| |
Protection of Privacy Policy
BACKGROUND
The following policy is in place at Canadian Therapeutic
College in compliance with the requirements of the Personal
Information Protection and Electronic Documents Act (PIPEDA).
This is federal legislation which is intended to provide
Canadians with a right of privacy with respect to their
personal information that is collected, used or disclosed by
an organization in the private sector in an era in which
technology increasingly facilitates the collection and free
flow of information.
1. THE ACT IN BRIEF
Organizations covered by the Act must obtain an individual's
consent when they collect, use or disclose the individual's
personal information. The individual has a right to access
personal information held by an organization and to
challenge its accuracy, if need be. Personal information
can only be used for the purposes for which it was
collected. If an organization is going to use it for
another purpose, consent must be obtained again.
Individuals should also be assured that their information
will be protected by specific safeguards, including measures
such as locked cabinets, computer passwords or encryption.
2. PRIVACY PRINCIPLES
The following privacy provisions are based on the Canadian
Standards Association's Model Code for the Protection
of Personal Information, recognized as a national
standard in 1996. These standards are a central part of
PIPEDA.
|
► |
Accountability: An organization is responsible for
personal information under its control and shall designate
an individual or individuals who are accountable for the
organization's compliance with the following principles |
|
► |
Identifying Purposes: The purposes for which personal
information is collected shall be identified by the
organization at or before the time the information is
collected. |
|
► |
Consent: The knowledge and consent of the individual
are required for the collection, use or disclosure of
personal information, except when inappropriate. |
|
► |
Limiting Collection: The collection of personal
information shall be limited to that which is necessary for
the purposes identified by the organization. Information
shall be collected by fair and lawful means. |
|
► |
Limiting Use, Disclosure, and Retention: Personal
information shall not be used or disclosed for purposes
other than those for which it was collected, except with the
consent of the individual or as required by the law.
Personal information shall be retained only as long as
necessary for fulfillment of those purposes. |
|
► |
Accuracy: Personal information shall be as accurate,
complete, and up-to-date as is necessary for the purposes
for which it is to be used. |
|
► |
Safeguards: Personal information shall be protected
by security safeguards appropriate to the sensitivity of the
information. |
|
► |
Openness: An organization shall make readily
available to individuals specific information about its
policies and practices relating to the management of
personal information. |
|
► |
Individual Access: Upon request, an individual shall
be informed of the existence, use and disclosure of his or
her personal information and shall be given access to that
information. An individual shall be able to challenge the
accuracy and completeness of the information and have it
amended as appropriate. |
|
► |
Challenging Compliance: An individual shall be able
to address a challenge concerning compliance with the above
principles to the designated individual or individuals for
the organization's compliance. |
| |
|
Exceptions
Some groups, such as law enforcement agencies and
journalists, have a lawful or investigative need to collect,
use and disclose personal information without having to
obtain the consent of the concerned individuals. For these
reasons, certain exemptions are included: |
|
► |
personal information collected, used or disclosed solely for
journalistic, artistic or literary purposes; |
|
► |
if the action clearly benefits the individual or if
obtaining permission could infringe on the information's
accuracy; |
|
► |
where such data can contribute to a legal investigation or
aid in an emergency where people's lives and safety could be
at stake; and |
|
► |
if disclosure aids, in times of emergency, matters of legal
investigation, or facilitates the conservation of
historically important records. |
POLICY
Privacy of personal information is an important principle to
Canadian Therapeutic College. We are committed to collecting, using
and disclosing personal information responsibly and only to the
extent necessary for the goods and services we provide. We also try
to be open and transparent as to how we handle personal
information. This document describes our privacy policies.
WHAT IS PERSONAL INFORMATION?
Personal information is information about an identifiable
individual. Personal information includes information that relates
to their personal characteristics (e.g., gender, age, income, home
address or phone number, family status), their health (e.g. health
history, health conditions, health services received by them) or
their activities (opinions, evaluations, comments, disciplinary
actions, intentions). Personal information is to be contrasted with
business information (e.g., an individual's business address and
telephone number), which is not protected by privacy legislation.
WHO WE ARE
Our organization, Canadian Therapeutic College, is engaged in the
education and training of students who wish to pursue a career in
any of the following professions: Massage Therapy, Sports Injury
Therapy, Paramedic, Dental Assisting and Dental Hygiene. We use a
number of consultants and agencies that may, in the course of their
duties, have limited access to personal information that we hold.
These include an educational consultant, accountants, computer,
website and database consultants. We restrict their access to any
personal information we hold as much as is reasonably possible. We
also have their assurance that they follow appropriate privacy
principles.
WE COLLECT PERSONAL INFORMATION:
PRIMARY PURPOSES
About Students
We collect, use and disclose only that personal information that
allows us to provide quality education to our students in the
following ways:
|
► |
to be able to engage in on-going, up-to-date communication
with a student as to their academic performance and status
at the college; |
|
► |
to allow the college to communicate, efficiently and
effectively, a student's financial status with the college; |
|
► |
to ensure that students are free from communicable diseases
and have no criminal record, in the interest of the
protection of the public; and |
|
► |
to ensure that all parties having business with the college
are treated with fairness, dignity and respect , the
gathering of personal information about a student's
activities may centre around any dispute that may arise
between the college and a student, as well as, any
disciplinary action the college may pursue. |
Examples of the information that we collect are marks, evaluations,
criminal history, certification that the individual is free from
communicable disease, transaction history with the college and notes
related to any dispute or disciplinary action against the
individual.
The personal information that we collect is with the informed
consent of the individual.
About Public Clinic Clients
As teaching clinics we collect only that personal information that
allows us to provide the indicated and requested therapy treatment.
For example, we collect information about a client's health
history, physical condition and function in order to help us assess
what their health needs are, to advise them of their options and
then to provide the health care they choose to have. A second
primary purpose is to obtain a baseline of health information so
that in providing ongoing health services we can identify changes
that are occurring over time. The personal information that we
collect is with the informed consent of the individual.
About Faculty and Employees
Canadian Therapeutic College is dedicated to the pursuit of
excellence in private post-secondary education for health care
professionals. To this end we ask for personal resumes, diplomas,
evidence of certification and police clearance certificates to
ensure a fit between individuals and role requirements and
protection of the public. Information about income, dependants and
beneficiary is required for health and dental coverage. All of this
information is collected and stored with the informed consent of the
individual.
About Contract Staff
For people who are contracted to do work for us (e.g., the
educational consultant, computer and database management
consultants, co-op students) , our primary purpose for collecting
personal information is to ensure we can contact them in the future
(e.g., for new assignments) and for necessary work-related
communications (e.g., sending out pay cheques, year-end tax
receipts). Examples of the type of personal information we collect
for those purposes include home addresses and telephone numbers. It
is rare for us to collect such information without prior consent,
but it might happen in the case of health emergency (e.g., a SARS
outbreak) or to investigate a possible breach of law (e.g., if a
theft were to occur in the clinic).
If contract staff or co-op students wish a letter of reference
or an evaluation, we will collect information about their work
related performance and provide a report as authorized by them.
WE COLLECT PERSONAL INFORMATION:
RELATED AND SECONDARY PURPOSES
Like most organizations, we also collect, use and disclose
information for purposes related to, or secondary to, our primary
purposes. The most common examples of our related and secondary
purposes are as follows:
|
► |
To invoice students for goods or services that were not paid
for at the time, to process credit card payments or to
collect unpaid accounts. |
|
► |
To advise graduates of special events or opportunities
(e.g., seminars, continuing education courses, development
of a new service, arrival of a new product) that we have
available. |
|
► |
Our clinics review client and other files for the purpose of
ensuring that we provide high quality services, including
assessing the performance of our staff. In addition,
external consultants (e.g., auditors, lawyers, practice
consultants, voluntary accreditation programs) may on our
behalf do audits and continuing quality improvement reviews
of our clinics, including reviewing client files and
interviewing our staff. |
|
► |
Massage Therapists are regulated by the College of Massage
Therapists of Ontario, Dental Assistants are regulated by
the Ontario Dental Nurses and Assistants Association,
Primary Care Paramedics are regulated by the Ministry of
Health and Dental Hygienists are regulated by the Dental
Hygiene Association. All of these regulating bodies may
inspect the records of our faculty or employees who are
Registered Massage Therapists, Dental Assistants, Paramedics
and Dental Hygienists as part of their regulatory activities
in the public interest. In addition, as professionals,
these faculty members and employees will report serious
misconduct, incompetence or incapacity of other
practitioners, whether they belong to other organizations or
our own. Also, our organization believes that it should
report information suggesting serious illegal behaviour to
the authorities. External regulators have their own strict
privacy obligations. Sometimes these reports include
personal information about our clients, students, or other
individuals, to support the concern (e.g., improper
services). Also, like all organizations, various government
agencies (e.g., Canada Customs and Revenue Agency,
Information and Privacy Commissioner, Human Rights
Commission, etc.) have the authority to review our files and
interview our staff as a part of their mandates. In these
circumstances, we may consult with professionals (e.g.,
lawyers, accountants) who will investigate the matter and
report back to us. |
|
► |
The College may share personal student information with the
Ministry of Education, The Ontario Student Assistant
Program, Banks, Faculty, Administration, Support staff and
the College's Financial Auditors. |
|
► |
The cost of some goods/services provided by the organization
to students is paid for by third parties (e.g., OSAP, HRDC
). These third-party payers often have your consent or
legislative authority to direct us to collect and disclose
to them certain information in order to demonstrate client
entitlement to this funding. |
|
► |
Clients, students and other individuals we deal with may
have questions about our goods or services after they have
been received. We also provide ongoing services for many of
our clinic clients over a period of months or years for
which our previous records are helpful. In order to respond
to any questions, we retain our clinic client information
for two years after the last contact. We retain our student
information for a minimum of 2 years in hard copy and 6
years in electronic format, after the end of their program. |
|
► |
If Canadian Therapeutic College were to be sold, the
purchaser would want to conduct a due diligence review of
the College's records to ensure that it is a viable business
that has been honestly portrayed to the purchaser. This due
diligence may involve some review of our accounting and
service files. The purchaser would not be able to remove or
record personal information. Before being provided access to
the files, the purchaser must provide a written promise to
keep all personal information confidential. Only reputable
purchasers who have already agreed to buy the organization's
business or its assets would be provided access to personal
information, and only for the purpose of completing their
due diligence search prior to closing the purchase. |
Students are given the option to be part of some of these related or
secondary purposes (e.g., by declining to receive notice of special
events or opportunities).
PROTECTING PERSONAL INFORMATION
|
► |
Paper information is either under supervision or secured in
a locked or restricted area. |
|
► |
Electronic hardware is either under supervision or secured
in a locked or restricted area at all times. In addition,
passwords are used in computers. |
|
► |
Paper information is transmitted through sealed, addressed
envelopes or boxes by reputable companies. |
|
► |
Electronic information is transmitted either through a
direct line or is anonymized or encrypted. |
|
► |
All staff are trained to collect, use and disclose personal
information only as necessary to fulfill their duties and in
accordance with our privacy policy. |
|
► |
External consultants and agencies with access to personal
information must enter into privacy agreements with us. |
RETENTION AND DESTRUCTION OF PERSONAL INFORMATION
We need to retain personal information for some time to ensure that
we can answer any questions you might have about the services
provided and for our own accountability to external regulatory
bodies. However, we do not want to keep personal information too
long in order to protect your privacy.
We keep our student files for 2 years in hard copy format and 6
years in electronic format with copies held on and off site. Our
clinic client files are shredded two years after the last contact.
If a clinic client asks, we will remove contact information right
away. We keep any personal information relating to our general
correspondence (i.e., with people who are not students or clients),
newsletters, seminars and marketing activities for about six months
after the newsletter ceases publication or a seminar or marketing
activity is over.
We destroy paper files containing personal information by
shredding. When our files are purged, twice yearly, we contract
with a reputable, bonded company to shred these documents and
provide us with a Certificate of Destruction. We destroy electronic
information by deleting it and, when the hardware is discarded, we
ensure that the hard drive is physically destroyed.
YOU CAN LOOK AT YOUR INFORMATION
With only a few exceptions, you have the right to see what personal
information we hold about you. Often all you have to do is ask. We
can help you identify what records we might have about you. We will
also try to help you understand any information you do not
understand (e.g., short forms, technical language, etc.). We will
need to confirm your identity, if we do not know you, before
providing you with this access. We reserve the right to charge a
nominal fee for such requests based on a per hour rate.
YOU CAN LOOK AT YOUR INFORMATION
We will require that you request to see your file in writing,
directed to the Information Officer. If we cannot give you access,
we will tell you within 30 days if at all possible and tell you the
reason, as best we can, as to why we cannot give you access.
If you believe there is a mistake in the information, you have the
right to ask for it to be corrected. This applies to factual
information and not to any professional opinions we may have
formed. We may ask you to provide documentation that our files are
wrong. Where we agree that we made a mistake, we will make the
correction and notify anyone to whom we sent this information. If
we do not agree that we have made a mistake, we will still agree to
include on our file a brief statement from you on the point and we
will forward that statement to anyone else who received the earlier
information.
DO YOU HAVE A QUESTION?
Our Information Officer, who will attempt to answer any questions or
concerns you might have, can be reached at:
Canadian Therapeutic College
760 Brant Street, Burlington ON L7R 4B7
Telephone: 905 632 3200
Toll Free: 1 877 278 8888
If you wish to make a formal complaint about our privacy practices,
you may make it in writing to our Information Officer, who will
acknowledge receipt of your complaint, ensure that it is
investigated promptly and that you are provided with a formal
decision and reasons in writing.
If you have a concern about the professionalism or competence of our
services or the mental or physical capacity of any of our
professional staff we would ask you to discuss those concerns with
us. If we cannot satisfy your concerns we will provide you with the
contact information for the appropriate regulatory body.
This policy is made under the Personal Information Protection and
Electronic Documents Act. That is a complex Act and provides
some additional exceptions to the privacy principles that are too
detailed to set out here. There are some rare exceptions to the
commitment set out above.
For general inquiries, the Information and Privacy Commissioner of
Canada oversees the administration of the privacy legislation in the
private sector. The Commissioner also acts as a kind of ombudsman
for privacy disputes. The Information and Privacy Commissioner can
be reached at:
112 Kent Street, Ottawa, ON, K1A 1H3
Telephone: 613 995 8210
Toll Free: 1 800 282 1376
www.privcom.gc.ca
|
|
