What Is Personal Information?
Personal information is information about an identifiable individual. Personal information includes information that relates to their personal characteristics (e.g., gender, age, income, home address, phone number, ethnic background, family status), their health (e.g., health history, health conditions, health services received) or their activities and beliefs (e.g., religion, political views, opinions expressed). Personal information is different than business information (e.g., an individual's business address and telephone number), which is not protected by privacy legislation.
Who We Are
George Jeffrey Children's Centre includes, at the time of writing, various clinical, administrative, health information, day care, and maintenance staff. We contract companies that may, in the course of their duties, have limited access to personal information that we hold. These include computer consultants, accountants, clinical service providers and mail distributors. As much as is reasonably possible, we restrict their access to personal information we hold and we have written assurance from staff and contractors that they follow appropriate privacy principles. We also provide volunteer and clinical student placement opportunities, where access to personal information is restricted as much as is reasonably possible. Clients are advised when volunteers or students are working directly with clinicians. We obtain written assurance of confidentiality and commitment to appropriate privacy principles.
Collection Of Personal Information:
The primary purpose for collecting personal information about our clients is to provide assessment and treatment. For example, we collect information about a client's health history, family history, current physical condition and function, and social situation in order to help us assess clinical needs, advise of clinical options, and provide care. Another purpose to obtaining personal information is to establish a baseline of health and social information, so that in providing ongoing health services, we can identify changes that occur over time. Collection of such information would only happen with expressed consent, except in the case of an emergency.
About Members of the General Public
For members of the general public, our primary purpose for collecting personal information, such as addresses, phone numbers and e-mail addresses, is to provide notice of special events (e.g., educational sessions offered, fundraising ventures). We attempt to obtain consent before using such personal information. Where this is not possible, we will upon request immediately remove any personal information from our distribution list. On our website we only collect personal information provided and only use that information for its intended purpose (e.g., to respond to an e-mail message, to register for a course, to obtain information, to subscribe to our newsletter). Cookies are only used to help you navigate our website, and are not used to monitor visitors to our website.
About Contract Workers, Volunteers and Students
For people who work with us, but who are not in our employ (e.g., volunteers), our primary purpose for collecting personal information is to ensure we can contact them in the future. Types of personal information we collect are home addresses and telephone numbers. It is rare for us to collect such information without prior consent, but it might happen in the case of health emergency or to investigate a possible breach of law (e.g., if a theft were to occur at the Centre). If contract workers, volunteers or students wish a letter of reference or an evaluation, we will collect information about their work related performance and provide a report as authorized by them.
For employees of the Centre, personal information is gathered in-case the need arises to reach an employee at home or to contact a designated person(s) in an emergency situation. Personal information is also gathered for the purpose of processing payroll, benefits, source deductions and other remittances. Consent is obtained prior to gathering employees' personal information. Employees are made aware that their information may be shared with financial institutions, Canada Customs and Revenue Agency, union (where applicable), benefits providers, etc.
Collection Of Personal Information:
Related And Secondary Purposes
Like most organizations, we also collect, use and disclose information for purposes related to or secondary to our primary purposes. The most common examples are as follows:
- To invoice clients for goods or services, to process credit card payments or to collect unpaid accounts.
- To advise clients and others of special events or opportunities (e.g., a seminar, development of a new service, distribution of newsletter)
- To forward information to clients and others regarding fundraising campaigns
- To provide receipts to clients and donors for payments and donations
- To review client, financial, and human resources files for the purpose of ensuring that we provide high quality services, including assessment of staff performance. In addition, external consultants such as auditors, lawyers, and accreditation officers may, on our behalf, do audits and quality reviews of our Centre. This may involve review of client, staff, and financial files, and interviewing of staff.
- Centre clinicians are regulated by their respective Colleges who, in the interest of the public, may inspect our records and interview our staff as part of their regulatory activities. As required, we will report serious misconduct, incompetence or incapacity of other practitioners, whether they belong to other organizations or our own. Also, our Centre believes that it should report information suggesting serious illegal behaviour to appropriate authorities.
- External regulators have their own strict privacy obligations. Sometimes these reports include personal information about our clients, or other individuals, to support the concern (e.g., improper services, child abuse or neglect). Also, like all organizations, various government agencies (e.g., Information and Privacy Commissioner, Human Rights Commission, government funding body, etc.) have the authority to review our files and interview our staff as part of their mandates. In these circumstances, we may consult with professionals (e.g., lawyers, accountants) who will investigate the matter and report back to us.
- The cost of some goods/services provided by the Centre to clients is paid for by third parties (e.g., OHIP, Assistive Devices Program). These third-parties often have your consent or legislative authority to direct us to collect and disclose to them certain information in order to demonstrate client entitlement to this funding.
- Employee information may be shared with health and insurance benefits providers with whom the Centre is contracted. Information may also be shared with our financial institution for payroll and company RRSP purposes.
- A person can choose to not be part of some of these related or secondary purposes (e.g., by declining to receive notice of special events, by declining to receive our newsletter, by paying for particular non-funded services in advance). We do not, however, have much choice about most of the related or secondary purposes guided by external regulations.
Protecting Personal Information
We understand the importance of protecting personal information. For that reason, we have taken the following steps:
- Paper information regarding clients, employees, and others is either under supervision or secured in a locked or restricted area.
- Electronic hardware is either under supervision or secured in a locked or restricted area at all times. In addition, passwords and security levels of access are used on individual computers.
- Paper information is transmitted through sealed, addressed envelopes or boxed by reputable companies.
- Electronic information is stored on a secured server with back up.
- External consultants with access to personal information must enter into privacy agreements with us.
Retention And Destruction Of Personal Information
We are required to retain and destroy personal information as per legislated guidelines. We retain and destroy records as follows:
- Upon discharge, client files are retained for a period of 10 years from 18th birthday, or if adult or deceased, for a period of 10 years.
- Financial and payroll records are retained for a period of 7 years.
- Human resources records are retained for a period of 7 years from termination date.
- We retain indefinitely a client discharge registry noting client name, date of birth and Centre discharge date.
- We retain indefinitely an employee registry noting employee name, date of birth, social insurance number, position(s) held, start date, termination date, last known address and last known telephone number.
Paper files containing personal information are destroyed by shredding. Electronic information is destroyed by deleting it. Before discarding any hard drives, we ensure they are fully erased or destroyed.
If you have a privacy concern, please contact our Privacy Officer at 625-6799