Privacy & Your Information

SickKids is committed to protecting the privacy and confidentiality of your information. Your privacy and right to access information is governed by the Freedom of Information and Protection of Privacy Act (FIPPA) and the Personal Health Information Protection Act (PHIPA). SickKids’ commitment to privacy and access to information is set out in policies that address confidentiality, privacy, security and the release of records. Policies ensure we only collect, use, store and disclose personal information (PI) and personal health information (PHI) for purposes authorized and/or required by law and that we will do so in a confidential and secure manner. All staff, including physicians, volunteers, etc., are subject to these policies.  

We will ask for your consent or inform you before we collect, use or share your information for any reason other than our stated activities or those authorized by law. We may inform you by posting or making readily available a notice that is likely to come your attention, describing the purposes for the collection, use and disclosure of your information.  

We may collect, use, or disclose your PHI without your consent, to: 

• contact a relative or friend if you are incapacitated; 
• prevent serious harm to you or others; 
• report suspected types of abuse; and/or 
• report certain diseases to public health authorities. 

Below you will find information about our collection, use and disclosure practices.

Privacy policy

Collection of your information 

Collection of your information includes the gathering, acquiring, receiving, or obtaining of your PHI. We collect PHI about you in accordance with PHIPA to help us accurately identify you, to provide or assist in providing you with the best care possible, and to ensure the accuracy of your records. SickKids may also collect PI and PHI in the form of audio or visual recordings to support and improve patient care and through the hospital’s video surveillance system for safety and security operations at the hospital.

We may collect this information either from you directly or, in some circumstances, from a person designated to make care decisions on your behalf, such as a substitute decision maker. The PHI that we collect may include your contact information, health card number and medical history. We may also collect PHI about you from other sources if we have obtained your consent to do so or if the law permits.

Use of your information  

The information you give us about you and your family is important to our work at the hospital. We use your PHI to treat and care for you. Ontario laws permit us to use your information for other purposes, including, but not limited to:

• To teach and educate – your information may be used to train staff and students to support our academic partnership with the University of Toronto and other schools.
• To support research and innovation – researchers may use your information while working on a study approved by the SickKids Research Ethics Board or appointed Board of Record. 
• To improve and enhance our services – your information may be used to perform quality improvement and risk management activities. 
• To maintain operations – your information may be used to plan, run, and manage programs, services, and internal operations. 
• To process payment – your information may be used to obtain payment for your treatment or services we provide (e.g., to obtain coverage from OHIP, WSIB, your private insurer, etc.). 
• To ensure your safety and enhance security in the hospital. 
• To contact you regarding initiatives at the hospital (e.g., if you are interested in participating in research). 
• To fulfill other purposes permitted or required by law. 

Use by staff and service providers  

We assume you agree (in other words, consent) to share your information with members of your care team, staff, trainees, and volunteers who are involved in your care and performing operational and supportive functions like the ones listed above. Only staff members who need your information for legitimate care and business purposes are allowed to access it.  

We may ask certain external parties, such as service providers and vendors, to use your information to provide services to or on behalf of SickKids. We will take steps to protect your information, including requiring external parties follow our confidentiality and privacy policies and applicable privacy laws.  

Digital solutions, artificial intelligence and data matching 

SickKids uses digital solutions to process PI and PHI or other information for the purposes described above. Digital solutions include electronic devices, mobile/web applications, health information systems, assessment tools, etc.  

SickKids may also use artificial intelligence (AI) applications that process PI or PHI for the purposes described above. The adoption of AI solutions enhances our ability to deliver optimal care and effectively plan for internal programs and operations by automating and improving decision-making processes. 

Similarly, your PI or PHI may be used for data matching. Data matching involves the computerized comparison of databases to allow linkages to be made between your information from sources across the hospital. This activity supports the purposes listed above.  

Digital solutions and AI that process PI or PHI and initiatives using PI or PHI for data matching are reviewed by SickKids’ Privacy and Information Security Offices to ensure they comply with internal policies, privacy laws, and best practices. 

Processing your information outside of Canada and using non-Canadian vendors 

Some support services are provided by vendors outside of Canada or by vendors who store information outside of Canada. As a result, information processed or stored outside of Canada may be subject to the laws of another country, which may be less protective than those of Canada. When information is processed outside of Canada, we take steps to ensure adequate security measures are in place, consistent with Canadian requirements. 

Use for de-identification and anonymization

SickKids may use your PI or PHI to de-identify or anonymize it. This entails modifying your information to remove details that can be used to identify you. De-identified information may be used for non-care purposes, such as determining study feasibility at SickKids. We take steps to mitigate risks associated with the re-identification of PI and PHI. 

Collection and use of email to communicate with you  

With your consent, SickKids may communicate with you about your or your child’s healthcare using email. It is up to you to know the risks and implement ways to protect yourself before you agree to use email to communicate with us. See below for more information. 

Sharing (disclosure) of your information 

We may share your information with:

People responsible for making decisions about your care and information 

These individuals, often referred to as substitute decision makers, need your information to make informed decisions about your ongoing care and treatment and about how we collect, use, or share your information.  

People you choose to share it with 

You may ask SickKids to share your information with others. This may include your family members or a lawyer. 

People involved in your health-care 

We share your information with health-care providers, like your family doctor or specialists, who are involved in your care. In certain circumstances, we may share your information with health-care providers outside of Canada for treatment purposes.  

Shared electronic health record systems and health records 

SickKids participates in provincially approved shared electronic health records and shared health record systems. These systems securely share electronic health information to provide timely and coordinated patient care. Individuals accessing these systems are bound by user terms and can only access for approved purposes (e.g., health-care). Examples include: 

People conducting patient satisfaction surveys 

We want to hear from you about the quality of care and services you receive at SickKids. We will use your name and address, and the dates of your visits to send you surveys about your experience. This information helps us improve the care we provide. 

SickKids Foundation 

SickKids Foundation is dedicated to supporting SickKids by raising funds for research, education, and the improvement of patient care. Unless you tell us not to, we will share your name and address with SickKids Foundation. 

Faith representatives 

Our Spiritual and Religious Care team provides Spiritual Care Provider support (and specific religious faith denomination as requested) for patients and families. If you would like a member of our Spiritual and Religious Care team to connect with you, please let your health-care provider know so that a referral can be made. We will work with you to ensure you receive the spiritual or religious care that you need. 

Visitors and callers 

Unless you ask us not to give out this information, we may share general information about you with others, such as your location in the hospital and your general health status (e.g., “stable”). Your consent is required to disclose any further information. If you do not want this to be shared, please contact the SickKids Privacy Office (contact details below) or speak to a member of your clinical team.   

External sharing/selling of data 

We may also share de-identified or anonymized data with third parties, such as government entities, research entities, industry partners, etc., for non-care purposes like research, measuring our performance, making improvements to our operations or relevant products or services, etc. SickKids may receive payment for the disclosure of this de-identified data. We may also permit third parties to use de-identified or anonymized data.  

Other people if required by law  

Ontario laws require or permit us to share some of your PI or PHI with, including but not limited to:  

• the Ministry of Health; 
• registries such as Pediatric Oncology Group of Ontario, Institute for Clinical Evaluation Sciences (ICES), Canadian Institute for Health Research (CIHI);  
• researchers, if approved by our Research Ethics Board (REB);  
• the Medical Officer of Health to report communicable diseases;  
• the Workplace Safety and Insurance Board (WSIB);  
• Law Enforcement Officers who present a warrant or subpoena, or to aid in an investigation;  
• the Children’s Aid Society where child harm is suspected; the children’s lawyer;  
• the public guardian and trustee; and  
• the Coroner. 

Withdraw your consent or place conditions on our use/sharing of your information 

Access, use, and disclosure of your information may be restricted in different ways depending on the request. If you want to withdraw your consent or place conditions on our use or sharing of your information, please contact the SickKids Privacy Office. The Privacy Office reviews every request on a case-by-case basis. See Consent Directives and Audit Requests (For Patients) (PDF) for more information. 

HINP statement of information practices 

SickKids is a Health Information Network Provider (HINP) when we provide services to two or more Health Information Custodians (HICs) to enable them to use electronic means to share PHI with one another for the purpose of providing care. SickKids must adhere to Ontario Regulation 329/04 (the Regulation) and comply with the HINP requirements, including making available information about its services to the HIC. Our obligations as a service provider and HINP are detailed in PHIPA and the Regulation, as well as in agreements with participating HICs.  

As a HINP, SickKids will: 

• Only use, disclose, or otherwise handle the PHI as directed by the applicable HIC; 
• Ensure that individuals handling PHI are aware of, and agree to, their obligations with respect to the PHI;  
• Notify the HIC if the PHI was handled in contravention of PHIPA or the HIC’s direction; 
• Notify the HIC of any breaches; 
• Provide the HIC with a plain language description of services; 
• Provide the HIC with an audit of accesses or disclosures of the PHI in the shared system;  
• Provide HICs with a summary of the privacy and security assessments;  
• Ensure that any third party retained agrees to comply with the restrictions and conditions to comply with PHIPA; 
• Enter into a written agreement with the HICs.  

The following are existing initiatives where SickKids acts as the HINP for other HICs: