MEDICAL CONFIDENCE
PRIVACY POLICY
About Medical Confidence
Medical Confidence Inc. (“Medical Confidence”) is a Canadian organization whose mission is to empower consumers of the Canadian healthcare system. We help individuals understand their health-related circumstances and access the ideal physician specialist(s) so that they become engaged in their treatment and have the best possible outcome.
Our services are provided both by traditional means as well as with the help of digital media where individuals interact with Medical Confidence interactively through web facilities where the individual can enroll by creating an account that enables the individual to provide personal information as well as Personal Health Information (PHI) to Medical Confidence and to access that information.
The online interactive services Medical Confidence provides include referrals designed to assist individuals and their health care providers to source the physician specialists whose services are required to meet the individual’s needs as identified by their health practitioner, as well as health-related applications and web-based tools. Medical Confidence does not provide medical advice or opinions to individuals.
Privacy Practices
Medical Confidence takes every possible precaution to ensure that the Personal Health Information (PHI) collected from individuals who access our services is protected, kept secure and managed in accordance with the terms of this policy.
In our work to empower healthcare consumers, Medical Confidence collects, uses and discloses PHI in partnership with appropriate healthcare professionals. We also collect PHI through health-related applications and web-based tools and share that information only as disclosed in the context of the particular application. At Medical Confidence we are committed to meeting the highest standard of ethics with respect to maintaining the privacy and confidentiality of the PHI we collect, use and disclose. We meet or exceed all legal requirements, including Ontario’s Personal Health Information Protection Act, 2004 (PHIPA) and Canada’s Personal Information and Protection of Electronic Documents Act (PIPEDA).
Every client, employee, volunteer, healthcare provider, contractor and authorized agent of Medical Confidence must adhere to our PHI management and privacy policies at all times.
Frequently Asked Questions
What is Personal Health Information (PHI)?
PHI includes an individual’s identifying information (name, contact details, etc.) along with any and all information about an individual’s health or healthcare history.
What PHI does Medical Confidence collect?
Medical Confidence collects and stores various types of PHI. Typically, we collect this information from individuals (patients) themselves and/or the individual’s Primary Care Practitioner, or from the concerned individual through health-related applications and web-based tools. This information is used to identify the ideal physician specialist(s) the individual should see and/or point the individual towards the optimal resource(s) within the Canadian healthcare system, or in the case of health-related applications and web-based tools, to support the service that the application provides.
Medical Confidence will only collect PHI that is essential for the task at hand (i.e., identifying the ideal MedConfidence Specialist who can best treat and meet the needs of the individual in question). The information we collect may include an individual’s name, date of birth, preferred language spoken (English/French), emergency contact information, current treating specialist and primary care practitioner’s name and contact details.
Health-related information we collect may include an individual’s family medical history, past and current conditions, symptoms, provincial health card number, any known allergies, body mass index, blood type, blood pressure, activities of daily living (e.g., food habits, exercise frequency, alcohol frequency, smoking frequency, etc.), current medications and dosages, diagnostic testing/imaging results, and specialist consultation and/or operative reports.
PHI is collected from individuals accessing our services, their treating medical practitioner(s) and/or any other individual(s) authorized to act on that individual’s behalf.
In the event we are contracted by and providing services directly to an individual (as opposed to through an organization), Medical Confidence collects all appropriate payment-related information directly from the individual by email or phone and is used solely for the purpose of processing the individual client’s request. Medical Confidence does not save this information after the payment has been processed.
De-identified information may be used for statistical purposes to help us improve our business practices and optimize our products and service delivery.
When does Medical Confidence share PHI?
We will share an individual’s PHI (once we have obtained that individual’s consent) with the physician specialist (or a member of his/her staff) to whom that individual is being referred for healthcare services. This information is typically shared by way of telephone discussion or electronic communications (i.e., fax or email). In the case of health-related applications and web-based tools, the information is typically shared with our client as disclosed in the application.
We may also be required by law or a Court Order to share certain PHI.
We will only share PHI with other professionals, agencies and providers who are involved in the care and treatment of an individual client if the individual or his/her substitute decision-maker provides consent for us to do so.
Medical Confidence does not share or sell PHI to any other third parties.
How does Medical Confidence ensure the safety and security of PHI?
Medical Confidence recognizes the importance of safeguarding PHI and will take all steps that are reasonable in the circumstances to ensure it is protected against theft, loss or unauthorized use or disclosure. We will also ensure that the records containing this information are protected against unauthorized copying, modification or disposal.
To ensure the safe storage of PHI, we have taken steps to meet the need for physical security, technological security and administrative controls. The measures we have taken for the physical security of the PHI records we maintain include restricting office access to unauthorized individuals and maintaining all records in a secure location.
The PHI records we maintain are kept in electronic format. Such records are protected through technological security measures we have taken including the use of passwords, firewalls, anti-virus software and encryption of all mobile electronic devices and of all information transmitted electronically.
What does Medical Confidence do in the event of a Privacy Breach?
In the event that an individual’s PHI has been stolen, lost or accessed by an unauthorized person, our first priority is to identify and contain the breach, and then to take steps to correct it. Where the information was provided to us by a health information custodian, we will immediately notify the custodian of the breach. Where the information was provided to us directly by an individual, we will notify said individual of the situation in accordance with applicable privacy legislations.
How long does Medical Confidence retain PHI?
Our policy is to retain personal health information records for seven (7) years after the referral facilitated by Medical Confidence is made or after use of the information has been completed. However, Medical Confidence will maintain records in accordance with any minimum retention period that is established by law.
How does Medical Confidence dispose of PHI?
When PHI records are to be destroyed, Medical Confidence will use safeguards to ensure secure destruction, including entering into a written agreement with any agent retained to dispose of PHI records, which will set out the requirements for secure disposal and require the agent to confirm in writing that secure disposal has occurred.
What if an individual needs access to his/her PHI?
Where Medical Confidence receives PHI from physicians and uses such information on behalf of physicians to facilitate referral of a patient (individual) to a specialist, we will direct the individual wishing to access his/her PHI to his/her physician. Where the information is not available from the individual’s physician, or where the individual provides Medical Confidence with information directly, we will make the information available to the individual. With certain limited exceptions, individuals have a general right to access and may request a copy of all PHI about them kept by Medical Confidence.
All requests for PHI must be made in writing. Upon receipt of the request, we will provide information requested or reasons why we are unable to do so. A request for PHI may be denied where:
- the information does not exist or cannot be found;
- the denial of access is required or authorized by law; or
- the request is frivolous, vexatious or made in bad faith.
We may charge a fee for this service and if so, we will provide notice in advance of processing the request.
All requests for access to PHI will be responded to in a reasonable timeframe.
How are corrections to PHI made?
If an individual believes his/her PHI is not accurate or complete, s/he may make a written request to Medical Confidence to have the information corrected.
Medical Confidence will correct PHI where it is demonstrated that the information in the individual’s record is, in fact, inaccurate or incomplete and necessary information is provided to correct the record.
Medical Confidence may refuse to correct PHI if the information in question pertains to a professional opinion, or an observation made by a healthcare provider. In these circumstances, where a correction request is denied, individuals may append a short statement of disagreement to their record.
Can I stop Medical Confidence’s use of my PHI?
Yes, an individual may withdrawal consent of the processing of their PHI, by making a request to the Privacy Officer using the contract information listed below. However, should an individual choose to withdrawal consent, Medical Confidence will no longer be able to use this information to connect the individual with MedConfidence Specialists, or provide other services as described within this policy.
After a withdrawal of consent request, PHI will no longer be processed unless required by law. Withdrawal of consent is not retroactive and does not guarantee data destruction; Medical Confidence may need to retain PHI depending on legal requirements under applicable legislation.
What if an individual has questions or concerns?
Medical Confidence reviews policies and procedures on an ongoing basis and may revise these from time to time. If these revisions significantly change how we collect, use or disclose previously collected PHI, we will inform appropriate individuals/clients and obtain consents where required.
All privacy-related questions or concerns pertaining to Medical Confidence should be directed to the Privacy Officer of Medical Confidence’s parent company, CloudMD:
Privacy Officer
CloudMD Software & Services Inc.
Suite 810 – 789 West Pender Street
Vancouver, BC, Canada V6C 1H2
Additional information regarding Privacy in Ontario is available by contacting:
Information & Privacy Commissioner/Ontario
80 Bloor Street West, Suite 1700
Toronto, ON M5S 2V1
(416) 326-3333
Commissioner@ipc.on.ca
Any changes to our privacy policy shall be appropriately communicated in a timely manner.
Last modified March 1, 2023.