Restricting Access to Your Health Records

What is a "lockbox"?

It's not exactly a "box" - and it doesn't have a lock. And a lockbox can mean different solutions depending on your request. Generally speaking, a lockbox means that all or part of your health information will be separated from our usual filing systems. If it is an electronic record, it will have additional restrictions of access. If it is a paper record, it will go into a sealed envelope. While all our health records are safely and securely stored, a lockbox will restrict the access to your health information from certain people or institutions.

Are there risks to having a lockbox?

There are some risks to putting your health information in a lockbox that you should consider before making your decision:

• Your health care providers may not have the information they need to give you the best possible care in a timely manner.
• Your health care providers may not have enough information to safely provide you with services and so may not be able to offer you care.
• It may be harder for your health care providers to share your information in an emergency.
• There may be errors in assessments, treatment or medications if the people providing care do not have enough information or do not have the right information about you.
• You may have to undergo duplicate tests, procedures and health history questions if existing information is unavailable.
• You may not benefit from the wide range of services we can offer you.
• There may be other risks specific to you and your request, which we will discuss with you.
• You can ask us questions about the specific risks that could come up depending on your choices.

Lockbox Exceptions

Under the law, there are times when we are allowed to or must collect, use, or share personal information about you - without your permission - even if your information is otherwise "locked".

\If your information is already in a lockbox, the "lock" may be broken and your information may be used or disclosed as permitted or required by law. We have provided some examples, but there may be other situations where the use or disclosure of your information is permitted or required by law. We may use or share your health information without your permission in order to, for example:

• Report a child in need of protection to the Children's Aid Society
• Make reports to the Ministry of Transportation or Public Health or other mandatory reports
• Protect you or someone else if we believe there is a significant risk of serious harm
• Obtain or process payments
• Plan our services
• Engage in quality improvement exercises
• Dispose of information
• Comply with a court order
• Defend ourselves in litigation
• Engage in research (as long as we have research ethics board approval)
• Teach our staff to provide health care

If you have questions about how we can use or share your health information, you can ask a team member or the Privacy Officer.

How do you request a lockbox?

You can discuss any concerns regarding the privacy and confidentiality of your health information and your lockbox options with your physician or health care provider or the Privacy Officer. In some cases, you may not need a lockbox in order to protect your information and we can discuss alternatives or options with you. For instance, you do not need a lockbox to prevent health care professionals who are not involved in your care from viewing your personal information as these professionals are not within your "circle of care" and are therefore already not permitted to access your information on the basis of our policies and privacy laws.

You can submit your lockbox request in writing using our "Client Lockbox Request" form, which you can get from your physician or health care provider or the Privacy Officer. The completed form should be given to your physician or health care provider or the Privacy Officer.

Lockbox requests are processed on a case-by-case basis. The Privacy Officer will review and respond to lockbox requests and will speak with your physician or health care provider. We may not be able to accommodate every request - but we will explain any limits with you. We will tell you when your lockbox is in place. You can also request that your lockbox be removed at any time by contacting your physician or the Privacy Officer.