+ About CUPS Consent

Consent is a granting of permission for an action or event to occur. In the case of your information, valid consent is required to collect information from you, to use that information on your behalf, and to disclose or share that information with others on your behalf.

Types of consent include:

a) direct, express, or explicit consent where you are granting your permission verbally, in writing, or in another direct and verifiable way

b) indirect or implied consent where you are seeking or accepting a service and giving permission to share the information necessary to receive that service; and

c) law-based consent where the law itself provides the consent such as permission for agencies to share information necessary in response to an emergency situation involving or related to yourself (as one example).

Sometimes more than one consent may be involved, with both consents supporting each other. At all times we need your valid consent before we can collect, use or share your information.

+ Your Personal Information

As part of delivering services to you, our clients, CUPS may need to collect, use, and/or share your information as part of those services. Normally we will collect this information directly from you, though in some limited circumstances we may be allowed by privacy laws to collect limited information indirectly such as from family members assisting you or through other sources such as the provincial public health record system. At all times CUPS follows the principle that we will only collect the least amount of information necessary to support the services you have requested.

+ Under what legal authority is CUPS collecting my Personal Information?

We collect your information under Section 11 of the Alberta Personal Information Protection Act (PIPA) and Section 20 of the Alberta Health Information Act (HIA). These same Acts also govern how we use, share, and protect your information, and we are bound by them.

+ Can I change my mind and cancel consent? What are the potential consequences if I do?

Whether consent is direct or implied, you can revoke it at any time. That is your right under the law. Be aware though that if the consent you are cancelling relates to information needed by an agency to provide you a requested service, withholding that information may or may not impact your ability to get that service. For example, the agency providing the service may require that information by law or similar before they can serve you. Be sure to ask questions about possible impacts when considering revoking consent so you are aware of the likely outcomes and how they may affect you.

+ Am I allowed access to my Personal Information that CUPS holds about me?

Under most-to-all privacy laws, you retain the right for either yourself or your authorized representative to request access to information an agency may hold about yourself. At CUPS we recognize this right, and you may make such a request at any time. It can be made as a routine verbal request for small amounts of information, or it may require a written formal request for more serious amounts. The request could be handled on the spot for simple matters, or there is also a formal process to follow where more time is needed to ensure your and the agency’s rights are respected.

Note that at all times it is the right of CUPS to use reasonable means to confirm the identity of yourself or your authorized representative, to ensure that someone unauthorized does not wrongfully access or influence your information.

+ How will my Personal Information be used?

Primarily we will only use your information for the purpose(s) for which you provided it to us. Privacy laws also support some limited circumstances where we may also use your information for such purposes as managing resources, measuring how well programs are doing, confirming your eligibility for services or programs, in support of service provider education and training programs (i.e. doctors-in-training doing their internship at CUPS), and/or as part of complying with the laws of Alberta or Canada related to the services and programs we provide to you.

+ How will my Personal Information be kept private and how will it be stored and protected?

At CUPS we are responsible for and committed to maintaining the privacy of your information. As such, we have a wide range of security and safety measures, administrative, physical, and technical, in place to protect your information from loss and wrongful access and abuse. Your paper records are stored in restricted access areas including locked storage for more sensitive information. Your electronic records are maintained on our secure internal network and electronic records systems, including ensuring we only use in-Canada servers to protect your information from abuse by other governments with less stringent rules than Alberta and Canada.

+ How is consent handled with children or if I need someone to act on my behalf?

A client is able to assign another person as their authorized representative, with authority to represent the client’s best interests. For most authorized representatives, a formal written statement and proper identification is needed to update your records with this authorization. In some cases, such as parents for children or guardians for someone who is short- or long-term incapable of deciding for themselves, the parent or guardian is through that status considered their authorized representative with all the authority necessary to make requests and grant consent on their behalf.

There are some unique circumstances under the law where the “automatic” authorize representative’s authority (i.e. parent or guardian) can be overridden by the person they represent. The most common example encountered is the “mature minor” status where for specific instances, a minor can be deemed mature enough by the health care or service provider to understand the issue(s) at hand and thus represent themselves and override their parents’ role and authority as their authorized representative. Such a circumstance is on a case-by-case basis though, and is not a blanket declaration for all matters involving the minor.

+ What means of communications are safe for Personal Information? What is CUPS policy on communications involving Personal Information?

In practical terms there are three types of communications channels: public such as open conversation in a public area, semi-private such as regular email, and private such as regular mail, secure messaging systems, and phone calls.

CUPS by policy will only communicate basic information such as appointment details by semi-private channels. All other information must be communicated by confirmed private channels or in-person.

Note that we do not control what communications channels you choose to use, but we recommend you take the same approach as we do for the sake of your privacy.

+ How long is my Personal Information kept by CUPS? How is it destroyed when it is no longer needed?

CUPS only retains your information for as long as necessary to ensure we are able to provide you with the services you have asked for, with the minimum time being however long the law requires us to hold it. There is no maximum length of time we are allowed to retain part or all of your information, but the law requires us to have a valid reason for doing so. One example is it’s not uncommon for an agency to maintain some information on past clients to help measure how well a service or program has done over time through tracking of statistics and similar outcomes-related data.

+ Who will have access to my Personal Information?

Only those CUPS personnel with a need-to-know as part of providing you with the services you have requested will have access to your information. To a limited extent this may include support personnel handing tasks such as administration in support of those services. And this need-to-know principle also extends to how much of your information they are permitted access to, with each person only being allowed access to the least amount of information necessary for them to carry out the task they are involved in for that service.

+ Will my Personal Information be shared inside CUPS? Will it be shared with anyone outside CUPS?

Internal

Your information is shared between personnel inside CUPS only in so far as is needed to carry out tasks related to providing and/or supporting the services and programs that you have requested. In privacy law, this is considered “use” of information within the organization providing services to you

External

Your information is shared with agencies outside CUPS only when it involves tasks related to providing and/or supporting services you have requested, and the outside agency needing your information is involved in those tasks on your behalf. We can only share information with outside agencies with valid consent, and at all times we still must abide by the need-to-know and least amount of information necessary principles to protect your privacy. A common example of sharing information with an outside agency that might be familiar to you is when your family doctor refers you to a specialist for medical services, where information is shared to enable that service. Without that information, the specialist may not be able to help you.

Finally, there are times where we may be legally required to share your information as part of complying with the laws of Alberta or Canada related to the services and programs that we are providing to you.

+ If I have questions or concerns about my Personal Information, who can I contact?

CUPS is required by law to make available to you a contact point to answer your privacy questions and concerns. You can reach our CUPS Privacy Officer by phone at 403-221-8780, by email at info@cupscalgary.com, or by mail at 1001 10 Ave SW. T2R 0B7.

Please address any messages, verbal or by email or mail, to “CUPS Calgary – Privacy Team”.