Our hospitals are under pressure. Please be patient with us as wait times may be longer than usual. Read more.

Hamilton Health Sciences Home

Accessing Your Health Information

Protecting your privacy – Our commitment to you

Hamilton Health Sciences (HHS) is committed to protecting the privacy of its patients, and to the respectful treatment of the personal health information in our custody and control.

Personal health information includes any information about you that identifies who you are and pertains to your health or your healthcare history. For example, personal health information can include details about your medical history, test results, or your health number.

HHS has established practices and procedures to ensure that your personal health information is protected, treated as confidential, and available only to individuals who require access to such information for the purpose of providing you with healthcare, or those who have access to your information as otherwise permitted or required by law.

Any person who works, studies or volunteers at HHS is required to agree in writing to comply with HHS’ privacy policies. Specifically, HHS maintains policies and practices, according to its obligations under the Personal Health Information Protection Act, 2004 (PHIPA), that concern:

  • The collection, use, and disclosure of personal health information;
  • Responding to individuals that seek to exercise their privacy rights, including their right to access their personal health information or to correct any recorded personal health information pertaining to them;
  • Handling and resolving complaints that relate to HHS’ collection, use and disclosure of personal health information;
  • Safeguarding personal health information; and
  • Addressing any suspected or actual contravention of PHIPA.

What is consent under PHIPA?

How we collect your personal health information

Most often, HHS collects personal health information (such as clinical information, health history, notes related to the provision of healthcare, test results or your health card number) directly from you or from a person lawfully permitted to act on your behalf. In certain instances, we may collect information from other sources if we have obtained your consent to do so or if such practices are permitted under law. For example, we will seek your express consent to collect your photograph as an alternative way of identifying you, or to assist in the provision of care, as appropriate. We will also seek your express consent to collect, use or disclose personal health information about you for marketing purposes in accordance with section 33 of PHIPA.

Subject to certain exceptions under PHIPA, we do not collect your personal health information unless we have your express (i.e. an explicit statement obtained directly from the patient or their Substitute Decision-Maker) or implied (concluded from the surrounding circumstances) consent to do so.

How we use your personal health information

Generally, we only use your personal health information for the purpose(s) for which the information was collected or created, namely to provide healthcare and related services to you.

However, we may also use your personal health information for other purposes, as permitted under PHIPA, including:

  • To plan, deliver or improve our programs or services, manage our internal operations and manage the healthcare system;
  • To conduct risk management activities;
  • To train and educate healthcare professionals and HHS staff;
  • To dispose of or modify personal health information in certain instances;
  • For research and statistical purposes (and only in accordance with specific HHS practices and procedures);
  • In connection with a legal proceeding or contemplated proceeding;
  • To obtain payment or process, monitor, verify or reimburse claims for payment for the provision of healthcare or related goods and services; or
  • As otherwise permitted or required under applicable law.

How else may we use your personal information?

To fundraise

The HHS Foundation is dedicated to supporting HHS by raising funds for research, education, and the improvement of patient care. Unless you tell us not to, we will give your name and address to the HHS Foundation for fundraising.

To conduct patient satisfaction surveys

We want to hear from you about the quality of care and services you received at HHS. We will use your name and address, and the dates of your visits to send you surveys. This information helps us improve the care we provide.

To inform your friends and family

Unless you ask us not to, we will provide general information about your health status to family or friends who ask. This includes the name of the clinical program caring for you (e.g. Cardiology), where your room is located, and your general health status, such as “stable” or “no change”.  Your consent is required to disclose any further information.

For Virtual Care

HHS offers virtual care to make sure that we can continue to care for our patients safely and effectively. This means that we will be using video and audio technologies for some patient visits, rather than asking you to present to your clinic in person. Please keep in mind that not all visits are suited for virtual care, and your care team will determine whether this mode of care is appropriate for you.

While HHS takes all reasonable steps to ensure the ongoing privacy and security of virtual care sessions, there are inherent privacy and security risks that personal health information may be intercepted or unintentionally disclosed during electronic communications or virtual care visits. HHS virtual care sessions are not recorded, but they will be documented in your electronic health record.

If you are concerned about engaging in virtual care, please speak to a member of your care team.

Before your virtual visit, your clinic will obtain your consent to communicate electronically. Additionally, your care provider will obtain your consent to engage in the virtual care session before the session starts.

How we may use service providers

Your personal health information may be transferred (or otherwise made available) to certain third parties that provide services on our behalf. We use service providers for services such as storing your personal health information and processing payments. Our service providers (which may be located in Canada or in the United States) are only provided with the information they need to perform their designated functions and are not authorized to use or disclose personal health information for their own purposes.

HHS and some of its healthcare partners use Epic’s health information system to collect and share your personal health information for the purpose of providing you with healthcare.

Access your personal health information through MyChart by Epic.

We also offer individuals the ability to sign up for several web-based portals such as ConnectMyHealth, PocketHealth and Sunnybrook MyChart™, which provide patients with access to their medical and diagnostic imaging records.

When we might disclose your personal health information

We will generally seek your express consent before disclosing your personal health information to a person or entity that is not a “health information custodian” (as defined in PHIPA) and also prior to disclosing your personal health information for a purpose other than for providing healthcare or assisting in providing healthcare. For example, we will only disclose personal health information about an individual to a researcher who satisfies the requirements of section 44 of PHIPA. Such persons and entities will only be permitted to use or share your personal information in accordance with the purposes for which they have received it, unless otherwise permitted or required by law.

There may be certain instances, such as legal, medical, or security reasons, as well as for research purposes, where HHS collects, uses and/or discloses personal health information without your consent. However, in all cases HHS will comply with its legal obligations under PHIPA.

How we safeguard personal health information

We have implemented reasonable administrative, technical and physical measures in an effort to safeguard the personal health information in our custody and control against theft, loss and unauthorized access, use, modification and disclosure. We restrict access to personal health information on a need-to-know basis to employees and authorized service providers who require access to fulfil their job requirements.

All HHS staff receive training and sign a pledge of confidentiality, which together reinforce their obligation to protect your privacy. We conduct audits and take other steps to safeguard personal health information and monitor compliance with HHS privacy policies.

We have record retention processes designed to retain personal health information for no longer than necessary or as otherwise required to meet legal or legitimate operational requirements.

How do HHS and Epic protect your privacy?

HHS now uses Epic’s health information system. We collect and share your personal health information with other authorized caregivers so that you get the best care possible. We will do so safely, using privacy and security controls to help keep your personal health information safe, meet health-care best practices and keep your care as a top priority.

How do HHS and Epic keep my personal health information secure?

HHS takes every reasonable steps to ensure that our staff are compliant with all legislated privacy rules and regulations. HHS has policies and procedures that clearly outline our duty to protect the privacy, confidentiality, and security of all PHI.

HHS also has a robust orientation program for new hires that includes privacy education and training. Our office also participates in role-based and other annual training events at HHS sites, leads privacy information sessions and supports access to privacy resources. Lastly, in an effort to harmonize privacy awareness and compliance across our organization, we have mandated that all staff successfully complete online privacy training on an annual basis which includes annual re-signing of the HHS confidentiality pledge.

In addition to these administrative privacy safeguards, Epic will enable a variety of technical controls, to protect your personal health information, including generating automated reports to monitor access to your personal health information.

Processing your information and the use of vendors outside of Canada

We take steps to make sure that everyone who performs services for us protects your privacy and only uses your personal health information when necessary. While HHS avoids processing or storing data outside of Canada as much as possible, some support services are provided by vendors subject to U.S. laws or in the U.S. In these situations, personal health information will be subject to the laws of another country which may be different, and less protective, than those of Canada.

Can I limit who sees my personal health information in Epic?

Yes. You can limit access to your personal health information for health care purposes by asking for a consent directive, also known as a ‘lockbox’. There are several kinds of consent directives. You can lock your entire record, a specific visit or a staff member from seeing your record. If you want to add a consent directive, contact the HHS Privacy Office for more information.

Hamilton Health Sciences – King West
P.O. Box 2000,
Hamilton, ON
L8N 3Z5
Tel: 905-521-2100 ext. 75126
Fax: 905-577-8474
Email: privacy@hhsc.ca

How can I access my personal health information in Epic?

Through Epic’s MyChart patient portal, you can view your personal health information online, at anytime, anywhere. Epic’s MyChart enables patients to: view test results when they are ready; see future appointments; and review other health information.

To learn more about MyChart, please visit the HHS website or contact the Health Records Department.

You may also get a paper copy of your chart by contacting the Department of Health Records of the hospital where you were treated. To correct something in your health record, talk to your health-care provider at your next visit or contact the HHS Privacy Office for more information.

Your choices

Subject to certain limited exceptions, you are entitled to a copy of your health care record. You must make such a request in writing and may be required to pay a fee.

To correct or amend your healthcare record, you may speak with your health care provider, or ask us in writing to amend your healthcare record.

You can limit access to your personal health information for healthcare purposes by placing a consent directive, also known as a lockbox, on your personal health record. Please contact the HHS Privacy Office to discuss your options with respect to your personal health record.

HHS is prepared to support your right to withdraw your consent to the collection, use and disclosure of your personal health information. If you would like to withdraw your consent to specific uses or disclosures that we have listed in this Privacy Statement, please contact the Privacy Office and complete the Withdrawal of Consent for Personal Health Information Use form. Please note that patients seeking to withdraw their consent for participation in a clinical research study must contact the primary investigator or research co-ordinator of the study to do so.

If you have any questions or concerns in respect of this Privacy Statement or any privacy related activities of HHS, you can contact the HHS Privacy Office at:

Privacy Office
Hamilton Health Sciences – King West
P.O. Box 2000,
Hamilton, ON
L8N 3Z5
Tel: 905-521-2100 ext. 75126
Fax: 905-577-8474
Email: privacy@hhsc.ca

If you wish to make a complaint about HHS’ privacy practices, you may contact the Information and Privacy Commissioner of Ontario at:
2 Bloor Street East, Suite 1400
Toronto, Ontario M4W 1A8
Tel.: 1-800-387-0073
Website: www.ipc.on.ca

Requesting a copy of your medical record

In addition to accessing your health information through MyChart by Epic, you may request copies of your full health care record or diagnostic images (such as X-rays or scans) by submitting a written request to the hospital.

In order for your request to be processed, it must include:

  • the patient’s name
  • patient’s date of birth
  • mailing address of where the information is to be sent
  • details on what information is requested
  • the signature of the patient or substitute decision maker (proof required) and witnessed
  • the request must be dated within 30 days of our receiving it
  • If you are making a request for records of a deceased patient, please contact the Release of Information Clerk within the Department of Health Records of the hospital where the patient was treated.

Administration Fee

  • To cover the cost of time and supplies, there is an administrative cost for requests.
  • For further information on fees and payment, please contact the Release of Information Clerk within the Department of Health Records of the hospital where you were treated.

Contact Information

Due to COVID-19, our offices are temporarily closed to the public.

The completed “Consent to Disclose Personal Health Information” form can be emailed to us at releaseofinfo@hhsc.ca or faxed or mailed to the site where you were treated at the addresses below. Should you wish to receive your records via email, please also complete the “Consent for E-mail Correspondence” form.

Please telephone the site where you were treated if you have any questions.

Hamilton General Hospital
Health Records Department
237 Barton Street East
Hamilton, ON L8L 2X2
Phone: 905-521-2100 Ext. 46264
Fax: 905-577-8024

Juravinski Hospital and Cancer Centre 
Health Records Department
699 Concession Street
Hamilton, ON L8V 5C2
Phone: 905-521-2100 Ext. 63315
Fax: 905-575-6344

McMaster University Medical Centre, McMaster Children’s Hospital, Main Street West Urgent Care Centre and the former Chedoke Hospital

1200 Main Street West
Hamilton, ON L8N 3Z5
Phone: 905-521-2100 Ext. 75123
Fax: 905-528-3828

St. Peter’s Hospital
88 Maple Avenue
Hamilton, ON L8M 1W9
Phone: 905-521-2100 Ext. 12216
Fax: 905-526-2065

West Lincoln Memorial Hospital
Correspondence / Release of Information
169 Main Street East
Grimsby, ON L3M 1P3
Phone: 905-945-2253 Ext. 11360
Fax: 905-945-3125

West Lincoln Memorial Hospital
Film Library Contact Information
Department of Radiology
169 Main Street East
Grimsby, ON L3M 1P3
Phone: 905-945-2253 Ext. 11321
Fax: 905-945-5148

Hamilton General Hospital
Film Library
237 Barton Street East
Hamilton, ON L8L 2X2
Phone: 905-521-2100 Ext. 46515
Fax: 905-527-9053

Juravinski Hospital (formerly Henderson General)

Film Library
711 Concession Street
Hamilton, ON L8V 1C3
Phone: 905-521-2100 Ext. 42257
Fax: 905-383-0583

McMaster University Medical Centre and McMaster Children’s Hospital
Film Library
P.O. Box 2000
Hamilton, ON L8N 3Z5
Phone: 905-521-2100 Ext. 75319
Fax: 905-521-5086

Requesting a correction to your personal health care information

If you believe that factual information in your medical record is incorrect, you have the right to ask to have it corrected.

To make a correction request, complete the FOI Correction Request Form and send it to:

Director of Privacy and Freedom of Information
Hamilton Health Sciences – King West

P.O. Box 2000
Hamilton, ON
L8N 3Z5

Tel: 905-521-2100 ext. 75122
E-mail: privacy@hhsc.ca
Fax: 905-577-8474

Report a privacy breach or concern

If you are concerned that another individual has inappropriately accessed your health care information or that of a loved one, please contact our Privacy and Freedom of Information office at:

Privacy and Freedom of Information Office
Hamilton Health Sciences – King West

P.O. Box 2000,
Hamilton, ON
L8N 3Z5

Tel: 905-521-2100 ext. 75126
Fax: 905-577-8474