Privacy Policy
Purpose
Cornerstone Family Counselling Services (CFCS), as a Health Information Custodian (HIC), is committed to protecting the privacy and security of Personal Health Information (PHI) in our care. This policy outlines our practices to ensure that client information is handled safely and in accordance with Ontario’s Personal Health Information Protection Act (PHIPA). .
Policy
We recognize the importance of privacy and the sensitivity of personal health information. This policy follows PHIPA guidelines to help safeguard client information and ensure that clients understand how we handle their data. Our staff members comply fully with PHIPA, as well as the professional requirements from their respective colleges.
Individual colleges, which cover a number of CFCS staff, direct their members to fully comply with PHIPA and all other relevant legislation. This means strict compliance with all rules under PHIPA when collecting, using, or disclosing PHI.
What is Personal Health Information (PHI)?
PHI includes any identifying information about an individual, such as:
- Information related to physical or mental health, including family health history
- Details about health care provided to the individual
- Identification of a substitute decision-maker
- Health card number
We collect PHI to provide counselling and therapy services. Information collected may include a client’s name, date of birth, address, health history, family background, and records of services provided.
Our Privacy Responsibilities
To protect PHI, all HICs and their staff are required to:
- Designate a Privacy Officer
- Implement clear privacy policies
- Share only necessary health information with authorized parties, ensuring that only those involved in care have access
- Notify clients if their information is shared outside the circle of care, intentionally or unintentionally
- Train all staff, students, and volunteers on PHIPA obligations
Our Privacy and Security Policy is designed to support Cornerstone Family Counselling Services staff in understanding their legal and professional obligations to maintain the confidentiality of individuals seeking service through our agency. It provides an overview of the confidentiality requirements set out under the Personal Health Information Protection Act, 2004 (PHIPA) and outlines other professional obligations related to client confidentiality within our scope of practice.
Given the complexities of the legal requirements, staff are reminded that whenever there is uncertainty, they should contact the Agency’s Privacy Officer. The Privacy Officer can, if needed, consult legal counsel or the Privacy Commissioner of Ontario for further direction.
Terms
PHI, subject to certain exceptions, means identifying information about an individual in oral or recorded form, if the information:
- relates to the physical or mental health of the individual, including information that consists of the health history of the individual’s family
- relates to the providing of health care to the individual, including the identification of a person as a provider of health care to the individual
- relates to payments or eligibility for health care in respect of the individual
- relates to the donation by the individual of any body part or bodily substance
- is the individual’s health number, or
- identifies an individual’s substitute decision-maker
Identifying information means information that identifies an individual, or for which it is reasonably plausible that it could be used, either alone or with other information, to identify an individual.
Guiding Ethical Practices
- Cornerstone staff must act in accordance with their professional and legal obligations.
- To establish and preserve trust in the therapeutic relationship, clients must be confident that their personal health information will remain confidential.
- Maintaining confidentiality is fundamental to providing the highest standard of care. Individuals who have confidence that their information will remain confidential are more likely to share complete and accurate health information, which leads to better treatment.
Collecting and Disclosing Information
Staff can only collect information that has a direct influence on the mental health treatment of the client, as per CRPO requirements.
Staff may only disclose PHI:
- When they have the patient’s or substitute decision-maker’s consent, and it is necessary for a lawful purpose
- Where it is permitted under legislation, without the patient’s or substitute decision-maker’s consent
- Where it is required by law
Consent
We require client consent before disclosing PHI. Staff may assume implied consent to share information within the client’s “circle of care” unless explicitly restricted. For disclosures outside the circle of care, express consent is needed, except as allowed by law.
Where technology-assisted tools such as AI-assisted documentation software are used in the delivery of services, additional informed consent is required. See “Technology Use in Service Delivery” below.
Implied Consent: Assumed for sharing information within the client’s “circle of care.”
Express Consent: Required for disclosures outside the circle of care, except as allowed by law.
Lock Boxes
The term “lock box” applies to situations where the client has expressly restricted their counsellor or therapist from disclosing specific personal health information to others, even to others involved in the client’s circle of care. Staff will honour these restrictions except in cases where doing so may compromise client safety or legal obligations.
If a lock box creates a situation where the staff member believes a client’s safety is at risk, they may refuse to provide treatment when it is not an emergency situation. The staff member should explain the reasons for their decision not to treat.
Standards and Practices
Staff will not share information about their clients with others inside or outside of the agency except for purposes of supervision, safety, and where directed by the client or permitted under the law.
All reasonable steps are taken to protect client information. In group supervision or case conceptualization discussions, a first name, initials, or pseudonym along with age will be used. While these steps reduce the risk of inappropriate disclosure, full anonymization is not always achievable given the nature of clinical work.
When service ends, staff will complete and authenticate all proper documentation and retain the record for at least 10 years from the date of the last interaction with the client, or for 10 years from the client’s 18th birthday, whichever is later.
Client Consent and Interaction Policy
Cornerstone is built to provide compassionate, high-quality care with genuine regard for the well-being of clients, both during active engagement and after a file is closed. To ensure compliance with privacy and confidentiality standards:
- Referrals and Information Sharing: Any exchange of information about a client with another program or service must only occur with the explicit consent of the client. This includes seeking general, non-health information updates on a referred individual.
- Interactions with Former Clients: If a staff member encounters a former client within the agency, any interaction should be respectful and guided by the client’s comfort level. Staff should not initiate discussions related to past care unless the client explicitly invites it.
Technology Use in Service Delivery
CFCS uses a small number of approved technology platforms to support clinical documentation, administration, and communication. All platforms that handle personal health information (PHI) are reviewed for compliance with PHIPA and PIPEDA before use, and staff are trained on the appropriate use of each tool.
The following platforms are currently approved for use at CFCS:
Jane App – Clinical and Practice Management
Jane App is our primary practice management system. It is used for client scheduling, intake forms, session notes, billing, and secure messaging. All client health records are stored and maintained in Jane. Jane is a Canadian platform and stores data on servers located in Canada.
Staff access to Jane is role-based. Therapists may only access records for clients they are directly working with. Intake staff have access limited to scheduling and administrative functions. Unauthorized access to client records is a serious breach of this policy and will result in disciplinary action. All staff must sign out of Jane at the end of every session or work period, regardless of whether they are using a clinic device or a personal device.
Klarify – AI-Assisted Session Documentation
Klarify is an AI-assisted note-taking platform used by therapists to support session documentation. It listens to a therapy session and generates a draft summary. The therapist reviews and edits this summary to write the official session note in Jane. The audio recording is deleted automatically after the draft is created. Session transcripts and notes stored within Klarify are deleted by the therapist once the final note has been entered into Jane.
Privacy safeguards
- Therapists must use their CFCS-issued Klarify account credentials at all times. Personal accounts are not permitted under any circumstances.
- Therapists must sign out of Klarify at the end of every session or work period. This applies whether using a clinic device or a personal device.
- When using a personal device, therapists must ensure the device is password-protected, that no session files are downloaded or saved locally, and that no other household members can access the device during or after a session.
- All data processed by Klarify is hosted on servers located in Canada. No client data leaves Canada.
- Client data is never used to train AI models.
- Klarify complies with PHIPA (Ontario) and PIPEDA (federal) privacy requirements.
- Only client initials are entered into Klarify. Full names are never used.
Client consent
Clients must provide informed consent before Klarify is used in any session. Consent is obtained in advance of the first session and confirmed verbally at the start of that session. Clients are informed that the tool is optional, that the audio recording is deleted after the draft summary is created, and that only the final therapist-authored note is retained in their health record. Clients may withdraw consent at any time, including mid-session.
Consent decisions, whether a client agrees or declines, are documented in the client’s file in Jane.
Couples, family, and group therapy
All individuals participating in a session must provide individual consent before Klarify can be used. If any participant declines, traditional note-taking is used for that session. For sessions involving minors, consent from a parent or guardian is required, along with age-appropriate assent from the minor where applicable. Therapists must consult with the Clinical Director before using Klarify in group therapy settings.
Special circumstances
Klarify is not used for crisis interventions, forensic assessments, or court-ordered sessions. Therapists must also consult with the Clinical Director before using Klarify with clients whose capacity to consent may be in question.
Staff obligations
Therapists using Klarify are required to complete Cornerstone’s Klarify training before use, obtain and document client consent prior to every first use, review all AI-generated content before writing the final note, delete all session files from Klarify immediately after the Jane note is finalized, and report any technical issues, inaccurate summaries, or client concerns to the Managing Director or Clinical Director. Klarify’s privacy policy is available at https://www.klarify.ca/privacy-policy. Clients or staff with questions about how Klarify is used at CFCS should contact the Privacy Officer.
Microsoft 365 – Administrative and Communication Tools
CFCS uses Microsoft 365 (including Outlook, Word, and Teams) for internal communications, document drafting, and administration. These tools are used for operational and administrative purposes only. Personal health information is not to be stored in Microsoft 365 environments, drafted in Word documents, or transmitted via Outlook unless it is appropriately secured and is necessary for a legitimate administrative or clinical purpose.
Staff must not use personal Microsoft accounts or personal email addresses to conduct CFCS business or handle any client information. When working from a personal device, staff must sign out of all CFCS platforms at the end of each work period and must not store any client information locally on the device.
Generative AI Tools
CFCS may use generative AI tools (such as AI writing assistants) for administrative and communications tasks, including drafting internal documents, policy templates, staff communications, and marketing content. These tools are used at the administrative level only.
The following rules apply to all generative AI tool use:
- Personal health information (PHI) must never be entered into a generative AI tool. This includes client names, session content, case notes, intake information, or any identifying details.
- Generative AI tools may be used to draft non-clinical content such as policy documents, staff handbooks, website copy, and communications materials, provided no PHI is involved.
- Only clinic-approved tools may be used for work-related tasks. Staff must not use personal AI accounts to conduct CFCS business.
- All AI-generated content used in official CFCS documents, communications, or policies must be reviewed and approved by the appropriate staff member before use. AI output is a drafting aid, not a final work product.
Failure to comply with these rules is a violation of this policy and may result in disciplinary action and regulatory reporting.
Website and Online Communications
The CFCS website uses a live chat tool (Tawk.to) to respond to inquiries from the public. This tool is used for general intake and information purposes only. Staff must not request or collect PHI through the live chat function. Disclosures about the use of this tool are available on our website.
Monitoring
CFCS conducts regular audits of our client information system to ensure compliance. The designated Privacy Officer will perform bi-annual attestations to confirm alignment with privacy practices. This includes reviewing the appropriate use of all approved technology platforms.
Access to Client Records
Staff are prohibited from accessing client records unless they are directly involved in the client’s care. In emergency situations where a client requires immediate support and their primary therapist is unavailable, another therapist may access the client’s file if it is necessary to provide appropriate care, and with the explicit consent of the client.
Unauthorized access or misuse of client data will result in disciplinary action, including possible termination, regulatory reporting, or legal action.
Data Breach Response
In the event of a data breach, Cornerstone Family Counselling Services will take the following steps:
- Identify and Contain the Breach: Immediately identify the nature and extent of the breach and take steps to contain it.
- Notify Affected Individuals: Notify affected individuals promptly, including the types of information involved and steps being taken to mitigate the harm.
- Report to Authorities: Report the breach to the appropriate regulatory authorities, such as the Information and Privacy Commissioner of Ontario.
- Investigate: Conduct a thorough investigation to determine the cause of the breach and implement measures to prevent future occurrences.
- Review and Update: Review and update privacy and security policies and procedures based on lessons learned.
Should you have questions or concerns, please contact CFCS’ Privacy Officer at [email protected].
Purpose
Cornerstone Family Counselling Services (CFCS), as a Health Information Custodian (HIC), is committed to protecting the privacy and security of Personal Health Information (PHI) in our care. This policy outlines our practices to ensure that client information is handled safely and in accordance with Ontario’s Personal Health Information Protection Act (PHIPA). .
Policy
We recognize the importance of privacy and the sensitivity of personal health information. This policy follows PHIPA guidelines to help safeguard client information and ensure that clients understand how we handle their data. Our staff members comply fully with PHIPA, as well as the professional requirements from their respective colleges.
Individual colleges, which cover a number of CFCS staff, direct their members to fully comply with PHIPA and all other relevant legislation. This means strict compliance with all rules under PHIPA when collecting, using, or disclosing PHI.
What is Personal Health Information (PHI)?
PHI includes any identifying information about an individual, such as:
- Information related to physical or mental health, including family health history
- Details about health care provided to the individual
- Identification of a substitute decision-maker
- Health card number
We collect PHI to provide counselling and therapy services. Information collected may include a client’s name, date of birth, address, health history, family background, and records of services provided.
Our Privacy Responsibilities
To protect PHI, all HICs and their staff are required to:
- Designate a Privacy Officer
- Implement clear privacy policies
- Share only necessary health information with authorized parties, ensuring that only those involved in care have access
- Notify clients if their information is shared outside the circle of care, intentionally or unintentionally
- Train all staff, students, and volunteers on PHIPA obligations
Our Privacy and Security Policy is designed to support Cornerstone Family Counselling Services staff in understanding their legal and professional obligations to maintain the confidentiality of individuals seeking service through our agency. It provides an overview of the confidentiality requirements set out under the Personal Health Information Protection Act, 2004 (PHIPA) and outlines other professional obligations related to client confidentiality within our scope of practice.
Given the complexities of the legal requirements, staff are reminded that whenever there is uncertainty, they should contact the Agency’s Privacy Officer. The Privacy Officer can, if needed, consult legal counsel or the Privacy Commissioner of Ontario for further direction.
Guiding Ethical Practices
01.
Cornerstone staff must act in accordance with their professional and legal obligations.
02.
To establish and preserve trust in the therapeutic relationship, clients must be confident that their personal health information will remain confidential.
03.
Maintaining confidentiality is fundamental to providing the highest standard of care. Individuals who have confidence that their information will remain confidential are more likely to share complete and accurate health information, which leads to better treatment.
Collecting and Disclosing Information
Staff can only collect information that has a direct influence on the mental health treatment of the client, as per CRPO requirements.
Staff may only disclose PHI:
- When they have the patient’s or substitute decision-maker’s consent, and it is necessary for a lawful purpose
- Where it is permitted under legislation, without the patient’s or substitute decision-maker’s consent
- Where it is required by law
Consent
We require client consent before disclosing PHI. Where technology-assisted tools such as AI-assisted documentation software are used in the delivery of services, additional informed consent is required. See “Technology Use in Service Delivery” below.
Implied Consent: Assumed for sharing information within the client’s “circle of care.”
Express Consent: Required for disclosures outside the circle of care, except as allowed by law.
Lock Boxes
The term “lock box” applies to situations where the client has expressly restricted their counsellor or therapist from disclosing specific personal health information to others, even to others involved in the client’s circle of care. Staff will honour these restrictions except in cases where doing so may compromise client safety or legal obligations.
If a lock box creates a situation where the staff member believes a client’s safety is at risk, they may refuse to provide treatment when it is not an emergency situation. The staff member should explain the reasons for their decision not to treat.
Standards and Practices
Staff will not share information about their clients with others inside or outside of the agency except for purposes of supervision, safety, and where directed by the client or permitted under the law.
All reasonable steps are taken to protect client information. In group supervision or case conceptualization discussions, a first name, initials, or pseudonym along with age will be used. While these steps reduce the risk of inappropriate disclosure, full anonymization is not always achievable given the nature of clinical work.
When service ends, staff will complete and authenticate all proper documentation and retain the record for at least 10 years from the date of the last interaction with the client, or for 10 years from the client’s 18th birthday, whichever is later.
Client Consent and Interaction Policy
Cornerstone is built to provide compassionate, high-quality care with genuine regard for the well-being of clients, both during active engagement and after a file is closed. To ensure compliance with privacy and confidentiality standards:
- Referrals and Information Sharing: Any exchange of information about a client with another program or service must only occur with the explicit consent of the client. This includes seeking general, non-health information updates on a referred individual.
- Interactions with Former Clients: If a staff member encounters a former client within the agency, any interaction should be respectful and guided by the client’s comfort level. Staff should not initiate discussions related to past care unless the client explicitly invites it.
Monitoring
Cornerstone conducts regular audits of our Client Information System to ensure compliance. The designated Privacy Officer performs bi-annual attestations to confirm alignment with privacy practices.
Access to Client Records
Staff are prohibited from accessing client records unless they are directly involved in the client’s care. In emergency situations where a client requires immediate support and their primary therapist is unavailable, another therapist may access the client’s file if it is necessary to provide appropriate care, and with the explicit consent of the client. Unauthorized access or misuse of client data will result in disciplinary action, including possible termination, regulatory reporting, or legal action.
Data Breach Response
In the event of a data breach, Cornerstone Family Counselling Services will take the following steps:
- Identify and Contain the Breach: Immediately identify the nature and extent of the breach and take steps to contain it.
- Notify Affected Individuals: Notify affected individuals promptly, including the types of information involved and steps being taken to mitigate the harm.
- Report to Authorities: Report the breach to the appropriate regulatory authorities, such as the Information and Privacy Commissioner of Ontario.
- Investigate: Conduct a thorough investigation to determine the cause of the breach and implement measures to prevent future occurrences.
- Review and Update: Review and update privacy and security policies and procedures based on lessons learned.
Contact Us
If you have questions or concerns about our privacy practices, please contact:
Evelyn DeMoss
Privacy Officer
Email: [email protected]
Have Questions?
We’re happy to answer any questions you may have about our services. Fill out our contact form, and we’ll get back to you promptly.
Connect with Us
Do you have questions about our privacy policy? Please fill out the form below, and we’ll get back to you promptly.