Paramedic Services Statement of Privacy Practices

Paramedic Services and privacy law

Halton Region Paramedic Services operates 24 hours a day, seven days a week to provide urgent medical care and transportation services to sick or injured individuals. Paramedic Services also participates in community paramedicine programs to improve care for seniors and individuals with complex chronic conditions. This includes in-home health monitoring and supporting referrals to the Mississauga Halton Local Health Integration Network (LHIN) Home and Community Care. In the course of providing these health care services and programs personal health information is often collected, used and disclosed.

As a health care provider, Paramedic Services is subject to the Personal Health Information Protection Act, 2004 (external link)(PHIPA), which governs the collection, use and disclosure (sharing) of personal health information within the health care sector. Under (PHIPA), you have privacy rights over personal health information collected by Paramedic Services while Paramedic Services has privacy obligations to the individuals it serves. Below are details about why and how Paramedic Services collects and manages personal health information, and how your rights over your personal health information are supported.

Collection, use and disclosure of your personal health information

To provide you with health care services and programs, Paramedic Services collects, uses and discloses the following personal health information:

• name, address and date of birth;
• health card number;
• facts about the situation being attended to or service being provided; and
• current and past health history, including use of medications.

Paramedic Services attempts to collect information directly from you. Paramedic Services may also collect personal health information indirectly from other individuals available at an incident scene to ensure appropriate and timely care. For example, as a result of tiered 911 medical calls, police and fire services may attend an emergency scene first and collect and document personal health information on behalf of Paramedic Services. When providing in-home monitoring, information about you may be collected from a family member or from your family doctor to better understand your care needs.

At times, Paramedic Services will use and disclose personal health information for purposes other than providing health care, such as managing and evaluating our services and programs or to comply with other legislation, such as reporting child abuse. (PHIPA) permits Paramedic Services to use and disclose personal health information for these and other authorized purposes.

Your consent rights

Typically, Paramedic Services is required to get your consent before collecting, using or disclosing your personal health information for health care purposes.

When providing urgent medical care and transportation services, Paramedic Services often relies on implied consent to collect, use and disclose personal health information. If you are unconscious or unable to give consent, we will collect, use and disclose personal health information, sometimes from other individuals, to provide urgent medical care until you indicate otherwise. When you request or agree to receive our health care services, such as agreeing to be transported from one hospital to another, your implied consent gives Paramedic Services permission to collect and disclose personal health information from and to relevant health care providers.

When providing community paramedicine programs and when sharing personal health information with people who are not health care providers, such as family, Paramedic Services obtains express consent (verbal or written permission) to collect, use and disclose personal health information. When express consent is required, Paramedic Services will provide you with information about why we need to collect, use and/or disclose personal health information and who that information will be collected from or shared with to help you make an informed decision.

While receiving services you can inform our paramedics of any restrictions you want placed on the collection, use or disclosure of your personal health information for health care. Paramedic Services will, however, continue to use and disclose your personal health information for purposes that are permitted or required by legislation.

Withdrawing your consent

You, or your substitute decision-maker, have the right to withdraw consent for the further collection, use and disclosure of your personal health information for health care services. Consent cannot be withdrawn for the use or disclosure of personal health information that has already occurred. Since withdrawing consent may have an impact on the health care you receive we will discuss those impacts with you to help you make a knowledgeable decision.

Safeguarding and managing your personal health information

Protecting your personal health information and respecting an individual's privacy rights is of high importance to Halton Region Paramedic Services. Under (PHIPA), any person or organization acting on behalf of Paramedic Services has a duty to comply with (PHIPA) when handling personal health information. Paramedic Services has implemented information management practices and a comprehensive privacy and security program to ensure the privacy and security of personal health information, including:

• assigning roles and responsibilities for managing and reporting on the Paramedic Services privacy program and its compliance with (PHIPA);
• maintaining a culture of privacy by holding mandatory and ongoing privacy training for staff;
• having policies and procedures to guide staff on obtaining an individual's consent and appropriately handling personal health information;
• restricting access to personal health information to authorized staff on a need-to-know basis;
• ensuring privacy and security requirements are enforced in agreements with staff and third-party providers of electronic systems that manage and store personal health information for Paramedic Services;
• using security controls to safeguard personal health information and prevent security breaches such as firewalls on our computer network and encrypting mobile devices;
• logging and auditing staff access to personal health information in electronic systems; and
• implementing a privacy breach response protocol to ensure privacy breaches are contained, investigated and remediated as necessary and that affected individuals are notified.

Access to and correction of your personal health information

Under (PHIPA), you have a right to request access to and a correction of your personal health information held by Paramedic Services, except in limited circumstances. Requests for access to personal health information maintained by Paramedic Services must be submitted in writing. Either you or a person acting on your behalf, such as a substitute decision-maker or a lawyer, can make the request. A form and instructions on making this request is available on halton.ca. Submit the access or correction request to:

Inquiries/complaints

Under (PHIPA), you have a right to ask questions and file complaints about how Paramedic Services collects, uses, discloses and manages personal health information or how it supports your rights for consent, access and correction requests and complaints. To ask a privacy question or make a privacy complaint, please contact:

Information and privacy commissioners

You have a right to formally complain about how Paramedic Services collects, uses, discloses and manages personal health information or how it supports your rights for consent, access and correction requests and complaints. These complaints are managed by the Information and Privacy Commissioner of Ontario (external link)(IPC), which is external to the Region and oversees compliance with (PHIPA). The IPC can be reached at: