Page 9 - Policies

UHN may use information from non-UHN organizations if UHN has authority to use for
the direct care of a patient.

Refer to Limiting Collection, Use and Disclosure of Personal Health Information on the
Privacy website.

Retention, Archiving & Destruction of Personal Health Information

UHN has established information retention guidelines that define consistent minimum
standards and requirements for the length of time PHI and records of personal health
information are to be maintained. (Refer to Access to Archival Records policy 1.30.008).

UHN has established appropriate practices for the timely and secure disposal of PHI
consistent with confidentiality, legal and regulatory requirements. (Refer to Storage,
Transport & Destruction of Confidential Information policy 1.40.006).

Researchers are responsible for the storage/retention of research data, as defined in
their approved research protocol.

Patients’ Rights

Upon request, an individual will be informed of the existence, use, and disclosure of his
or her PHI, and will be given access to that information as per Patient Access to the
Medical Record policy 1.40.003 and Release of Patient Information policy 1.40.002.
UHN agents may not access their own paper and/or electronic records outside of this
process and, by extension, may not directly view their own records in electronic systems.

UHN will make specific information about its policies and practices relating to the
management of PHI readily available to individuals. (See Patient Access to the Medical
Record policy 1.40.003.)

An individual will be able to address a challenge concerning compliance with this policy.

UHN will inform individuals who make inquiries or lodge complaints of the existence of
relevant complaint procedures.

UHN will investigate all complaints. If a complaint is found to be justified, UHN will take
appropriate measures, including amending its policies and practices if necessary.

Ensuring Accuracy of Personal Health Information

UHN will take reasonable steps to ensure that information is as accurate, complete, and
relevant as is necessary to minimize the possibility that inappropriate information may be
used to make a decision about the individual. (Refer to Data Quality policy 1.40.016).

An individual will be able to challenge the accuracy and completeness of the information
and have it amended as appropriate. (Refer to Patient Requests for Correction to

This material has been prepared solely for use at University Health Network (UHN). UHN accepts no responsibility for use of this material by
any person or organization not associated with UHN. No part of this document may be reproduced in any form for publication without
permission of UHN. A printed copy of this document may not reflect the current, electronic version on the UHN Intranet.
Policy Number 1.40.007 Original Date 08/02
Section Privacy & Information Security Revision Dates 07/05; 11/14; 11/16
Issued By Privacy Office Review Dates
Approved By Senior Vice-president & Chief Information Page 3 of 8
Officer