Why have hospitals been added under the legislation?
Access to information held by public institutions is vital for a free and functioning democratic society. This is a welcome step toward a culture of greater transparency and accountability in hospitals. It also addresses that Ontario is the only Canadian province in which hospitals were not covered by freedom of information legislation.
Aren’t hospitals already covered under the Personal Health Information Protection Act (PHIPA)?
Yes, hospitals have been covered under the Personal Health Information Protection Act (PHIPA) since 2004. However, PHIPA only governs the collection, use and disclosure of personal health information and not other types of information.
Under PHIPA, you are entitled to request access to your own records of personal health information, including hospital records. PHIPA also allows a substitute decision-maker to access records of personal health information on behalf of another individual in defined circumstances.
Every hospital has a designated contact person, usually called a privacy officer, to facilitate these requests for health records and resolve privacy complaints under PHIPA. Please click here for accessing your own personal health information.
What changes with the introduction of FIPPA to hospitals?
With the introduction of FIPPA, individuals have a much broader right of access to records held by hospitals. For example, an individual may request access to records under a hospital’s custody or control relating to:
- Administrative and operational functions
- Financial considerations and decisions
- Personal information
There are a number of exemptions and exclusions from the right of access. For example, where the disclosure of a record could reasonably be expected to interfere with a law enforcement matter, it may be exempt from disclosure. Another example, records that relate to the operations of a hospital foundation are excluded from the right of access.
When do I have to use FIPPA to get information?
The Ontario government and other public bodies, including GRH routinely make a lot of information available to the public. Individuals can look at the websites or contact the privacy and access office to see if they can get the information they need without submitting a FIPPA application.When information is not available informally or through another process, a formal request for access can be made under FIPPA.
How do I request information under FIPPA?
1. Complete a FIPPA application form in PDF format.
2. Describe the records you wish to access as clearly and as specifically as possible. Include your name, address and telephone (or fax) number where you can be reached.
3. Sign the form and keep a copy for your reference.
4. Mail the completed form and the $5 application fee to the GRH privacy and access office, or bring your form and fee into the GRH health information management department.
Where do I send my completed FIPPA form and application fee?
GRH privacy and access office
P.O Box 9056, 835 King St. West
Kitchener, ON, N2G 1G3
When will I get a response to my FIPPA request?
In most cases, you should receive a response from GRH within 30 days, unless GRH requires a time extension. If you do not receive a response within the 30 day period, you may submit a complaint to the Information and Privacy Commission via their website.
When can the hospital take more than 30 days to reply?
The hospital may extend the time limit for up to an additional 30 days, or longer if:
- If the applicant does not provide enough detail to enable the hospital to identify the requested records
- If the hospital needs time to consult with a third party or another hospital/public body before deciding whether to grant access
- If a large number of records is requested and responding within 30 days would interfere unreasonably with the operations of the hospital
- If a third party makes a complaint to the Information and Privacy Commission about a decision to grant access
If the hospital wants to extend the response time limit, you will be informed in writing of the reason for the extension and given the new date by which a response may be expected.
How do I find out if I will be charged and how much it will be?
If you have to pay a fee, in addition to the $5 application fee, the hospital will send you a fee estimate before providing the service. You will have 30 days to notify the hospital if you wish to pay the fee or want to modify the request in order to reduce the fee. If the fee is expected to exceed $100 you may be asked to send in 50% of the fee before the hospital proceeds in processing your request.
If you do not reply to a fee estimate within 30 days, the hospital may consider the application to have been abandoned. If you receive a fee estimate that you think is unreasonable, you may submit a complaint to the Information and Privacy Commission.
Can fees be waived under FIPPA?
FIPPA includes a discretionary fee waiver provision. If you would like your fees waived, you must send a request to the hospital. Fees may be waived if the hospital believes that:
- Paying the fees would impose an unreasonable financial hardship on the applicant, or
- The applicant is requesting access to his or her own personal information and a waiver is reasonable and fair in the circumstances, or
- The records relate to a matter of public interest concerning public health, safety or the environment.
The hospital will inform you in writing of its decision about waiving the fees. You may submit a complaint to the Information and Privacy Commission if the hospital refuses to waive all or part of the fees.
What kind of response can I expect?
The hospital will reply to your request in the way that you have specify on your form. If access is granted, you will be informed when and how access to the records will be given. If you are denied access to all or some of the requested records, you will be advised of the specific FIPPA exemptions on which the refusal is based and the reason that this exemption applies. You will be notified of the information by a member of the privacy and access office who can answer questions about the refusal. You will also be informed of your right to complain to the Information and Privacy Commission about the refusal.
When an exemption to disclosure applies to part(s) of the record, this information will not be disclosed. However, the remainder of the document will be provided to you. A blank space or a heavy black line and a FIPPA section number for the applicable exemption to access will appear in place of the severed information on the copy of the record provided to you. Please click here for more information on excluded and exempt records.
What can I do if I am not satisfied with the response?
If you are not satisfied with the hospital’s response to your FIPPA request, you may submit a complaint to the Information and Privacy Commission (IPC). The IPC is an independent reviewer with broad investigative, auditing and reporting powers under FIPPA. You may complain to the IPC for a number of reasons including if:
- You have not received a response to your application within 30 days;
- You do not believe the extension of the response time beyond 30 days is appropriate;
- You have been denied access to all or part of the records for which you applied;
- Your request for correction of your personal information has been refused;
- A hospital refuses to waive all or part of estimated fees;
- You believe your own personal information has been collected, used, or disclosed in violation of FIPPA;
- As a third party, you wish to contest a decision of the hospital to give access to records against your wishes;
- You are the relative of a deceased person who has been refused access to that person’s personal information by a public body.
Generally, the complaint must be made within 30 days after being notified of the decision. The IPC will investigate your complaint and will to try to resolve it informally, to the satisfaction of the parties and in a manner consistent with the purposes of FIPPA. If the complaint cannot be resolved informally and is found to be supportable, the IPC will make recommendations to the hospital. Written notification of the IPC's findings and any recommendations to the hospital will be sent to you, when the investigation is completed.
What is a record?
FIPPA applies to all records in the custody or under the control of the hospital. A ‘record’ is information in any form and includes information that is written, photographed, recorded or stored in any manner on any storage medium or by any means including graphic, electronic or mechanical. It does not include electronic software or any mechanism that produces records.
Does FIPPA give me the right to access my personnel files if I work for a private company?
FIPPA does not apply to the private sector. The Canadian Personal Information and Electronic Documents Act (PIPEDA) protects employee information in the federally-regulated private sector, as well as personal information of customers. At the present time there is no requirement that private sector businesses in Ontario provide their employees with access to personnel files. Some companies do so by internal policy or procedure.
What is personal information?
Personal information is any kind of recorded information about an identifiable individual. It includes:
- Your name;
- Your home address or home telephone number, facsimile or email;
- Your age, sex, sexual orientation, marital or family status;
- Your ancestry, race, colour, nationality, national or ethnic origin;
- Your religion or creed, or religious belief, association or activity;
- Your personal health information;
- Your blood type, fingerprints or other hereditary characteristic;
- Your political belief, association or activity;
- Your education, employment or occupation, or educational, employment or occupational history;
- Your source of income or financial circumstances, activities or history;
- Your criminal history, including regulatory offences;
- Personal views or opinions, except if they are about another person;
- Views and opinions expressed about you by another person; and
- Identifying numbers, symbols or other particulars assigned to you.
When a hospital asks me for personal information, can the hospital then give that information to someone else without my knowledge?
FIPPA limits the disclosure of personal information without the consent of the individual. However, it does authorize disclosure in certain circumstances such as verification of an individual’s eligibility in a program, collection of a debt or fine, or enforcement of maintenance orders.
What can I do if I think that a hospital has misused or improperly disclosed my personal information?
You may contact the privacy and access office to discuss your concerns or fill out a complaint form in Microsoft Word format and send it to firstname.lastname@example.org or by mail to:
GRH privacy and access officeIf you are dissatisfied with the public body’s response or explanation, you may make a complaint to the Information and Privacy Commission.
P.O Box 9056, 835 King St. West
Kitchener, ON, N2G 1G3