procedures.
2.03
All team members are responsible for ensuring that personal information is protected and is only used for the purposes for which it was collected and is not disclosed without proper authorization. All team members will be required to sign a confidentiality agreement to that effect on an annual basis.
2.04
All regulated health professionals managing information in the context of service delivery are required to be compliant with the guidelines provided by their regulatory college.
2.05
Any team members that handle personal information contrary to this policy may be subject to disciplinary measures up to and including dismissal or termination of contracted services.
2.06
The Privacy Officer, Melanie Maunula, is accountable for the implementation of this policy and the related procedures. As such, any issues or questions regarding this policy or related procedures should be directed accordingly.

3.0

SCOPE

3.01
This statement of policy and procedure applies to all team members, including owners, directors, employees, subcontractors and students.

4.0

RESPONSIBILITY

4.01

The Privacy Officer, Karli Atkinson, is responsible for:

 

  • ensuring policies and related procedures regarding the collection, use and disclosure of all personal information related to service delivery are current and adhered to by all team members;
  • responding to client requests for access or corrections to their personal information; 
  • monitoring and responding to third party requests for personal information; 
  • ensuring complaints or breaches are appropriately investigated, documented and reported; 
  • ensuring that possession of and access to personal information is relinquished prior to team members leaving their position or upon being terminated; 
  • ensuring proper destruction and disposal of all personal information in compliance with relevant guidelines. See A11-Retention and Destruction of Records Policy and Procedure.

 

4.02
All team members are responsible for:
  • keeping their files current and ensuring their documentation is compliant with the requirements of their regulatory college;
  • being familiar with and adhering to the policies and related procedures regarding the collection, use and disclosure of all personal information related to service delivery;
  • explaining this policy and related procedures to clients and referring them to the Privacy Officer, Melanie Maunula, if appropriate;
  • obtaining the proper consents and authorizations prior to disclosure of personal information related to service delivery;
  • keeping passwords private and restricting access to personal information;
  • immediately reporting any privacy breaches to Melanie Maunula, the Privacy Officer to investigate and report if deemed appropriate; 
  • relinquishing possession or access to any personal information when leaving their position or upon termination;

5.0

TERMS AND DEFINITIONS

5.01
Personal information is any information about an identifiable individual and may include race, ethnic origin, colour, age, marital status, family status, religion, education, medical history, criminal record, employment history, financial status, address, telephone number, and any numerical identification, such as Social Insurance Number. Personal information also includes information that may relate to the work performance of the individual, any allegations, investigations or findings of wrongdoing, misconduct or discipline. Personal information does not include job title, business contact information or job description.
5.02
Personal health information is information about an identifiable individual that relates to the physical or mental health of the individual, the provision of health care to the individual, the individual’s entitlement to payment for health care, the individual’s health card number, the identity of providers of health care to the individual or the identity of substitute decision-makers on behalf of the individual. This information can be in oral or recorded format.
5.03
Third party is an individual or organization other than the subject of the records or a representative of Creative Therapy Associates. Note that in certain circumstances; Creative Therapy Associates may be entitled to provide personal information to a third party acting as an agent of Creative Therapy Associates.

6.0

REFERENCES AND RELATED STATEMENTS OF POLICY AND PROCEDURE

  • Attachment A Privacy Statement
  • Attachment B Code of Conduct, Conflict of Interest and Confidentiality Agreement
  • Personal Health Information Protection Act (PHIPA) (Ontario)
  • Personal Information Protection and Electronic Documents Act (PIPEDA) (Canada)
  • A-03 Privacy Breach Investigation and Reporting Policy and Procedure
  • A-04 Data Classification Policy and Procedure
  • A-05 Third Party Audit Policy and Procedure
  • A-06 Offboarding/Role Change Policy and Procedure
  • A-07 DLP Controls Policy and Procedure
  • A-08 End Point Security Policy and Procedure
  • A-09 Computer, E-mail and Internet Use Policy and Procedure A-10 Mobile Device Policy and Procedure
  • Attachment-Email Consent
  • A-11 Retention and Destruction of Records Policy and Procedure
  • CS-01 Consent for Services Policy and Procedure

7.0

PROCEDURE

7.01
Personal information regarding clients may only be collected, used, disclosed and retained for the purposes identified by Creative Therapy Associates as necessary and only after such purposes have been disclosed to the client and their knowledgeable consent obtained.
7.02
All team members much ensure that no personal client information is disclosed without the client’s consent and that all information handling processes are compliant with recommended privacy practices.
7.03
All team members must employ the following safeguards and take reasonable steps to ensure:
  • Paper information is either under supervision or secured in a locked or restricted area;
  • Electronic hardware is either under supervision or secured in a locked or restricted area at all times. In addition, passwords are used on computers and devices;
  • Paper information is transmitted through sealed, addressed envelopes;
  • Electronic information is transmitted either through a direct line or is anonymized or encrypted;
  • Team members are trained to collect, use and disclose personal information only as necessary to fulfill their duties and in accordance with our privacy policy; and
  • External consultants and agencies with access to personal information must enter into privacy agreements with us.

8.0

DOCUMENT CONTROL

VERSION DATE DESCRIPTION OF CHANGES REQUESTED BY
CATEGORY
Privacy Statement
REVISION DATE
February 1, 2020

Our Commitment to You

We are committed to protecting your privacy and ensuring the confidentiality of your personal health information. The types of personal health information we collect may include your name, date of birth, health history, and records of the care provided to you. We collect, use and disclose personal health information for the following purposes:

 

  • to provide speech-language pathology or occupational therapy services to our clients
  • to obtain payment for services provided
  • to teach students and to provide continuing education to our team
  • to conduct quality improvement and risk management exercises
  • to comply with our regulatory obligations to the College of Speech-Language Pathologists and Audiologists of Ontario and the College of Occupational Therapists of Ontario and College of Psychologists and Behaviour Analysts of Ontario
  • for other purposes that are permitted by law.

 

We will collect, use and disclose only as much personal health information as is needed to achieve these purposes. You can withhold or withdraw your consent to the collection, use or disclosure of your personal health information by contacting our privacy officer.
Access to Health Records

You have the right to seek access to your health records that we keep and to ask us to correct a record if you believe it is inaccurate or incomplete. Please contact our privacy officer for more information.

Questions or Concerns?


If you have questions, would like to access our complete privacy policy or want to make a complaint about our privacy practices, please contact:


Karli Atkinson

Privacy Officer

1-883 Tungsten Street
Thunder Bay, ON P7B 6H2
(807) 624-2590
katkinson@creativetherapyassociates.ca

You also have the right to complain to the Information and Privacy Commissioner of Ontario at the address below if you have concerns about our privacy practices or how your personal health information has been handled.
Information and Privacy Commissioner of Ontario
2 Bloor Street East, Suite 1400, Toronto Ontario M4W 1A8
Telephone: Toronto Area (416/local 905) (416) 326-3333
Long Distance: 1 (800) 387-0073 (Within Ontario)
TDD/TTY: (416) 325-7539
FAX: (416) 325-9195
www.ipc.on.ca
CATEGORY
Website 
REVISION DATE
May 18, 2017
Creative Therapy Associates ("us", "we", or "our") operates the http://www.creativetherapyassociates.ca website (the "Service").

Personal Information Collect, Use, Disclosure and Consent

Personal Information may include your name, email address, age, home address, phone number, marital status, income, credit history, medical information, education, employment information and social registration numbers.

We are committed to providing our clients, customers, members ("you", "your" or "them") with exceptional service. Providing exceptional service may involve the collection, use and, at times, the disclosure of your Personal Information. Protecting your Personal Information is one of our highest priorities. While we have always respected your privacy and safeguarded all Personal Information, we have strengthened our commitment to this goal. This is to continue to provide exceptional service to you and to comply with all laws regarding the collection, use and disclosure of Personal Information. We will inform you of why and how we collect, use and disclose Personal Information; obtain your consent, as required; and handle Personal Information according to applicable law. Our privacy commitment includes ensuring the accuracy, confidentiality, and security of your Personal Information and allowing you to request access to, and correction of, your personal information.

This page informs you of our policies regarding the collection, use, and disclosure of Personal Information when you use our Service.

We will not use or share your information with anyone except as described in this Privacy Policy.

We will only collect Personal Information that is necessary to fulfill the following purposes:

  • To verify identity;
  • To identify your preferences;
  • To open and manage an account;
  • To ensure you receive a high standard of service;
  • To meet regulatory requirements;
  • Other legal reasons as apply to the goods and services requested.
We will obtain your consent to collect, use or disclose Personal Information. In some cases, we can do so without your consent (see below). You can provide consent orally, in writing, electronically or through an authorized representative.

You provide implied consent where our purpose for collecting using or disclosing your Personal Information would be considered obvious or reasonable in the circumstances. Consent may also be implied where you have notice and a reasonable opportunity to opt-out of having your Personal Information used for mail-outs, marketing or fundraising and you do not opt-out.

We may collect, use or disclose Personal Information without the consent:

  • When permitted or required by law;
  • In an emergency that threatens an individual's life, health, or personal security;
  • When the Personal Information is available from a public source;
  • When we require legal advice from a lawyer;
  • For the purposes of collecting a debt or protection from fraud;
  • Other legally established reasons.
We will not sell your Personal Information to other parties unless consent has been provided or implied. We retain your Personal Information for the time necessary to fulfill the identified purposes or a legal or business purpose. We will make reasonable efforts to ensure that your Personal Information is accurate and complete. You may request correction to your Personal Information to ensure its accuracy and completeness. A request must be in writing and provide sufficient detail to identify your Personal Information and the correction being sought.

We are committed to ensuring the security of your Personal Information and may use passwords, encryption, firewalls, restricted employee access or other methods, in our discretion. We will use appropriate security measures when destroying your Personal Information such as shredding documents or deleting electronically stored information, in our discretion.

Log Data

We may also collect information that your browser sends whenever you visit our Service ("Log Data"). This Log Data may include information such as your computer's Internet Protocol ("IP") address, browser type, browser version, the pages of our Service that you visit, the time and date of your visit, the time spent on those pages and other statistics.

In addition, we may use third party services such as Google Analytics that collect, monitor and analyze this type of information in order to increase our Service's functionality. These third party service providers have their own privacy policies addressing how they use such information.

Cookies

Cookies are files with small amount of data, which may include an anonymous unique identifier. Cookies are sent to your browser from a web site and stored on your computer's hard drive.

We use "cookies" to collect information. You can instruct your browser to refuse all cookies or to indicate when a cookie is being sent. However, if you do not accept cookies, you may not be able to use some portions of our Service. If you do not instruct your browser to refuse all cookies or to indicate when a cookie is being sent, your consent to our use of your Personal Information may be implied.

Service Providers

We may employ third party companies and individuals to facilitate our Service, to provide the Service on our behalf, to perform Service-related services or to assist us in analyzing how our Service is used.

These third parties have access to your Personal Information only to perform these tasks on our behalf and are obligated not to disclose or use it for any other purpose.

Compliance With Laws

As set out above, and for clarity, we will disclose your Personal Information where required to do so by law or subpoena or if we believe that such action is necessary to comply with the law and the reasonable requests of law enforcement or to protect the security or integrity of our Service.

Security

The security of your Personal Information is important to us, but remember that no method of transmission over the Internet, or method of electronic storage is 100% secure. While we strive to use commercially acceptable means to protect your Personal Information, we cannot guarantee its absolute security.

International Transfer

Your information, including Personal Information, may be transferred to — and maintained on — computers located outside of your province, country or other governmental jurisdiction where the data protection laws may differ than those from your jurisdiction.

If you are located outside Canada and choose to provide information to us, please note that we transfer the information, including Personal Information, to Canada and process it there.

Your consent to this Privacy Policy followed by your submission of such information represents your agreement to that transfer.

Links To Other Sites

Our Service may contain links to other sites that are not operated by us. If you click on a third party link, you will be directed to that third party's site. We strongly advise you to review the Privacy Policy of every site you visit.

We have no control over, and assume no responsibility for the content, privacy policies or practices of any third party sites or services.

Children's Privacy

Our Service does not address anyone under the age of 18 ("Minor").

We do not knowingly collect personally identifiable information from Minors. If you are a parent or guardian and you are aware that your Minor has provided us with Personal Information, please contact us. If we become aware that we have collected Personal Information from Minors without verification of parental consent, we take steps to remove that information from our servers.

Changes To This Privacy Policy

We may update our Privacy Policy from time to time. We will notify you of any changes by posting the new Privacy Policy on this page.

You are advised to review this Privacy Policy periodically for any changes. Changes to this Privacy Policy are effective when they are posted on this page.

If we make any material changes to this Privacy Policy, we will notify you either through the email address you have provided us, or by placing a prominent notice on our website.

Contact Us

If you have any questions about this Privacy Policy, please contact us.

Privacy Policy of http://www.creativetherapyassociates.ca