(Approved by the Executive Director on March 18, 2020)

1. Policy

a) The Vanier Community Service Centre adheres to federal and provincial laws governing the protection of privacy and the protection of personal information.

b) The Centre is committed to ensuring the accuracy and confidentiality of personal information that it obtains during its activities.

c) The Centre maintains physical, technical and procedural security arrangements in relation to its offices and information storage facilities to prevent loss, misuse, unauthorized access, disclosure or modification of personal information. This vigilance also applies to the disposal or destruction of personal information.

d) The Centre also protects personal information by limiting its access only to employees, volunteers and interns who, according to the Centre’s management, need it in order to provide services.

e) The Centre is committed to ensuring that employee vigilance regarding the protection of client privacy and confidentiality is exercised daily in their professional communications with clients and in their inter-professional communications with colleagues.

f) Employee vigilance and caution  for the protection of privacy and confidentiality mentioned in point d) above must be exercised even more rigorously with clients who are also employees of the Centre in order to avoid unfortunate incidents which would have a direct negative and unwanted impact on relationships and work climate.

2. Definition

a) Personal information: any information recorded in any form relating to an identified person or to a person whose identity can be implied or determined from this information, excluding information concerning business contacts (such as name, title and business address).

• Name, address, date of birth, health card number

• Medical background

• Clinical notes following a visit with a health professional

• Laboratory analysis reports

• Emergency department reports

• Consultation reports

3. Procedures 

3.1 Privacy Officer

a) The Legal Aid Services Director is designated as the contact person responsible for privacy and the protection of information within the Centre.

Main responsibilities of the contact person: 

i. Show leadership in the privacy program

ii. Do the necessary verifications

iii. Implement policies and procedures

iv. Help train staff and volunteers on privacy issues

v. Ensure compliance with relevant laws on the protection of personal information

vi. Resolve allegations of non-compliance

vii. Keep up to date on new relevant laws and regulations

viii. Liaise with government agencies or the Privacy Commissioner, when necessary.

3.2 Protection of personal information:

1. The Centre ensures that the personal information in its possession is accurate, complete and up to date.
2. The Centre retains personal information for as long as it is useful for the purposes for which it was collected. The retention period varies depending on the service and the nature of the information (see policy on record retention).
3. There are processes to destroy, delete and erase this information or to convert it to an anonymous format.
4. The Centre collects, uses and provides personal information only in reasonable circumstances and for the sole purpose of providing products, services or information to customers. The client must give written consent so that a worker can disclose information to an external worker or to someone close to the client.
5. The Centre will use fair personal information collection practices that comply with the law.
6. All Centre employees, volunteers and interns must sign a form stating that they cannot share information about Centre clients.
7. Any external agent of the Centre (eg: concierge, worker from another organization who works in the Centre's offices) must also sign the confidentiality form.
8. The Centre only uses personal information for the purposes described and for professional reasons and it does not sell, trade or disclose, for consideration, any personal information obtained in the course of offering the services and programs.
9. Centre employees, interns and volunteers may not bring client files or other documents concerning them outside the Centre except in exceptional cases such as legal representations before the court (legal aid services) or other representations requiring the information.
10. Any file that must be transferred from one site to another of the Centre must be done by internal mail.
11. The personal information of individuals who participate in a group or community development team initiative is the responsibility of the employee responsible for the operation of the service. This information must always be kept under lock and key in the worker’s office when it is not necessary for the proper functioning of the program.
12. When a community worker offers a group, they should ensure that the consent for personal information is signed by all participants. This form also indicates the importance of not sharing what is discussed as a group.
13. When a worker is responsible for an initiative where he collects confidential information about participants, he or she must ensure that the consent for personal information is signed by all such persons.

n) Documents containing personal information must be destroyed by a shredder or placed in a closed recycling container of the "Shred It" type or equivalent. They should not be put in the trash or in a blue recycling bin.

o) If the Centre wants to use a photo of a client for one of its publications, it must first obtain the client's consent.

p) If personal information is stolen, lost or has been read by an unauthorized person, the Centre will notify the client concerned by telephone and in writing.

q) If an employee receives a subpoena concerning a client, he or she must immediately inform the Executive Director who, if necessary, may obtain legal advice.

3. Confidentiality

a) The Centre may disclose personal information about a client:

i. to other Centre workers in order to choose the appropriate interventions or for other professional reasons;

ii. to professional consultants to review files and assess the quality of the acts performed;

iii. to individuals or organizations that assist the Centre in educating the public about its programs and services;

iv. to legal entities including the police if they have a warrant from the court;

v. to individuals or organizations that are our legal advisors or service providers;

vi. those responsible for reviewing the Centre with a view to obtaining accreditation;

vii. to individuals or organizations that are involved in the corporate reorganization of the Centre, if applicable.

b) Personal information provided will be disclosed only when necessary.

c) When the Centre discloses personal information to organizations providing services on its behalf, it will require that such service providers only use this information for the sole purpose of providing services to the Centre, the client or the individual involved and that they have the necessary measures in place to protect this personal information.

d) When personal information is likely to be transferred to another organization in anticipation of a proposed merger or a reorganization of the Centre, the transfer will be made only if the parties have reached an agreement under which the collection , the use and disclosure of information (including any personal information) are limited to the purposes of the transaction, including any decision relating to its execution, and that they will be invoked by the parties only for the purpose of undertaking and to complete the transaction.

e) Please note that there are situations where the use and / or disclosure of personal information is justified or permitted and where the Centre is legally required to disclose information without consent.

Such circumstances may include the following:

i.when required by law or by order or requirement of a court, administrative body or other governmental tribunal;

ii. when the Centre believes, with valid reasons, that it is necessary to protect the rights, privacy, safety or property of an identifiable person or group;

iii. when it is necessary to establish or collect amounts payable to the Centre;

iv. when it is necessary to allow the Centre to seek remedies at its disposal or to limit the damage it may suffer;

v. when the information is public.

f) If the Centre is coerced or authorized to disclose information without consent, only the required information will be disclosed.

g) The following behaviors of employees in their day-to-day communications with clients or with colleagues help to ensure the protection of client privacy and confidentiality:

• The professional does not take a client's call when he is already in the presence of another client in his office. If he absolutely must take the call for an emergency situation, for example, he makes sure to either deal with the call quickly by not giving any details allowing to identify the person who is calling or to ask the client present to leave the office for a few minutes to settle this call.

• The professional who takes a phone call from a client makes sure to close their office door before handling the call.

• Interprofessional consultations or case discussions are held in offices with the doors closed, to ensure that these conversations are not overheard.

• Interprofessional discussions on a client's state of health or personal situation are held only between the professionals involved in the follow-up of the client, at an appropriate time and place; unnecessary or inappropriate gossip about a client's health or personal circumstances should be avoided. Each professional is responsible for acting as the guardian of this rule and therefore, to call to order a colleague who deviates from it.

4. Public statement on the confidentiality of personal information

The Centre displays its intention to protect the personal information of its clients in the various sites of the Centre (see Appendix 1).