PRIVACY POLICY

 

At Gut Instincts Nutrition Counselling your privacy is of utmost importance to us. Please find below all of the details about how we strive to keep your privacy protected.

 

Last Updated: May 25, 2021

 

The Use of Personal Information

 

Privacy of personal information and personal health information (collectively referred to as “Personal Information”) is an important principle to Gut Instincts Nutrition Counselling (hereinafter referred to as “Gut instincts Nutrition Counselling”, “we” or “our”).

We are committed to collecting, using and disclosing Personal Information of our clients (hereinafter “clients”, “you”, “your”) responsibly, in accordance with applicable law, and only to the extent necessary for the services we provide.

By providing Personal Information to Gut Instincts Nutrition Counselling, you consent to our collection, use and disclosure of such information in accordance with this privacy policy and as otherwise permitted or required by law.

 

Our Organization

Owner: Suzanne Dietrich, Registered Dietitian

Health Information Custodian: Suzanne Dietrich

Information Officer/Contact Person: Suzanne Dietrich

 

Who We Are

Suzanne Dietrich, RD is the principal of Gut Instincts Nutrition Counselling. Gut Instincts Nutrition Counselling uses other healthcare professionals and support staff that assist in the provision of care to our clients.

We also work with consultants and agencies that may, in the course of their duties, have limited access to Personal Information we hold. These include computer consultants, office security and maintenance, bookkeepers and accountants, lawyers, contract dietitians, virtual assistants, interns, credit card companies, website managers and cleaners.

 

We restrict access to any Personal Information we hold as much as is reasonably possible. We also obtain assurances from any healthcare professionals, support staff, consultants and agencies that they will follow appropriate privacy principles.

 

What is Personal Information and Personal Health Information?

Personal information means any factual or subjective information, recorded or not, about an identifiable individual, including without limitation, age, name, ID numbers, income, ethnic origin. Personal health information is identifying information about an individual in oral or recorded form that relates to the details of their healthcare, including:

• the physical, nutritional or mental health of the individual (including the family health history);
• the provision of health care to the individual (including identifying the individual’s health care provider(s));
• a plan of service under the Home Care and Community Services Act, 1994;
• payments or eligibility for health care or coverage for health care;
• the individual’s health number; or
• the identification of the individual’s substitute decision-maker.

Table 1: Types of Personal Information and Personal Health Information that may be collected Personal Information Personal Health Information Name

Health history of individual

Home address, telephone number, email address

Family health history

Gender & Age

Health measurements, samples, lab results, examination results

Extended Health Benefit Coverage

Health conditions, assessment results or diagnoses

Language

Health services provided to or received by the individual

Occupation

Prognosis or other opinions formed during assessment and treatment

Religion

Compliance with assessment and treatment

Ethnicity, race or country of origin

Reasons for discharge and discharge condition and recommendations

Employer

Identity of individual’s health care providers

 

 

 

Purpose for Collecting, Using and Disclosing Personal Health Information

Primary Purposes: Gut Instincts Nutrition Counselling collects, uses and discloses personal health information about a client, including without limitation clients health history, physical condition and social situation primarily in order to help us assess what clients’ needs are, to advise clients of treatment options and provide them with the chosen health care in connection with dietetic services. In addition, this information is collected to obtain a baseline of health and social information so that in providing ongoing health services, changes can be identified. With your permission, this information may be disclosed to other members of your health care team, to provide you with optimal health care.

 

Secondary Purposes: We also collect, use and disclose Personal Information for related purposes. For example, we collect, use and disclose Personal Information to:

1. Obtain payment for services or goods provided from the individual, WSIB, private insurers or others, as applicable.
2. Conduct quality improvement and risk management activities. We review client files to ensure that we provide high quality services, including assessing the performance of our staff/contract dietitians, interns. External consultants (e.g., auditors, lawyers, practice consultants, voluntary accreditation programs) may conduct audits and quality improvement reviews on our behalf.
3. Promote our clinic, special events and opportunities (e.g. a seminar or conference) that we have available. We will always obtain express consent from the client prior to collecting or handling Personal Health Information for this purpose.
4. Comply with external regulators. Our profession is regulated by the College of Dietitians of Ontario (hereinafter “CDO”), who may inspect our records and interview our staff as part of its regulatory activities in the public interest. The CDO has its own strict confidentiality and privacy obligations. In addition, as professionals, we will report serious misconduct, incompetence or incapacity of other practitioners, whether they belong to other organizations or our own. We will also report information suggesting illegal behaviour to authorities. In addition, we may be required by law to disclose personal health information to various governmental agencies (e.g., Ministry of Health and Long-Term Care, children’s aid societies, Canada Customs and Revenue Agency, Information and Privacy Commissioner, etc).
5. Educate our staff and students. We value the education and development of future and current professionals. We will review client records in order to educate our staff and students about the provision of health care.
6. Facilitate the sale of our organization. If the organization or its assets were to be sold, the potential purchaser would want to conduct a “due diligence” review of the organization’s records to ensure that it is a viable business that has been honestly portrayed. The potential purchaser must first enter into an agreement with the organization to keep the information confidential and secure and not to retain any of the information longer than necessary to conduct the due diligence. Once a sale has been finalized, the organization may transfer records to the purchaser, but it will make reasonable efforts to provide notice to the individual before doing so.

Protecting Personal Information

We understand the importance of protecting Personal Information. For that reason, we have taken the following steps:

• Paper information is either under supervision or secured in a locked or restricted area.
• Electronic hardware is either under supervision or secured in a locked or restricted area at all times. In addition, strong passwords are used on all computers and mobile devices.
• Personal Information is only stored on mobile devices if necessary. All Personal Information stored on mobile devices is protected by strong encryption.
• We try to avoid travelling with personal health information. However, when we do so, we transport, use and store the personal health information securely.
• Paper information is transferred through sealed, addressed envelopes or boxes by reputable companies with strong privacy policies.
• Electronic information is either anonymized or encrypted before being transmitted.
• Our staff members & contract employees are trained to collect, use and disclose Personal Information only as necessary to fulfill their duties and in accordance with our privacy policy.
• We do not post any Personal information about our clients on social media sites and our staff and contract employees are trained on the appropriate use of social media.
• External consultants and agencies with access to Personal Information must enter into privacy agreements with us.

 

Openness about the Personal Information Process

Our Privacy Policy is available from our website at www.gutinstincts.ca and can be provided to any individual upon request. Our Privacy Policy will be posted in our reception area. A copy of our Privacy Commitment, which summarizes our Privacy Policy is provided to each new client at the time the consent form is signed.

 

Access Personal Information

You have the right (with some exceptions) to access Personal Information about you that is held by us and to know what we have done with your Personal Information.

 

Procedure for Accessing Personal Information

We request that all access requests be in writing. We will confirm the identify of the requestor prior to disclosing any Personal Information. We will respond to your request as soon as possible and generally within 30 days, if possible.

If the request is granted, we will provide your Personal Information or a summary of what we have in our file and will take reasonable steps to ensure that you understand the records being provided (e.g., explain short forms or codes and technical language). We may charge a fee related to the access request based on the guidelines of the Information and Privacy Commissioner’s Office of Ontario.

If a request is refused, we will provide our reasons for the refusal as well as the appropriate contact details for the Information and Privacy Commissioner of Ontario.

 

Grounds for refusal to access Personal Information could include:

• Frivolous, vexatious and bad faith requests
• If the information is quality of care information or information generated for the College’s quality assurance program;
• Raw data from standardized assessments;
• There is a risk of serious harm to the treatment of recovery of the individual or of serious bodily harm to another person; or
• Access would reveal the identity of a confidential source of information.

 

Correction Requests

You have the right to request a correction to information held by us. The purpose is to maintain appropriate and accurate information on clients. Correction requests are restricted to factual information. Professional observations and opinions are not generally subject to correction requests.

 

If we agree that there is a mistake in the record, we will make the correction, but we will not destroy the original entry. At your request and where it is reasonably possible, we will notify third parties to whom we sent this information. We reserve the right to refuse to notify a third party if the correction cannot reasonably be expected to have an effect on the ongoing provision of health care or some other benefit to the individual.

 

If we do not agree that there is a mistake in the record, a notice of disagreement will be filed with the record. Upon any notice of refusal, we will advise you of your right to complain to the Information and Privacy Commissioner about the refusal.

 

We may also refuse corrections, if, for example, the request is frivolous, vexatious or made in bad faith, or if we did not create the record and do not have sufficient knowledge, expertise or authority to make the correction.

 

Retention and Destruction of Personal Information

 

Gut Instincts Nutrition Counselling will retain clinical records for 10 years after the last client interaction or 10 years after the client turns 18 years of age. If required by the circumstances Gut Instincts Nutrition Counselling may retain a clinical record for a longer period of time, such as in the case that litigation is contemplated or ongoing or where a request for access to the record is outstanding.

 

Personal health information will be disposed of in a secure manner so that the records cannot be reconstructed (s.13 of the Act and s. 1(5.1) of the regulations). Paper records will be cross-cut shredded (using external shredding services) and electronic files will be deleted or destroyed in a way that the information cannot be recovered.

 

When Suzanne Dietrich, RD dies, the person responsible for her estate will be responsible for complying with applicable legislation governing Personal Information until he or she is able to transfer the information to another health information custodian.

 

Privacy Breach

 

While we will take precautions to avoid any breach of your privacy, if there is a loss, theft or unauthorized access of your Personal Information we will notify you.

 

Upon learning of a possible or known breach, we will take the following steps, as applicable:

 

Step 1: Respond immediately by implementing the organization’s privacy breach protocol.

• Inform the necessary staff within the organization.
• Consider whether the Commission must or should be notified (PHIPA provides that regulations may be passed setting out certain kind of breaches that must be reported to the Commission, s. 12(3).

Step 2: Containment – Identity the scope of the potential breach and take steps to contain it.

• Assess what and how much information was breached and in what manner (e.g., paper format, electronic format), including individuals or organizations who many have been involved with or are responsible for the breach, and the nature and quantity of the Personal Health information that is affected.
• Determine whether copies were made and retrieve and copies of Personal Health Information (PHI) that have been disclosed.
• Ensure that no copies of PHI have been made or retained by anyone who was not authorized to receive the information. Record the person’s contact information in case follow-up is required.
• Determine whether the breach would allow unauthorized access to any other PHI. Implement any necessary action to contain further unauthorized access (e.g., change passwords, identification numbers and/or temporarily shut down a system).
• In case of unauthorized access by an agent, consider suspending their access rights.

Step 3: Notification – Identity those individuals whose privacy was breached and notify them of the breach.

• Notify all individuals whose personal health information has been compromised in the most appropriate way possible in light of the sensitivity of the information (e.g., by phone, in writing, at your next appointment, etc.) and at the first reasonable opportunity. Where appropriate the individual will be informed of the name of the agent responsible for unauthorized access, date of breach, description of the nature and scope of breach, as well as the description of the PHI that was subject to the breach, the measures implemented to contain the breach.
• Inform all individuals of the steps that have or will be taken to address the privacy breach and that the Information and Privacy Commissioner’s Office, Ontario has been informed.
• Provide the individuals with the organization’s and the Information and Privacy Commissioner’s Office of Ontario contact information in case individuals have further questions.
• Advise the individual of their right to make a complaint to the Commission (s. 12).

Step 4: Investigation and Remediation

• Conduct an internal investigation into the matter to identify how and why the privacy breach occurred.
• Take the necessary steps to implement a plan that strives to avoid similar privacy breach from occurring in the future.
• If deemed necessary, we will advise the Information and Privacy Commissioner’s Office of Ontario of the investigation findings and the proposed future prevention plan and work together to make any necessary changes.
• Report the results of investigation to the relevant regulatory College if appropriate or required (PHIPA requires HICs to report certain events to the relevant regulatory College, including when a member is suspended, terminated or otherwise disciplined or has had their privileges or business affiliation revoked or restricted as a result of a privacy breach; s. 17.1.The organization may also be required to report the circumstances to a regulatory College under the Regulated Health Professionals Act, 1991 in cases of professional misconduct, incompetence or incapacity.)
• Ensure all staff are appropriately trained and conduct further training if required.

Depending on the circumstances of the breach, we may notify and work with the Information and Privacy Commissioner of Ontario. If we take disciplinary action against one of our practitioners (or revoke or restrict the privileges or affiliation of one of our practitioners) for a privacy breach, we are required to report that to the practitioner’s regulatory College. We may also report the breach to the relevant regulatory College if we believe that it was the result of professional misconduct, incompetence or incapacity.

 

Complaints System

We maintain an internal complaint system.

If you wish to make a formal complaint about our privacy practices, you may make it in writing to Suzanne Dietrich (contact details below). Suzanne Dietrich will acknowledge receipt of your complaint and ensure that it is investigated promptly and that you are provided with a formal decision and reasons. Every effort is made to investigate and provide a decision and reasons within 30 days.

 

You also have the right to complain to the Information and Privacy Commissioner of Ontario if you have concerns about our privacy practices or how your personal health information has been handled.

 

Contact Information

If you have any questions or want to make a complaint about our privacy practices, please contact:

Suzanne Dietrich, RD at [email protected]

 

You also have the right to complain to the Information and Privacy Commissioner of Ontario at the address below if you have concerns about our privacy practices or how your personal health information has been handled:

 

Information and Privacy Commissioner of Ontario

2 Bloor Street East, Suite 1400, Toronto, Ontario M4W 1A8
Telephone:  1 (800) 387-0073
Fax: (416) 325-9195
www.ipc.on.ca

 

This policy is made under the Personal Health Information Protection Act, 2004, S.O. 2004, c. 3. It is a complex statute and provides some additional exceptions to the privacy principles that are too detailed to set out here.