Protecting Your Privacy

Osler is accountable for protecting the privacy, confidentiality and security of personal health information in our custody and control. We have established policies, procedures, safeguards and oversight mechanisms to ensure compliance with the Personal Health Information Protection Act, 2004 (PHIPA) and other applicable laws. A designated Privacy Office is responsible for overseeing our privacy program, responding to questions and concerns, monitoring compliance and supporting the appropriate collection, use, disclosure, retention and disposal of personal health information.

We maintain a strong focus on performance excellence by regularly monitoring and evaluating our privacy practices, conducting audits and risk assessments, investigating privacy incidents and implementing corrective actions where required. We use these results to continuously improve our information practices and strengthen our protection of patients' privacy rights.

Osler is open and transparent about its information practices. We provide information to patients, families and visitors about the purposes for which personal health information is collected, used, disclosed, retained and protected. Notices are posted throughout our hospital and additional privacy information is available through our website, patient materials and Privacy Office. These resources explain why we collect, use and disclose personal health information, the legal authority for doing so, the safeguards we have in place to protect it, the privacy rights available to individuals and how to contact us with questions, concerns or requests regarding personal health information.

When you provide us with your personal health information, we assume that you understand and consent to the collection, use and disclosure of that information for the purpose of providing and assisting in providing your health care. Depending on the circumstances and purpose, your consent may be implied from your actions, or it may be obtained expressly, either verbally or in writing. We will ensure that you have sufficient information to make informed decisions about your personal health information and your privacy choices.

Your personal health information may be shared with members of your health care team and other health information custodians involved in your care, often referred to as your 'circle of care', unless you tell us otherwise.

You have the right to withhold or withdraw your consent to the collection, use or disclosure of all or part of your personal health information at the time we request the information or at any time afterwards. You may also request restrictions on how your information is shared, sometimes referred to as a consent directive or 'lockbox' request. 

If you choose not to provide certain information, or if you withdraw your consent, we will explain any potential impact on our ability to provide safe, effective and quality health care services. In some circumstances, we may not be able to accommodate your request where the collection, use or disclosure of information is required or authorized by law.

We may collect, use or disclose your personal health information without your consent where permitted or required by law, including for purposes such as public health reporting, the management and administration of the health care system, risk management, quality improvement or other activities authorized under applicable legislation.

If we wish to use or disclose your personal health information for a purpose that is not otherwise permitted, required by law, or related to providing your health care, we will explain the purpose and obtain your consent before doing so.

Osler collects personal health information from you primarily for the purpose of providing, supporting and coordinating appropriate health care and related services. Whenever possible, we collect information directly from you.

If you are unable to provide the information needed for your care, we may collect it from another person authorized to act on your behalf, such as your substitute decision-maker, or from other health care providers and organizations that are or have been involved in your care, where permitted or required by law.

We may also collect personal health information about you from sources other than yourself with your consent or where authorized or required by applicable legislation.

Osler collects only the personal health information that is reasonably necessary to fulfill the identified purpose. Where other information can reasonably serve the same purpose, personal health information will not be collected.

Osler uses and discloses your personal health information for the purpose of providing, supporting and coordinating appropriate health care and related services or as permitted or authorized by law.

Access to your personal health information is limited to individuals who require the information to perform their duties and authorized responsibilities.

We may use your personal health information to:

• Provide, coordinate, and support your care and treatment
• Plan, administer, evaluate, monitor and improve the quality, safety, effectiveness and delivery of health care services and programs
• Conduct chart reviews, quality assurance activities, patient safety initiatives, risk management activities and service improvement projects
• Public health purposes
• Monitor, investigate and prevent fraud, misuse of services, unauthorized access or unauthorized receipt of services or benefits
• Educate students, residents, staff and other authorized agents involved in the delivery of health care, subject to appropriate privacy and confidentiality safeguards
• Contact you regarding your care experience, including gathering information about your satisfaction with, or concerns about, services you received to support continuous quality improvement
• Meet legal, regulatory, accreditation, financial, audit, reporting and accountability requirements

Subject to applicable legislation, Osler or its Foundation may contact you regarding fundraising activities. Where required by law, you will be provided with an opportunity to decline or opt out of future fundraising communications.

In certain circumstances, authorized health care providers who are not directly employed by Osler may also access your electronic medical record where necessary to provide care or support health system operations. This may include credentialed physicians and health care providers affiliated with partner organizations and care networks, such as primary health providers, public health, Compass, Trillium Gift of Life Network, family health teams and other authorized clinical partners. Access is granted only where permitted by law, supported by information-sharing arrangements, where appropriate and limited to serve the purpose for which it was disclosed.

Osler is a member of shared health information systems. These shared systems permit health care providers with the ability to securely access and use electronic patient health information. This access ensures the delivery of timelier and people-centred care. The information below highlights the systems that Osler is currently a member of:

• Child Health Network
• ConnectingOntario
• Diagnostic Image Repository Services
• MyChart™
• Ontario Laboratories Information System
• Ontario Clinical Imaging Network
• PocketHealth

Epic Care Everywhere

Epic Care Everywhere allows authorized health care providers involved in your care to securely access relevant personal health information from participating partner hospitals. Osler uses Epic Care Everywhere to support timely, coordinated and people-centred care. If you do not wish for your information to be shared through Epic Care Everywhere, please contact the Privacy Office at Privacy.Office@williamoslerhs.ca or by phone at 905-494-2120 ext. 29466.

Osler takes reasonable steps to ensure that personal health information is as accurate, complete and up to date as necessary for the purposes for which it is used or disclosed. We rely on information provided by you, your authorized representative and other health care providers and organizations involved in your care to maintain the accuracy of your records.

We encourage you to inform us of any changes to your personal information or any inaccuracies in your health record. Subject to applicable legal requirements, you have the right to request access to and correction of your personal health information if you believe it is inaccurate or incomplete.

Where a correction request cannot be made or granted under applicable legislation, you may have the right to require that a statement of disagreement be attached to your record in accordance with legal requirements.

Osler is committed to protecting the privacy, confidentiality, integrity and security of your personal health information. We maintain administrative, technical and physical safeguards that are appropriate to the sensitivity of the information and designed to protect it against theft, loss, unauthorized access, use, disclosure, copying, modification and disposal.

Our staff, physicians, volunteers, learners and other authorized agents are required to comply with Osler's privacy and confidentiality policies and receive education and training regarding their privacy obligations. Individuals with access to personal health information are required to protect its confidentiality and are only permitted to access information necessary to perform their duties.

We use security measures designed to safeguard personal health information, including user authentication, role-based access controls, encryption where appropriate, secure networks and system monitoring. We regularly monitor and audit access to personal health information to help detect and address unauthorized access, use or disclosure.

Osler retains personal health information in accordance with applicable legal, regulatory and operational requirements and securely destroys, deletes or de-identifies records when they are no longer required.

In some cases, Osler may engage third-party service providers, vendors, suppliers or data processors to support the administration of our programs, systems and services. Where these organizations handle personal health information on our behalf, they are contractually required to implement privacy and security safeguards that meet applicable legal requirements and are consistent with Osler's privacy and security standards. We monitor and manage these relationships to help ensure the ongoing protection of personal health information.

Osler has procedures in place to respond to privacy and security incidents, including the investigation, containment, mitigation and notification of privacy breaches where required by law.

Osler is committed to being open and transparent about how we collect, use, disclose, retain and protect personal health information.

We have designated a Privacy Office to oversee compliance with privacy legislation and to respond to privacy-related questions, concerns, investigations and complaints. The Privacy Office can also assist you with requests to access or correct your personal health information, questions about your privacy rights and inquiries regarding Osler's information handling practices.

Subject to applicable legislation, you have the right to:

• Request access to your personal health information
• Request correction of your personal health information if you believe it is inaccurate or incomplete
• Ask questions about how your personal health information is collected, used, disclosed, retained and protected
• Raise concerns or submit a privacy complaint regarding Osler's information practices

If you have a concern about Osler's privacy practices, we encourage you to contact our Privacy Office so that we can review and address your concern. If you are not satisfied with the outcome, you may contact the Information and Privacy Commissioner of Ontario, which oversees compliance with Ontario's health privacy legislation.

Osler maintains a record of your personal health information in accordance with applicable legal, regulatory, and operational requirements. Subject to limited exceptions under applicable legislation, you have the right to access and receive a copy of your personal health information held by Osler.

Many health records, including test results, clinical reports, and visit information, are available online through MyChart, Osler’s secure patient portal. Patients are encouraged to access their information through MyChart where available.

You can also request access to your medical record by submitting a written request to Osler's Health Information Management (HIM) Department. Osler may need to verify your identity before records are released to help protect your privacy and the confidentiality of your information.

Osler will respond to your access request within 30 days, as required by law. In certain circumstances, including where responding to the request would unreasonably interfere with hospital operations or requires a lengthy search, the response period may be extended in accordance with applicable legislation. If an extension is required, you will be notified of the reason and the length of the extension.

You may request correction of your personal health information if you believe the information is inaccurate or incomplete. Requests for correction should be submitted in writing and supported by information that explains the requested change. Osler will make reasonable efforts to correct records that are demonstrated to be inaccurate or incomplete. If Osler declines a correction request, you may have the right to submit a statement of disagreement, which will be attached to the record in accordance with applicable legislation.

In limited circumstances permitted by law, access to all or part of a record may be denied, such as where disclosure could reasonably be expected to result in a risk of serious harm, reveal information about another individual, or otherwise meet a legislated exemption. Where access is denied, you will be provided with the reason, unless prohibited by law, and information about available review or complaint processes.

For access to your own personal health information/medical record contact Osler's HIM office.

Osler is committed to embedding privacy and security into the design and operation of our programs, services, technologies and business processes.

As part of our commitment to innovation and high-quality patient care, Osler may use technologies that incorporate artificial intelligence (AI) capabilities. AI tools can help analyze large volumes of information, including personal health information where authorized, to support activities such as patient care, health system planning, hospital capacity management, quality improvement, clinical decision support, operational efficiency and administrative process automation.

Osler implements appropriate privacy, security and governance safeguards when evaluating, developing, deploying and using AI-enabled technologies. The use of AI is subject to applicable legal, regulatory, ethical and organizational requirements, including measures designed to protect the confidentiality, integrity and security of personal health information.

Osler is committed to transparency regarding the use of AI-enabled technologies and providing information about how personal information is collected, used, disclosed and protected in connection with these tools.

AI-enabled systems are evaluated before implementation and monitored on an ongoing basis to help ensure they remain accurate, reliable, effective and appropriate for their intended use. Osler also considers the potential for bias and unintended impacts when assessing AI-enabled technologies and takes steps to promote fair, responsible and appropriate use.

AI is used to support, not replace, human expertise and professional judgment. Clinical decisions affecting patient care are reviewed and made by qualified health care professionals, who remain responsible for the care and treatment decisions provided to patients.

Osler is committed to complying with applicable privacy legislation and maintaining responsible information handling practices. The Freedom of Information and Privacy Office is responsible for overseeing Osler's privacy program, investigating privacy concerns and complaints, responding to privacy inquiries and supporting individuals in exercising their privacy rights under applicable legislation.

You may contact Osler's Freedom of Information and Privacy Office with any questions, concerns or complaints regarding the collection, use, disclosure, retention, protection or management of your personal health information, or regarding Osler's compliance with its privacy obligations.

Freedom of Information and Privacy Office
Phone: 905-494-2120 ext. 29466
Contact us through our online privacy feedback form

Osler will review and investigate privacy concerns and complaints in accordance with its privacy policies and applicable legislation. We encourage individuals to raise concerns directly with us so that we may work to address and resolve them.

If you are not satisfied with Osler's response to your privacy concern, complaint, access request, or correction request, you have the right to contact the Information and Privacy Commissioner of Ontario (IPC), which oversees compliance with the Personal Health Information Protection Act, 2004 (PHIPA) and Freedom of Information and Protection of Privacy Act (FIPPA).

Information and Privacy Commissioner of Ontario
2 Bloor Street East, Suite 1400
Toronto, ON M4W 1A8
Telephone: 416-326-3333
Toll-Free: 1-800-387-0073