Privacy Policy 

 

By: Danielle Stirrett, Registered Physiotherapist 

For physiotherapy services rendered at Dynamic Movement Chiropractic and Health Centre 3-110 Anne St. S. Barrie ON L4N 2E3

​

1. Introduction 

 

At Danielle Stirrett Physiotherapy, I am committed to protecting the privacy, confidentiality, and security of my clients’ personal health information (PHI). As a regulated health professional, I recognized the importance of maintaining the trust placed in me by my clients and am committed to complying with all applicable privacy legislation, including the Personal Health Information Protection Act (PHIPA), 2004, as well as the standards and expectations established by the College of Physiotherapists of Ontario. 

 

2.    What is PHI?  

 

PHI means identifying information about an individual related to their physical or mental health, healthcare services received, health history, treatment plans, assessments, or other information contained within a health record. 

 

Examples include, but are not limited to: 

• Treatment notes 

• Diagnosis and clinical findings

• Exercise programs and rehabilitation plans 

• Imaging reports or medical documentation 

• Communication between healthcare providers regarding care

• Billing and insurance-related health information 

 

3.    Collection of PHI

 

Danielle Stirrett Physiotherapy collects PHI necessary to provide safe, effective and appropriate physiotherapy services. 

 

PHI may be collected through: 

• Client intake forms 

• Physiotherapy assessments 

• Health history questionnaires

• Referrals from physicians or other healthcare providers 

• Communication with clients or authorized representatives 

• Previous healthcare records provided with consent 

• Insurance or third-party payer documentation 

 

Only information necessary for the provision of physiotherapy services, administrative requirements, regulatory obligations, or legal responsibilities will be collected. 

 

4.    Consent for Collection, Use, and Disclosure of PHI 

​

4.1. General Consent Principles 

​

At Danielle Stirrett Physiotherapy, consent is obtained before collecting, using, or disclosing PHI, except where permitted or required by law. 

 

Clients have the right to understand: 

• What information is being collected

• Why the information is required 

• How the information will be used 

• Who may receive the information 

• Their ability to withdraw or limit consent where appropriate 

 

Clients may ask questions about privacy practices at any time. Detailed contact information is available below. 

 

4.2.  Express Consent 

 

Express consent is obtained when a client provides clear and specific permission for the collection, use, or disclosure of their PHI. 

 

Express consent may be obtained through: 

• Written consent forms 

• Signed documentation 

• Electronic consent 

• Verbal consent documented in the client record 

 

Express consent may be required for situations such as: 

• Sending PHI to another healthcare provider 

• Providing documentation to an insurance company or third party 

• Sharing records outside the circle of care

• Communicating health information through electronic methods where additional consent is required

 

4.3.  Implied Consent 

 

Implied consent refers to situations where consent may reasonably be inferred based on the client’s actions and the circumstances of care. 

 

Examples include: 

• A client providing medical history information during an initial physiotherapy assessment 

• A client attending scheduled physiotherapy appointments and participating in treatment 

• A client allowing information to be shared with healthcare providers involved in their ongoing care within the established circle of care 

 

PHI will only be used or disclosed under implied consent when it is reasonable and appropriate for the purpose of providing healthcare services. 

 

4.4.  Withdrawal of Consent 

 

Clients may withdraw consent for the collection, use, or disclosure of their PHI at any time, subject to legal, regulatory, or contractual requirements. Clients can also ask that specific information is not shared with certain people or organizations, sometimes called a “lock box.” This request will be followed unless the law says otherwise.

 

5.    Use and Disclosure of PHI 

 

5.1. Use of PHI 

 

At Danielle Stirrett Physiotherapy, PHI is used only for the purposes that are related to providing physiotherapy services, managing client care, and fulfilling professional, legal and administrative responsibilities. 

 

PHI may be used for the following purposes: 

• Assessing, diagnosing and treating clients 

• Developing and modifying physiotherapy treatment plans 

• Monitoring progress and functional outcomes 

• Providing exercise recommendations and rehabilitation guidance 

• Communicating with clients regarding appointments, treatment and care instructions 

• Coordinating care with other healthcare providers involved in the client’s treatment 

• Completing clinical documentation and maintaining health records 

• Processing payments, billing and insurance documentation 

• Meeting regulatory, legal and professional obligations 

• Quality improvement, education and practice management activities where permitted and appropriate 

 

Only the minimum amount of PHI necessary for the intended purpose will be accessed, used or disclosed. 

 

5.2. Disclosure of PHI 

 

PHI will not be disclosed to individuals or organizations outside of Danielle Stirrett Physiotherapy without appropriate consent, unless disclosure is permitted or required by law. 

 

PHI may be disclosed with client consent to: 

• Referring physicians or nurse practitioners 

• Other regulated healthcare professionals involved in the client’s care 

• Insurance companies or third-party payers 

• Employers or other organizations where authorized by the client 

• Legal representatives where appropriate and authorized 

• Other individuals specifically identified by the client 

 

Before disclosing PHI, Danielle Stirrett Physiotherapy will take reasonable steps to: 

• Confirm the identity and authority of the recipient 

• Ensure appropriate consent has been obtained 

• Share only information necessary for the stated purpose 

• Use secure methods of communication whenever possible 

 

5.3. Disclosure Without Consent 

 

PHI may be disclosed without consent only where permitted or required by applicable legislation. 

Examples may include: 

• Situations involving legal requirements, such as court orders or statutory obligations 

• Reporting requirements established by legislation 

• Circumstances where disclosure is necessary to reduce a significant risk of serious harm 

• Regulatory investigations or professional obligations 

 

6.    Electronic Communication Policy (Emails and Text Messaging) 

 

6.1. Purpose of Electronic Communication 

 

Danielle Stirrett Physiotherapy may use electronic communication methods, including email and text messaging to support client care and clinic operations. 

 

Electronic communication may be used for: 

• Appointment scheduling, confirmation, cancellation and reminders 

• Administrative communication

• Sending general clinic information 

• Responding to client questions regarding appointments or treatment logistics 

• Providing exercise instructions, resources or follow-up information 

• Communicating with clients regarding ongoing physiotherapy care when appropriate

 

6.2. Types of PHI That May Be Sent Electronically 

 

Where appropriate and with client consent, PHI may be communicated electronically, including: 

• Home exercise program instructions 

• Rehabilitation/treatment recommendations/instructions  

• Progress updates 

• Forms or documentation related to physiotherapy care 

 

6.3. Consent for Email and Text Messaging 

 

Prior to using email or text messaging for communication involving PHI, clients will be informed of: 

• The purpose for which electronic communication may be used

• The types of information that may be communicated 

• The potential privacy risks associated with electronic communication 

• The limitations of electronic communication 

• The steps taken by the clinic to protect information 

 

Clients may provide consent through: 

• Written consent forms 

• Electronic consent 

• Verbal consent documented in the health record 

Consent for electronic communication is voluntary. Clients may request alternative communication methods at any time. 

 

6.4. Risks Associated With Electronic Communication 

 

Although Danielle Stirrett Physiotherapy takes reasonable steps to protect PHI, electronic communication carries inherent risks, including: 

• Messages may be intercepted, accessed or viewed by unintended recipients 

• Email accounts or devices may be accessed by unauthorized individuals 

• Text messages may appear on locked or unlocked device screens 

• Messages may be stored by third-party service providers out of the clinic’s control 

• The identity of the recipient cannot always be guaranteed 

 

Clients are responsible for maintaining the security of their own devices, email accounts and messaging applications. 

 

Clients are encouraged to: 

• Use private email accounts 

• Maintain password protection on devices 

• Avoid sharing devices or accounts used for healthcare communication 

• Notify the clinic if their contact information changes 

 

6.5. Text Messaging Policy 

 

Text messaging may be used primarily for appointment-related communication and brief client interactions. 

 

Examples of appropriate text messages include: 

• Appointment reminders 

• Confirmation of appointment times 

• Requests to contact the clinic 

• Administrative updates 

 

Text messaging may include limited health information only when necessary and when consent has been obtained. Clients should understand that standard SMS/text messaging may not be encrypted and may involve third-party telecommunications providers. 

 

6.6. Email Communication Policy 

 

Email may be used for communication when the client has provided consent. When email communication is used:

• Danielle Stirrett Physiotherapy email account will be maintained with appropriate security measures 

• Emails containing PHI will only be sent for appropriate purposes 

• The clinic will use reasonable measures to confirm the intended recipient 

• Clients should understand that email transmission cannot be guaranteed to be completely secure

 

7.    Protection of PHI and Security Safeguards 

 

Danielle Stirrett Physiotherapy maintains administrative, technical and physical safeguards designed to protect PHI from unauthorized access, collection, use, disclosure, modification, loss or destruction. 

 

7.1. Administrative Safeguards

 

Administrative safeguards include: 

• Privacy policies and procedures 

• Education and training regarding confidentiality obligations 

• Confidentiality agreements for contractors etc. 

• Regular review of privacy practices 

• Procedures for responding to privacy concerns and breaches

 

7.2. Technical Safeguards 

 

Technical safeguards include: 

• Password-protected electronic systems  

• Use of strong passwords  

• Secure electronic medical record systems 

• Multi-factor authentication where available 

• Regular software and security updates 

 

7.3. Physical Safeguards

 

Physical safeguards include: 

• Secure storage of paper records in a locked filing cabinet 

• Restricted access to treatment areas and administrative spaces 

• Secure disposal containers and shredding of confidential documents 

• Privacy measures during client conversations and assessments i.e. private treatment rooms, sound machines etc.  

• Ensuring computer screens and records are not visible to unauthorized individuals 

 

8.    Privacy Breach Response Protocol 

 

8.1. Purpose 

 

Danielle Stirrett Physiotherapy is committed to responding promptly and appropriately to any suspected or confirmed privacy breach involving PHI. A privacy breach occurs when PHI is collected, accessed, used, disclosed, lost or destroyed in a manner that is unauthorized or inconsistent with applicable privacy legislation. 

 

Examples of privacy breaches may include:

• Sending PHI to the wrong recipient 

• Losing a device or document containing PHI 

• Unauthorized access to electronic health records 

• Discussing client information with an unauthorized individual 

• Improper disposal of confidential records 

 

8.2. Reporting a Suspected Privacy Breach 

 

Any suspected or confirmed privacy breach will be reported immediately to the Information Privacy Commissioner of Ontario if necessary. 

 

8.3. Breach Response Process 

 

Upon becoming aware of a potential privacy breach, Danielle Stirrett Physiotherapy will take reasonable steps to: 

 

1. Contain the breach via actions that may include: 

• Retrieving incorrectly disclosed information where possible

• Requesting deletion of information sent to an unintended recipient 

• Restricting unauthorized access 

• Securing affected systems or records 

 

2.   Investigate the breach by assessing: 

• What information was involved 

• Who may have accessed the information 

• The likelihood of misuse 

• The number of individuals affected 

• Whether policies or procedures require improvement 

 

3.   Where required by privacy legislation or professional obligations, affected clients will be notified of: 

• The nature of the breach 

• The information involved 

• Steps taken to address the breach 

• Recommended actions the client may take 

• Contact information for questions or concerns 

 

4.   Prevent future occurrences via actions that may include: 

• Update policies and procedures 

• Additional education 

• Modify security safeguards

• Review electronic communication practices

 

All privacy breaches and responses will be documented appropriately. 

 

9. Retention and Destruction of Personal Health Information 

 

9.1.  Record Retention 

 

Danielle Stirrett Physiotherapy maintains client records in accordance with applicable legislation, including PHIPA and the College of Physiotherapists of Ontario requirements. Client health records will be retained for a minimum of 10 years from the later of the following two dates: 

• The date of the last patient encounter 

• The date that the patient reached or would have reached 18 years of age. 

 

9.2.  Secure Storage of Records 

 

Client records may be maintained in electronic and/or paper format. Electronic records will be stored using secure EMR systems with appropriate access controls. Paper records will be stored securely and protected from access, loss, damage or theft in a locked filing cabinet. Only authorized individuals who require access for their professional responsibilities may access client records. 

 

9.3.  Destruction of Records 

 

When records are eligible for destruction, Danielle Stirrett Physiotherapy will ensure secure destruction methods are used to protect confidentiality. For example, secure shredding of paper documents, permanent deletion of electronic records where appropriate and/or secure disposal of devices containing PHI. 

 

10. Client Access to PHI 

 

10.1. Right of Access

 

Clients have the right to request access to their PHI maintained by Danielle Stirrett Physiotherapy, subject to applicable privacy legislation. Clients may request access to: 

• Physiotherapy assessment records 

• Treatment notes 

• Exercise programs 

• Reports and correspondence 

• Other PHI contained within their health record 

 

10.2. Requesting Access to Records 

 

Requests for access should be submitted to:

Danielle Stirrett, Registered Physiotherapist

3-110 Anne Street South, Barrie ON, L4N 2E3 

705-986-4582

daniellephysiotherapy@gmail.com 

 

Clients may be required to provide in writing sufficient information to identify themselves, specify the records being requested and/or provide authorization if requesting records on behalf of another person. Danielle Stirrett Physiotherapy will respond to access requests within 30 days. 

 

In certain circumstances, access to personal health information may be limited or refused where permitted by law. If access cannot be provided fully, the client will be informed of the reason access is limited or denied, any available options for review or appeal and/or steps to address concerns. 

 

Please note there is an administrative task fee of $30. 

 

11. Correction of PHI 

 

Clients may request corrections to their PHI in writing if they believe information contained within their record is inaccurate or incomplete. Requests for correction should include the information believed to be incorrect, the requested correction and supporting information where applicable. If Danielle Stirrett Physiotherapy agrees that information requires correction, appropriate updates will be made to the record. If a correction request is denied, the client will be informed of the reason for refusal and the ability to add a statement of disagreement to the record where applicable. Clinical opinions, professional assessments and documented observations will not generally be altered solely because a client disagrees with the professional interpretation. Danielle Stirrett Physiotherapy will respond to correction requests within 30 days. 

 

12. Privacy Audits, Reviews and Updates

 

Danielle Stirrett Physiotherapy conducts periodic privacy reviews to ensure ongoing compliance with privacy legislation, professional standards and internal policies. Privacy audits may evaluate compliance with privacy procedures, electronic communication practices, storage and disposal procedures, consent documentation and/or security safeguards. Privacy reviews may include reviewing changes in privacy legislation, updates to professional standards, documentation practices, changes in technology, identifying potential privacy risks, updating policies and procedures and staff education when required. Any identified privacy concerns will be addressed promptly. 

 

13. Contact Information and Privacy Questions 

 

If clients have questions, concerns, or complaints regarding the collection, use, disclosure or protection of their PHI, they may contact: 

 

Danielle Stirrett, Registered Physiotherapist

3-110 Anne Street South, Barrie ON, L4N 2E3 

705-986-4582

daniellephysiotherapy@gmail.com

 

Clients have the right to file a complaint if they believe their rights have been violated to the Information and Privacy Commissioner of Ontario, who can be reached at: 

 

1400-2 Bloor Street East, Toronto ON, M4W 1A8 

Tel: 416-326-3333

Long Distance: 1-800-387-0073

Fax: 416-325-9195

TTY: 416-325-7539

 

For more general inquires, the Office of the Privacy Commissioner can be reached at: 

 

30 Victoria Street, Gatineau QB, K1A 1H3 

Tel: 819-994-5444

Toll-Free: 1-800-282-1376

Fax: 819-994-5424

TTY: 819-994-6591

 

This policy is made by Danielle Stirrett (contact person) with guidance from the PHIPA. This Act is  complex and provides some additional exceptions to the privacy principles that are too detailed to set out here. There are some rare exceptions to the commitments set out above. Please refer to the Act for more clarification. 

​