M.Lucas Psychotherapy Professional Corporation operating as Healing Roots Therapy and Healing Roots Health & Wellness Inc. are committed to protecting the privacy of personal health information. Depending on the services you receive, one or both organizations may collect, use, or disclose your personal health information. Each organization remains independently responsible for complying with its obligations under applicable privacy legislation and safeguarding the personal information under its custody or control.

We are committed to collecting, using and disclosing personal information responsibly and only to the extent necessary for the mental health services we provide. We try to be open and transparent about how we handle personal information. This document describes our privacy policies.

What is Personal Health Information?

Personal health information is information about an identifiable individual. Personal health information includes information that relates to:

• the physical or mental health of the individual (including family health history);
• the provision of health care to the individual (including identifying the individual’s health care provider);
• a plan of service under the Home Care and Community Services Act, 1994;
• payments or eligibility for health care or coverage for health care;
• the donation or testing of an individual’s body part or bodily substance;
• the individual’s health number; or
• the identification of the individual’s substitute decision-maker.

Who We Are

Lucas Psychotherapy Professional Corporation operates as Healing Roots Therapy and provides psychotherapy services.

Healing Roots Health & Wellness Inc. provides other health and wellness services, including psychological assessments conducted by psychologists and psychological associates registered with the College of Psychologists and Behaviour Analysts of Ontario.

Depending on the services you receive, your personal health information will be collected, used, disclosed, and maintained by the appropriate organization. Each organization is independently responsible for complying with its obligations under applicable privacy legislation.

Both of our organizations use a number of consultants and agencies that may, in the course of their duties, have limited access to personal health information we hold. These include computer consultants and security, bookkeepers and accountants, lawyers, Practice Management Software system (Jane), and website managers. We restrict their access to any personal information we hold as much as is reasonably possible. We also have their assurance that they follow appropriate privacy principles.

Why We Collect Personal Health Information

We collect, use and disclose personal information to serve our clients. For our clients, the primary purpose for collecting personal health information is to provide psychotherapy, psychological services, assessments and other health related services that we offer. For example, we collect information about a client’s health history, including their family history, physical condition and function and social situation to help us assess what their health needs are, to advise them of their options and then to provide the health care they choose to have. A second primary purpose is to obtain a baseline of health and social information so that in providing ongoing health services we can identify changes that are occurring over time.

We also collect, use and disclose personal health information for purposes related to or secondary to our primary purposes. The most common examples of our related and secondary purposes are as follows:

Related Purpose #1: To obtain payment for services or goods provided. Payment may be obtained from the individual, private insurers or others.

Related Purpose #2: To promote our clinic, new services, special events and opportunities (e.g. group therapy or psychoeducation workshops) that we have available. We will always obtain express consent from the client prior to using personal health information for this purpose.  You may withdraw your consent to receive marketing communications at any time by contacting our Privacy Officer.

Related Purpose #3: To comply with external regulators. Our professionals are regulated by the College of Registered Psychotherapists of Ontario, Ontario College of Social Workers and Social Service Workers, and College of Psychologists and Behaviour Analysts of Ontario (as applicable to the services provided) who may inspect our records and interview our staff as a part of its regulatory activities in the public interest. The College of Registered Psychotherapists of Ontario has its own strict confidentiality and privacy obligations. In addition, as professionals, we will report serious misconduct, incompetence or incapacity of other practitioners, whether they belong to other organizations or our own. Also, our organization believes that it should report information suggesting illegal behaviour to the authorities. In addition, we may be required by law to disclose personal health information to various government agencies (e.g., Ministry of Health, children’s aid societies, Canada Customs and Revenue Agency, Information and Privacy Commissioner, etc.).

Related Purpose #4: To educate our interns. We value the education and development of future and current professionals. We will review client records to educate our interns and students about the provision of health care.  Where possible, records used for educational purposes will be de-identified or anonymized.  In all cases, only the minimum amount of personal health information necessary for the educational purpose will be used, in accordance with PHIPA s. 38(1)(c).

Personal Health Information and Minors

Under PHIPA, a minor who has the capacity to consent to the collection, use, or disclosure of their personal health information is treated as an adult for all purposes under the Act, including the right to access their own records and to control how their information is used.  Where a minor has the capacity to consent, their personal health information may not be disclosed to a parent or guardian without the minor’s own consent.  Where a minor does not have the capacity to consent, a parent or legal guardian will generally act as the substitute decision-maker (SDM) for purposes of consent and access.  The capacity of a minor to consent will be assessed on an individual basis in accordance with PHIPA and applicable professional standards.  Clients and their SDMs who wish to limit access to a minor’s records should contact our Privacy Officer.

Right to Limit Disclosure of Your Personal Health Information

Under PHIPA s. 20(2), you have the right to instruct us not to disclose your personal health information to specific persons or for specific purposes.  This is sometimes referred to as a “lock-box” request.  If you wish to restrict disclosure of your information, please notify our Privacy Officer in writing.  We will accommodate your request to the extent permitted by law and will advise you of any limitations on our ability to do so.

Protecting Personal Information

We understand the importance of protecting personal information. For that reason, we have taken the following steps:

• Paper information is either under supervision or secured in a locked or restricted area. It is shredded once it is added to a client’s electronic file.
• Electronic hardware is either under supervision or secured in a locked or restricted area at all times. In addition, strong passwords are used on all computers and mobile devices.
• Personal health information is only stored on mobile devices if necessary. All personal health information stored on mobile devices is protected by strong encryption (MFA).
• We try to avoid taking personal health information home to work on there. However, when we do so, we transport, use and store the personal health information securely.
• Paper information is transferred through sealed, addressed envelopes or boxes by reputable companies with strong privacy policies.
• Electronic information is either anonymized or encrypted before being transmitted.
• Our staff members are trained to collect, use and disclose personal information only as necessary to fulfil their duties and in accordance with our privacy policy.
• We do not post any personal information about our clients on social media sites and our staff members are trained on the appropriate use of social media sites.
• External consultants and agencies with access to personal information must enter into privacy agreements with us.

Retention and Destruction of Personal Information

We need to retain personal information for some time to ensure that we can answer any questions you might have about the services provided and for our own accountability to external regulatory bodies. However, to protect your privacy, we do not want to keep personal information for too long.

We keep our client files for at least 10 years from the date of the last client interaction or from the date the client turns 18. We destroy paper files containing personal health information by cross-cut shredding.

We destroy electronic information by deleting it in a manner that it cannot be restored. When hardware is discarded, we ensure that the hardware is physically destroyed or the data is erased or overwritten in a manner that the information cannot be recovered.

Clients Can Look at Their Records

With only a few exceptions, clients have the right to see what personal information we hold about them, by contacting the Privacy Officer. We can help clients identify what records we might have about them. We will also try to help them understand any information they do not understand (e.g., short forms, technical language, etc.). We will need to confirm their identity, if we do not know them, before providing them with this access. We reserve the right to charge $95.00 for the entire record (representing the reasonable costs of retrieval, reproduction, and administration).  This fee may be waived in appropriate circumstances.  Please contact our Privacy Officer if cost is a barrier to accessing your records.

We may ask clients to put their request in writing. We will respond to their request within 30 days, as required by PHIPA s. 54(7).  Where an extension is required in the circumstances permitted by PHIPA, we will notify you of the extension and the reason for it before the end of the initial 30-day period. If we cannot give them access, we will tell them the reason, as best we can, as to why.

If clients believe there is a mistake in the information, they have the right to ask for it to be corrected. This applies to factual information and not to any professional opinions we may have formed. We may ask clients to provide documentation that our files are wrong. Where we agree that we made a mistake we will make the correction. At the client’s request and where it is reasonably possible, we will notify anyone to whom we sent this information (but we may deny their request if it would not reasonably influence the ongoing provision of health care). If we do not agree that we have made a mistake, we will still agree to include in our file a brief statement from the client on the point.

If there is a Privacy Breach

While we will take precautions to avoid any breach of your privacy, if there is a loss, theft or unauthorized access of your personal health information we will notify you. It is important to complete the following form and submit it to our clinic ‘Privacy Officer’ (Operations Manager).

Upon learning of a possible or known breach, we will take the following steps:

• We will contain the breach to the best of our ability, including by taking the following steps if applicable
  • Retrieving hard copies of personal health information that have been disclosed
  • Ensuring no copies have been made
  • Taking steps to prevent unauthorized access to electronic information (e.g., change passwords, restrict access, temporarily shut down system)
• We will notify affected individuals
  • We will provide our contact information in case the individual has further questions
  • We will provide the Commissioner’s contact information and advise the affected individual of their right to complain to the Commissioner
• We will investigate and remediate the problem, by:
  • Conducting an internal investigation
  • Determining what steps should be taken to prevent future breaches (e.g. changes to policies, additional safeguards)
  • Ensuring staff is appropriately trained and conduct further training if required

Where a breach involves personal health information and meets the threshold for notification under PHIPA s. 12.2, we will notify the Information and Privacy Commissioner of Ontario. If we take disciplinary action against one of our practitioners [or revoke or restrict the privileges or affiliation of one of our practitioners] for a privacy breach, we are required to report that to the practitioner’s regulatory College. We may also report the breach to the relevant regulatory College if we believe that it was the result of professional misconduct, incompetence or incapacity.

Practice management records and breach documentation are retained in accordance with our records management policy and applicable regulatory requirements.