Privacy of personal information is an important principle to the Courtenay Vickers RD (CVRD). CVRD is committed to collecting, using, and disclosing personal information responsibly and only to the extent necessary for the services offered. CVRD tries to be open and transparent about how personal information is handled. This document describes our privacy policies.

What is Personal Health Information?

Personal health information is information about an identifiable individual. Personal health information includes information that relates to:

• the physical or mental health of the individual (including family health history).

• the provision of health care to the individual (including identifying the individual’s health care provider).

• community and home care services.

• payments or eligibility for health care or coverage for health care.

• the donation or testing of an individual’s body part or bodily substance.

• the individual’s health number; or

• the identification of the individual’s substitute decision-maker.

Who is Courtenay Vickers RD

Courtenay Vickers RD is a virtual private practice that includes, at the time of writing, only 1 staff. CVRD uses a number of consultants and agencies that may, in the course of their duties, have limited access to the personal health information held at CVRD. These include but are not limited to computer consultants, bookkeepers and accountants, lawyers, credit card companies, and website managers. CVRD restricts their access to any personal information held as much as is reasonably possible. CVRD also has assurance that they follow appropriate privacy principles.

Why Courtenay Vickers RD Collects Personal Health Information

CVRD will collect, use, and disclose personal information in order to serve clients. For clients with CVRD, the primary purpose for collecting personal health information is to provide nutrition counselling. For example, CVRD will collect information about a client’s health history, including their family history, physical condition and function and social situation in order to help assess what their health needs are, to advise them of their options and then to provide the health care they choose to have. A second primary purpose is to obtain a baseline of health and social information so that in providing ongoing health services, CVRD can identify changes that are occurring over time.

CVRD will also collect, use, and disclose personal health information for purposes related to or secondary to our primary purposes. The most common examples of our related and secondary purposes are as follows:

Related Purpose #1: To obtain payment for services or goods provided. Payment may be obtained from the individual, private insurers or others.

Related Purpose #2: To conduct quality improvement and risk management activities. CVRD will review client files to ensure that clients receive high-quality services, including assessing the performance of staff. External consultants (e.g. auditors, lawyers, practice consultants, voluntary accreditation programs) may conduct audits and quality improvement reviews on behalf of CVRD.

Related Purpose #3: To comply with external regulators. Professionals at CVRD are regulated by the College of Dietitians of Ontario who may inspect records and interview staff of CVRD as a part of its regulatory activities in the public interest. The College of Dietitians of Ontario has its own strict confidentiality and privacy obligations. In addition, as professionals, CVRD will report serious misconduct, incompetence, or incapacity of other practitioners, whether they belong to other organizations or CVRD. Also, CVRD believes that it should report information suggesting illegal behaviour to the authorities. In addition, CVRD may be required by law to disclose personal health information to various government agencies (e.g., the Ministry of Health, and Long-Term Care, children’s aid societies, Canada Customs and Revenue Agency, Information and Privacy Commissioner, Ontario, etc.).

Related Purpose #4: To educate staff and students. CVRD values the education and development of future and current professionals. CVRD will review client records in order to educate future staff and students about the provision of health care.

Protecting Personal Information

CVRD understands the importance of protecting personal information. For that reason, CVRD has taken the following steps:

• Paper information is either under supervision or secured in a locked or restricted area.

• Electronic hardware is either under supervision or secured in a locked or restricted area at all times. In addition, strong passwords are used on all computers and mobile devices.

• Personal health information is only stored on mobile devices if necessary. All personal health information stored on mobile devices is protected by strong encryption.

• Paper information is transferred through sealed, addressed envelopes or boxes by reputable companies with strong privacy policies.

• Electronic information is either anonymized or encrypted before being transmitted.

• CVRD does not post any personal information about clients on social media sites.

• External consultants and agencies with access to personal information must enter into privacy agreements with CVRD.

Retention and Destruction of Personal Information

CVRD needs to retain personal information for some time to ensure that any questions you might have about the services provided are answered, and for accountability to external regulatory bodies.

CVRD keeps client files for at least ten years from the date of the last client interaction if the client was younger than 18 at the date of the last visit, at least 10 years after the date that the client turns, or would have turned, 18 years of age. Paper files containing personal health information by shredding. Electronic information is destroyed by deleting it in a manner that it cannot be restored. When hardware is discarded, it ensured that the hardware is physically destroyed, or the data is erased or overwritten in a manner that the information cannot be recovered.

You Can Look at Your Records

With only a few exceptions, you have the right to see what personal information is held about you, by contacting hello@courtenayvickersrd. CVRD can help you identify what records we have about you. CVRD will also try to help you understand any information you do not understand (e.g., short forms, technical language, etc.). CVRD will need to confirm your identity before providing you with this access. CVRD reserves the right to charge $30.00 for the first twenty pages of records and 25 cents for each additional page. CVRD may ask you to put your request in writing and will respond to your request within 30 days, if at all possible. If CVRD cannot give you access, you will be notified the reason why, as best we can. If you believe there is a mistake in the information, you have the right to ask for it to be corrected. This applies to factual information and not to any professional opinions CVRD may have formed. CVRD may ask you to provide documentation that our files are wrong. Where CVRD agrees that a mistake has been made, CVRD will correct it. At your request and where it is reasonably possible, CVRD will notify anyone to whom was sent this information (but CVRD may deny your request if it would not reasonably have an effect on the ongoing provision of health care). If CVRD does not agree that a mistake was made, CVRD will still agree to include in our file a brief statement from you on the point.

If there is a Privacy Breach

While CVRD will take precautions to avoid any breach of your privacy, if there is a loss, theft, or unauthorized access of your personal health information, CVRD will notify you.

Upon learning of a possible or known breach, the following steps will be taken:

• We will contain the breach to the best of our ability, including by taking the following steps if applicable

• Retrieving hard copies of personal health information that have been disclosed

• Ensuring no copies have been made

• Taking steps to prevent unauthorized access to electronic information (e.g., change passwords, restrict access, temporarily shut down system)

• We will notify affected individuals

• We will provide our contact information in case the individual has further questions

• We will provide the Commissioner’s contact information and advise the affected individual of their right to complain to the Commissioner

We will investigate and remediate the problem, by:

• Conducting an internal investigation

• Determining what steps should be taken to prevent future breaches (e.g. changes to policies, additional safeguards)

• Ensuring staff is appropriately trained and conduct further training if required

• Depending on the circumstances of the breach, CVRD may notify and work with the Information and Privacy Commissioner of Ontario. We may also report the breach to the relevant regulatory College if it is believed that it was the result of professional misconduct, incompetence, or incapacity.

Do You Have Questions or Concerns?

If any client or prospective clients have any questions or concerns about the privacy practices at CVRD or this Privacy Policy, please contact: Courtenay Vickers RD at hello@courtenayvickersrd.com

You also have the right to complain to the Information and Privacy Commissioner of Ontario if you have concerns about the privacy practices at CVRD or how your personal health information has been handled, by contacting:

Information and Privacy Commissioner/Ontario
2 Bloor Street East, Suite 1400
Toronto, Ontario M4W 1A8
Telephone: Toronto Area (416/local 905): (416) 326-3333
Long Distance: 1 (800) 387-0073 (within Ontario)
TDD/TTY: (416) 325-7539
FAX: (416) 325-9195
www.ipc.on.ca

Courtenay Vickers RD reserves the right to modify this Privacy Policy anytime. Any changes will be effective immediately upon posting the revised policy.