Privacy Code

(Approved March 3, 2005, as amended December 3, 2007, October 4, 2011, December 9, 2014, and December 7, 2018)

The College of Medical Radiation and Imaging Technologists of Ontario (the College) was established by the Medical Radiation and Imaging Technology Act, 2017 (the Act).(1) The legal powers and duties of the College are set out in the Regulated Health Professions Act, 1991, (the RHPA) the Health Professions Procedural Code, being Schedule 2 to the RHPA (the Code) and the regulations and by-laws made under the foregoing (together “the Legislation”).

In carrying out its objects, the College has a duty to serve and protect the public interest.

In the course of fulfilling its mandate, the College may collect, use and disclose personal information regarding applicants for membership, members, persons holding themselves out as members, members’ patients, persons who may have received services from a person holding themselves out as a member and persons employed, retained, elected or appointed for the purpose of the administration and enforcement of the Legislation. The College’s collection, use and disclosure of personal information in the course of carrying out its regulatory activities is done for the purpose of regulating the profession in the public interest.

Persons who are employed, retained or appointed by the College, as well as every Councillor or Non-Council Committee Member, are required by section 36 of the RHPA(2) to keep confidential all information that comes to their knowledge, subject to certain limited exceptions. Breach of this provision by an individual can lead to the imposition of a fine of up to $25,000.00 for a first offence and up to $50,000.00 for a second or subsequent offence. Breach of this provision by a corporation can lead to the imposition of a fine of up to $50,000.00 for a first offence and up to $200,000.00 for a second or subsequent offence.

The College is not subject to the federal Personal Information Protection and Electronic Documents Act or the provincial Personal Health Information Protection Act. The College has voluntarily adopted this Privacy Code to provide a voluntary mechanism through which the College can provide appropriate privacy rights to individuals involved in the College’s activities while still enabling the College to meet its statutory mandate under the Legislation.

This Privacy Code and its procedures are administered in accordance with the following principles.

Principle 1: Accountability

The Registrar & CEO is accountable for compliance with this Privacy Code and its procedures. Complaints or questions regarding the manner in which personal information is being handled by the College should be directed to the Registrar & CEO directly by mail or by phone.

The College will provide orientation and training to all new employees, appointees, Councillors and Non-Council Committee Members regarding their obligations pursuant to section 36 of the RHPA and this Privacy Code.

The College’s policies regarding privacy and information management are available on the College’s website and by request by mail or by phone.

Principle 2: Identifying Purposes

The purpose for which the College collects, uses and discloses personal information is to administer and enforce the Legislation.

The purposes for which the College collects and uses personal information include the following:

  • to assess whether an applicant meets the standards of qualification to be issued a certificate of registration;
  • to assess whether a member continues to meet the standards of qualification for a certificate of registration;
  • to notify a member of their annual renewal of registration;
  • to investigate complaints regarding the conduct or actions of a member;
  • to investigate whether a member has committed an act of professional misconduct or is incompetent and to resolve such matters including through the imposition of a specified continuing education and remediation program and through undertakings;
  • to inquire into whether a member is incapacitated;
  • to negotiate and implement informal resolutions, including acknowledgments and undertakings and specified continuing education and remediation programs;
  • to hold a hearing of allegations of a member’s professional misconduct or incompetence or of allegations that a member is incapacitated;
  • to monitor a member’s practice in accordance with an order issued by a committee of the College or an undertaking or agreement with the College;
  • to carry out the quality assurance program of the College, including an assessment of the records and practice of its members;
  • to administer the program established by the College to provide funding for therapy and counselling for eligible persons;
  • to investigate reports filed about members of the College under the Code;
  • to assess whether a former member’s certificate of registration should be reinstated;
  • to investigate whether an individual is practising the profession, using protected titles or holding themselves out as qualified to practise the profession, without legal authority;
  • to carry out reviews and audits of its practices and processes;
  • to develop and provide statistical information for the purpose of human resource planning and demographic, research and other studies including providing information to the Ministry of Health and Long-Term Care and other appropriate agencies;
  • to maintain records for the proper functioning to the College and to communicate with persons;
  • to communicate with and provide information to members including the electronic delivery of information;
  • to circulate proposed amendments of regulations and by-laws for input by members and stakeholders;
  • to conduct member surveys;
  • to review prospective candidates for individuals to be retained, elected or appointed to administer the Legislation and to retain or appoint such persons;
  • to maintain records to ensure accurate remuneration and payment of expenses, and all documentation require by law and by the various levels of government in accordance with generally accepted accounting principles; and
  • to administer or enforce the Legislation.

The College may collect personal information for these purposes from applicants, potential members, members, patients and other persons, such as employers and colleagues. Personal information is collected by the College from time to time and at regular intervals.

The College discloses personal information only as permitted by section 36 of the RHPA or as require by law. For example, the College is required under the Code to maintain a register containing information about its members. The Code requires the College to post the information designated as public on the College’s website and to provide access to designated information to a person who requests it. Another example of permissible disclosure of personal information is that hearings of the Discipline Committee are required, subject to certain exceptions, to be open to the public. Evidence at a hearing of the Discipline Committee may include personal information regarding the member of the College who is the subject of the allegation of professional misconduct or incompetence, as well as personal information regarding the member’s patients related to the allegations of professional misconduct or incompetence.

Where personal information is collected for one regulatory purpose, the College has the right to use and disclose the information for another regulatory purpose.

Principle 3: Consent

The College collects personal information for purposes related to its objects, including for the purpose of the proper administration and enforcement of the Legislation and for other related regulatory purposes. In carrying out its objects,(3) the College has a duty to serve and protect the public interest. Obtaining consent of an individual would, in many cases, defeat the purposes of the College collecting, using and disclosing the personal information. Personal information will only be collected, used and disclosed without the knowledge and consent of an individual for the purpose of the administration or enforcement of the Legislation and in accordance with any applicable provision(s) of the Legislation.

Principle 4: Limiting Collection

The College collects only the personal information that is required for the purposes identified in Principle 2 of this Privacy Code and in accordance with the Legislation. The College collects personal information using procedures that are fair and lawful.

Personal information regarding patients must be collected as part of the College’s regulatory function. This information is typically obtained by the College as part of an investigation or the administration of the quality assurance program. The focus of these inquiries is the conduct, competence or capacity of the member and the protection of the public. The College only collects personal information regarding patients in connection with its regulatory function.

Principle 5: Limiting Use, Disclosure or Retention

The College does not engage in commercial activity and does not send commercial electronic messages.

The College uses personal information only for the purposes identified in Principle 2 and in accordance with the Legislation. Personal information is only disclosed in accordance with section 36 of the RHPA or as required by law.(4)

The College has a record retention policy(5) in place to ensure that personal information that is no longer required to be kept is destroyed, erased or anonymized.

Principle 6: Accuracy

It is in the best interest of the public that the College collect, use and disclose only accurate personal information in regulating the profession. The College therefore uses reasonable efforts to ensure that the information it collects, uses and discloses is accurate.

Members are required to provide the College with current name, contact and employment information and to advise the College of changes within seven days of any change.

Principle 7: Safeguards

The College ensures that the personal information it holds is secure.

The College ensures that personal information is stored in electronic and/or physical files that are secure. Security measures are in place to safeguard this information which includes, but is not limited to, restricting access to personal information, ensuring that physical files are under lock and key and ensuring that electronic files are encrypted or password protected. The College reviews is security measures periodically to ensure that all personal information is secure.(6)

The College will provide orientation and training to all employees regarding the information safeguards required for personal information and their importance.

The College ensures that personal information that is no longer required to be retained is disposed of in a confidential and secure manner.

Principle 8: Openness

The College’s privacy and information management policies and procedures are available to the public and its members are available on the College’s website and by request by mail or by phone. Inquiries may be directed to the Registrar & CEO.

Principle 9: Individual Access

1. Access

Where the College holds personal information about an individual that forms part of a record created by another organization, the College will refer the individual to the organization that created the record so that the individual may obtain access to the personal information from that organization rather than the College, unless it is appropriate to do so. In all other cases, where the College holds a record of personal information about an individual, upon written request, the College shall allow access to the record to that individual, unless providing access could reasonably be expected to interfere with the administration or enforcement of the Legislation or it is impracticable or impossible for the College to retrieve the record.

For example, situations where access may be denied include:

  • the record contains references to another individual(s) that cannot be severed;
  • disclosure may result in significant risk of harm to the requester or a third party;
  • information in the record was collected or created in the course of an inspection, investigation, inquiry, assessment or similar procedure authorized by law;
  • disclosure may defeat the purpose(s) for which the information in the record was collected;
  • information in the record cannot be disclosed for legal, security or commercial proprietary reasons;
  • information in the record is subject to solicitor-client or other privilege;
  • information in the record was generated in the course of a dispute or resolution process;
  • the request is frivolous, vexatious, made in bad faith or otherwise an abuse of process.

While the College’s response will typically be provided at no cost or minimal cost to the individual, depending on the nature of the request and the amount of information involved, the College reserves the right to impose a cost recovery fee. In these circumstances, the College will inform the individual of the approximate cost to provide the response and proceed upon payment by the individual of the cost.

The College will make reasonable efforts to respond to the request within 30 days and to assist the individual in understanding the information.

Individuals should send their written requests for access, with contact information and sufficient information about themselves to identify them, to the Registrar & CEO by mail.

In the event that the College refuses to provide access to a record of personal information it holds, then the College will provide reasons for denying access. The individual may then choose to file a complaint with the Registrar.

2. Challenging accuracy and completeness of personal information

If the College has granted an individual access to a record of their personal information, the individual has the right to request a correction of what, in their view, is erroneous information in the record. Where an individual is able to successfully demonstrate that personal information of a factual nature (not, for example, the expression of an opinion) is inaccurate or incomplete, the College will amend the information in the record (i.e. correct or add information).

When amending the information, the College will not generally obliterate the original information. Where the record consists of any opinion or observation that has been made in good faith about an individual, the College may refuse to correct the information in the record. In some cases, a correction may be inappropriate (i.e. where the fact that a person made or recorded a statement is the primary focus of the record rather than whether the statement is, in fact, accurate) and the College may refuse to correct the information in the record.

In addition, where appropriate, the College will notify any third parties to whom the College has disclosed the record containing the erroneous information.

Where there is a dispute between the individual and the College as to the accuracy or completeness of the information in the record, then the College will document the details or the disagreement, will permit the individual to prepare a concise statement of disagreement for attachment to the record, and, where appropriate, will make reasonable efforts to advise any third party who received the record containing the contested information from the College, of the unresolved disagreement.

Principle 10: Challenging compliance

Complaints or questions regarding the College’s compliance with this Privacy Code should be directed to the Registrar & CEO by phone or by mail.

If the Registrar & CEO cannot satisfactorily resolve a complaint, the College has a formal privacy complaints procedure which includes:

  • acknowledging the complaint;
  • reviewing the complaint by the College’s Privacy Committee;
  • providing a written decision and reasons to the complainant; and
  • taking appropriate measured where the complaint is found to be justified.

Breaches of confidentiality/privacy that are not otherwise the subject of a complaint are dealt with in accordance with the procedure set out in Schedule 2.

SCHEDULE 1

Section 36 of the Regulated Health Professions Act, 1991, as amended
(currency date: January 1, 2020)

Confidentiality

36 (1) Every person employed, retained or appointed for the purposes of the administration of this Act, a health profession Act or the Drug and Pharmacies Regulation Act and every member of a Council or committee of a College shall keep confidential all information that comes to his or her knowledge in the course of his or her duties and shall not communicate any information to any other person except,

(a) to the extent that the information is available to the public under this Act, a health profession Act or the Drug and Pharmacies Regulation Act;

(b) in connection with the administration of this Act, a health profession Act or the Drug and Pharmacies Regulation Act, including, without limiting the generality of this, in connection with anything relating to the registration of members, complaints about members, allegations of members’ incapacity, incompetence or acts of professional misconduct or the governing of the profession;

(c) to a body that governs a profession inside or outside of Ontario;

(d) as may be required for the administration of the Drug Interchangeability and Dispensing Fee Act, the Healing Arts Radiation Protection Act, the Health Insurance Act, the Health Protection and Promotion Act, the Independent Health Facilities Act, the Laboratory and Specimen Collection Centre Licensing Act, the Long-Term Care Homes Act, 2007, the Retirement Homes Act, 2010, the Ontario Drug Benefit Act, the Coroners Act, the Controlled Drugs and Substances Act (Canada) and the Food and Drugs Act (Canada);

(d.1) for a prescribed purpose, to a public hospital that employs or provides privileges to a member of a College, where the College is investigating a complaint about that member or where the information was obtained by an investigator appointed pursuant to subsection 75 (1) or (2) of the Code, subject to the limitations, if any, provided for in regulations made under section 43;

(d.2) for a prescribed purpose, to a person other than a public hospital who belongs to a class provided for in regulations made under section 43, where a College is investigating a complaint about a member of the College or where the information was obtained by an investigator appointed pursuant to subsection 75 (1) or (2) of the Code, subject to the limitations, if any, provided for in the regulations;

(e) to a police officer to aid an investigation undertaken with a view to a law enforcement proceeding or from which a law enforcement proceeding is likely to result;

(f) to the counsel of the person who is required to keep the information confidential under this section;

(g) to confirm whether the College is investigating a member, if there is a compelling public interest in the disclosure of that information;

(h) where disclosure of the information is required by an Act of the Legislature or an Act of Parliament;

(i) if there are reasonable grounds to believe that the disclosure is necessary for the purpose of eliminating or reducing a significant risk of serious bodily harm to a person or group of persons;

(j) with the written consent of the person to whom the information relates; or

(k) to the Minister in order to allow the Minister to determine,

(i) whether the College is fulfilling its duties and carrying out its objects under this Act, a health profession Act, the Drug and Pharmacies Regulation Act or the Drug Interchangeability and Dispensing Fee Act, or

(ii) whether the Minister should exercise any power of the Minister under this Act, or any Act mentioned in subclause (i).

Reports required under Code

(1.1) Clauses (1) (c) and (d) do not apply with respect to reports required under section 85.1 or 85.2 of the Code.

Definition

(1.2) In clause (1) (e),

“law enforcement proceeding” means a proceeding in a court or tribunal that could result in a penalty or sanction being imposed.

Limitation

(1.3) No person or member described in subsection (1) shall disclose, under clause (1) (e), any information with respect to a person other than a member.

No requirement

(1.4) Nothing in clause (1) (e) shall require a person described in subsection (1) to disclose information to a police officer unless the information is required to be produced under a warrant.

Confirmation of investigation

(1.5) Information disclosed under clause (l) (g) shall be limited to the fact that an investigation is or is not underway and shall not include any other information.

Restriction

(1.6) Information disclosed to the Minister under clause (1) (k) shall only be used or disclosed for the purpose for which it was provided to the Minister or for a consistent purpose.

Not compellable

(2) No person or member described in subsection (1) shall be compelled to give testimony in a civil proceeding with regard to matters that come to his or her knowledge in the course of his or her duties.

Evidence in civil proceedings

(3) No record of a proceeding under this Act, a health profession Act or the Drug and Pharmacies Regulation Act, no report, document or thing prepared for or statement given at such a proceeding and no order or decision made in such a proceeding is admissible in a civil proceeding other than a proceeding under this Act, a health profession Act or the Drug and Pharmacies Regulation Act or a proceeding relating to an order under section 11.1 or 11.2 of the Ontario Drug Benefit Act.