Commitment to Confidentiality

We at RALII Psychotherapy, Coaching & Wellness are committed to maintaining the highest standards of confidentiality and professional integrity. All personal health information collected is used solely for the purposes of providing therapy, assessment, supervision, and client support.

Confidentiality is essential to creating a safe, therapeutic environment where clients can share openly without fear of unauthorized disclosure. All staff, contractors, and students are required to sign confidentiality agreements and receive training in PHIPA compliance and ethical information management.

Definitions

Personal Health Information (PHI): Any identifying information about an individual relating to their health, health care history, or provision of health services. This includes notes, correspondence, assessments, or any communication that could identify a client.

Circle of Care: The group of health care providers who have legitimate and consented access to a client’s information to provide direct care.

Confidentiality: The ethical and legal obligation to protect information shared by clients during therapy.

Breach: Any unauthorized access, use, disclosure, or loss of personal health information.

Collection, Use, and Disclosure of Information

RALII collects information directly from clients or, with consent, from third parties (e.g., physicians, family members, or agencies). Information is collected to:

• Provide appropriate and effective psychotherapy or counselling.
• Conduct assessments and document treatment progress.
• Facilitate supervision or consultation to enhance quality of care.
• Fulfill administrative, legal, and regulatory requirements.

We disclose information only:

• With the client’s written consent.
• When required by law (e.g., court order, mandatory reporting).
• In situations involving risk of harm to self or others.
• In the event of suspected abuse or neglect of a child or dependent adult.

All disclosures are documented and reviewed for necessity and proportionality.

Limits to Confidentiality

While confidentiality is a cornerstone of therapy, there are specific legal and ethical limits under which information may be disclosed:

1. Risk of Harm:If a client expresses intent to harm themselves or others.
2. Abuse Reporting:If there is reasonable suspicion of child abuse, neglect, or abuse of a dependent adult or resident in a care facility.
3. Court Orders:When compelled by law through subpoena or court order.
4. Professional Misconduct:When disclosure is required to protect public safety.
5. Supervision and Consultation:Minimal and non-identifying information may be discussed for professional supervision and training purposes.

Clients are informed of these limits during intake and consent discussions.

Record Keeping & Retention Policy

All clinical records are maintained in compliance with CRPO, PHIPA, and professional standards.
Records include session notes, assessments, correspondence, and consent forms.

Record Storage:

• Electronic records are maintained on encrypted, password-protected platforms (e.g., PHIPA-compliant EMRs).
• Paper files, if used, are stored in locked cabinets in secure offices.
• Access is restricted to authorized personnel only.

 Retention Period:
Client records are retained for 10 years after the date of the last session or, for minors, 10 years after they reach age 18. After this period, records are securely destroyed (digitally deleted or shredded).

Client Access & Correction Requests

Clients have the right to:

• Access their own clinical records.
• Request corrections to inaccurate or incomplete information.
• Receive a written explanation if a correction is denied.

Requests must be made in writing using the Client Access/Correction Request Form.

RALII will respond within 30 days, as required under PHIPA.

If access could result in harm or violates another individual’s privacy, access may be limited in accordance with legal guidelines.

Electronic Communication & Virtual Therapy

Virtual therapy sessions (video, phone, or email) are conducted using PHIPA-compliant platforms (Jane).
Clients are informed that while all reasonable precautions are taken, electronic communication may carry inherent risks.

Clients are required to sign a Virtual Therapy & Electronic Communication Consent Form acknowledging understanding of these risks.
Sensitive information should not be shared through unsecured email or text messages.

RALII ensures:

• Devices are password-protected and encrypted.
• Files are transmitted securely and stored on Canadian servers whenever possible.
• Session notes are entered into secure clinical software immediately after sessions.

Privacy Breach Protocol & Flowchart

A privacy breach occurs when personal health information is lost, stolen, or accessed by unauthorized persons.
If a breach is suspected or confirmed, the following steps are taken immediately:

1. Identify and containthe breach (secure records, disable access).
2. Notifythe Privacy Officer or Practice Lead.
3. Assessthe scope and sensitivity of the information compromised.
4. Reportthe breach to affected individuals as soon as possible.
5. Documentthe incident and corrective actions taken.
6. Notifythe Information and Privacy Commissioner of Ontario (IPC) if required.
7. Reviewpolicies to prevent recurrence.

Flow Summary:

Detect → Contain → Notify → Investigate → Report → Review

Roles & Responsibilities of Staff, Contractors, and Students

All staff, independent contractors, and students at RALII are bound by confidentiality agreements and PHIPA regulations.

Staff/Contractors:

• Maintain confidentiality of all client information.
• Store, transmit, and dispose of PHI securely.
• Report any suspected breach immediately to the Privacy Officer.

Students/Interns:

• Operate under supervision and cannot access client files independently.
• Must obtain supervisor consent before contacting or disclosing information.

Supervisors:

• Ensure supervisees maintain CRPO and PHIPA compliance.
• Support ethical decision-making and quality of care through oversight and documentation review.

Complaints & Concerns Process

Clients who have concerns about privacy, confidentiality, or any aspect of service are encouraged to discuss them directly with their therapist.
If unresolved, clients may submit a formal written complaint to the RALII Privacy Officer.

All complaints are acknowledged within 10 business days and investigated promptly.
If the matter cannot be resolved internally, clients have the right to contact:

• Information and Privacy Commissioner of Ontario (IPC)
  2 Bloor Street East, Suite 1400, Toronto, ON M4W 1A8
  📞1-800-387-0073 🌐 ipc.on.ca
• College of Registered Psychotherapist of Ontarion

375 University Avenue, Suite 800, Toronto ON M5G 2J5

📞 416-479-4330 📠 416-639-2168 🌐 www.crpo.ca

Review and Update Policy

Effective Date: 9^th November 2025
Next Review Date: 8^th November 2026