Statement of Information Practices

Personal Health Information Protection Act, 2004 (PHIPA), section 16 · Effective 19 October 2026

This statement explains, in plain language, how our practice handles your personal health information. A fuller privacy policy is also available. Paper copies of both are available at the front desk on request.

Who is responsible for your information

Dr. John Stirrat Medicine Professional Corporation is the general surgery practice of Dr. John Stirrat, who provides consultations, surgery and endoscopy at South Bruce Grey Health Centre and Hanover and District Hospital. Under PHIPA, Dr. Stirrat is the health information custodian for the practice's own records: the person legally responsible for the personal health information the practice holds. Staff and other people who work for the practice handle your information only on the custodian's behalf and only as this statement allows.

Dr. Stirrat is also the practice's privacy contact person. Contact details are at the end of this page.

Records created while you are a patient of a hospital, such as your operative report, anaesthesia record and nursing notes, belong to that hospital, which is a separate custodian with its own privacy office. We keep copies of the hospital records we need in our office chart. Requests about the hospital's own records go to the hospital.

What we collect and why

We collect only the personal health information we need to provide you with care and to run the practice. This typically includes:

• your name, date of birth, sex, address, phone number and email, and your Ontario health card number;
• your health history, symptoms, examination findings, diagnoses, medications, allergies, and surgical and treatment plans;
• laboratory, pathology, imaging and endoscopy results, operative and consultation reports, and records from hospitals;
• the referral from your family physician, nurse practitioner or other provider, and referrals we send on to others;
• information needed to bill the Ontario Health Insurance Plan (OHIP) or, for uninsured services, you or a third party; and
• emergency contact and substitute decision-maker details you give us.

We use this information to:

• provide you with surgical and endoscopic care, including assessment, consent, the procedure itself, follow-up and prescriptions;
• communicate with your family physician or nurse practitioner, the hospital and other providers involved in your care;
• bill for services;
• run and improve the practice, including scheduling, record keeping and quality review;
• meet legal and professional obligations, such as mandatory public-health reporting and College of Physicians and Surgeons of Ontario requirements; and
• respond to requests for your information that you authorize, such as insurance forms.

We collect information directly from you whenever possible. Because nearly all our patients come to us by referral, we also receive information about you from the provider who referred you, from hospitals where you have been treated, from laboratories, pathology and imaging departments, and from provincial electronic health record systems that Ontario makes available to treating clinicians.

Your consent

In most cases we rely on your implied consent to collect, use and share your health information for the purpose of providing you with care. This means that when you seek care from us, we assume you agree that we may share relevant information with other health care providers who are also treating you, such as the family physician who referred you, the hospital where your surgery takes place, an anaesthetist, a pathologist, a pharmacist filling your prescription, or another specialist we involve in your care. Ontario law calls this group of providers the circle of care.

For anything outside providing care, such as releasing information to an insurer, an employer, a lawyer, or a family member who is not your substitute decision-maker, we need your express consent, usually in writing.

You may withdraw or limit your consent at any time by telling us, although a withdrawal does not apply to information we have already shared. We will explain any consequences for your care.

Restricting who can see your information (the "lock-box")

You have the right to ask us not to share specific information, or not to share it with a specific provider, even within your circle of care. This is sometimes called a lock-box request. If you make one, we will flag your record and honour your request, except where the law requires or allows us to share the information anyway (for example, to prevent a serious risk of harm). If we send a referral or report and must leave something out because of your request, we are required to tell the recipient that some information has been withheld, without saying what it is.

To make a lock-box request, contact our privacy contact person. We will confirm it in writing and note it in your record.

How we protect your information

We keep your records in an electronic medical record system that is secured with user accounts, strong passwords and multi-factor sign-in, encryption of stored data, and audit logs of who accessed what. Paper records and fax machines are kept in areas the public cannot reach. Everyone who works in the practice signs a confidentiality agreement and receives privacy training. Information is shared with other providers only through secure channels. When records are no longer needed, they are destroyed securely.

If we become aware that your information has been lost, stolen, or accessed by someone who should not have seen it, we will notify you at the first reasonable opportunity and, where the law requires, report the incident to the Information and Privacy Commissioner of Ontario and the College of Physicians and Surgeons of Ontario.

Seeing and correcting your record

You have the right to see and get a copy of your health record, and to ask us to correct information you believe is inaccurate or incomplete. Put your request in writing to the privacy contact person. We will respond within 30 days, and we will tell you if we need more time or if we are unable to give you access to a specific part of the record (for example, because it contains information about another person). We may charge a reasonable fee for copies, and we will tell you the fee before we proceed.

If we do not agree that a correction is needed, you may ask us to attach a short statement of disagreement to your record, and we will include it whenever that information is shared.

How long we keep records

We keep your record for as long as the College of Physicians and Surgeons of Ontario requires, which is currently at least ten years after your last visit (or, for patients under 18, at least ten years after their 18th birthday), and then destroy it securely.

Questions, concerns and complaints

If you have a question about this statement, want to make a lock-box request, want to see or correct your record, or have a concern about how your information has been handled, please contact:

Please do not send detailed health information by email unless we have agreed with you how to do so securely.

If you are not satisfied with our response, you have the right to complain to the Information and Privacy Commissioner of Ontario, which oversees PHIPA:

Changes to this statement

We review this statement at least once a year and whenever our practices change. The current version is always posted at johnstirrat.ca/information-practices.html and available at the practice. This version took effect on 19 October 2026.