toh

The Ottawa Hospital uses a variety of technical and administrative privacy safeguards to protect your personal health information. We also track all user accesses to your personal health information through Epic, the electronic health record system. Our staff is trained to protect patient privacy. Legislation and hospital policies require staff to only access the information they need to give or support your care.

You have the right to withdraw consent for users to access your personal health information at The Ottawa Hospital.  You can do so by placing a consent directive on your information (sometimes referred to as a “lockbox”).

A consent directive is a privacy control that may help to increase peace of mind regarding your personal health information. However, it may also impact care if a health-care provider is not able to see your entire health record. Please discuss with your care team the benefits and risks of placing a consent directive or “lockbox” on your health record.

Some risks to consider when adding a Consent Directive:

1. Your health care team may be prevented from accessing your relevant health information, which may result in a delay in your care.
2. Your clinician may not have current or accurate information required to safely provide you with care and in some cases may be unable to offer you treatment.
3. Staff may need to contact you at inconvenient times, to obtain express consent to access your HIS.
4. You may receive multiple calls from different staff in the hospital who are involved in your care.

You may reduce these risks by considering a request for the Consent Directive to apply only to specific individuals or records rather than to your entire chart.

The Ottawa Hospital and its partners use the Epic digital health network to provide better health-care and privacy protection to our patients. Epic has three different levels of additional privacy controls that can be applied to your health record.

• Patient Level: This level applies to all staff members for the patient’s entire health record.
• User Level: This level applies to a specific staff member(s) for the patient’s entire health record.
• Encounter Level: This level applies to all staff for a specific hospital visit or encounter.

Every time a staff member attempts to access a patient’s health record with a consent directive, that staff member must confirm they have the patient’s express consent to do so.  They must also note the purpose for which they are accessing the health record.

Please note that The Ottawa Hospital cannot completely restrict access to your personal health information. There are specific situations which still allow for access without patient consent, including a risk of serious bodily harm to the patient or another person, billing, error management and investigating incidents and complaints. The hospital’s Information and Privacy Office regularly audits user accesses to patients’ health records to ensure they are authorized accesses.

For information about withdrawing consent to your provincial health care records please contact the following:

1. eHealth Ontario: 1-866-250-1554
2. Service Ontario: 1-800-291-1405

Last updated on: January 3rd, 2024