Access and Release of Information

Procedure

Category: Privacy
Subject: Access and Release of Information
Division: Human Resources and Corporate Services
Procedure Number: CA.58.02.104
Effective Date: June 27, 2016

Wellington-Dufferin-Guelph Public Health (WDGPH) recognizes that, except in special circumstances, a person has the right to access and/or request a copy of their own personal and confidential information as well as general information held by the Agency.

The Personal Health Information Protection Act (PHIPA) specifically applies to personal health information[1]  and supersedes the Municipal Freedom of Information and Protection of Privacy Act (MFIPPA).

Sources of Requests
  1. Client Requests from Regulatory Colleges

All requests for records from regulatory colleges as defined in the Regulated Health Professions Act must be forwarded to the Chief Privacy Officer (CPO) for processing.

  1. Client Requests from Legal Sources (including police and court order)

All requests for records from law enforcement agencies or by a court or tribunal must be forwarded to the CPO for processing.

  1. Direct Client Requests

Direct client requests are those made by an individual requesting a copy of his/her own personal information held by WDGPH. The requests may be routine/informal or formal requests. Requests may be made in person, by email, or by telephone.  Requested records may be sent by email, fax, or mail, or they may be viewed on site.

Responding to the Client’s Request

Regardless of the source, WDGPH must respond within 30 days of receiving a completed Access Request. In some cases, the time limit can be extended. The person requesting information will be informed in writing of any extensions as soon as possible (i.e. an extension may be needed when a request involves searching a large volume of records).

Fees

The application fee will normally be waived for all requests. When additional costs are incurred by WDGPH including locating, retrieving, processing and copying a record, fees may be charged to the person requesting the information. Fees are determined by guidelines provided by application legislation and direct costs incurred by WDGPH.

If the fees are anticipated to be more than $25.00, the person requesting the information will be given a fee estimate. If the estimate of fees to be paid is $100.00 or more, the requester will be required to pay a 50% non-refundable deposit. Any applicable fees for processing requests will be considered on a case-by-case basis, and determined by the CPO.

Payments may be made by cash, cheque (payable to WDGPH), or credit card. A processing fee may be applied to credit card payments over $50.

PROCEDURE

Client Accessing/Obtaining Copies of Information
  1.  Routine/Informal Request

General Information

WDGPH will release most general records as part of our routine disclosure practices. General inquiries of publicly available information, such as available on the internet, or other public source should be provided at the time of the request by the employee receiving the request.

When the record is related to a specific division or program; managers will designate staff to provide records under the custody and control of that division/program.

Confidential Client Information

This normally occurs when a client is in person receiving WDGPH services and self-requests a copy of their own information, or contacts WDGPH regarding their own personal health records or that of their minor child.

In person:

  • A copy will be provided and a note will be recorded in the appropriate record as identified within each department/program confirming the request, date and information provided.
  • Receipt of information will be confirmed by the client using the CA.30.01.801 Acknowledgement of Receipt of Confidential Information form, or stamp.

By telephone, email, text, fax:

  • The identity of the requester will be confirmed by the designated staff prior to providing confidential information. If the request is received through a telephone conversation, the identity will be confirmed by asking the caller to provide several pieces of personal information that can be matched to the record or chart.
  • Immunization records and personal health information reports (lab reports) can be emailed:
    • Only if the requester initiates this method;
    • Once the WDGPH agent has advised the requester of the security risks for this method of release, and offered alternatives to release;
    • Once the WDGPH agent has obtained the permission and confirmation from the requester that they were advised of the risks for this method of release; and has obtained confirmation of identity of the requester by asking the requester to provide several pieces of personal information that can be matched to the record or chart; and
    • Once acknowledged and identity is confirmed, the requester is advised to email WDGPH requesting their document be emailed back to that same email address. WDGPH staff will use the reply function on the email to provide an immunization record or medical report, therefore preventing any misdirection of a typed email address.
  • Email releases must not be initiated by the agents of WDGPH unless it is a secure email system, e.g. ONE Mail (used by physicians, clinics, other medical providers on the ONE Mail system).
  1. Formal Request

Once the request has been identified as a formal request per the definition in this document, the following steps should occur:

  1. The requester will:
  • Complete a CA.30.01.800 Access/Correction Request form; and
  • If the requester is acting as an agent on someone’s behalf, a signed CA.30.01.802 Consent to Release Confidential Information form or equivalent, must be completed from that individual which authorizes the agent to act on their behalf.
  1. Upon receiving  the completed form or equivalent, the CPO/designate will:
  • Log the request on the CA.30.01.804 Formal Access and Release of Information Request Tracking and Analysis Form;
  • Contact the Manager of the program identified and inform them about the request;
  • Confirm with the requester the scope of the request; advise other managers/departments if the requests include their department;
  • Confirm the process and set due dates when records need to be received; and
  • Contact legal counsel if necessary.
  1. The Manager(s) will:
  • Determine how long it will take to reply to the request;
  • Within in five business days of receiving the request, advise the CPO  if an extension is needed to search for the information, and if it involves a third party; and provide an estimate of the costs, if any involved in processing the request, by completing the CA.30.01.803 Fee Estimate form;
  • Ensure the search for record(s) is completed, and that all search activities are documented;
  • Make two complete copies of the records. All copies must be single-sided on letter or legal paper, and fastened with paperclips (not stapled);
  • Review records and redact one copy accordingly, identifying the section of the Act that applies. Redacting can be done either with a black marker or by using correction tape, ensuring that all text being removed is not visible (Sharpie type markers are not appropriate for redacting purposes, the preferred marker is legal crayon/pencil); and
  • Forward both copies (redacted and non-redacted) of all responsive records to the CPO.  The copies must be either delivered by hand or sent by interoffice mail in a sealed plain envelope, inside a sealed interoffice envelope marked “confidential”.

Redacting a Paper Document 

Before providing the final document:

  • Use opaque (100% impenetrable by light; neither transparent nor translucent) marker, tape or paper to cover over the sections to be redacted. Do not use plain-paper as the copier may pick up images through the paper. Even some black paper may allow some light reflection – you must ensure redaction is completed as required; or
  • Cut-out (literally) all the text to be redacted and properly dispose of (shred) the clippings. This method will always be 100% effective.
  1. The CPO/designate, within 30 days of receiving the completed application and fee, if applicable, will:
  • Advise the requester if an extension is needed;
  • Send the requester a decision letter once the request is reviewed:
    If the request is approved, the letter will indicate:
    • If additional fees for processing are required;
    • If third-party notices are needed; and
    • If there is a time extension required. 

If the request is denied, the letter will indicate:

  • The reasons for denying the application; and
  • The right to appeal to the IPC;
  • Collect the fees – if applicable;
  • Contact the requester to let them know the copy of the record is available and make arrangements for delivery. If the requester is picking up the records, the location must be identified so that the records can be available;
  • Reasonable efforts need to be made to physically confirm the identity of the requester prior to releasing information. E.g. when the information is picked up requesting proof of identification or calling the requester prior to releasing information and speaking with them to make arrangements for delivery;
  • Document in the client file that the record was picked up and identity was confirmed; and
  • Complete the CA.30.01.805 Request Tracking and Analysis form and keep forms and all documentation related to the request on file and send a copy of the letter to the Manager for the file.
Right to Review Record – On Site

If a requester chooses to review records on site, the following process occurs:

  • The requester will advise WDGPH of this request (email, or CA.30.01.800 Access/Correction Request form).
  • Once the request is received, the Manager or designate will contact the requester to set up an appointment for the review of the records. Review of records requires and appointment and cannot be done on a drop-in basis.
  • The Manager will review the records prior to the appointment to ensure there is no third party information. If there are records which need redacting, the Manager will copy, review and redact, and provide the redacted copies of the records for the requester to review.
  • The Manager must advise the requester there are redacted records which we are unable to disclose under the Act.
  • The review should be done in a private space with the Manager/designate present during the review.
  • During the review, the requester can request a copy of a page(s) of the record. These can be identified and copied after the records have been reviewed, and provided to the requester.
  • The requester is not permitted to take any of the original records.
  • If copies of any records are released, the Manager/designate must make a note on the file indicating the date and information provided.

This process may differ if this is a legal request with a court warrant or subpoena. For clarity in handling cases such as these consult the CPO or designate.

Correcting Information

WDGPH will respond to correction requests as soon as possible and within 30 days of receiving the request. If an extension is required, the requester will receive a letter to explain the reason for the extension and the date a response is expected.

When a requester wants to correct his or her personal information:

  1. The requester will contact WDGPH.
  2. The requester will be asked to complete a CA.30.01.800 Access/Correction Request form. Advise the requester of how to locate the form on our website or arrange to forward them the form.
  3. The CPO/Designate will:
  • Review and log the request;
  • Confirm the requester’s identity;
  • Follow-up with the requester if information is incorrect;
  • Decide if the correction will be made by consulting with Manager to investigate and advise; and
  • Write to the requester if an extension is needed (include reason and date for response).

If the request is approved, the CPO will:

  • Ensure the original, incorrect information is replaced with the correct information following the documentation standards set out by the college of the regulated professional making the correction;
  • Inform everyone who uses the record that the information has been corrected; and
  • Write a letter to the requester to inform them that the correction has been made, including the original information and the corrected information.

If the request is denied, the CPO will:

  • Send a response to correction letter advising  the requester why the request is denied;
  • Attach a memo to the file of the decision; and
  • Inform them of their right to appeal this decision with the IPC.

There are limited exceptions to WDGPH’s (custodian) duty to correct an individual’s personal health information when:

  • A custodian believes on reasonable grounds that a request for correction is frivolous or vexatious or made in bad faith;
  • Personal health information consists of a record that was not originally created by the custodian, and the custodian does not have sufficient knowledge, expertise and authority to correct it; or
  • It consists of a professional opinion or observation that a custodian has made in good faith about the individual.

WDGPH Contact Information:

Chief Privacy Officer
Wellington-Dufferin-Guelph Public Health
160 Chancellors Way,
Guelph, ON N1G 0E1
1-800-265-7293 ext. 2975

Appealing a Decision

A requester can choose to appeal a decision if they disagree with the way WDGPH handled their request and as such, a requester may appeal the decision to the Information and Privacy Commissioner (IPC).

To make an appeal, a requester must:

  • Contact the IPC within 30 days of receiving a decision from WDGPH;
  • Forward and complete an Access/Correction Complaint form http://www.ipc.on.ca/images/Resources/up-accfrm_e.pdf; or
  • Forward a written letter to the IPC:
    Information and Privacy Commissioner
    2 Bloor Street East, Suite 1400, Toronto, ON M4W 1A8 
    1-416-326-3333  |  1-800-387-0073  |  www.ipc.on.ca

DEFINITIONS

Record – Any information that is in print, on film or electronic.  This can include correspondence, memorandum, books, plans, maps, drawings, diagrams, photographs, microfilms, sound recordings, videotapes, or machine-readable records.

Confidential Information – Includes personal information, personal health information and sensitive information for non-person entities.

Chief Privacy Officer (CPO) or Designate – Oversees all matters related to Privacy on behalf of the MOH, whose roles and responsibilities include:

  • Accountable for the implementation and maintenance of WDGPH’s privacy and security program;
  • Ensure compliance with rules set out in PHIPA, MFIPPA, and WDGPH’s privacy policies;
  • Ensure that all Board of Health members and agents of WDGPH are informed of their privacy related obligations;
  • Respond to inquiries from the public about WDGPH’s information practices;
  • Respond to requests of a person for access to, or correction of,  personal or personal health information in the custody, or under the control of, WDGPH; and
  • Receive complaints about any alleged violation of privacy obligations.

Formal Requests – Are submitted in writing and include records that may require significant review or processing before release:

  • Information that may include third party details;
  • General records not available to the public (dog bite report, any health record); and
  • Require processing and review by CPO before release.

Informal or Routine Requests – Unless there is a statutory requirement or exception in MFIPPA or PHIPA not to release information, routine disclosures of general records are encouraged and include:

  • Information that does not include third party details;
  • Immunization records – self requested or for minor dependent (under the age of 16);
  • Self-requested personal test results;
  • Self-requested attendance records for groups, classes and courses delivered by WDGPH;
  • General records otherwise available to the public (inspection reports, brochures, business information, etc.);
  • Routine inspection reports of food establishments, pools, some small water systems, personal service settings; and
  • Requires little or no processing before release.

Redact – edit (text) for publication or to censor or obscure (part of a text) for legal or security purposes. For the purposes of WDGPH, this would include all third party information in a requester’s record.

REFERENCES AND RELATED FORMS, POLICIES AND PROCEDURES

Corresponding Policy:  CA.58.01.100 Privacy Governance  
Appendix A Access to Information Schedule of Fees (attached)
CA.30.01.800 Access/Correction Request
CA.30.01.801 Acknowledgement of Receipt of Confidential Information
CA.30.01.802 Consent to Release Information
CA.30.01.803 Fee Estimate
CA.30.01.804 Formal Access and Release of Information Request Tracking and Analysis Form
CA.30.01.805 Request Tracking and Analysis (Formal Requests)

CONTACT FOR INQUIRIES

Director, Human Resources and Corporate Services

APPROVED BY

Director, Human Resources and Corporate Services

APPENDIX A

Access to Information
Schedule of Fees

Individuals can make a request to access general records or personal information (about themselves) or request a correction of personal information using the Access/Correction Request Form

Completed forms can be dropped off in person or mailed to:

Chief Privacy Officer
Wellington-Dufferin-Guelph Public Health
160 Chancellors Way,
Guelph Ontario N1G 0E1

Personal requests fee schedule (applicable to both MFIPPA and PHIPA)

Activity:

Cost:

Application fee

$5.00 (Agency will determine if applicable)

Photocopying

$0.20 per page

Diskette/CD’s

$10.00 each

Computer programming – if needed to develop a
program to retrieve information

$15.00 per ¼ hour

Appeal fee to the IPC

$10.00

General request received under MFIPPA:

Activity:

Cost:

Application fee

$5.00

Time spent manually searching for records

$7.50 per ¼ hour

Records preparation for disclosure

$7.50 per ¼ hour

Photocopying

$0.20 per page

Diskette/CD’s

$10.00 each

Computer programming – if needed to develop a
program to retrieve information

$15.00 per ¼ hour

Appeal fee to the IPC

$25.00

Note:  PHIPA fees can only be charged for disclosing personal health information to third parties that amounts to cost recovery (what it cost WDGPH to process the request). Fees should not be charged to an individual requesting their own records.