Sample Privacy Forms - Saskatchewan Medical Association

Sample Privacy Forms
Confidentiality Agreement for Employees
• applies to all clinic employees
Confidentiality Agreement between Medical Practice and Service Provider
• applies to third parties that may have access to patient information (e.g.
offsite dictation, billing software companies, etc.)
Confidentiality Agreement between Medical Practice and File Storage Facility
• applies to third party physical storage facilities for paper charts, electronic
backup tapes, etc.
Confidentiality Agreement between Medical Practice and File Destruction Facility
• applies to third party facilities for destroying paper charts
Request for Access to Personal Information
• applies to patient requests for information or requests from patient’s legal
representative
Request to Amend Personal Information
• applies to patient requests for amendments or requests originating from
patients’ legal representatives.
16

CONFIDENTIALITY AGREEMENT FOR EMPLOYEES
I am aware that the medical practice named below has policies and procedures regarding
the privacy, confidentiality, and security of personal patient information and that it must
comply with Saskatchewan’s Health Information Protection Act. I understand that it is
my responsibility to be familiar with the requirements outlined in these policies and
procedures and I have read the current version of these policies and procedures.
As an employee of the medical practice named below, I agree to observe and comply with
all policies and procedures of the medical practice with respect to privacy, confidentiality,
and security of patient information. Except when I am legally authorized or compelled to
do so, I will not use or disclose personal patient information that comes to my knowledge
or possession by reason of my employment with this medical practice.
I understand that any breach of the policies and procedures, including misuse or
inappropriate disclosure of patient information, may be just cause for the termination of
my employment.
Employee name (please print)
Employee signature
Date (dd/mm/yy)
Medical Practice (please print)
Dr.
Witness (privacy officer) (please print)
Witness signature
Date (dd/mm/yy)
17

CONFIDENTIALITY AGREEMENT BETWEEN MEDICAL PRACTICE
& SERVICE PROVIDER
The service provider named below hereby agrees that it will not use or disclosure any
identifiable patient information (whether received or created before or after the date
of this agreement) except for the purposes necessary to perform services for the medical
practice named below, as set out in the service contract entered into between the service
provider and the medical practice before this date (“service agreement”) or with the prior
written consent of the medical practice in its sole discretion or as compelled by law.
The service provider represents that it has safeguards in place, equal or superior to the
medical practice named below, to protect the security of patient information. The service
provider agrees to securely dispose of identifiable patient information once it is no longer
required for the purposes specified in the service contract and to notify the medical practice
within a reasonable time thereafter that this has been done and how it has been done.
The service provider represents that it is aware of and fully compliant with Saskatchewan’s
Health Information Protection Act.
The service provider acknowledges and agrees that any breach of this agreement may result
in termination of the service agreement and may be grounds for legal action by the medical
practice against the service provider.
Service Provider (please print)
Authorized Signatory (please print)
Authorized signature
Date (dd/mm/yy)
Medical Practice (please print)
Dr.
Witness (privacy officer) (please print)
Witness signature
Date (dd/mm/yy)
18

CONFIDENTIALITY AGREEMENT BETWEEN MEDICAL PRACTICE
& FILE STORAGE FACILITY
The file storage facility named below hereby agrees that it accepts for storage patient files
provided by the medical practice described below.
The file storage facility agrees that it will not allow its representatives, agents or employees
to read, use or disclose any patient information contained within the files provided to it.
The file storage facility agrees that it will maintain complete confidentiality with respect
to all patient information (whether received or created before or after the date of this
agreement).
The file storage facility agrees that, upon receiving a request from the medical practice, it
will deliver the requested files to the medical practice on a timely basis.
The file storage facility represents that it has safeguards in place, to protect the security of
patient information.
The file storage facility represents that it is aware of and fully compliant with
Saskatchewan’s Health Information Protection Act
The file storage facility acknowledges and agrees that any breach of this agreement may
result in termination of the service agreement and may be grounds for legal action by the
medical practice against the service provider.
File Storage Facility (please print)
Authorized Signatory (please print)
Authorized signature
Date (dd/mm/yy)
Medical Practice (please print)
Dr.
Witness (privacy officer) (please print)
Witness signature
Date (dd/mm/yy)
19

CONFIDENTIALITY AGREEMENT BETWEEN MEDICAL PRACTICE
& FILE DESTRUCTION FACILITY
The Contractor named below hereby agrees that it will destroy patient files and other
confidential information provided by the medical practice described below.
The Agreement
The Contractor agrees that it will, with respect to all documents provided by the medical
practice to it for destruction:
a) Shred all documents within 10 days of taking possession of those documents;
b) Not permit any agent or employee of the Contractor, or any other person, to read or
copy any document;
c) Maintain all documents in a secure location until they are shredded;
d) Shred the documents in such a manner that they cannot be reconstructed;
e) Comply with all the requirements of The Health Information Protection Act and the
regulations under The Health Information Protection Act respecting personal health
information.
The Contractor acknowledges and agrees that any breach of this agreement may result in
termination of the agreement for destruction of documents.
Contractor (please print)
Authorized Signatory (please print)
Authorized signature
Date (dd/mm/yy)
Medical Practice (please print)
Dr.
Witness (privacy officer) (please print)
Witness signature
Date (dd/mm/yy)
20

ACCESS TO PERSONAL INFORMATION
Upon request, we will give a patient (or the patient’s legally authorized representative)
access to his or her personal information from the records we have in our custody or that
are under our control. Our privacy officer will also explain how we collect and use personal
information, and to whom it has been disclosed.
Within 30 business days of receiving your completed “Request for Access to Personal
Information” form (attached), we will provide you with a copy of the information, let you
review the original records if we cannot reasonably provide copies to you, or give reasons
for not providing access. We may extend the time for responding to your request in certain
circumstances. There are a few circumstances where we are permitted or required by law
to
refuse to give you access to some information in your records.
If we refuse access, our privacy officer will explain the reasons for this. If you disagree with
our refusal, we will try to resolve the matter with you. If we cannot resolve the matter to
your satisfaction, you may ask the College of Physicians and Surgeons of Saskatchewan to
try to resolve it. If you are still not satisfied, you may refer the matter to the Office of the
Information and Privacy Commissioner for Saskatchewan.
Saskatchewan’s Health Information Protection Act allows us to charge you a reasonable
fee for access to your personal information. If we wish to charge a fee, we will provide you
with an estimate before we provide the service. We may require you to pay a deposit for
all or part of the fee before we provide the service.
To request access to your personal information or information about a person you are
legally authorized to represent, please complete the attached “Request for Access to
Personal Information” form. If you need assistance, our privacy officer will help you
complete the form.
21

REQUEST FOR ACCESS TO PERSONAL INFORMATION
The information on this form will be used to respond to your request for your personal
information or the personal information of someone whom you are legally entitled to represent.
Whose information do you want access to
My own personal information.
Another person’s personal information.
Please complete the “Patient Information” and “Authorized Representative’s Contact
Information” sections below, and attach proof that you can legally act on behalf of that
individual.
Patient Information
Mr / Mrs / Ms (please circle)
Last Name
Street Address
City
Province
First Name
Postal Code
Fax
Health Card Number
Home Phone
Business Phone
Date of Birth (dd/mm/yy)
Email Address
Please describe, in as much detail as possible, the information you want access to. Indicate if
you also want access to records about the disclosure of your information, or information of the
person you are representing. Be sure to give previous names, if any.
Please indicate if you wish to:
Receive a photocopy of the record.
Please note that a base fee of $______ per page applies for each page copied. For convenience, you
may enclose this fee with your request. You will be provided with an estimate of any additional costs.
View the original record, without receiving a copy.
Please ask for an estimate of the fee you will be charged for:
Review of the original by the physician and / or
Supervision by physician or designated staff person for your review
A deposit of the fee(s) may be required.
Patient signature
Date (dd/mm/yy)
(Authorized Representatives - see following page)
22

Access by Authorized Representative
I am a legally authorized representative of the patient named above and have attached
proof of that representation. I hereby request access to the patient’s personal records on
his or her behalf.
Authorized representative‘s contact information
Mr / Mrs / Ms (please circle)
Last Name
Street Address
City
Province
First Name
Postal Code
Fax
Health Card Number
Home Phone
Business Phone
Date of Birth (dd/mm/yy)
Email Address
Authorized Representative signature
Date (dd/mm/yy)
23

AMENDING PERSONAL INFORMATION
If you believe information in your patient records with our office is inaccurate or
incomplete, you (or your legally authorized representative) may ask us to correct the error
or omission. Our privacy officer will explain the process.
We will not amend your patient record to change our diagnosis or opinion, unless we are
convinced that our diagnosis or opinion was mistaken.
Within 30 days of receiving your request, we will correct any information in your patient
record that we have verified to be inaccurate or incomplete, then send a copy of the
corrected record to each organization to which the inaccurate or incomplete information
was disclosed within the past year.
If we decide that no correction is necessary, our privacy officer will explain the reasons for
this. We will note your requested correction and reasons for not making any correction
and include it in your record, to indicate a correction was requested but not made.
If you disagree and believe that a change should have been made, we will attempt to
resolve the matter with you. If we cannot resolve the matter, we will tell you how to
request a review by the College of Physicians and Surgeons of Saskatchewan. If you are
still dissatisfied after that review, you may take the matter to the Office of the Information
and Privacy Commissioner for Saskatchewan.
To request an amendment to your personal information, please complete the attached
“Request to Amend Personal Information” form. If you need assistance, our privacy officer
will help you complete the form.
24

REQUEST TO AMEND PERSONAL INFORMATION
The information gathered on this form will be used to respond to your request to amend your
personal information or the personal information of someone you are legally entitled to represent.
Whose information do you want to amend
My own personal information.
Another person’s personal information.
Please complete the “Patient Information” and “Amendments by Authorized Representative”
sections below, and attach proof that you can legally act on behalf of that individual.
Patient Information
Mr / Mrs / Ms (please circle)
Last Name
Street Address
City
Province
First Name
Postal Code
Fax
Health Card Number
Home Phone
Business Phone
Date of Birth (dd/mm/yy)
Email Address
Please describe, in as much detail as you can, the information you want amended. Be sure to give
the complete patient name that is in the records if it is different from the name given above. If
you need more space, please attach a separate sheet of paper.
What amendment do you want to make and why Please attach any documents that support
your request.
Patient signature
Date (dd/mm/yy)
(Authorized Representatives - see following page)
25

Amendments by Authorized Representative
I am a legally authorized representative of the patient named above and have attached
proof of that representation. I hereby request access to the patient’s personal records on
his or her behalf.
Authorized representative‘s contact information
Mr / Mrs / Ms (please circle)
Last Name
Street Address
City
Province
First Name
Postal Code
Fax
Health Card Number
Home Phone
Business Phone
Date of Birth (dd/mm/yy)
Email Address
Authorized Representative signature
Date (dd/mm/yy)
26