Privacy and Personal Health Information Policy

Effective Date: September 2026
Last Reviewed: September 2026

Our Commitment to Privacy

Knorr & Associates Inc. is committed to protecting the privacy, confidentiality and security of the personal health information entrusted to us.

We provide nurse-led case management, rehabilitation coordination, clinical assessment, treatment, support and related professional services to individuals with catastrophic, complex and life-altering injuries.

Our privacy practices are governed by the Personal Health Information Protection Act, 2004 (“PHIPA”), its regulations, applicable professional standards and other legal requirements.

Depending on the circumstances of a particular engagement, Knorr & Associates Inc. may act as a health information custodian or as an authorized agent or service provider working with another organization. Regardless of our role, we limit the collection, use and disclosure of personal health information and take reasonable steps to safeguard it.

Our Privacy Officer

Knorr & Associates Inc. has designated a Privacy Officer who is responsible for:

• Overseeing compliance with PHIPA and this policy
• Responding to questions, access requests and correction requests
• Receiving and investigating privacy concerns and complaints
• Overseeing staff privacy education and confidentiality obligations
• Responding to suspected or confirmed privacy breaches
• Reviewing the organization’s privacy and security practices

Privacy Officer:
Lisa Bauer, RN
Knorr & Associates Inc.
7847 Highway 7
Locust Hill, Ontario L0H 1J0

Telephone: 905-471-1699
Email: admin@knorrandassociates.com

Please write “Confidential: Privacy Officer” in the subject line of an email or on any written correspondence.

Do not include detailed personal health information in an initial email. The Privacy Officer will arrange an appropriate method for communicating sensitive information.

What Is Personal Health Information?

Personal health information is identifying information about an individual in oral, written or electronic form. It may include information concerning:

• Physical or mental health, medical history, diagnoses, symptoms or impairments
• Injuries, functional abilities, care needs and rehabilitation goals
• Assessments, treatment, medication and services provided
• Hospitalization, discharge planning and community supports
• Cognitive, behavioural, psychological, vocational or educational functioning
• Family health history
• Attendant care, personal support and caregiving needs
• Eligibility for or payment of health care and rehabilitation services
• Insurance claims, accident benefits and dates of loss
• Health card numbers or other identifying numbers
• The identity of a substitute decision-maker, caregiver or health care provider
• Other identifying information contained within a health record

Information may still be identifying even when an individual’s name is not included, particularly when it can be combined with other information to identify that person.

How We Collect Personal Health Information

We collect only the information reasonably necessary to provide and coordinate services, fulfil our professional responsibilities and meet legal requirements.

Information may be collected directly from the individual or, where authorized or permitted, from:

• A substitute decision-maker
• Family members or caregivers
• Hospitals, physicians and other health care providers
• Occupational therapists, physiotherapists, speech-language pathologists, social workers, kinesiologists, rehabilitation support workers and other rehabilitation professionals
• Ontario Health at Home and other community agencies
• Schools, employers or vocational providers
• Lawyers, law clerks or legal representatives
• Insurers, adjusters and other funding organizations
• Assessors, treatment providers and regulated professionals
• Other persons or organizations authorized by the individual or permitted by law

We will seek consent where required. Consent must be knowledgeable, relate to the information involved and not be obtained through deception or coercion.

An individual may withhold or withdraw consent, subject to legal, professional and contractual limitations. Withdrawal of consent does not apply retroactively to information already collected, used or disclosed with valid consent.

Why We Collect and Use Information

We may collect and use personal health information to:

• Assess medical, rehabilitation, functional, cognitive and psychosocial needs
• Develop, implement, coordinate and monitor rehabilitation and care plans
• Assist with hospital discharge and community transition planning
• Identify safety concerns, risks and required supports
• Make and coordinate appropriate referrals
• Communicate with the individual, substitute decision-maker, family and authorized rehabilitation team
• Prepare clinical reports, progress reports, meeting minutes and other professional documentation
• Participate in medical appointments, rehabilitation meetings and case conferences
• Coordinate attendant care, personal support, equipment, housing, transportation, educational and vocational services
• Support applications for benefits, programs, services or funding
• Submit treatment plans, invoices and other documentation where authorized
• Obtain payment for services
• Maintain complete and accurate clinical and business records
• Meet professional, regulatory, legal, insurance and contractual requirements
• Respond to concerns, complaints, audits or legal proceedings
• Conduct quality assurance, risk management, staff education and service improvement activities

We do not use personal health information for marketing without the consent required by law.

We do not sell personal health information.

When Information May Be Disclosed

With consent or as otherwise permitted or required by law, personal health information may be disclosed to:

• The individual or their authorized substitute decision-maker
• Members of the individual’s authorized health care and rehabilitation team
• Hospitals, physicians, specialists and community health providers
• Lawyers and legal representatives
• Insurers, adjusters and funding organizations
• Government programs or agencies
• Schools, employers and vocational providers
• Regulated health professionals and assessors
• Service providers supporting our secure information systems, record management, billing or business operations
• Professional regulatory bodies
• The Information and Privacy Commissioner of Ontario
• Law enforcement, courts or other authorities where disclosure is legally required or permitted

Only the amount of information reasonably necessary for the authorized purpose will be disclosed.

Express consent will be obtained when required, including when personal health information is disclosed outside the health care team to an insurer or another organization that is not a health information custodian, unless the disclosure is otherwise permitted or required by law.

Safeguarding Personal Health Information

Knorr & Associates Inc. uses reasonable administrative, technical and physical safeguards appropriate to the sensitivity of the information in our custody or control.

These safeguards may include:

• Privacy, confidentiality and information-security policies
• Confidentiality agreements and privacy education for staff and service providers
• Access limited to individuals who require the information to perform authorized duties
• Password protection, multi-factor authentication and access controls
• Secure electronic record systems and protected electronic devices
• Encryption and secure transmission methods where appropriate
• Secure storage of paper records
• Procedures for verifying recipients before information is transmitted
• Secure backup, retention and destruction procedures
• Monitoring, investigation and documentation of suspected privacy incidents
• Contractual privacy and security requirements for applicable service providers

Staff, contractors and agents are expected to access, use and disclose personal health information only as necessary to perform their authorized duties.

Website, Email and Electronic Communication

Our general website and ordinary email should not be used to transmit detailed medical records, reports or other sensitive personal health information unless Knorr & Associates Inc. has confirmed an approved method of transmission.

Please contact our office before sending sensitive information electronically. We will provide instructions for an appropriate transmission method.

Where we provide a specifically designated secure referral form, portal or electronic transmission process, information submitted through that process will be collected and used only for the purposes identified at the time of submission and as otherwise permitted or required by law.

Our website may automatically collect limited technical information, such as internet protocol address, browser type, device type, pages visited and date and time of access. This information may be used to maintain website security, functionality and performance. Website visitors should review any separate cookie notice displayed on the website.

Email and other electronic communications carry inherent privacy and security risks. We take reasonable precautions, but no method of electronic transmission can be guaranteed to be completely secure.

Accuracy of Information

We take reasonable steps to ensure that personal health information used or disclosed by us is as accurate, complete and current as necessary for its intended purpose.

Individuals are encouraged to advise us when their personal information, contact information or health information changes or requires clarification.

Access to Personal Health Information

Subject to limited exceptions under PHIPA, an individual has the right to request access to records of their personal health information in our custody or control.

Access requests should be made in writing to the Privacy Officer and should:

• Identify the individual making the request
• Describe the records being requested
• Specify the relevant dates or services, where possible
• Include appropriate authorization when the request is made by a representative

We may need to verify the identity and authority of the person making the request.

We will respond within the timeframe required by PHIPA. In certain circumstances, PHIPA permits an extension of that timeframe. If an extension is required, the individual will be notified.

A reasonable cost-recovery fee may apply. If a fee will be charged, an estimate will be provided in advance.

Access may be limited or refused where authorized by law, including where information is subject to legal privilege, contains information about another person that cannot reasonably be separated, or where another statutory exception applies. If access is refused, we will provide written reasons and information about available complaint rights, as required.

Requests to Correct Information

An individual may request correction of personal health information that they believe is inaccurate or incomplete.

Correction requests should be made in writing to the Privacy Officer and should identify:

• The record or information requiring correction
• The requested correction
• The reason the existing information is believed to be inaccurate or incomplete
• Any supporting documentation

A correction request may be refused where permitted by PHIPA, including where the record was not created by Knorr & Associates Inc. and we do not have sufficient knowledge or authority to correct it, or where the requested change concerns a professional opinion or observation made in good faith.

Where a correction is not made, the individual may be entitled to submit a statement of disagreement to be attached to the record.

Record Retention and Secure Destruction

Personal health information is retained only for as long as reasonably necessary to provide services and meet applicable legal, professional, regulatory, contractual, insurance and record-retention requirements.

Records subject to a legal proceeding, investigation, complaint, audit or anticipated claim may be retained for a longer period where necessary.

When information is no longer required, it is securely destroyed, deleted or de-identified in a manner appropriate to its format and sensitivity.

Privacy Breaches

A privacy breach may include the theft, loss, unauthorized collection, access, use, disclosure, copying, modification or disposal of personal health information.

If Knorr & Associates Inc. becomes aware of a suspected or confirmed privacy breach, we will take reasonable steps to:

• Contain the breach
• Protect against further unauthorized access or disclosure
• Investigate what occurred
• Determine the information and individuals affected
• Correct identified weaknesses
• Document the incident and the response
• Notify affected individuals where required
• Notify the Information and Privacy Commissioner of Ontario and applicable professional regulatory bodies where required
• Maintain and submit required privacy-breach statistics

Affected individuals will be given information about the breach and the steps being taken in response, as required by law.

Privacy Questions and Complaints

Questions, concerns or complaints about our privacy practices should be directed to the Privacy Officer.

We will:

• Acknowledge the concern or complaint
• Review the circumstances fairly
• Take reasonable steps to investigate
• Provide a response
• Implement corrective action where appropriate

Raising a privacy concern will not adversely affect the services an individual receives from Knorr & Associates Inc.

Changes to This Policy

We may amend this policy to reflect changes in legislation, professional requirements, technology or our information practices.

The current version will be posted on our website with its effective date and last review date.

Knorr & Associates Inc.
7847 Highway 7
Locust Hill, Ontario L0H 1J0
Telephone: 905-471-1699
Email: admin@knorrandassociates.com