Privacy Policy and Statement of Information Practices
1. Our Commitment & Accountability
18010781 Canada Inc., operating as Heartland Urgent Care (“Heartland,” “the Clinic,” “we,” “us” or “our”), is the health information custodian responsible for patient records created and maintained through the Clinic.
Physicians, employees, administrative personnel and other authorized individuals who access patient information through the Clinic act on behalf of the Clinic and must comply with the Personal Health Information Protection Act, 2004 (“PHIPA”), applicable professional requirements and the Clinic’s privacy policies.
The Clinic has designated its Clinic Manager/Administrator as Privacy Officer. The Privacy Officer is responsible for:
* Supporting the Clinic’s compliance with PHIPA.
* Ensuring staff and other authorized agents understand their privacy obligations.
* Responding to questions concerning the Clinic’s information practices.
* Managing requests for access to or correction of patient records.
* Receiving and investigating privacy complaints.
* Coordinating the Clinic’s response to privacy breaches.
The Clinic must maintain a named individual in this role internally, even when the public-facing title “Privacy Officer” is used.
2. Information We Collect
The Clinic collects only the information reasonably necessary to provide healthcare, operate the practice and meet legal or professional obligations.
Information may include:
* Name, date of birth, address, telephone number, email address and other identifying information.
* Ontario health card, insurance, payment and billing information.
* Medical history, medications, allergies, symptoms, diagnoses, examination findings, treatment plans and clinical notes.
* Laboratory, imaging and other investigation results.
* Referrals, consultation reports and correspondence with healthcare providers.
* Appointment, registration and administrative information.
* Information provided by a substitute decision-maker where legally authorized.
* Information received from other healthcare providers, hospitals, pharmacies, laboratories, government health systems or other authorized sources.
* Information voluntarily submitted through the Clinic’s website or other communication channels.
* Video images recorded by security cameras in designated public areas of the Clinic.
3. Why We Collect and Use Info
Personal health information may be collected and used to:
* Identify and register patients.
* Provide, coordinate, evaluate and follow up on healthcare.
* Maintain complete and accurate medical records.
* Communicate with patients and authorized representatives.
* Arrange laboratory testing, diagnostic imaging, referrals, prescriptions and other healthcare services.
* Schedule and administer appointments.
* Process OHIP, insurance and uninsured-service billing.
* Support patient safety, quality assurance and clinic operations.
* Fulfil legal, regulatory, reporting and professional obligations.
* Investigate complaints, privacy incidents or security concerns.
* Protect the safety and security of patients, personnel and Clinic premises.
4. Consent
The Clinic obtains consent before collecting, using or disclosing personal health information unless PHIPA or another law permits or requires otherwise.
Where permitted under PHIPA, the Clinic may rely on implied consent to share relevant information with healthcare providers involved in providing or assisting in the provision of care. Express consent will be obtained where required, including for disclosures outside the patient’s circle of care.
Consent must be knowledgeable, relate to the information involved and not be obtained through deception or coercion.
Consent may be provided by an authorized substitute decision-maker where the patient is not legally capable of making the relevant information decision. The Clinic will follow PHIPA requirements concerning capable minors and substitute decision-makers.
A patient may withdraw or limit consent by notifying the Clinic. A withdrawal applies prospectively and does not invalidate earlier authorized activity. Consent cannot be restricted where collection, use, disclosure or documentation is required by law or professional standards.
Where a patient requests a consent restriction or “lockbox,” the Clinic will discuss the possible implications for safe and coordinated care and document the restriction appropriately.
5. Disclosures
The Clinic may disclose personal health information:
* To healthcare providers involved in providing or assisting with care.
* To laboratories, diagnostic facilities, hospitals, specialists and pharmacies where reasonably necessary for care.
* To OHIP, insurers or other payors for authorized billing and administrative purposes.
* To technology, record-management and administrative service providers acting on the Clinic’s behalf and subject to appropriate confidentiality and security requirements.
* To public health, child-protection, regulatory, law-enforcement or other authorities where permitted or required by law.
* In response to a valid court order, warrant or other lawful requirement.
* With the patient’s express consent for another lawful purpose.
Only the information reasonably necessary for the authorized purpose will be disclosed.
Heartland Pharmacy is a separate organization and health information custodian. Its privacy practices apply to information it independently collects. Information is shared between the Clinic and the pharmacy only with appropriate consent or as otherwise permitted or required by law.
The Clinic does not sell personal information or personal health information.
6. Website Contact Form and Email
The general website contact form is intended only for non-urgent administrative questions.
Patients must not use the form or ordinary email to submit symptoms, diagnoses, test results, medication information, health card numbers or other detailed medical information. The form and ordinary email are not monitored continuously and must not be used for emergencies or time-sensitive medical concerns.
If personal health information is nevertheless received through the contact form or email, the Clinic will treat it as personal health information and protect, redirect, document or securely dispose of it as appropriate.
Patients should use the Clinic’s designated secure patient system or telephone the Clinic for care-related communication. For emergencies, call 911 or attend the nearest emergency department.
Where unencrypted email containing personal health information is considered necessary, the Clinic will assess the sensitivity and circumstances and obtain and document the patient’s express consent after explaining the purposes, limitations and risks of unencrypted communication.
Privacy complaints or access requests may initially be sent to the Privacy Officer by email, but detailed medical information should not be included. The Clinic will arrange an appropriate secure method for identity verification and further communication.on:
* To healthcare providers involved in providing or assisting with care.
* To laboratories, diagnostic facilities, hospitals, specialists and pharmacies where reasonably necessary for care.
* To OHIP, insurers or other payors for authorized billing and administrative purposes.
* To technology, record-management and administrative service providers acting on the Clinic’s behalf and subject to appropriate confidentiality and security requirements.
* To public health, child-protection, regulatory, law-enforcement or other authorities where permitted or required by law.
* In response to a valid court order, warrant or other lawful requirement.
* With the patient’s express consent for another lawful purpose.
Only the information reasonably necessary for the authorized purpose will be disclosed.
Heartland Pharmacy is a separate organization and health information custodian. Its privacy practices apply to information it independently collects. Information is shared between the Clinic and the pharmacy only with appropriate consent or as otherwise permitted or required by law.
The Clinic does not sell personal information or personal health information.
7. Online Booking and Service Providers
8. Website Cookies and Analytics
The website may use necessary cookies and limited analytics or advertising-measurement technologies. These may collect technical information such as:
* IP address.
* Browser and device type.
* Approximate geographic location.
* Referring website.
* Pages viewed.
* General website interactions.
The Clinic will configure its website and advertising tools so that medical-record content, health card numbers, reasons for visits and information entered into secure patient systems are not intentionally sent to advertising or analytics platforms.
Some website service providers may process technical information outside Ontario or Canada. Information processed elsewhere may be subject to the laws of that jurisdiction.
External websites and services are governed by their own privacy policies.
9. Video Surveillance
The Clinic operates visible security cameras that record designated entrance, reception and public-access areas 24 hours a day.
Video surveillance is used only for reasonable safety and security purposes, including:
* Protecting patients, personnel and Clinic property.
* Deterring and investigating theft, violence, unauthorized entry or other security incidents.
* Supporting the investigation of a documented incident where reasonably necessary.
Cameras will not be installed in examination rooms, procedure rooms, washrooms or other areas where patients reasonably expect a high degree of privacy. Audio recording is disabled.
Signs notifying visitors of video surveillance will be prominently displayed before or upon entering a recorded area.
Because video showing an individual attending a medical clinic may constitute personal health information, surveillance recordings will be protected accordingly. Access is restricted to the Privacy Officer and specifically authorized individuals who require access for a legitimate security, privacy or legal purpose.
Recordings will not be used for marketing, employee performance monitoring, monitoring clinical encounters or any unrelated purpose.
Recordings will normally be automatically overwritten or securely deleted within 30 days. A relevant recording may be retained longer when reasonably required to investigate an incident, respond to an access request, preserve evidence, comply with a legal obligation or complete a proceeding. It will be securely deleted when no longer required.
Recordings will be disclosed only with consent or where permitted or required by law. Wireless transmission, remote access and stored recordings will be protected using strong security controls, including encryption, restricted accounts and secure credentials.
Individuals may request access to surveillance footage containing their personal health information. Access may be limited where necessary to protect another person’s privacy or where another legal exception applies.
10. Safeguards
The Clinic uses reasonable administrative, technical and physical safeguards appropriate to the sensitivity of the information.
Safeguards include:
* Privacy and confidentiality obligations for personnel.
* Privacy training appropriate to each person’s responsibilities.
* Role-based access to patient information.
* Unique user accounts and passwords.
* Audit logging where supported by the relevant system.
* Encryption of electronic personal health information on mobile devices and cloud systems.
* Secure electronic medical-record and communication systems.
* Secure backups and recovery procedures.
* Physical controls for areas and equipment containing confidential information.
* Procedures for terminating access when personnel leave or change roles.
* Secure transfer and destruction of records.
* Privacy and security requirements for service providers.
Personnel must not share system credentials or access patient information without an authorized work-related purpose.
11. Retention and Destruction
Medical records are retained for at least the periods required by law and CPSO policy:
* Adult patients: at least 10 years after the date of the last entry.
* Patients who are children: at least 10 years after the date on which the patient reached or would have reached 18 years of age.
Records may be retained longer where an access request, complaint, investigation, legal proceeding or other lawful requirement is outstanding.
Administrative records, contact-form submissions, emails, billing information, security recordings and other information are retained according to the Clinic’s applicable retention schedule and only for as long as reasonably required.
When the retention period expires, paper and electronic information will be securely destroyed so that it cannot reasonably be reconstructed or retrieved. Applicable backup copies will also be addressed through the Clinic’s secure destruction procedures.
12. Access to Patient Records
Patients or their legally authorized representatives may request access to personal health information held by the Clinic.
A request should be made in writing to the Privacy Officer and should identify the records requested. The Clinic will verify the requestor’s identity and authority before releasing information.
The Clinic will normally respond within 30 days, subject to any extension permitted by PHIPA. A reasonable cost-recovery fee may apply. If a fee is expected, an estimate will be provided before access is completed.
Access may be refused in whole or in part only where permitted by law. If access is refused, the Clinic will provide the required written explanation and information about the right to complain to the Information and Privacy Commissioner of Ontario.
13. Correction of Patient Records
Patients may request correction of personal health information that they believe is inaccurate or incomplete for the purposes for which the Clinic uses the information.
Correction requests should be submitted in writing to the Privacy Officer and should identify the information and requested correction.
The Clinic will respond in accordance with PHIPA. A request may be refused where permitted by law, including where the entry represents a professional opinion or observation made in good faith. Where applicable, the patient may submit a statement of disagreement and may complain to the Information and Privacy Commissioner of Ontario.
14. Privacy Breaches
The Clinic maintains procedures for responding to theft, loss and unauthorized collection, access, use, disclosure, copying, modification or disposal of personal health information.
The Clinic will:
* Take immediate reasonable steps to contain the incident.
* Investigate its cause and scope.
* Document the incident and remedial action.
* Notify affected individuals at the first reasonable opportunity where required.
* Report the breach to the Information and Privacy Commissioner of Ontario and applicable regulatory colleges where required.
* Maintain breach records and submit required annual breach statistics.
* Take corrective action intended to reduce the risk of recurrence.