Japanese Social Services (JSS) recognizes the importance of securing privacy for clients and the confidentiality of personal information, and this document describes our privacy policies.
JSS exercises careful and consistent vigilance in regards to its protection of client rights to privacy and confidentiality, including the collection, use and disclosure of personal information in-person and virtually. JSS adheres to all relevant privacy legislation. Clients have the right to withdraw their consent to service and/or the collection, use and disclosure of their personal information at any time.
Who We Are
JSS is composed of a team of registered social workers of Ontario, a registered psychotherapist of Ontario and an office administrator, which provides services to those who seek support through our agency. We have a clinical supervisor who has access to the personal information as required in providing the clinical staff with supervision. We also work with consultants or agencies, such as our IT and Security consultant, that may, in the course of their duties, have limited access to personal health information in our possession. We restrict their access to any personal information we hold as much as possible. We also have their assurance that they follow appropriate privacy principles.
JSS keeps client files on computers and files on paper with information including:
- how to contact clients (e.g., name, address, phone number, email address)
- a description of clients (e.g., age, languages spoken, household income to determine the fee for service as we use “sliding scale” system to enhance accessibility to our services)
- client personal health information (as required)
- information about the issues clients are facing
- a description of the services JSS provided to each client
These pieces of information are collected and records are kept for all individuals, couples and families that seek and access services at JSS. Records include demographic information, ongoing notes and other documents and assessments completed when applying for and during service. This is not an exhaustive list of what may compose a record. Records are necessary for professional maintenance of quality and continuity of service.
All client records and counselling sessions are strictly confidential. A basic axiom of our policy is to never release information which individually identifies a client without informed consent, except in the circumstances outlined below in the section Limitations to Confidentiality. Only people who are directly involved in client service and supervision at JSS are allowed to look at a client’s record. We have security, passwords and policies to make sure that client information stays private.
Limitations to Confidentiality
JSS adheres to the following legal limits to confidentiality:
- Suspicion that a child under 16 years is at risk of abuse or neglect;
- Imminent risk of physical harm to oneself;
- Direct threat of physical harm to another person;
- When records are subpoenaed by a court of law or the agency is presented with a search warrant;
- A client of the agency discloses that they were sexually abused by a regulated health professional and
- A client, who is a regulated health professional, discloses own action of sexual abuse towards his / her client.
It is important to note that as registered healthcare professionals, we may also be required to make our files available for audit by our regulatory body (e.g., College of Registered Psychotherapist of Ontario and the Ontario College of Social Workers and Social Service Workers), third-party payer agencies (if applicable, e.g., Financial Services Commission of Ontario) or by the government. These audits are confidential, and a record of the audit will be inserted into your client file.
Protecting Personal Information
We understand the importance of protecting personal information. For that reason, we have taken the following steps:
- Paper information is either under supervision or secured in a locked or restricted area.
- Electronic hardware is either under supervision or secured in a locked or restricted area at all times. In addition, strong passwords are used on all computers and mobile devices.
- Personal health information is only stored on mobile devices if necessary. All personal health information stored on mobile devices is protected by strong encryption.
- We try to minimize the frequency of traveling with personal health information. However, when we do so, we transport, use and store the personal health information securely.
- Paper information is transferred through sealed, addressed envelopes or boxes by reputable companies with strong privacy policies.
- Electronic information is either anonymized or encrypted before being transmitted.
- We do not post any personal information about our clients on social media sites and our staff members are trained on the appropriate use of social media sites.
- External consultants and agencies with access to personal information must enter into privacy agreements with us.
Confidentiality of E-mail, Cell Phone and Faxes Communication
It is very important to be aware that e-mail and cell phone communication can be relatively easily accessed by unauthorized people and hence, the privacy and confidentiality of such communication can be compromised. E-mails, in particular, are vulnerable to such unauthorized access due to the fact that servers have unlimited and direct access to all e-mails that go through them. Faxes or texts
can easily be sent erroneously to the wrong phone number. Please notify staff in charge of your case at the beginning of use of our services if you decide to avoid or limit in any way the use of any or all of the above-mentioned communication devices. Please do not use e-mail, faxes or texts for emergencies.
Retention and Destruction of Personal Information
We keep our client files for at least ten years from the date of the last client interaction or from the date the client turns 18.
We destroy paper files containing personal health information by cross-cut shredding. We destroy electronic information by deleting it in a manner that it cannot be restored. When hardware is discarded, we ensure that the hardware is physically destroyed or the data is erased or overwritten in a manner that the information cannot be recovered.
Your Right to Request to View Your Records
With only a few exceptions, you have the right to see what personal information we hold about you, by contacting staff in charge of your case or JSS’s Privacy Officer (Contact Information is in the section “How to Reach Us” below). We can help you identify what records we might have about you. We will also try to help you understand any information you do not understand (e.g., short forms, technical language, etc.). We will need to confirm your identity before providing you with this access. We reserve the right to charge $30.00 for the first twenty pages of records and 25 cents for each additional page. However, the fees are not to be a barrier to information and may be reduced/waived to ensure accessibility depending on your financial situation.
We may ask you to put your request in writing. We will respond to your request as soon as possible and generally within 30 days. If we cannot give you access, we will tell you the reason, as best we can, as to why.
If you believe there is a mistake in the information, you have the right to ask for it to be corrected. This applies to factual information and not to any professional opinions we may have formed. We may ask you to provide documentation that our files are wrong. Where we agree that we made a mistake we will make the correction. At your request and where it is reasonably possible, we will notify anyone to whom we sent this information (but we may deny your request if it would not reasonably have an effect on the ongoing provision of health care). If we do not agree that we have made a mistake, we will still agree to include in our file a brief statement from you on the point.
If there is a Privacy Breach
While we will take precautions to avoid any breach of your privacy, if there is a loss, theft or unauthorized access of your personal health information we will notify you.
Upon learning of a possible or known breach, we will take the following steps:
- We will contain the breach to the best of our ability, including by taking the following steps if applicable
- Retrieving hard copies of personal health information that have been disclosed
- Ensuring no copies have been made
- Taking steps to prevent unauthorized access to electronic information (e.g., change passwords, restrict access, temporarily shut down system)
- We will notify affected individuals
- We will provide our contact information in case the individual has further questions
- We will provide the Commissioner’s contact information and advise the affected individual of their right to complain to the Commissioner
- We will investigate and remediate the problem, by:
- Conducting an internal investigation
- Determining what steps should be taken to prevent future breaches (e.g. changes to policies, additional safeguards)
- Ensuring staff is appropriately trained and conduct further training if required
Depending on the circumstances of the breach, we may notify and work with the Information and Privacy Commissioner of Ontario. If we take disciplinary action against one of our practitioners or revoke or restrict the privileges or affiliation of one of our practitioners for a privacy breach, we are required to report that to the practitioner’s regulatory College. We may also report the breach to the relevant regulatory College if we believe that it was the result of professional misconduct, incompetence or incapacity.
How to Reach Us
If you have any questions or concerns about how your personal information has been collected or used, please contact staff in charge of your case:
OR you may contact JSS’s Privacy Officer, Yuka Sato-Atiyota via e-mail at firstname.lastname@example.org.
You also have the right to complain to the Information and Privacy Commissioner of Ontario at the address below if you have concerns about our privacy practices or how your personal health information has been handled:
Information and Privacy Commissioner/Ontario
2 Bloor Street East, Suite 1400, Toronto, Ontario M4W 1A8
Telephone: Toronto Area (416/local 905): (416) 326-3333
Long Distance: 1 (800) 387-0073 (within Ontario)
TDD/TTY: (416) 325-7539
FAX: (416) 325-9195
This policy is made under the Personal Health Information Protection Act, 2004, S.O. 2004, c. 3. It is a complex statute and provides some additional exceptions to the privacy principles that are too detailed to set out here.