Privacy Policy

Public version · Effective 19 October 2026

This policy expands on our Statement of Information Practices. It describes how Dr. John Stirrat Medicine Professional Corporation (the "practice", "we", "us") collects, uses, discloses, protects and retains personal health information, and how you can exercise your rights under Ontario's Personal Health Information Protection Act, 2004 (PHIPA) and its regulation.

1. Accountability

Dr. John Stirrat is a general surgeon providing consultations, surgery and endoscopy at South Bruce Grey Health Centre and Hanover and District Hospital. He is the health information custodian for the practice under PHIPA and is responsible for the personal health information in the practice's own custody or control. Records a hospital creates while you are its patient (operative reports, anaesthesia and nursing records, hospital test results) are in that hospital's custody; the hospital is a separate custodian with its own privacy office, and requests about those records go to the hospital. The practice keeps the copies it needs in its office chart. As a custodian who is an individual, Dr. Stirrat has not designated a separate contact person and personally carries out the contact-person functions under PHIPA section 15:

• making sure the practice complies with PHIPA;
• making sure everyone who works in the practice knows their privacy duties;
• responding to questions from the public about our information practices;
• responding to requests for access to or correction of records; and
• receiving complaints.

Everyone who works in or for the practice, whether employed, contracted, volunteering or in training, is an agent of the custodian under PHIPA. Agents may only collect, use, disclose, retain or dispose of personal health information as the custodian permits, for the custodian's purposes, and as the law allows. Each agent signs a confidentiality agreement before handling any information and completes privacy training on starting and at least annually.

2. What "personal health information" means

Personal health information is identifying information about you, in any form, that relates to your physical or mental health, the care you have received, payment or eligibility for care, your health card number, your substitute decision-maker, or the donation of body parts or substances. Information that cannot reasonably be used to identify you is not personal health information, and this policy does not restrict our use of properly de-identified information.

3. Purposes of collection, use and disclosure

We collect, use and disclose personal health information for these purposes:

Providing health care

Assessing your referral; consultation, informed consent, surgery, endoscopy and procedures; pre-operative and post-operative care and follow-up; prescribing; ordering and receiving tests and pathology; referring you on to other specialists or programs (for example, cancer care or wound care) when needed; and coordinating your care with your family physician or nurse practitioner, the hospital and other providers treating you.

Communicating with you

Contacting you about appointments, results, recalls and preventive care, using the contact methods you have agreed to.

Payment

Billing OHIP, other insurers, or you for services, and verifying health card eligibility.

Operating the practice

Scheduling, record keeping, quality improvement, risk management, training of staff, and planning and evaluating the practice's services.

Legal and professional obligations

Meeting mandatory reporting duties, College of Physicians and Surgeons of Ontario (CPSO) requirements, court orders, and audits by OHIP or other authorized bodies.

Purposes you authorize

Completing forms and reports for insurers, employers, schools or others at your request.

We limit what we collect to what is reasonably necessary for these purposes. We do not sell personal health information and we do not use it for marketing.

4. How we collect information

We collect information directly from you, or from your substitute decision-maker, whenever that is reasonably possible. We also collect information indirectly, as PHIPA permits, from:

• the family physician, nurse practitioner or other provider who referred you, whose referral usually includes your history, medications and relevant test results;
• hospitals where you are assessed or treated, including operative, pathology and imaging records;
• other health care providers in your circle of care, such as other specialists, pharmacies and home-care agencies;
• laboratories, pathology departments and diagnostic imaging facilities;
• provincial electronic health record systems available to treating clinicians, which may include the Ontario Laboratories Information System (OLIS), the ConnectingOntario ClinicalViewer, and the Digital Health Drug Repository; and
• OHIP, for eligibility and billing purposes.

5. Consent

Implied consent within the circle of care

PHIPA allows health care providers to rely on your implied consent to collect, use and share personal health information for the purpose of providing or assisting in providing you with health care. When another provider refers you to us and you attend, we assume you consent to the sharing of relevant information among the providers involved in your care, including the referring provider, the hospital where your procedure takes place, anaesthesia, pathology and any other specialist we involve, unless you tell us otherwise. This includes information we receive from other providers and information we send to them, such as consultation and operative reports sent back to your family physician.

Express consent

We will ask for your express consent, in writing where practical, before:

• disclosing information to anyone who is not a health care provider treating you, such as an insurer, employer, lawyer, school or researcher;
• disclosing information to a family member or friend who is not your substitute decision-maker;
• using information for any purpose not described in this policy; or
• communicating with you about your care by a method that is not secure, such as unencrypted email or text message.

Capacity and substitute decision-makers

If you are not capable of making decisions about your information, PHIPA sets out who may make them for you, in order of priority. We will record who your substitute decision-maker is and why. A capable person of any age may make their own decisions about their health information; for children under 16, a parent may also make decisions, except about treatment the child has decided on their own or counselling the child has received on their own.

Withdrawing consent

You may withdraw or limit your consent at any time by telling us. Withdrawal is not retroactive: it does not apply to information already collected, used or disclosed. We will tell you if withdrawing consent could affect your care.

6. Lock-box requests

Under PHIPA you may withhold or withdraw consent to the collection, use or disclosure of all or part of your record, including within your circle of care. Common examples are asking that a particular diagnosis not be included in referrals, or that a specific provider not receive your information. When we receive a lock-box request we will:

1. discuss with you what the request covers and any risks to your care, so you can make an informed decision;
2. record the request in your chart in a way that alerts anyone handling your record;
3. apply it to future uses and disclosures, including referrals, reports and electronic sharing, to the extent our systems allow; and
4. where we must send information to another provider and your request means something is left out, tell that provider that information has been withheld, without saying what.

A lock-box request does not prevent us from using or disclosing information where PHIPA permits or requires it without consent (section 7 below), including to reduce a significant risk of serious bodily harm.

For referrals we receive about you, you may ask that the referral be handled manually only and not processed with the AI-assisted step described in section 9. We will honour that request for every referral that identifies you once we have recorded it.

7. When we share information without consent

PHIPA permits or requires us to use or disclose personal health information without your consent in limited situations. The ones most likely to arise in a family practice are:

• reporting to public health authorities, including reportable diseases and immunization information required by law;
• mandatory reports, such as suspected child abuse or neglect, a medical condition that may make a person unfit to drive, and reports required under the Regulated Health Professions Act about other health professionals;
• disclosures to the CPSO or another regulatory college for the purpose of its statutory functions;
• contacting a relative, friend or substitute decision-maker if you are injured, incapacitated or ill and unable to give consent;
• reducing or eliminating a significant risk of serious bodily harm to you or someone else;
• complying with a court order, summons, warrant or other legal requirement;
• responding to a legal proceeding in which the practice or the custodian is a party or witness;
• verifying eligibility and billing OHIP, and responding to OHIP audits;
• disclosures to a successor custodian if the practice is transferred or closes, with notice to you; and
• disclosures to a health data institute, prescribed registry or prescribed entity (for example, Ontario Health for cancer registries and screening programs, or surgical quality programs) as PHIPA allows.

8. Service providers and technology we use

We use outside companies to supply information technology and related services. PHIPA calls these electronic service providers. They may only use personal health information as needed to provide the service to us, must keep it confidential, and may not use it for their own purposes. We have written agreements with each of them. Our main providers are:

We do not use any other cloud or AI service to process personal health information. If that changes, we will update this policy and the Statement of Information Practices before doing so.

10. Safeguards

We protect personal health information with administrative, technical and physical safeguards appropriate to its sensitivity:

Administrative

A designated privacy contact person; written privacy and security policies; confidentiality agreements and annual privacy training for everyone who works in the practice; access to records limited to what each role needs; written agreements with every service provider; a privacy breach procedure; and an annual review of this policy and of our safeguards.

Technical

Unique user accounts, strong passwords and multi-factor authentication for the EMR and other systems; encryption of data at rest on practice computers and in transit; audit logs in the EMR of who accessed which record; automatic screen locking; up-to-date operating systems and security software; secure, encrypted backups; and secure channels (such as the EMR's fax integration or provincial systems) for sending information to other providers.

Physical

Paper records, computers and fax machines kept in areas not accessible to the public; locked storage for paper records; screens positioned away from public view; and secure shredding of paper and secure wiping or destruction of storage media.

11. Access to your record

You have a right of access to your own personal health record. To request access or a copy:

1. Make the request in writing to the privacy contact person. We may ask you to confirm your identity.
2. We will respond within 30 days. If we cannot, because the request is large or complex, we will tell you in writing within 30 days and may take up to 30 additional days.
3. We may charge a reasonable fee that does not exceed the cost of providing the record. We will give you a fee estimate before proceeding, and you may narrow your request.
4. In limited circumstances PHIPA allows or requires us to refuse access to part of a record, for example where it contains information about another person, is subject to legal privilege, or where access could reasonably be expected to result in serious harm. If we refuse, we will tell you the reason, which parts are affected, and that you may complain to the Information and Privacy Commissioner of Ontario.

You may also simply ask your physician to review your record with you at an appointment; no formal request is needed for that.

12. Correction of your record

If you believe your record is inaccurate or incomplete for the purposes for which we use it, you may ask us in writing to correct it. We will respond within 30 days (extendable by up to 30 days with notice) . We will make the correction if you show, to our satisfaction, that the record is incomplete or inaccurate and you give us the information needed to correct it. We are not required to change a professional opinion or observation made in good faith, or a record we did not create and cannot verify.

If we make a correction, we will note the correction in the record so the original entry remains legible, and, at your request, notify anyone we have disclosed the information to in the past year where the correction could affect your care. If we refuse, we will tell you why, and you may require us to attach a concise statement of disagreement to the record, which we will include whenever we disclose that information. You may also complain to the Information and Privacy Commissioner.

13. Retention and disposal

We retain the practice's records in accordance with CPSO requirements: at least ten years from the date of the last entry, or for a patient who was under 18 at the time of the last entry, at least ten years after the patient turns 18. Records may be kept longer where a legal proceeding, audit or investigation is pending.

When records reach the end of their retention period we destroy them securely: paper by cross-cut shredding, and electronic records by deletion from the EMR and secure wiping or destruction of any storage media. We keep a record of what was destroyed, when and how. If the practice closes or transfers, we will give you notice and tell you how to obtain your records.

14. Privacy breaches

A privacy breach occurs when personal health information is stolen, lost, or collected, used or disclosed without authority, including a misdirected fax or an employee looking at a record without a need to. Our breach procedure requires us to:

1. Contain the breach immediately, for example by retrieving a misdirected fax, revoking access, or disabling an affected system.
2. Notify every affected individual at the first reasonable opportunity, telling them what happened, what information was involved, what we have done, and that they may complain to the Information and Privacy Commissioner of Ontario.
3. Report to the Information and Privacy Commissioner of Ontario where PHIPA or its regulation requires (for example, a breach that is part of a pattern, that involves an agent's wilful or snooping access, or that is otherwise significant), and to the CPSO where a regulated professional is involved. We also count all breaches and report the annual statistics to the Commissioner as required.
4. Investigate the cause and remediate, including discipline where appropriate and changes to our safeguards.

15. Questions and complaints

Questions, access or correction requests, lock-box requests and complaints should be directed to:

We will acknowledge a complaint promptly, investigate it, and respond to you in writing. If you are not satisfied, or you prefer to go directly to the regulator, you may file a complaint with the Information and Privacy Commissioner of Ontario. A complaint to the Commissioner should normally be made within one year of the matter coming to your attention.

16. Review of this policy

The custodian reviews this policy at least annually and whenever the practice's information practices, systems or service providers change. The current version is posted at johnstirrat.ca/privacy.html and is available in paper form at the practice. This version took effect on 19 October 2026.