Rochon Racicot Dentistry (the “Corporation”) is a dental and orthodontics practice that provides dental services to patients of all ages in the city of Ottawa. In the course of providing our services, the Corporation will collect personal information, including personal health information, and we have prepared this policy to inform you about our ongoing commitment to protecting privacy in respect of the personal information which we collect and use in the course of providing services.
While the Corporation is committed to protecting the confidentiality and privacy of personal information which it holds about its employees, this Policy does not apply to that information, which is not subject to the Corporation’s legal obligations set out below.
The Corporation is subject to the Ontario Personal Health Information Protection Act (PHIPA) in respect of our collection, use and disclosure of personal health information about patients. This Policy sets out the measures which the Corporation has put in place to comply with these obligations.
What is Personal Information?
“Personal Information” means any information, recorded in any form, about an identified individual or an individual whose identity may be inferred or determined from such information, including personal health information.
“Personal Health Information” means identifying information about an individual that,
- relates to the physical or mental health of the individual, including the health history of the individual’s family,
- relates to the providing of health care to the individual, including the identification of a person as a provider of health care to the individual,
- relates to payments or eligibility for health care in respect of the individual,
- relates to the donation by the individual of any body part or bodily substance of the individual or is derived from the testing or examination of any such body part or bodily substance,
- is the individual’s health number, or
- identifies an individual’s substitute decision-maker.
The Corporation is a “health information custodian” within the meaning of PHIPA in respect of the personal health information which we collect, use and disclose in the course of providing services to our patients.
Accountability and Openness
The Corporation’s employees and agents are responsible for complying with this Policy and protecting the privacy of the Corporation’s patients. The Corporation has designated its Secretary-Treasurer as its Privacy Officer, responsible for supervising the Corporation’s compliance with this policy. Any questions or inquiries related to this Policy can be directed to the Corporation’s Privacy Officer at the following coordinates:
381 Kent Street, Suite 508
The Corporation is subject to the oversight of the Information and Privacy Commissioner/Ontario in respect of its compliance with PHIPA. Complaints about the Corporation’s collection, use or disclosure of personal health information, or the Corporation’s decisions with respect to requests for access to personal health information, should be directed to the Office of the Information and Privacy Commissioner/Ontario, at the following coordinates:
Information and Privacy Commissioner/Ontario
1400-2 Bloor Street East
The Corporation is committed to openness in respect of its privacy practices. Patients of the Corporation have a right to understand how the Corporation will handle their personal information. Patients will be directed to this Policy at the time of intake, and any questions will be addressed by the Privacy Officer. They also have a right under PHIPA to request access to their personal health information in the custody of the Corporation, subject to the limits set out in that Act.
Unless permitted by law, no personal information is collected without first obtaining the consent of the patient. Consent may take various forms – it may be verbal or written express or implied.
The Corporation may rely on implied consent to the collection, use and disclosure of personal information about patients of the Corporation which is necessary for the purpose of providing services to the patient.
Where the Corporation proposes to use or disclose personal information for a purpose other than those reasonably consistent with the purposes for which it was collected, the Corporation will seek express consent from its patient for the new use or disclosure, except where use or disclosure for the new purpose is permitted or required by law.
In most cases, patients are free to refuse to consent, or to withdraw consent at any time upon reasonable notice. This may in many cases result in the Corporation being unable to provide services to the patient. A patient who requests to withdraw consent will be advised of the consequences of doing so.
Purposes for Which the Corporation May Collect Personal Information
The Corporation may use the personal information which we collect in order to:
- Provide our patients with dental and orthodontic services;
- Communicate with third party insurers on patients behalf;
- Maintain appropriate files and records relating to the care and services provided to our patients;
- Manage our relationships with patients;
- Provide training and education programs for all staff, including but not limited to dental assistants, dental hygienists, receptionists, administrators
- Provide you with information about our services (including by means of direct marketing);
- Meet legal and regulatory requirements; and
- Such other purposes consistent with these purposes.
The specific personal information the Corporation collects from you will depend upon which services we provide to you. We may collect personal information and personal health information including but not limited to contact information, demographic information, information with respect to your medical history, your treating health care practitioners, treatment plans which have been established for you, medications which you have been prescribed, and other information related to your health care and personal support needs.
How the Corporation Collects, Uses and Discloses Personal Information
The Corporation only collects, uses and discloses Personal Information for purposes detailed above and purposes reasonably consistent with those purposes, except as required or permitted by law. The Corporation only collects, uses and discloses as much information as is required for these purposes. The Corporation collects personal information directly from the individuals to whom it relates in most cases, except where permitted or required by law, and except where the Corporation’s employees are part of the circle of care for a patient and may therefore rely on implied consent to collect or disclose personal health information about that patient within the circle of care as needed to provide care to the patient.
Personal information relating to patients of the Corporation will be accessed and used only by those employees and agents of the Corporation who require it in the course of performing their duties, including providing services to the patient in question. The Corporation’s employees and agents are not permitted to access or use personal information about the Corporation’s patients for their own purposes or for purposes unrelated to their duties on behalf of the Corporation.
Where the Corporation discloses personal information to a third party service provider who requires personal information in order to provide services to the Corporation, we will take all reasonable precautions to ensure that the service provider will treat the personal information with the same level of confidentiality as the Corporation.
The Corporation will never sell, trade, barter, exchange or disclose for consideration any Personal Information it has obtained.
The Accuracy and Retention of Personal Information
The Corporation endeavours to ensure that any personal information provided and in our possession is as accurate, current and complete as necessary for the purposes for which we use that information. If we become aware that personal information is inaccurate, incomplete or out of date, the Corporation will revise the personal information and, if necessary, use our best efforts to inform third parties which were provided with inaccurate information so that those third parties may also correct their records.
We keep your personal information as long as it is required for the reasons it was collected. The length of time we retain information varies, depending on the purpose for which it was collected and the nature of the information. This period may extend beyond the end of your relationship with us.
When your Personal Information is no longer required for the Corporation’s purposes, we have procedures to ensure that it is securely destroyed and/or anonymized.
The Corporation stores personal information primarily in the City of Ottawa, but we may use service providers to process personal information which are located elsewhere in Canada or in the United States.
Security, Protection of Personal Information and Breach Response
The Corporation maintains all reasonable physical, procedural and technical security with respect to its offices and information storage facilities so as to prevent any loss, misuse, unauthorized access, disclosure, or modification of Personal Information. This also applies to our disposal or destruction of Personal Information.
Unauthorized access to, use of or disclosure of personal information by any employee or agent of the Corporation will be grounds for discipline up to and including termination of employment.
The Corporation requires that all instances of unauthorized collection, use or disclosure of personal information immediately be disclosed to its Privacy Officer. Where the Corporation determines that a privacy breach has occurred, we will implement the breach response protocol approved by the Information and Privacy Commissioner of Ontario, and will provide notification to the affected individuals, the Commissioner, and/or the relevant professional regulatory bodies as may be required by law.
Access to your Personal Information
Individuals have a right to request access to their personal health information in the possession of the Corporation, pursuant to PHIPA. Requests for access to and/or correction of personal health information in the custody of the Corporation should be directed to Dr. Racicot or Dr. Rochon at firstname.lastname@example.org, and will be processed in accordance with the requirements of PHIPA.
Information about visitors to our web site is not personal health information. However, for transparency purposes, we have set out below what information we collect about visitors to our website and how it is used.
Our web servers track general information about visitors such as their domain name, time of visit, IP address, type and version of browser and which pages are being accessed. This information is used only in aggregate form, to better serve visitors by helping us to:
- Manage our site;
- Diagnose any technical problems; and
- Improve the content of our website.