Privacy Policy
Your privacy is important to us. We are committed to protecting all personal information. This commitment to safeguarding your privacy is reflected in this Privacy Code.
PRIVACY CODE – ONTARIO COLLEGE OF PHARMACISTS
This privacy code has been created based on the following assumptions:
- The term “College” has the same meaning as it does in the Regulated Health Professions Act (RHPA).
- With respect to its regulatory activities, the College is not engaged in a ‘commercial activity’ as set out in the Personal Information Protection and Electronic Documents Act (PIPEDA) and as such, the College’s collection, use and disclosure of personal information is not covered by PIPEDA.
- The Privacy Code endeavors to adapt the Canadian Standards Association (CSA) principles included in Schedule 1 to PIPEDA in a manner that is appropriate for a regulatory body.
- The Privacy Code is voluntary.
- The principles set out in Privacy Code are not equivalent to the CSA Principles included in Schedule 1 to PIPEDA.
- The College is an ‘investigative body’ under PIPEDA in order to permit organizations that are governed by PIPEDA to be able to provide personal information about members to the College on a voluntary basis.
- The Privacy Code does not deal with the personal information of employees of the College.
- The Privacy Code is not intended for use by members of the College in connection with their obligations under PIPEDA.
Preamble
Pharmacy is a self-governing health profession in Ontario under the Regulated Health Professions Act (RHPA). Under the RHPA, it is the duty of the Minister of Health to ensure that health professions are regulated and coordinated in the public interest.
The Ontario College of Pharmacists was established by the Pharmacy Act and has the following objects as set out in the Health Professions Procedural Code (being Schedule 2 to the RHPA) and the Drug and Pharmacies Regulation Act (DPRA):
- “To regulate the practice of pharmacy and to govern the members in accordance with the Pharmacy Act, the Regulated Health Professions Act, 1991 and its code, and the regulations and by-laws.
- To develop, establish and maintain standards of qualification for persons to be issued certificates of registration.
- To develop, establish and maintain programs and standards of practice to assure the quality of the practice of profession.
- To develop, establish and maintain standards of knowledge and skill and programs to promote continuing evaluation, competence and improvement among the members.
- To develop, establish and maintain standards of professional ethics for the members.
- To develop, establish and maintain programs to assist individuals to exercise their rights under the Code and the Regulated Health Professions Act, 1991.
- To administer the health profession Act, this Code and the Regulated Health Professions Act, 1991 as it relates to the profession and to perform the other duties and exercise the other powers that are imposed or conferred on the College.
- To promote and enhance relations between the College and its members, other health profession colleges, key stakeholders, and the public.
- To promote inter-professional collaboration with other health profession colleges.
- To develop, establish, and maintain standards and programs to promote the ability of members to respond to changes in practice environments, advances in technology and other emerging issues.
- Any other objects relating to human health care that the Council considers desirable.
- To regulate drugs and pharmacies under the Drug and Pharmacies Regulation Act.
- To develop, establish and maintain standards of qualification for persons to be issued certificates of accreditation.
- In carrying out its objects, the College has a duty to serve and protect the public interest.
The legal powers and duties of the College are set out in the RHPA, the Health Professions Procedural Code, the Pharmacy Act and the DPRA. The activities of the College are subject to a number of oversight mechanisms including both general and specific oversight by the Ontario Minister of Health and Long-Term Care and specific oversight by the Health Professions Appeal and Review Board and the Health Professions Regulatory Advisory Council (HPRAC) and the Ontario Fairness Commissioner.
In the course of fulfilling its mandate, the College may collect, use and disclose personal information regarding applicants for membership, members, pharmacy ownership and directorship, members’ patients and persons employed, retained, elected or appointed for the purpose of the administration of the Legislation. The personal information being collected is critical to the College’s ability to effectively regulate the profession in the public interest.
Individuals who are employed, retained or appointed by the College as well as every member of College Council or a College committee are required by section 36 of the RHPA to preserve secrecy with respect to all information that comes to their knowledge. Breach of this provision can lead to the imposition of fines of up to $50,000.00. (Section 36 of the RHPA is attached as Schedule 1 to this Privacy Code.) In addition, personal information handled by the College is subject to the provisions of this Privacy Code.
The College’s collection, use and disclosure of personal information in the course of carrying out its regulatory activities is done for the purpose of regulating the profession in the public interest. These regulatory activities are not of a commercial character. Accordingly, the performance of the College of its statutory duties is not covered by the federal legislation titled the “Personal Information Protection and Electronic Documents Act.” The College has adopted this Privacy Code voluntarily to provide a voluntary mechanism through which the College can provide appropriate privacy rights to individuals involved in the College’s activities while still enabling the College to meet its statutory mandate under the RHPA, the Health Professions Procedural Code, the Pharmacy Act and the DPRA.
Definition of Terms
The following terms used in this Privacy Code have the meanings set out below:
Accreditation Committee means the Accreditation Committee of the College as required by the DPRA.
“Board” means the Health Professions Appeal and Review Board.
“By-laws” means the by-laws of the College passed under the authority of section 94 of the RHPA Procedural Code.
“College” means the Ontario College of Pharmacists.
DPRA means the Drug and Pharmacies Regulation Act and the regulations made there under.
Director of a Pharmacy means a director as specified in subsection 142(2) of the Drug and Pharmacies Regulation Act.
“Discipline Committee” means the Discipline Committee of the College as required by the RHPA Procedural Code.
“Inquires, Complaints and Reports Committee” means the Inquires, Complaints and Reports Committee of the College as required by the RHPA Procedural Code.
“Legislation” means the RHPA, RHPA Procedural Code, Pharmacy Act, Drug and Pharmacies Regulation Act, Regulations and By-laws.
“member” means a member of the College.
“organization” includes an individual, a corporation, an association, a partnership, and a trade union.
“patient” is deemed to include an individual to whom an applicant or member of the College has purported to provide professional services.
“personal information” means information about an identifiable individual but does not include the name, title, or business address or telephone number of an individual.
Pharmacy owner (operator) the holder of a certificate of accreditation.
“Privacy Committee” means the internal College Committee constituted to deal with complaints regarding the manner in which personal information is handled by the College, including complaints regarding an individual’s request for access to his or her personal information.
“Profession Specific Act” means Pharmacy Act.
“Registration Committee” means the Registration Committee of the College as required by the RHPA Procedural Code.
“Regulations” means the regulations made under the RHPA, the DPRA, and/or regulations made under the Profession Specific Act.
“RHPA” means the Regulated Health Professions Act, 1991 as amended from time to time.
“RHPA Procedural Code” means the Health Professions Procedural Code (being Schedule 2 to the RHPA).
Principle 1 – Accountability
The Privacy Officer for the College is accountable for compliance with these policies and procedures. Complaints or questions regarding the manner in which personal information is being handled by the College should be directed to the Privacy Officer who can be reached at 416-962-4861 ext 2347, or email privacyofficer@ocpinfo.com.
The College will provide orientation and training to all new employees and appointees as well as all members of Council, committees or working groups regarding their obligations pursuant to section 36 of the RHPA and this Privacy Code.(1)
The College’s Privacy Code is also available on request by phone at 416-962-4861, ext 2483 or by mail at 483 Huron Street, Toronto, Ontario M5R 2R4. College policy regarding access, retention and destruction of information is available on request.
Principle 2 – Identifying Purposes
The purpose for which the College collects, uses and discloses personal information is to administer and enforce the Legislation.
The College collects and uses personal information regarding its members for the following purposes:
- to assess whether a member continues to meet the standards of qualification for a certificate of registration;
- to investigate complaints regarding the conduct or actions of a member of the College;
- to investigate whether a member has committed an act of professional misconduct or is incompetent;
- to inquire whether a member is incapacitated;
- to hold a hearing of allegations of a member’s professional misconduct or incompetence or of allegations that a member is incapacitated;
- to carry out the quality assurance program of the College, including an assessment of the records and practice of its members;
- to administer the program established by the College to provide funding for therapy and counseling for persons who, while patients, were sexually abused by members of the College;
- to investigate reports filed about members of the College under the RHPA Procedural Code;
- to assess whether a former member’s certificate of registration should be reinstated;
- to assess whether pharmacy ownership and directorship is in compliance with the legislation;
- to provide statistical information for human resource planning and demographic studies;
- to administer elections to the council of the Ontario College of Pharmacists;
- to administer or enforce the Legislation;
- to disseminate information relating to the regulation of the profession including but not limited to the standards of practice, standards of operation and the code of ethics.
The College may collect personal information regarding a member from the member, patients or agents of the member and other persons, for the purposes set out above. Personal information regarding members is collected by the College from time to time and at regular intervals.
The College discloses personal information regarding its members only as permitted by section 36 of the RHPA or as required by law. For example, the College is required under the RHPA Procedural Code to maintain a register containing information about its members. The RHPA Procedural Code and the By-laws require the College to provide access to designated information to a person who requests it.
The College collects and uses personal information regarding the patients of members of the College for the following purposes:
- to investigate complaints regarding the conduct or actions of a member of the College or of a pharmacy accredited by the College;
- to investigate whether a member has committed an act of professional misconduct or is incompetent;
- to inquire whether a member is incapacitated;
- to hold a hearing of allegations of a member’s professional misconduct or incompetence or of allegations that a member is incapacitated;
- to carry out the quality assurance program of the College, including an assessment of the records and practice of its members;
- to administer the program established by the College to provide funding for therapy and counseling for persons who, while patients, were sexually abused by members of the College;
- to investigate reports filed about members of the College under the RHPA Procedural Code;
- to assess whether a member continues to meet the standards of qualification for a certificate of registration;
- to assess whether a pharmacy continues to meet the standards of operation for a certificate of accreditation;
- to assess whether a former member’s certificate of registration should be reinstated;
- to administer or enforce the Legislation.
The College may collect personal information regarding a patient of a member of the College or a pharmacy accredited by the College from the patient, the member and other persons, for the purposes set out above.
The College discloses personal information regarding the patients of members of the College or of pharmacies accredited by the College only as permitted by section 36 of the RHPA or as required by law. For example, hearings of the Discipline Committee are required, subject to certain exceptions, to be open to the public. Evidence at a hearing of the Discipline Committee may include personal information regarding the member of the College who is the subject of the allegation of professional misconduct or incompetence, as well as personal information regarding the member’s patients related to the allegations of professional misconduct or incompetence. Another example of disclosure of personal information about patients of members of the College relates to complaints regarding the conduct or actions of members of the College. Where a complainant, who is frequently a patient of a member, or a member does not agree with a decision of the Inquiries, Complaints and Reports Committee, subject to certain exceptions, either person can request a review by the Board. The RHPA Procedural Code requires that the College disclose to the Board a record of the investigation and the documents and things upon which the decision was based. This disclosure of personal information about a patient of a member to the Board is required under the RHPA Procedural Code.
The College collects and uses personal information regarding applicants and the patients of students and interns to assess whether a student or intern meets, and continues to meet, the standards of qualification to be issued a certificate of registration and to administer or enforce the Legislation. The College discloses personal information regarding students and interns and their patients only as permitted by Section 36 of the RHPA or as required by law. For example, the RHPA Procedural Code provides a procedure for a student or intern who does not agree with a decision of the Registration Committee to request a review or a hearing by the Board. The RHPA Procedural Code requires that the College disclose to the Board a copy of the order and reasons of the Registration Committee and the documents and things upon which the decision was based. This disclosure of personal information to the Board is required under the RHPA Procedural Code.
The College collects and uses personal information regarding individuals who may be practising the profession of pharmacy and their patients to investigate whether the individual has contravened or is contravening the Legislation and to administer or enforce the Legislation. The College discloses personal information regarding such individuals only as permitted by section 36 of the RHPA or as required by law.
The College collects and uses personal information regarding individuals who are retained, elected or appointed for the purpose of the administration of the Pharmacy Act and the DPRA including the following:
- to review prospective candidates and retain or appoint persons for the purpose of the administration of the Act;
- to maintain records to ensure accurate remuneration and payment of expenses, and all documentation required by law and by the various levels of government in accordance with sound accounting practices;
- to maintain accurate and fair accounts of any disputes involving a person retained or appointed for the purpose of the administration of the Act or a member of the Council or Committee of the College.
The College discloses personal information regarding the individuals referred to above only as permitted by section 36 of the RHPA or as required by law.
The College will make a reasonable effort to specify the identified purposes to the individual from whom the personal information is collected, either at the time of collection or after collection but before use, except where to do so would defeat the purpose of the Legislation or be inconsistent with the Legislation.(2)
The College will state the identified purposes in such a manner that an individual can reasonably understand how the information will be used or disclosed.
Principle 3 – Consent
The College collects personal information for purposes related to its objects (see Preamble for the College’s objects) including for the purpose of the proper administration and enforcement of the Legislation. In carrying out its objects, the College has a duty to serve and protect the public interest.
The College will make a reasonable effort to specify the identified purposes to the individual from whom the personal information is collected as described in Principle 2. Obtaining consent of the individuals would, in many cases, defeat the purposes of the College’s collecting, using and disclosing the personal information. Personal information will only be collected, used and disclosed without the knowledge and consent of the individual for the purpose of the administration or enforcement of the Legislation and in accordance with the provisions of the Legislation. For example, personal information about a patient may be collected and used without the patient’s consent for the purpose of the College’s inspection process regarding the assessment of a pharmacy’s operation in accordance with the DPRA and the Regulations. Another example is that personal information about a patient may be collected and used without the patient’s consent for the purpose of an investigation of a member in accordance with the RHPA Procedural Code and the Regulations.(3)
Principle 4 – Limiting Collection
The College collects only the personal information that is required for the purposes identified in Principle 2 of this Privacy Code. The College collects personal information using procedures that are fair and lawful.
Personal information regarding patients must be collected as part of the College’s regulatory function. This information is obtained by the College as part of an inspection, investigation or quality assurance program. The focus of these inquiries is the conduct, competence or capacity of the member or a pharmacy operation and the protection of the public. The College only collects personal information regarding patients to satisfy this regulatory purpose.
Principle 5 – Limiting Use, Disclosure or Retention
The College uses personal information only for the purposes identified in Principle 2 and in accordance with the provisions of the Legislation. Personal information is only disclosed in accordance with the provisions of section 36 of the RHPA or as required by law.
The RHPA Procedural Code and By-laws clearly designate the information regarding members that is publicly available and the By-laws can be accessed from this College website or by contacting the College at 416-962-4861, ext. 2483. Under the RHPA Procedural Code, the College is required to publish certain information regarding discipline hearings conducted by the Discipline Committee.
Under the RHPA Procedural Code, discipline hearings conducted by the Discipline Committee are open to the public. Evidence at a discipline hearing may include personal information regarding the member and the member’s patients related to allegations of professional misconduct or incompetence. Under the RHPA Procedural Code, the panel of the Discipline Committee has the discretion to close a hearing under certain prescribed circumstances and/or restrict the publication of personal information where appropriate. Under the RHPA Procedural Code, reviews of decisions of the Inquiries, Complaints and Reports Committee and Registration Committee by the Board are open to the public. Similarly, the Board has the discretion to restrict the disclosure of personal information in its review process. The objective of these regulatory processes is always the protection of the public.
The College has a record retention policy in place and conducts regular audits to ensure that personal information that is no longer required to be kept is destroyed, erased or made anonymous. Specific information regarding the record retention policy can be obtained by contacting the Privacy Officer at the College.(4)
Principle 6 – Accuracy
It is in the best interest of the public that the College collect, use and disclose only accurate personal information in regulating the profession. The College therefore uses its best efforts to ensure that the information it collects, uses and discloses is accurate.
Members and pharmacy operators are required to provide the College with current name, contact and practice information and to advise the College of changes. This information is updated annually when members renew their registration and certification, and pharmacies renew their accreditation with the College.
Principle – Safeguards
The College ensures that personal information it holds is secure.
The College ensures that personal information is stored in electronic and physical files that are secure. Security measures are in place to safeguard this information which include restricting access to personal information to authorized personnel, ensuring that physical files are under lock and key and ensuring that electronic files are password protected. The College reviews its security measures periodically to ensure that all personal information is secure.(5)
Employees of the College receive an orientation and ongoing training regarding the information safeguards required for personal information and their importance.
The College ensures that personal information that is no longer required to be retained is disposed of in a confidential and secure fashion (i.e., shredding).
Principle 8 – Openness
The College’s information management policies and procedures are available to the public and its members by request by phone at 416-962-4861, ext. 2483 or by mail at 483 Huron Street, Toronto, Ontario M5R 2R4.
Inquiries concerning the College’s policies and practices for collecting, using and disclosing personal information may be directed to the Privacy Officer at 416-962-4861, ext. 2347 or privacyofficer@ocpinfo.com.
Principle 9 – Individual Access
Where the College holds personal information about an individual, upon written request, the College shall allow access to the information to that individual, unless providing access could reasonably be expected to interfere with the administration or enforcement of the Legislation or it is impracticable or impossible for the College to retrieve the information.
Examples of situations where access may be denied include:
- Information contains references to another individual(s) that cannot be severed;
- Disclosure may result in significant risk of harm to the requestor or a third party;
- Information was collected or created in the course of an inspection, investigation, inquiry, assessment or similar procedure authorized by law;
- Disclosure may defeat the purposes for which the information was collected;
- Information cannot be disclosed for legal, security or commercial proprietary reasons;
- Information is subject to solicitor-client or other privilege;
- Information was generated in the course of a formal dispute or resolution process;
- The request is frivolous, vexatious, made in bad faith or otherwise an abuse of process;
In cases where the personal information forms part of a record created by another organization, the College will refer the individual to the organization that created the record (unless it is inappropriate to do so) so that the individual may obtain access to the personal information from the organization rather than the College.
While the College’s response will typically be provided at no cost or minimal cost to the individual, depending on the nature of the request and the amount of information involved, the College reserves the right to impose a cost recovery fee. In these circumstances, the College will inform the individual of the approximate cost to provide the response and proceed upon payment by the individual of the cost.
The College will make every effort to respond to the request within thirty days and to assist the individual in understanding the information.
Individuals should send their written request for access, with contact information and sufficient information to identify themselves, to: Privacy Officer, Ontario College of Pharmacists, 483 Huron Street, Toronto, Ontario M5R 2R4 or at privacyofficer@ocpinfo.com.
In the event the College refuses to provide access to all of the personal information it holds, then the College will provide reasons for denying access. The individual may then choose to file a complaint with the College’s Privacy Committee. Challenging accuracy and completeness of personal information
An individual has the right to request a correction of what in his or her view, is erroneous information. Where the information forms part of a record created by another organization, then the College will refer the individual to the organization that created the record (unless it is inappropriate to do so) so that the individual may challenge the accuracy or completeness of the information.
Where an individual is able to successfully demonstrate that the personal information is inaccurate or incomplete, the College will amend the information (i.e. correct, or add information). In addition, where appropriate, the College will notify any third parties to whom the College has disclosed the erroneous information.
Where there is a dispute between the individual and the College as to the accuracy or completeness of the information, then the College will document the details of the disagreement, and, where appropriate, will advise any third party who received the contested information from the College, of the unresolved disagreement.
Principle 10 – Challenging compliance
Complaints or questions regarding the College’s compliance with this Privacy Code should be directed to the Privacy Officer.
If the Privacy Officer cannot satisfactorily resolve a complaint, the College has a formal privacy complaints procedure which includes:
- acknowledging the complaint;
- review of the complaint by the College’s Privacy Committee;
- providing a written decision and reasons to the complainant; and
- taking appropriate measures where the complaint is found to be justified.
Please note that there is a different process for handling complaints about the conduct or actions of a member of the College. Please contact the Investigations and Resolutions Department if you wish to file a complaint about the conduct or actions of a member of the College.
SCHEDULE 1
SECTION 36 OF THE REGULATED HEALTH PROFESSIONS ACT, 1991
Confidentiality
36. (1) Every person employed, retained or appointed for the purposes of the administration of this Act, a health profession Act or the Drug and Pharmacies Regulation Act and every member of a Council or committee of a College shall keep confidential all information that comes to his or her knowledge in the course of his or her duties and shall not communicate any information to any other person except,
(a) to the extent that the information is available to the public under this Act, a health profession Act or the Drug and Pharmacies Regulation Act;
(b) in connection with the administration of this Act, a health profession Act or the Drug and Pharmacies Regulation Act, including, without limiting the generality of this, in connection with anything relating to the registration of members, complaints about members, allegations of members’ incapacity, incompetence or acts of professional misconduct or the governing of the profession;
(c) to a body that governs a profession inside or outside of Ontario;
(d) as may be required for the administration of the Drug Interchangeability and Dispensing Fee Act, the Healing Arts Radiation Protection Act, the Health Insurance Act, the Health Protection and Promotion Act, the Independent Health Facilities Act, the Laboratory and Specimen Collection Centre Licensing Act, the Fixing Long-Term Care Act, 2021, the Retirement Homes Act, 2010, the Ontario Drug Benefit Act, the Coroners Act, the Controlled Drugs and Substances Act (Canada) and the Food and Drugs Act (Canada).