Our Role

Heart & Mind Therapy is the Health Information Custodian (“HIC”) for personal health information collected, used, disclosed, and maintained through the practice, in accordance with Ontario’s Personal Health Information Protection Act, 2004 (PHIPA).

Our regulated clinicians, administrative team members, contractors, students, supervisors, and approved service providers may act as authorized agents of Heart & Mind Therapy where permitted by law and where necessary to support the delivery of care or the operation of the practice.

All authorized agents are required to protect personal information in accordance with PHIPA, applicable professional standards, confidentiality obligations, and Heart & Mind Therapy’s privacy policies.

Heart & Mind Therapy has appointed Lydia Forge, Registered Social Worker (RSW), Clinic Director, as Privacy Officer. The Privacy Officer is responsible for overseeing compliance with PHIPA, responding to privacy inquiries and requests, managing privacy incidents, and supporting the practice’s privacy program.

What Personal Health Information We Collect

We may collect:

• identifying information;
• contact information;
• emergency contact information;
• intake forms;
• mental health history;
• medical and medication information;
• family, relational, developmental, cultural, spiritual, or social history;
• session notes;
• assessment information;
• treatment plans;
• progress notes;
• billing and payment information;
• insurance-related information;
• communication records;
• referral information;
• risk and safety information;
• consent forms;
• correspondence with other professionals, where authorized or required.

Why We Collect Personal Health Information

We collect personal health information to provide safe and appropriate care, assess needs, develop treatment plans, provide psychotherapy or related services, coordinate services, communicate with you, process billing and payment, manage appointments, comply with legal and regulatory requirements, maintain clinical records, support supervision and consultation, and respond to risks, complaints, audits, or legal obligations.

Consent

We collect, use, and disclose personal health information with your consent, unless PHIPA or another law permits or requires otherwise.

Consent may be express or implied depending on the context, but we seek express consent when disclosing information to third parties unless disclosure is legally required or otherwise permitted.

Limits of Confidentiality

Confidentiality is central to therapy. However, there are limits.

Information may need to be disclosed without consent in situations such as:

• risk of serious harm;
• suspected child abuse or neglect;
• abuse or neglect involving residents of long-term care or retirement homes;
• valid court orders, subpoenas, warrants, or legal proceedings;
• mandatory reporting obligations;
• regulatory college investigations;
• billing, collection, or insurance-related requirements;
• supervision or consultation within professional limits;
• other situations required or permitted by law.

Your clinician will discuss confidentiality and its limits during informed consent.

Use Within the Practice

Information may be shared internally where necessary for intake and matching, scheduling, supervision, consultation, billing, clinical coordination, administrative support, quality improvement, responding to inquiries, managing risk, or addressing complaints.

Only individuals who reasonably need access should access the information.

Supervision and Consultation

Clinicians may consult with supervisors, clinical consultants, legal advisors, or other regulated professionals to support safe and ethical care.

When possible, identifying information is minimized.

Students, Interns, and Contractors

Heart & Mind may involve students, interns, administrative team members, or contractors in service delivery or operations.

These individuals are expected to follow confidentiality, privacy, supervision, and role-based access obligations appropriate to their role.

Couples and Family Services

Where psychotherapy is provided to couples, families, or multiple participants, Heart & Mind Therapy maintains a clinical record for the therapeutic service provided.

Requests for access to, or disclosure of, records relating to couples or family therapy may require consideration of the privacy rights of multiple individuals. Heart & Mind Therapy may limit or refuse disclosure where required or permitted by law to protect the privacy, confidentiality, or legal rights of another person.

Where appropriate, Heart & Mind Therapy may seek clarification, obtain additional consent, or obtain legal advice before responding to such requests.

Records

We maintain clinical records in accordance with applicable law and professional standards.

Records may include intake documents, progress notes, consent forms, correspondence, billing records, consultation notes, risk-related documentation, assessment information, and other clinically relevant information.

Storage and Security

Records may be stored electronically through secure practice-management systems, cloud-based platforms, or other protected systems.

We use reasonable safeguards, including role-based access, secure passwords, restricted access, privacy-aware workflows, confidentiality expectations, and secure storage practices.

Retention of Clinical Records

Heart & Mind Therapy retains clinical records in accordance with the Personal Health Information Protection Act, 2004 (PHIPA), applicable legislation, professional regulatory standards, insurance requirements, and our internal record-retention policies.

As a general guideline:

• Clinical records for adults are retained for at least ten (10) years following the date of the client’s last clinical entry or contact.
• Where the client was a minor at the conclusion of services, clinical records are retained for at least ten (10) years after the client reaches eighteen (18) years of age.

Where applicable legal requirements, professional college standards, contractual obligations, or insurance requirements require a longer retention period, Heart & Mind Therapy will retain records for the longer applicable period.

If retention requirements differ among regulated professions within the practice, Heart & Mind Therapy applies the retention period that satisfies all applicable legal and professional obligations.

Following the applicable retention period, records are securely destroyed or permanently de-identified in accordance with PHIPA and accepted professional practices.

Privacy Breaches

If Heart & Mind Therapy becomes aware of a privacy breach involving personal information or personal health information, we will take reasonable steps to:

• contain the breach;
• investigate the circumstances;
• assess potential risks;
• mitigate further unauthorized use or disclosure;
• notify affected individuals where required by law;
• notify the Information and Privacy Commissioner of Ontario where required under PHIPA; and
• comply with any applicable reporting, documentation, and record-keeping obligations, including maintaining records of privacy breaches as required by law.

Access to Your Record

You may request access to your clinical record.

Access may be limited in certain circumstances, including where access could reasonably be expected to result in serious harm, reveal confidential information about another person, interfere with legal obligations, or where another legal exception applies.

Correction Requests

You may request correction of factual information in your record if you believe it is inaccurate or incomplete.

Clinical opinions or professional judgments are generally not removed simply because there is disagreement, but you may request that a statement of disagreement be added where appropriate.

Disclosure to Third Parties

We do not disclose personal health information to third parties without consent unless permitted or required by law.

Third parties may include physicians, schools, insurers, lawyers, courts, child protection authorities, emergency contacts, family members, other healthcare providers, regulatory colleges, payment processors, or collection agencies where applicable.

Legal Requirements

Heart & Mind Therapy may disclose information where disclosure is required or permitted by law, including in response to valid court orders, subpoenas, warrants, mandatory reporting obligations, or other lawful authorities.

Where appropriate and permitted by law, Heart & Mind Therapy may seek clarification, obtain client consent, or obtain legal advice before disclosing information to ensure that any disclosure is limited to what is legally required or authorized.

Insurance and Receipts

Receipts may include information such as your name, clinician name, credentials, registration number, service date, fee, and service type.

If you submit receipts to an insurer, you are responsible for understanding how the insurer handles that information.

Email, Texting, and Electronic Communication

Electronic communication may carry privacy risks.

We use reasonable safeguards, but cannot guarantee complete security for email, text, or internet transmission.

Clients are encouraged not to include highly sensitive information in email or text unless necessary.

Virtual Therapy

Virtual therapy requires both the clinician and client to take reasonable steps to protect privacy.

Clients are encouraged to use a private location, secure internet connection, headphones where appropriate, and avoid public Wi-Fi where possible.

AI and Technology

Heart & Mind Therapy may use approved technology, including AI-assisted tools, to support administrative operations, scheduling, workflow management, quality improvement, and other non-clinical business functions.

AI technologies are not used to replace professional clinical judgment or provide psychotherapy.

Heart & Mind Therapy does not use AI systems to process identifiable personal health information unless:

• the technology has undergone an appropriate privacy and security assessment;
• its use complies with PHIPA, applicable legislation, and professional standards;
• appropriate contractual safeguards are in place with the service provider;
• internal governance and security requirements have been satisfied; and
• client consent has been obtained where required by law.

Heart & Mind Therapy regularly reviews technologies used within the practice to support privacy, confidentiality, and information security.

Withdrawal of Consent

You may withdraw consent for certain uses or disclosures of your information.

Withdrawal may affect our ability to provide services and may be limited by legal, ethical, billing, record-keeping, safety, or professional obligations.

Complaints and Privacy Concerns

If you have a privacy concern, please contact:

Privacy Officer
Lydia Forge, RSW, Clinic Director
Heart & Mind Therapy
Email: info@heartnmind.ca

We will take privacy concerns seriously and respond in a reasonable manner.

You may also contact the Information and Privacy Commissioner of Ontario.

Professional College Complaints

Depending on your clinician’s registration, you may also contact the relevant regulatory college:

• College of Registered Psychotherapists of Ontario;
• Ontario College of Social Workers and Social Service Workers;
• College of Psychologists and Behaviour Analysts of Ontario.

Updates to This Notice

We may update this notice periodically.

The revised version will be posted or provided with a new effective date.