INTRODUCTION
Canadian Rehabilitation Institute (CRI) conducts Independent Evaluations (IE’s) for the insurance, legal and corporate markets.
ACCOUNTABILITY
CRI will be responsible for all personal information under our control. We have a Chief Privacy Officer to ensure our compliance with the PIPEDA (Policy Information Protection and Electronic Documents Act) and our own Privacy Policy.
Should we use third parties to process personal information, we will use reasonable means to ensure that all such transferring of personal information is afforded a comparable level of protection to that which we maintain.
IDENTIFY PURPOSES
CRI will identify the purpose for which we collect personal information on or before the time of collection. All referrals received from our clients will be reviewed to ensure that their requests for information are compliant with PIPEDA.
Confidential information and medical records may be collected in order to ensure proper and complete assessments are conducted and to ensure that assessors have the necessary information to conduct appropriate assessments.
CONSENT
CRI will obtain the appropriate consent from individuals for the collection, use or disclosure of personal information, except where the law provides an exception.
Express consent is specific authorization given by the individual to CRI, either in writing or verbally. Implied consent is when CRI has not received specific consent, but the circumstances allow us to collect, use, or disclose personal information.
When possible, we may obtain express consent for the collection, use, disclosure of personal information, or when we determine that consent has been implied by the circumstances.
Personal information will only be collected, used and disclosed without consent in accordance with Section 7 of the Personal Information Protection and Electronics Documents Act, S.C. 2000, c.5 (PIPEDA).
LIMITING COLLECTION
Any personal information collected will be limited to that which is necessary for the purposes as stated in ‘Identify Purposes’. We will only collect personal information for specific, legitimate purposes, and will only collect information by fair and lawful means and not by misleading or deceiving individuals about the purpose for which the information is being collected.
Our policies and procedures relating to the limitations on collection of personal information will be regularly communicated to our staff who deal with collection, use and disclosure of personal information.
LIMITING USE, DISCLOSURE, & RETENTION
Personal information will only be used or disclosed for the purposes for which it is collected, except with the consent of the individual or as permitted by law. We will only retain personal information as long as necessary for the fulfillment of those purposes or as required by regulatory bodies. Personal information that is no longer required to fulfill identified purposes will be destroyed, erased, or made anonymous.
Please note that there may be situations where we use, disclose or retain personal information for legitimate purposes not identified to the individual to which the information pertains including those situations referred to in “Consent’.
ACCURACY
Any personal information we collect will be as accurate, complete and up-to-date as necessary for its intended purposes. We will further attempt to ensure that any personal information is only in relation to the purpose for which it was collected.
If a significant error or omission is identified, we will correct or amend the information as necessary. Where possible, we will send such corrected or amended information to third parties who have had access to the information in question.
SAFEGUARDS
CRI will safeguard all personal information under our control in a manner that is appropriate to the sensitivity of the information. We will take all the physical security measures necessary including properly locking our facilities and/or locking all personal information in secure filing areas, and securing all electronic storage devices.
All CRI personnel are properly trained in the policies that pertain to these safeguards. No unauthorized access to our offices, including secure areas within our offices, is permitted.
No sensitive personal information, pertaining to personal information will be electronically transferred to our clients unless the electronic files have been password-protected prior to transfer. Distribution of personal information will be on a need-to-know basis.
We will take the necessary precautions in the disposal or destruction of personal information, both hard copy and electronic, to prevent unauthorized parties from gaining access to such information.
OPENNESS
We will make available to all individual requests, specific information about our policies and procedures relating to the management of the personal information that is under our control.
In addition, we will make available to the public easily understandable information about our company’s privacy policy.
INDIVIDUAL ACCESS
An individual, upon request, will be informed of the existence, use and disclosure of their personal information in our possession, and may be given access to their information. The individual may be permitted to challenge the accuracy and the completeness of that information and correct or amend information found to be deficient. Where appropriate, amended information will be sent to any third parties having access to the information.
There are lawful exceptions that will prevent the individual from gaining access, which include, but are not limited to the following:
- The information was collected without consent for the purposes related to an investigation of a breach or an agreement or contravention of a law or other lawful exemption.
- The information is protected by the Solicitor/Client privilege.
- Someone’s life or security might be compromised.
- It was collected without the individual’s knowledge or consent to ensure its availability and accuracy, and the collection was required to investigate a breach of an agreement or contravention of a federal or provincial law (the Privacy Commissioner must be notified).
- The information was generated during the course of a formal dispute resolution process.
CHALLENGING COMPLIANCE
According to PIPEDA, “An individual shall be able to address a challenge concerning compliance with the principles to the designated individual or individuals accountable for the organization's compliance.”
Should any individual wish to challenge our compliance of the Personal Information Protection and Electronic Documents Act (PIPEDA), they may contact the Chief Privacy Officer identified below.
We will investigate all requests and complaints and take appropriate measures to correct information handling processes and provide a response within a reasonable time period.
462 Birchmount Road, Unit 52
Scarborough, ON
Canada M1K 1N8
Telephone: (416) 694-1919
Toll-Free: 1-866-794-1919
Fax: (416) 694-9693
E-Mail: info@cricanada.ca