The Personal Information Protection and Electronic Documents Act (“PIPEDA”) is federal legislation which was enacted January 1, 2001 and must be complied with no later than January 1, 2004.
Carling Animal Hospital Professional Corporation and Rogecam Ltd, hereinafter referred to as The Practice, comply with PIPEDA and are committed to respecting the privacy rights of all individuals, including clients and employees, by ensuring that their personal information is collected, used and disclosed in an appropriate manner.
The Practice collects personal information about its clients for purposes of effectively communicating with, and providing veterinary medical services to, its clients. The Practice also collects personal information about its employees for purposes of personnel management and administration.
The principals established in the personal information policy of The Practice conform with the requirements with PIPEDA. This personal information policy may be amended if the province of Ontario enacts privacy legislation in the future, to ensure that this policy conforms with such legislation.
The Practice is responsible for all personal information under its control. The owner’s of The Practice have designated an individual who will be accountable for compliance with the personal information policy and procedures. This individual will be known as the “Privacy Officer”. The Practice is committed to protecting personal information and, accordingly, will include an appropriate level of protection in any dealings with third parties who receive personal information from The Practice. The Practice will ensure that its clients, employees and other interested individuals have the opportunity to review and update their personal information on file with The Practice. All such persons will be advised that questions and concerns can be directed to the Privacy Officer.
2. Identifying the Purposes for Collection of Personal Information
The Practice will identify the purposes for which it collects personal information at or before the time the information is collected. The most common related and secondary purposes for the collection of personal information include the following:
i. Enabling The Practice to maintain complete and accurate client files, and to comply with all requirements of the College of Veterinarians of Ontario and the Veterinarians Act and regulations thereto;
ii. Enabling The Practice to communicate effectively with its clients, and to communicate and work with third parties providing services to such clients; and
iii. Enabling The Practice to maintain complete and accurate personnel files; and
iv. Enabling The Practice to invoice clients for goods and services that were not paid for at the time, to process credit card payments or to collect unpaid accounts; and
v. To advise clients that their pet is due for a particular service or procedure or would benefit from a particular service or procedure; and
vi. Enabling The Practice to accommodate requests from or inspections by The College of Veterinarians of Ontario, the licensing body for Veterinarians in the Province of Ontario who may inspect our records as part of their regulatory activities. Furthermore, as professionals, we are obliged to report serious misconduct, incompetence or incapacity of other practitioners, whether they belong to other organizations or our own.
Also, like all organizations, various government agencies (e.g. Canada Customs and Revenue Agency, Information and Privacy Commissioner, Human Rights Commissioner, etc.) have the authority to review our files and interview our staff. In these circumstances, we may consult with professionals (e.g. lawyers, accountants) who will investigate the matter and report back to us; and
vii.In the event The Practice or its assets were to be sold, to enable the purchaser to conduct a “due diligence“ review of The Practice’s records to ensure that it is a viable business that has been honestly portrayed to the purchaser. This due diligence may involve some review of our accounting and client/patient files. The purchaser would not be able to remove personal information. Before being provided access to the files, the purchaser would be required to provide a written promise to keep all personal information confidential; and
viii. To enable the practice to communicate your personal information if required to do so by law, including by an order of any court.
The Practice will identify additional purposes that arise for the collection of personal information. The Practice will communicate such additional purposes to its clients and interested individuals, if it is appropriate in the circumstances to explain the purpose for which the personal information is collected.
The Practice will obtain the consent from individuals for the collection, use or disclosure of their personal information. The Practice will make every effort to obtain the express consent from an individual through the use of a retainer or engagement agreement or other written document through which such personal information is obtained. Implied consent may also be given by an individual. Express consent must be in writing; implied consent will not be in writing, but the circumstances relating to the provision of implied consent shall be such that a reasonable person would conclude that the individual has consented to the collection, use or disclosure of his or her personal information. There may be situations where consent is given verbally, either in person or over the telephone.
The consent of an individual may be withdrawn at any time.
4. Limitations on the Collection of Personal Information
The Practice will only collect personal information which is necessary for our related and secondary purposes which have been identified. Personal information shall be collected by fair and lawful means, and will not be collected for unspecified or improper purposes.
5. Limitation on the Use, Disclosure and Retention of Personal Information
Personal information will not be used or disclosed for purposes other than those for which it was collected, except with the consent of the individual providing the personal information or except where use or disclosure required by law.
As we provide ongoing services for many of our patients and clients over a period of months or years, we retain patient and client records for a minimum of 10 years after the last contact. Furthermore, our regulatory body, the College of Veterinarians of Ontario, also requires us to retain client and patient records.
The Practice will make every reasonable effort to ensure that personal information collected by it will be as accurate, complete and up-to-date as possible for the purposes for which the information is to be used. The Practice will on an ongoing basis make every effort to ensure the accuracy and completeness of personal information under its control.
The Practice shall safeguard and protect personal information under its control by implementing security measures appropriate to the sensitivity of the information.
The Practice shall ensure that its employees keep all personal information confidential and comply with the security standards established by The Practice.
The Practice shall require third parties to whom personal information is disclosed to commit to an appropriate level of security in protection of such information to satisfy the standards established by The Practice and/or may be required to enter into privacy and security agreements with us.
On the disposal or destruction of personal information, The Practice shall take the necessary precautions to prevent third parties from accessing such information and to maintain the confidentiality of such information.
The Practice will make available to any interested individual specific information about The Practice’s policies and procedures relating to personal information which is under the control of The Practice. The Practice will facilitate access to its personal information policies and procedures, and will make available information concerning the identity of its Privacy Officer, and the means by which a person can communicate with the Privacy Officer. The Practice will also ensure that individuals are aware of the means of gaining access to their personal information.
9. Individual Access to Personal Information
An individual providing personal information to The Practice will be informed about the existence, use and disclosure of his or her personal information, and will be given access to and the right to ensure the accuracy and completeness of such information. An individual will be able to address the accuracy and completeness of his or her personal information and have it amended, if inaccurate or incomplete.
The Practice will respond promptly to any request by an individual for access to his or her personal information. The Practice will maintain a complete record of third parties to whom personal information has been disclosed, and will make such record available to an individual whose personal information has been so disclosed.
10. PIPEDA and CASL
The Practice recognizes both Industry Canada and CRTC statements that existing express consent obtained in compliance with PIPEDA will be considered compliant with CASL going forward. As such, if the Practice obtained valid expressed consent prior to CASL coming into force it will continue to rely on that express consent after CASL comes into force, even if the Practice's original request for express consent under PIPEDA may not contain the required identification and contact information under CASL.
11. Questions and Concerns Regarding the Compliance Policy
An individual providing personal information to The Practice may address any question, concern or complaint regarding The Practice’s compliance with this personal information policy to the Privacy Officer.
Our Privacy Officer, Paul Reinhardt, may be contacted at The Practice (2268 Carling Ave., Ottawa, Ontario K2B 7G1), telephone: (613) 725-0310 ext 240, facsimile: (613) 725-3219 or email:firstname.lastname@example.org
The Practice will establish a procedure for processing any complaint about the personal information policy to ensure that all complaints are dealt with in an objective, fair and expeditious manner.
The Information and Privacy Commissioner may be reached at: 112 Kent Street Ottawa, Ontario K1A 1H3 Tel: (613)995-8210 Fax: (613) 947-6850 11/27/03