top of page

Compliance Policy

CareOnDemand’s Compliance Policy ensures we meet all regulatory, licensing, and accreditation requirements, upholding the highest standards of safety, fairness, and legal integrity across our operations in accordance with Canadian laws.

Hipaa

HIPAA

CareOnDemand is committed to ensuring the privacy and security of clients' health information in compliance with Canadian privacy laws, including the Personal Information Protection and Electronic Documents Act (PIPEDA), Personal Health Information Protection Act (PHIPA) (Ontario), and other applicable regulations. This policy outlines the procedures we follow to protect personal health information (PHI) and ensure its secure handling and use.

 

Definitions

 

  • Personal Health Information (PHI): Information related to a client’s health status, medical treatment, or payment for healthcare services that can identify an individual.

  • PIPEDA: A federal law governing the collection, use, and disclosure of personal information in the course of commercial activities.

  • PHIPA: Ontario’s specific legislation for protecting health information.

 

Scope

 

This policy applies to all CareOnDemand employees, contractors, and care workers who handle PHI in the course of providing services to clients.

 

Privacy of Health Information

 

CareOnDemand ensures the confidentiality and privacy of PHI in accordance with Canadian privacy regulations.

 

  • Use and Disclosure of PHI: PHI is used or disclosed only for purposes such as treatment, care coordination, and payment. Any other use or disclosure requires the client’s informed consent, except as required by law.

  • Client Consent: PHI is collected, used, and disclosed with the consent of the individual, as per PIPEDA and PHIPA. Clients have the right to withdraw their consent at any time.

  • Minimum Necessary Standard: Only the minimum amount of PHI necessary to perform a task is accessed or disclosed.

 

Security of Health Information

 

CareOnDemand protects electronic personal health information (ePHI) using stringent security measures.

 

  • Data Encryption: PHI is encrypted during transmission and storage to prevent unauthorized access.

  • Access Controls: Only authorized personnel have access to PHI, and strong authentication methods, such as unique IDs and passwords, are required for access.

  • Physical Safeguards: Physical security measures, such as locked facilities and secure workstations, are in place to protect PHI from unauthorized access.

  • Audit Logs: Regular audits are conducted to monitor access to PHI and ensure compliance with privacy regulations.

 

Breach Notification

 

In the event of a breach involving PHI, CareOnDemand follows established procedures to comply with breach notification requirements under Canadian law.

 

  • Notification of Affected Parties: Affected individuals and the Office of the Privacy Commissioner of Canada (OPC) will be notified promptly if there is a breach involving personal health information.

  • Risk Assessment: A risk assessment will be conducted to determine the impact of the breach and the appropriate remedial actions.

  • Corrective Measures: Steps will be taken to address the breach and prevent future occurrences, including updating security protocols and training.

 

Employee Responsibilities

 

  • Training: Employees and contractors with access to PHI must undergo regular training on privacy, security, and breach reporting protocols.

  • Confidentiality Agreements: Employees must sign confidentiality agreements to protect the privacy and security of client data.

  • Reporting Breaches: Employees are responsible for reporting any known or suspected privacy breaches to the designated Privacy Officer.

 

Third-Party Service Providers

 

CareOnDemand ensures that third-party service providers handling PHI are also compliant with Canadian privacy regulations. Service Agreements are in place to ensure they follow the same privacy and security protocols.

 

Client Rights

 

Clients have the following rights concerning their personal health information:

 

  • Access: Clients may request access to their PHI and obtain copies of their health records.

  • Correction: Clients have the right to request corrections to their PHI if they believe it is inaccurate or incomplete.

  • Withdrawal of Consent: Clients may withdraw consent for the use and disclosure of their PHI at any time, subject to legal obligations.

 

Sanctions for Violations

 

Any employee found in violation of this policy may face disciplinary actions, up to and including termination. Breaches may also result in legal consequences under Canadian privacy laws.

bottom of page