Privacy Policy

VHA collects PHI about its clients for the purpose of providing nursing, personal support, homemaking, rehabilitation services and extreme cleaning services, as well as evaluating, quality monitoring, improvement and auditing (including accreditation surveys and professional college audits) and risk management with respect to those services.
VHA collects PI from its employees, independent contractors and volunteers for the purpose of fulfilling legal and contractual obligations as well as management requirements within the employer/contractor relationship and for the protection of the clients that it serves.

VHA Personnel responsible for the collection of PI/PHI shall identify, before or at the time of collection, the purpose for collecting the information.

If PI/PHI is necessary to a research project, the guidelines set out by the Information Privacy Commissioner will be followed, i.e., an application or proposal must be submitted and reviewed by an ethics panel or research ethics board and, if approved, the researchers must sign confidentiality agreements and no identifiable PI/PHI will be included in the research report or article.
If PI/PHI is to be subsequently used for any other purposes (i.e., outreach, public advocacy) those purposes will be specifically communicated to the individual and consent obtained prior to that use.
VHA shall not collect PI/PHI without legitimate purpose. Except as otherwise required by law, both the amount and type of information collected will be limited to what is reasonably necessary to fulfill the purposes for collection.
A summary notice with respect to an individual’s privacy rights at VHA, including the collection, use and disclosure of information, shall be posted on VHA’s website. The website shall also include available contact information for VHA’s Privacy Officer as well as the Information Privacy Commissioner of Ontario.

Complete copies of VHA’s policies and procedures regarding privacy shall be posted on VHA’s intranet, The ‘Loop’.

VHA Personnel responsible for the collection of PI/PHI must ensure that each individual understands and consents to the collection, use, disclosure and dissemination of their PI/PHI.

Consent may be communicated either in writing or verbally and may be express or implied depending on the circumstances and as prescribed by law. In all instances, consent regarding the collection, use and disclosure of PHI must be documented. VHA’s current templates and forms should be used, as appropriate.

If assuring knowledge and acquiring consent is impossible or inappropriate because the individual to whom the information pertains lacks capacity, the appointed substitute decision-maker must give consent. If there is no substitute decision-maker or the substitute is unavailable, direction must be obtained from an appropriate VHA manager or the Privacy Officer.

At no time shall consent be forced or obtained through deception.

An individual can withdraw their consent at any time as long as doing so meets all legal or contractual obligations and the individual provides reasonable notice. VHA Personnel shall refer any request to withdraw to the appropriate manager who will handle withdrawals of consent in consultation with the Privacy Officer. The manager is responsible for explaining to the individual the implications of the withdrawal of consent. In the case of a client withdrawing consent, VHA may or may not be able to continue service to the client without collection of, access to, or communication of the PHI at issue.

Where at all possible and reasonable, withdrawal of consent should be in writing and signed by the individual or substitute decision-maker.

Any withdrawal of consent applies to future situations and consent may not be withdrawn retroactively.

All VHA Personnel shall sign a confidentiality agreement at the start of their employment/term with VHA and shall annually re-confirm this agreement and their commitment to continue following VHA’s Confidentiality, Non-Solicitation, and Conflict of Interest Policy with respect to all confidential information at VHA, including PI/PHI.

All contractors/agents/suppliers to VHA who will have access to personal information will sign a confidentiality agreement as part of their contract with VHA, and before commencing any work for VHA, that confirms that the confidentiality of VHA information will be maintained and securely stored, at all times. VHA’s Privacy Officer may conduct privacy audits of suppliers/contractors and independent contractors, as necessary, to ensure ongoing compliance with their obligation to confidentiality.

VHA Personnel shall only have access to PI/PHI on a “need-to-know” basis and system controls are in place to ensure that access is only granted based on the individual’s medical/paramedical/therapeutic and administrative duties as assigned. Accessing information for any other purpose will be deemed a disclosure, access or use that requires prior approval or attention and response by the Privacy Officer.

Clients and employees asking to obtain copies of their client/employee records must submit a formal access request in writing. Client requests are to be submitted to the Records Management Coordinator and employee requests are to be submitted to the attention of the Human Resources (HR) Manager. All such requests must contain appropriate information to positively identify the client/employee and be signed by the client/employee and/or substitute decision maker.

The HR Manager/Records Department will provide a response to the access request within a reasonable period of time, depending on the circumstances, but not more than 10 business days. The HR Manager/Records Department may exercise discretion not to permit review/release of portions of the record if releasing it may harm the physical or mental well-being of the client/employee. The HR Manager/Records Department will not deny access without first consulting with the Privacy Officer. The client/employee may appeal the denial of access to the Privacy Officer and then further to the President/CEO, if necessary.

For copies of client records/employee files to be sent externally, for example, requests by lawyers, insurance companies and other third parties, authorization and consent in writing by the client/employee must first be obtained. Upon confirming consent, any copied records to be sent to external parties must be sent using appropriately secure means and indicate that the information being sent is strictly confidential, only for the use of the identified recipient, and only for the identified/requested purpose. VHA may charge a reasonable fee to lawyers, insurance companies and other third parties requesting photocopies of client/employee files.

The release of original client records is permitted only under special circumstances (i.e., court subpoena) upon approval from VHA’s Privacy Officer.

No PHI/PI will be released without the written consent of the client/employee except as required by law or in the event of an emergency threatening the health or safety of the client/employee or the health and safety of the public, or in accordance with the exceptions outlined in PHIPA.

Any access to PI/PHI via patient portals or employee self-serve portals made directly by patients/their delegates or employees, respectively, are not considered formal access requests. Such access is not required to follow the procedures described above nor is such access tracked or reported within VHA.

PI/PHI shall never be disclosed or shared via social media. VHA Personnel shall always follow VHA’s Social Media policy when dealing with social media platforms.