Québec's Law 25: what a small clinic needs to know

1. Designate a person in charge

By default, the person in charge of protecting personal information is the person with the highest authority in the business: often, the clinic owner. They can delegate the role in writing, in whole or in part, to someone on the team, but they remain accountable.

This person's title and contact information must be published on the clinic's website (without a website, they must be made available by another appropriate means). You don't need to notify the Commission d'accès à l'information. A dedicated email address, such as privacy@yourclinic.ca, makes things easier down the road.

2. Set out and explain what you do with personal information

• Internal rules. Who on the team can access what, how long you keep files and how you destroy them, and how you handle a complaint. These rules, proportionate to the size of your activities, are approved by the person in charge; detailed information about them is published on your website, in clear and simple terms.
• A privacy policy. If you collect information by technological means (an online form, booking on your website), publish a privacy policy in clear and simple terms, and let clients know about any changes.
• Information at the time of collection. Tell clients why you're collecting their information, how, who it may be shared with, whether it may be shared outside Québec, and what their rights of access and correction are.
• Carefully chosen suppliers. A clinic that entrusts information to a supplier (software, hosting) remains responsible for it. Ask them who processes what, and where.

3. Get valid consent

Consent must be clear, free, informed and given for specific purposes. Ask for it for each purpose, in clear terms; if you ask in writing, present it separately from any other information.

Health information (intake form, client file, treatment notes) is sensitive information. Using it for a purpose other than the one intended requires express consent. A concrete example: don't use answers from a health questionnaire to target a promotion without that consent.

4. Know how to respond to a privacy incident

1. 1
   Recognize the incidentUnauthorized access, use or disclosure, or the loss of information: an email sent to the wrong client, a stolen unlocked phone, a misplaced paper file.
2. 2
   Reduce the risk right awayTake reasonable steps to lower the risk of harm and to prevent a similar incident from happening again.
3. 3
   Assess the risk of serious injuryBased on how sensitive the information is, the possible consequences of its use, and how likely it is to be misused.
4. 4
   Notify, if the risk is seriousPromptly: the Commission d'accès à l'information, in writing (it provides a form for this), and the people concerned.
5. 5
   Record it in the registerEvery incident, including those that don't present a serious risk. The Commission can ask for a copy of the register.

5. Other good habits

• Before sending information outside Québec. A privacy impact assessment (PIA) is required, including when a supplier stores or processes the information for you outside Québec.
• Before adopting a new system. A project to acquire or overhaul a system involving personal information, such as new client-file software, also calls for a PIA, scaled to how sensitive the information is and the size of the project.
• Keep, then destroy. Once the purposes for which information was collected have been achieved, it must be destroyed (or anonymized under the applicable rules), subject to any retention period set by law. Also check the record-keeping period your association requires.
• Answer access requests. A client can ask to see their file or have it corrected; the person in charge replies within 30 days.