Background

This policy is based on the guidelines outlined in the Personal Information Protection and Electronic Documents Act (PIPEDA) 2004. The Act provides requirements for the collection, use, retention, disclosure and disposal of personal information in the private sector. The purpose of this policy is to assist staff and volunteers in complying with the Privacy Legislation.

Definitions

Personal Information

Factual or subjective information recorded or not about an identifiable individual includes:

• age, name, income, ethnic origin, social status
• opinions, evaluations, comments or disciplinary actions
• employee files, medical records

Personal information does not include name, title or business address or telephone number of an employee of an organization.

Consent

Voluntary agreement with what is being done or proposed. Consent can be either expressed or implied. Expressed consent is given explicitly, orally or in writing. Implied consent arises where consent may reasonably be inferred from the action or non-action of the individual.

Disclosure

Making personal information available to others outside the organization.

Use

Refers to the treatment and handling of personal information within an organization.

Personal Health Information

Information about an identifiable individual who is living or deceased, recorded or not, that relates to his/her physical or mental health or well-being, provision of healthcare, eligibility of healthcare or registration information.

Registration Information

Refers to information relating to an individual collected or created for registering the individual in connection with a custodian’s services or benefits such as name, address, telephone number, date of birth and signature. Does not include information about the individual’s health status or health care.

Policy

Accountability

All staff and volunteers are responsible for maintaining and protecting personal information. Delta Hospital and Community Health Foundation has designated the Executive Director as Privacy Officer. Other individuals may be delegated to be responsible for the day-to-day collection and processing of personal information. The Privacy statement on the website contains information about the Delta Hospital and Community Health Foundation’s policies.

Identifying purpose

The purposes for collecting personal and health related information are identified before or at the time of collection and may be done orally or in writing. The primary purpose for collection is related to registration, provision of services and recognition of financial contributions. Those who collect information on behalf of Delta Hospital and Community Health Foundation respond to questions about collection purposes in a timely manner.

Consent

Consent, whether expressed or implied is to be knowledgeable and related to the purpose of collection. For consent to be knowledgeable, identified purpose must include the information most people would want to know. An individual’s consent should be obtained for collection and use of information. Expressed consent may be withdrawn at anytime verbally or in writing with reasonable notice. In situations where it is reasonable to believe a person’s action puts themselves or others at risk, consent may not be obtained prior to action being taken.

Limiting Collection

The collection of personal information shall be limited to that necessary for the purposes identified by the organization for service provision and fundraising. Information will be collected by fair and lawful means.

Limiting use, disclosure and retention

Personal information shall be used only for the purpose for which it is collected, except with the consent of the individual or as required by law. Personal information shall be retained for time periods necessary to achieve purpose and in accordance with appropriate legislation. Personal information that is no longer required to fulfill the identified purpose will be destroyed as per Record Retention Procedures. Personal information may be disclosed as aggregate or statistical data that has been de-identified ensuring anonymity of individual. Personal information collected for fundraising activity is not sold, tracked or shared with any other organization.

Accuracy

Personal information shall be as accurate, complete and up to date as is necessary for the purpose for which it is to be used.

Safeguards

Personal information shall be protected by security safeguards appropriate to the sensitivity of the information.

Openness

Information regarding the policies and procedures for management of personal information is provided to clients, family members, community and employees through open and transparent means such as website, registration forms, publications and oral communication.

Individual Access

An individual is informed of the existence, use and disclosure of his/her personal information. Within 30 days of receipt of a written request, the individual shall be given access to that information. Individuals have the right to request correction of personal information that is demonstrated to be incomplete or inaccurate. When the request for correction is not resolved to the satisfaction of the individual, a note is documented on the file and the individual is informed of the Privacy Commissioner of British Columbia and provided contact information.

Challenging Compliance / Providing Recourse

An individual shall be informed of the procedure regarding compliance with privacy and protection of personal information by the designated individual or individuals accountable for the organization’s compliance.

Complaints

An individual may complain to Delta Hospital and Community Health Foundation’s Privacy Officer who can be reached by email at [email protected] or 604.940.9695 or fax: 604.940.9670. If the response is not satisfactory, an individual may complain, in writing, to: Chair of the Board of Directors
Delta Hospital and Community Health Foundation
5800 Mountain View Boulevard
Delta, BC V4K 3V6 If the matter cannot be resolved, an individual may file a complaint with the Privacy Commissioner of Canada about any alleged breaches of the law.