Privacy Policy

1. Purpose, Scope and Legislative Authority

This Privacy Policy outlines how PrimePath Community Care ("we," "us," "our," or "Organization") collects, uses, discloses, and safeguards personal health information (PHI) and personal information of individuals ("you," "your," or "individual") under its custody and control.

As a health information custodian operating in Ontario, Canada, our privacy practices are governed primarily by the Personal Health Information Protection Act, 2004 (PHIPA), with complementary compliance obligations under the Personal Information Protection and Electronic Documents Act (PIPEDA), the Health Information Act (HIA), the Accessibility for Ontarians with Disabilities Act (AODA), and the Canadian Anti-Spam Legislation (CASL).

This policy applies to all employees, volunteers, contractors, agents, and service providers ("Staff") who have access to or collect personal health information on our behalf. The policy is reviewed and updated annually, with the next scheduled review in March 2027.

2. Definitions

3. Collection of Personal Health Information

We collect personal health information only to the extent necessary to accomplish specific, identified purposes. Collection is limited to the minimum amount of information required to deliver services, fulfill legal obligations, and support effective client care management.

3.1 Lawful Basis for Collection

We collect personal health information based on:

• Consent obtained from the individual or their SDM
• Legal obligations (e.g., funding requirements, employment standards, child protection)
• Necessity for provision of health care services
• Public health and safety purposes
• Research or evaluation purposes (with ethics board approval)

3.2 Sources of Collection

We collect personal health information directly from:

• The individual themselves
• Family members, caregivers, or authorized representatives
• Healthcare providers and other custodians (with consent)
• Government and funding agencies (for program eligibility and reporting)
• Our website and client management systems

4. Use of Personal Health Information

4.1 Primary Purposes

We use personal health information for:

• Providing direct client care and health services
• Clinical documentation and care planning
• Appointment scheduling and follow-up
• Care coordination and communication with other providers
• Billing and payment processing
• Quality assurance and client safety monitoring

4.2 Secondary Purposes

With consent, we may use personal health information for:

• Research and program evaluation (ethics-approved)
• Training and education of health professionals
• Performance improvement initiatives
• Funnel analysis and service development

4.3 Prohibited Uses

We do NOT use personal health information for:

• Marketing or promotional purposes (without explicit consent)
• Profiling or discriminatory practices
• Sale to third parties for commercial purposes
• Political campaigns or lobbying efforts
• Any purpose unrelated to healthcare delivery or legal obligations

5. Disclosure of Personal Health Information

5.1 Disclosures Without Consent

Under PHIPA, we may disclose personal health information without consent only in the following circumstances:

• To healthcare providers directly involved in providing care to the individual
• Where required or authorized by law (mandatory reporting, court orders, search warrants)
• Where the life, safety, or health of an individual is at serious risk
• To facilitate a transfer of care in an emergency where consent cannot be obtained in time
• For the investigation or prosecution of a crime where obtaining consent would compromise the investigation
• Audits and reviews by authorized government bodies and funders
• Disclosures to legal counsel for the purpose of obtaining legal advice

5.2 Prohibited Disclosures

We do NOT disclose personal health information for direct marketing purposes, commercial third-party sales, or political activities unless explicit consent has been obtained.

6. Consent Framework

6.1 Consent Requirements

Consent is required for:

• Collection of personal health information not necessary for care
• Disclosure outside the circle of care (except as authorized by law)
• Use for secondary purposes (research, training, marketing)
• Automated decision-making or profiling

6.2 Obtaining and Recording Consent

Consent is obtained through:

• Written consent forms (signed and dated)
• Verbal consent (documented in the individual's record with date and witness signature)
• Electronic consent (through secure systems)

6.3 Withdrawal of Consent

Individuals may withdraw consent at any time by providing notice to our Privacy Officer. Withdrawal does not affect the lawfulness of uses or disclosures made prior to withdrawal, but will apply to future processing.

6.4 Incapacity and Substitute Decision-Makers

For individuals unable to provide consent, consent is obtained from their court-appointed substitute decision-maker (SDM). In the absence of a legally appointed SDM, we may consult with family members or caregivers to determine the individual's wishes, with documentation in the client record.

7. Safeguards and Security

7.1 Administrative Safeguards

• Privacy and security policies and procedures
• Staff training and competency verification
• Background checks for all Staff with PHI access
• Confidentiality agreements and non-disclosure provisions
• Access controls and role-based permissions
• Regular security audits and risk assessments
• Incident response and breach management procedures

7.2 Physical Safeguards

• Secured facilities with controlled access (badges, locks, cameras)
• Secure storage of physical health records in locked cabinets
• Shredding or secure disposal of confidential documents
• Restricted access to areas where PHI is stored or processed

7.3 Technical Safeguards

• Encryption of personal health information in transit and at rest
• Secure password management and multi-factor authentication
• Firewalls, intrusion detection, and antivirus protection
• Regular software patching and security updates
• Data backup and disaster recovery procedures
• Automatic session timeouts for unattended systems
• Activity logging and audit trails

7.4 Third-Party Service Provider Security

Any agent or third-party service provider who has access to PHI must:

• Execute a Data Processing Agreement (DPA) or equivalent contract
• Implement equivalent privacy and security safeguards
• Limit use of PHI to authorized purposes only
• Notify us immediately of any breach or security incident
• Cooperate with audits, inspections, and investigations
• Comply with all applicable privacy legislation

8. Mandatory Reporting and Override of Privacy

PrimePath Community Care is legally obligated to report or disclose personal health information in the following circumstances, even without consent:

9. Retention of Personal Health Information

Personal health information is retained for the minimum period necessary to accomplish the purposes for which it was collected, and in accordance with applicable legal and regulatory requirements.

10. Privacy Breach Management

10.1 Breach Definition

A breach occurs when there is unauthorized access, use, or disclosure of personal health information, or loss of physical records containing PHI.

10.2 Breach Response Procedure

11. Individual Rights Under PHIPA

PHIPA grants individuals the following rights regarding their personal health information:

12. Privacy Officer and Contact Information

13. Policy Review, Amendment, and Enforcement

13.1 Policy Review Schedule

This Privacy Policy is reviewed annually or when material changes to legislation, technology, or organizational practices require an update. The next scheduled review is March 2027.

13.2 Changes to This Policy

PrimePath Community Care reserves the right to modify this policy to reflect changes in legislation, technology, or organizational practices. Individuals will be notified of material changes by email or website posting.

13.3 Enforcement and Compliance

All staff, agents, and service providers are required to comply with this policy and applicable privacy legislation. Failure to comply may result in disciplinary action, civil liability, or criminal liability.

13.4 Questions and Feedback

If you have questions or feedback regarding this Privacy Policy, please contact our Privacy Officer at privacy@primepathcommunitycare.ca.