What is Personal Health Information?

Personal health information means identifying information about an individual relating to their physical or mental health (including medical history), the providing of health care to the individual, payments or eligibility for health care, organ and tissue donation and health number.

We collect the following personal information:

• Identification and contact information (name, address, date of birth, telephone number, emergency contact, etc.)

• Billing information (provincial plan and/or private insurer)

• Health information (symptoms, diagnosis, medical history, test results, reports and treatment, record of allergies, prescriptions, etc.)

Collection, Use and Disclosure of Personal Information by Elysian

1. Accountability

We take our commitment to securing patient privacy very seriously. Each provider, contractor, and employee associated with our Clinics are responsible for the personal information under his/her control. Our employees are informed about the importance of privacy and receive information periodically to update them about our Privacy Policy and related issues. Our Chief Medical and Privacy Officers are responsible for the monitoring and continuous improvement of our privacy policies and procedures.

2. Purpose: Why do we collect your personal information?

We ask you for information to establish a relationship and serve your medical needs. We obtain most of our information about you directly from you, or from other health practitioners whom you have seen and authorized to disclose to us. We will limit the information we collect to what we need for those purposes, and we will use it only for those purposes. We do not collect any other information, or allow information to be used for other purposes, without your express (i.e., verbal, written or electronic) consent.

3. Consent

By virtue of seeking care from us, your consent is implied (i.e., assumed) for your information to be used by this office to provide you with that care, and to share with other health care providers involved in your care.

You can withdraw your consent to us collecting your personal information or having your information shared with other health care providers or other parties at any time by giving us reasonable notice, except where the collection or disclosure is authorized or required by law; healthcare providers may override the consent directive in certain circumstances, such as emergencies. However, please discuss this with your physician first so we can explain the possible consequences of withdrawing consent.

4. Limiting Collection

We collect information by fair and lawful means. We collect only that information which may be necessary for purposes related to the provision of your medical care.

5. Limiting Use, Disclosure and Retention

The information we request from you is used for the purposes defined. We will seek your consent before using the information for purposes beyond the scope of the posted Privacy Statement.

Under no circumstances do we sell patient lists or other personal information to third parties. There are some types of disclosure of your personal health information that may occur as part of this Practice fulfilling its routine obligations in providing care, and practice management. Examples include suppliers of electronic medical records, visiting consultants and other care providers, and suppliers to the Practice. These external agents can only interact with Elysian with the understanding that they abide by our Privacy Policy, PIPA and other governing statutes, and only to the extent necessary to allow them to provide business services or support to this Practice.

By law, medical records need to be retained for 16 years after a medical encounter, or PHI is received. We will retain your information only for the time it is required by law.

When and to whom do we disclose personal information?

• Disclosure to other health care providers: Your implied consent extends to us sharing your personal information with other providers involved in your care, including (but not limited to) other physicians and specialists, pharmacists, lab technicians, nutritionists, physiotherapists and occupational therapists. Each of these practitioners are expected to fully respect your privacy and confidentiality.

• Disclosures authorized by law: There are limited situations where we are legally required to disclose your personal information without your consent. These situations include (but are not limited to) billing MSP, provincial health plans, reporting infectious diseases and fitness to drive, or by court order.

• Disclosures to all other parties: Your express consent is required before we will disclose your information to third parties for any purpose other than to provide you with care or unless we are authorized to do so by law. Examples of disclosures to other parties requiring your express consent include (but are not limited to) third parties who are conducting medical examinations for purposes not related to the provision of care, enrolment in clinical (research) trials and provision of charts or chart summaries to insurance companies.

6. Accuracy

We make every effort to ensure that all of your information is recorded accurately. If you find errors of fact in your personal health information, please notify us as soon as possible and we will make the appropriate corrections, and we will make a note in your record regarding our inaccuracy. We are not required to correct information relating to clinical observations, diagnoses or opinions made in good faith, but you have a right to append a short statement of disagreement to your record if we are unable to make a requested change.

7. Safeguards: Protecting Your Information

Elysian maintains personal information in a combination of paper and electronic files. Recent paper records concerning individuals’ personal information are stored in files kept onsite at our offices. Older records will be scanned and electronically archived in your electronic medical record. Safeguards are in place to protect the security of your information. These safeguards include a combination of physical, technological and administrative security measures that are appropriate to the sensitivity of the information. These safeguards are aimed at protecting personal information against loss or theft, as well as unauthorized access, disclosure, copying, use or modification.

Access to personal information will be authorized only for Elysian providers and employees, and other agents who require access in the performance of their duties, and to those otherwise authorized by law.

We provide information to health care providers acting on your behalf, (such as referring physicians, or external medical consultants) on the understanding that they are also bound by law and ethics to safeguard your privacy. Other organizations and agents must agree to abide by our Privacy Policy and may be asked to sign contracts to that effect. We will give them only the information necessary to perform the services for which they are engaged, and will require that they not store, use or disclose the information for purposes other than to carry out those services.

Our computer systems are password-secured and constructed in such a way that only authorized individuals can access secure systems and databases.

If you send us an e-mail message that includes personal information, such as your name included in the "address", we will use that information to respond to your inquiry. Please remember that e-mail is not necessarily secure against interception. If your communication is very sensitive, you should not send it electronically unless the e-mail is encrypted or your browser indicates that the access is secure.

Specific procedures are in place for communicating by phone, email, fax, and post/courier.

We retain patient records for a minimum period of 16 years, or as otherwise required by law and professional regulations.

When information is no longer required, it is destroyed in an irreversible and secure manner, in accordance with set procedures of the College of Physicians and Surgeons of BC that govern the storage and destruction of personal information.

8. Openness: Keeping You Informed

The Practice has prepared this plain-language Privacy Policy to keep you informed. You may view a copy by visiting our website at www.elysianhealth.ca.

If you have any additional questions or concerns about privacy, we invite you to contact us by phone and we will address your concerns to the best of our ability.

9. How can records be accessed?

You have the right to access your record in a timely manner. We may need to see identification prior to providing access. You may request a copy of your record, for a minimal fee (the information is yours, but there are costs of printing and other incidentals). If you wish to view the original record, one of our staff must be present to maintain the integrity of the record, and a minimal fee may be charged for this access. Patient requests for access to your medical record can be made verbally or in writing to your provider or the staff at Elysian.

In extremely rare circumstances you may be denied access to your records, for example if providing access would create a significant risk to you or to another person.

If we deny your request to access your personal information, we will advise you in writing of the reason for the refusal and you may then challenge our decision.

10. Challenging our compliance

We encourage you to contact us with any questions or concerns you might have about your privacy or our Privacy Policy. We will investigate and respond to your concerns about any aspect of our handling of your information.

In most cases, an issue is resolved simply by telling us about it and discussing it. If, after contacting us, you believe that this office has not replied to your access request or has not handled your personal information in a reasonable manner or in accordance with PIPA, you may choose to make a complaint to the College of Physicians and Surgeons of BC or the Information & Privacy Commissioner for BC.

Rev 1.0 Date Dec 24th 2020