printemailclick to share buttonfacebooktwitterlinkedin
CCO Privacy FAQs (Frequently Asked Questions)
 
  1. Who is Cancer Care Ontario (CCO)?
  2. What types of information does CCO collect?
  3. Where does CCO get personal health information?
  4. Does CCO get information from my doctor?
  5. What is CCO’s authority to collect this information?
  6. What are some of CCO’s data holdings?
  7. How does CCO use the information it collects?
  8. Does CCO conduct cancer research?
  9. How does CCO support external research?
  10. What is CCO’s Enterprise Data Warehouse?
  11. What is CCO’s role in relation to the Ontario Breast Screening Program?
  12. What is CCO’s role in relation to the ColonCancerCheck Program?
  13. What is CCO's role in relation to the Ontario Cervical Screening Program?
  14. Are healthcare providers required to submit my cancer data to CCO?
  15. Does CCO collect my name and address?
  16. I don’t remember being asked if this type of information about me could be given to CCO. How does CCO get this information about my health status without my knowledge or consent?
  17. What can I do if I don’t want my information to be shared with CCO?
  18. Who has access to personal health information held by CCO?
  19. Can I see the information CCO collects about me?
  20. Can CCO tell me about the status of my treatment?
  21. Can CCO give me information about my family’s cancer history?
  22. How does CCO protect my information?
  23. How does CCO protect my identity?
  24. Does CCO give my information to anyone else? What about insurance companies or my employer?
  25. What is CCO’s role in the provision of Information Technology (IT) services?
  26. What is CCO’s role in relation to the Wait Time Information System?
  27. Who can I speak to if I have questions about CCO’s information practices and privacy program?

1. Who is Cancer Care Ontario (CCO)?

Cancer Care Ontario (CCO) is the provincial agency responsible for continually improving cancer services. Formally launched and funded by the Ontario government in 1997, CCO is governed by the Cancer Act (Ontario). Further, as an Operational Service Agency of the Ontario government, CCO’s mandate is determined pursuant to a Memorandum of Understanding (MOU) between CCO and the Ministry of Health Long-Term Care (MOHLTC) dated December 2, 2009.

As the provincial agency responsible for continually improving cancer services, and the Ontario Government’s cancer advisor, CCO:

  • Directs and oversees close to $950 million public health care dollars to hospitals and other cancer care providers to deliver high quality, timely cancer services;
  • Implements provincial cancer prevention and screening programs designed to reduce cancer risks and raise screening participation rates;
  • Works with cancer care professionals and organizations to develop and implement quality improvements and standards;
  • Uses electronic information and technology to support health professionals and patient self-care and to continually improve the safety, quality, efficiency, accessibility and accountability of cancer services;
  • Plans cancer services to meet current and future patient needs, and works with health care providers in every Local Health Integration Network (LHIN) to continually improve cancer care for the people they serve; and
  • Rapidly transfers new research into improvements and innovations in clinical practice and cancer service delivery.

In addition to cancer, CCO has other core lines of business including supporting and hosting the provincial Access to Care (ATC) program, which is a part of the Government of Ontario’s Wait Times Information Strategy (WTIS).

CCO has also worked with renal leadership in Ontario to operate the Ontario Renal Network (ORN). In 2010, the MOHTLC formally transferred the provincial oversight and co-ordination of the Chronic Kidney Disease (CKD) Management Program to the ORN under the auspices of CCO.

CCO also administers the Provincial Drug Reimbursement Program (PDRP), which includes the New Drug Funding Program (NDFP), the Evidence Building Program (EBP), and the Case-by-Case-Review Program (CBCRP) for cancer drugs, on behalf of the MOHLTC. Beyond CBCRP, CCO offers ad-hoc support (e.g., reviewer identification) to out-of- country (OOC) requests when required for non-drug funding requests, such as cancer-related tests, radiation, and surgery.

Each of these programs is governed by separate accountability agreements between CCO and the MOHLTC.

In order to fulfill its mandate, CCO requires access to personal health information (PHI) from across Ontario. CCO derives its authority to collect, use, and disclose this information from its designations under Ontario’s Personal Health Information Protection Act, 2004 (PHIPA).

2. What types of information does CCO collect?

With the exception of personal health information collected in respect of (a) the implementation of the MOHLTC’s Access to Care (ATC) strategy and (b) the Ontario Renal Network (ORN), most of CCO’s data are related to cancer. For example, the data may be related to expenditures for clinics or services or the data may be related to clinical information such as the type of cancer diagnosed, its location, its size, as well as the treatment or services provided. This data may include both confirmed cases of cancer and cancer screening data. Cancer screening data may include information relevant to the early detection of cancer or the risks of developing cancer.

For the purposes of the ATC, CCO collects personal health information in respect of four initiatives designed to reduce wait times and to improve patients’ access to health care services: Surgery and Diagnostic Imaging Wait Times (WTIS), Surgical Efficiency Targets Program (SETP), Emergency Room National Reporting System Initiative (ERNI), and Alternate Level of Care (ALC).

For the purposes of the ORN, CCO collects personal health information for the management and coordination of the Provincial Chronic Kidney Disease (CKD) program. In particular, CCO uses renal personal health information collected from CKD service providers to effectively organize and manage the delivery of renal services in Ontario.

3. Where does CCO get personal health information?

CCO collects information from different sources depending on the data holding but, in general, CCO collects most of its information from facilities such as hospitals, clinics, independent health facilities and laboratories, classified under the Personal Health Information Protection Act, 2004 (PHIPA) as “health information custodians”.

CCO also obtains data from the Ontario Ministry of Health and Long-Term Care (MOHLTC), and other organizations, such as the Canadian Institute for Health Information and the Office of the Registrar General of Ontario.

4. Does CCO get information from my doctor?

Yes, CCO obtains information from health care providers, which may include doctors. CCO also collects information from hospital medical records.

5. What is CCO’s authority to collect this information?

CCO’s authority to collect personal health information comes from both the Cancer Act (Ontario) and the Personal Health Information Protection Act, 2004 (PHIPA). The Cancer Act permits the collection of personal health information for the purpose of study and reporting on cancer in Ontario. CCO’s Memorandum of Understanding with the Ontario Ministry of Health and Long-Term Care (MOHLTC) affirms CCO’s role as the principal advisor to the MOHLTC in providing strategic direction and leadership for all components of the cancer control system. CCO is a designated ’prescribed entity’ under Section 45 of PHIPA, which means that CCO has the authority to collect personal health information without consent for purposes related to the planning and management of the health system.

For several programs, CCO collects personal health information under additional PHIPA authorities. In providing information technology (IT) services (e.g. computer applications or network services), CCO may operate as an IT service provider under PHIPA. This role strictly limits CCO’s use of personal health information to that which is required to support electronic services to health care providers. For more information, see Question #25 (What is CCO’s role in the provision of Information Technology (IT) services?), below.

As of 2007, CCO is also designated as a ‘prescribed registry’ under clause 39(1)(c) of PHIPA with respect to its role in compiling and maintaining screening information for colorectal, cervical and breast cancer in the Ontario Cancer Screening Registry. This designation grants CCO the authority to collect, use and disclose PHI for the purposes of facilitating or improving the provision of health care with respect to colorectal, cervical and breast cancer. For more information, see Questions #11-#13 – below, or visit CCO’s Screening website .

6. What are some of CCO’s data holdings?

The best known of CCO’s data holdings is the Ontario Cancer Registry (OCR). The OCR is used to study information related to cancer in Ontario for health system planning and management purposes. It is also used to support research, such as studies that look at the relationship between smoking and lung cancer rates in young women.

The OCR contains information on all diagnosed adult cancers in Ontario. It collects different information from different sources. For example, potential cases of cancer are identified from hospital records collected by the Canadian Institute for Health Information. Reports on the site and stage of the cancer are obtained from pathology reports collected by pathology laboratories in hospitals and private laboratories. Deaths related to cancer are identified by the Ontario Office of the Registrar General. A series of complex formulae are then used to combine the information to create a record that most likely represents an individual. It is this record that is stored in the OCR.

Another significant data holding is related to CCO’s New Drug Funding Program (NDFP). The NDFP was developed to make sure that all patients in Ontario have equal access to new and expensive hospital-based intravenous (IV) drugs, regardless of where they live. The NDFP is responsible for reimbursing hospitals for the cost of the treatment. This holding collects sufficient identifying personal and clinical information to ensure the payment is made on behalf of a specific individual, with a specific condition, and that the treatment is being administered according to clinical practice guidelines. The data are subsequently used by CCO to estimate future drug requirements and expenditures and, if required, to audit claims.

A description of CCO’s data-holdings, including identifying purposes, is available on the DataHealth System Information and Data page on our website.

7. How does CCO use the information it collects?

CCO uses the information it collects to:

  1. Plan and manage the cancer system in Ontario. This includes:
    • Studying and reporting on patterns of cancer in the province. For example, using data collected over many years, CCO is able to report on:
      1. whether the incidence of cancer in general, or any specific type of cancer, is increasing, decreasing or remaining stable;
      2. survival rates for different types of cancer, that is how long people with certain types of cancer can expect to live and if survival is changing over time;
      3. the prevalence of cancers, that is how many people are living with cancer in Ontario; and
      4. relationships between sex, age, environmental factors or geographic locations and cancer.
    • Evaluating the effects of early diagnosis and treatment;
    • Studying service delivery and utilization;
    • Estimating current and future needs for cancer services;
    • Studying wait times for cancer surgery.
  2. Operate Ontario’s cancer screening program, which offers certain groups in Ontario the opportunity to get regularly tested, or screened, for three types of cancer: breast cancer, cancer of the lower parts of the bowel, called “colorectal cancer,” and cancer of the cervix, called “cervical cancer.” CCO sends letters about cancer screening to the following groups of people:
    • men and women aged 50 to 74 (to get screened for colorectal cancer);
    • women aged 50 to 74 (to get screened for breast cancer);
    • women aged 21 to 69 ( to get screened for cervical cancer);
  3. Develop and test information technology (IT) solutions (e.g., computer applications, web portals) in respect of health system projects and programs managed by CCO.
  4. Support health research.
  5. Manage the following ATC initiatives:
    • WTIS: ATC uses personal health information under the WTIS initiative to reduce wait times by providing clinicians and health care decision makers with the information they need to more effectively manage wait times at the organizational, regional, and provincial level;
    • SETP: ATC uses personal health information under the SETP initiative to enable Ontario hospitals to compare their performance with that of their peers and identify areas of surgical improvements;
    • ERNI: ATC uses personal health information under the ERNI initiative to improve the performance and timeliness of access to emergency rooms in Ontario;
    • ALC: ATC uses personal health information to under the ALC initiative to analyze near real-time wait time data in acute care and post-acute care hospitals in Ontario.
  6. Manage the Ontario Renal Network Program: CCO provides aggregate reports based on the analysis of renal personal health information collected from the CKD service providers. Reports are disclosed to the kidney disease community which includes the MOHTLC, LHINs, nephrologists and dialysis centres.
  7. Operate CCO’s New Drug Funding Program (NDFP): Personal health information collected for NDFP is used to reimburse hospitals for patients who have met the eligibility criteria.

8. Does CCO conduct cancer research?

CCO supports a research program. Its purpose is to contribute to the development of new cancer knowledge through epidemiological, intervention, health services, surveillance, and policy research, as well as knowledge synthesis and dissemination. For example, CCO has completed studies that look at the relationship between smoking and lung cancer rates in young women, and studies of the impact of obesity and physical activity on cancer.

9. How does CCO support external cancer research?

CCO is committed to supporting cancer research and the research needs of the health sector, and encourages the use of its data for bona fide research

All requests by external researchers for access to CCO data must meet the requirements set out in Section 44 of the Personal Health Information Protection Act, 2004 (PHIPA). This means that the research protocol must be approved by a Research Ethics Board and supported by a confidentiality agreement entered into by the researchers.

In addition to the Section 44 PHIPA requirements, CCO has data access protocols in place that must be satisfied before data are disclosed for research. For example, researchers must submit a data access request to CCO’s Data Access Committee (of which CCO’s Chief Privacy Officer is a member) and, beyond satisfying the Section 44 requirements, the research must meet CCO’s scientific standards and be consistent with CCO’s mission and objectives.

10. What is CCO’s Enterprise Data Warehouse?

CCO’s Enterprise Data Warehouse (EDW) has been designed to make CCO’s data-holdings readily accessible to cancer planners (e.g. health care providers and researchers) through a secure, web-based analytical and reporting tool called iPort™. CCO’s use and disclosure of personal health information via this tool complies with the requirements of the Personal Health Information Protection Act, 2004 (PHIPA) and CCO’s Data Use and Disclosure Policy. The EDW enhances the privacy and security of data stored at CCO, creates a more authoritative data foundation, and yields robust reporting and analytic capabilities for enhanced cancer planning, management and research.

11. What is CCO’s role in relation to the Ontario Breast Screening Program?

CCO manages the Ontario Breast Screening Program (OBSP) and its related Integrated Client Management System (ICMS). The ICMS is an information management system used not only to provide statistical information on screening and assessment indicators but also to support front line administration and management of the OBSP. This means that the ICMS includes data elements required for both program administration (e.g. client registration and payments) and program management (e.g. statistical analysis and evaluation).

With respect to service delivery, CCO has been designated as a Section 39 ‘prescribed registry’ under the Personal Health Information Protection Act, 2004 (PHIPA). This allows CCO more direct engagement with patients in providing breast cancer screening services (e.g. the sending of invitations for cancer screening). For more information, see Question #5 (What is CCO’s authority to collect this information?), above

.

12. What is CCO’s role in relation to the ColonCancerCheck Program?

In January 2007, the Ontario Ministry of Health and Long-Term Care launched a province-wide population-based colorectal cancer screening program in collaboration with CCO. CCO operates and manages the CCC Program.

The goals of the program are to raise awareness about colorectal cancer, increase screening, and decrease mortality due to colorectal cancer. The ColonCancerCheck Program has both a service delivery, and a management and reporting component. For the purposes of service delivery, CCO has been designated as a Section 39 ‘prescribed registry’ under the Personal Health Information Protection Act, 2004 (PHIPA). This allows CCO more direct engagement with patients in providing colorectal cancer screening services (e.g. the sending of invitations for cancer screening). For more information, see Question #5 (What is CCO’s authority to collect this information), above.

13. What is CCO’s role in relation to the Ontario Cervical Screening Program?

In 1997, the Ministry of Health and Long-Term Care (the “MOHLTC”) approved and funded a cervical cancer screening program at CCO. The province-wide OCSP was launched on June 15, 2000 with the goal of reducing cervical cancer incidence and mortality.

CCO is committed to implementing a comprehensive and coordinated quality cervical cancer screening program, to which all eligible Ontario women will have access. Working in partnership with a variety of stakeholders, CCO is building on existing services and enhancing information systems to ensure a coordinated approach to cervical cancer screening and to ensure that Ontario women have access to a comprehensive, coordinated system that supports high-quality cervical cancer screening.

The OCSP has both a service delivery, and a management and reporting component. For the purposes of service delivery, CCO has been designated as a Section 39 ‘prescribed registry’ under the Personal Health Information Protection Act, 2004 (PHIPA). This allows CCO more direct engagement with patients in providing cervical cancer screening services (e.g. the sending of invitations for cancer screening). For more information, see Question #5 (What is CCO’s authority to collect this information?), above.

14. Are healthcare providers required to submit my information to CCO?

With one exception, healthcare providers (e.g. hospitals) are not required to submit personal health information to CCO. The exception relates to the authority of the Ontario Ministry of Health and Long-Term Care (MOHLTC) under the Public Hospitals Act (Ontario) to direct public hospitals to deliver pathology-related hospital records to CCO.

While not required, healthcare providers are authorized to submit the information and are aware of CCO’s authority to collect it. They are also keenly aware of the value that analysis of the data can have in helping identify best treatment practices, estimate the need for services, and locate services where they are most needed. Healthcare providers are also aware that CCO applies great care in handling the data and in its interpretation. Accordingly, they generally are willing to provide this information.

15. Does CCO collect my name and address?

Yes, your name and address are collected from some sources for some data holdings.

For example, patient names are collected by the New Drug Funding Program (NDFP) to ensure that the reimbursement being made is on behalf of a specific individual, and to allow the program to verify that the treatment was given as claimed by the facility.

In the case of the Ontario Cancer Registry, name and address are collected from the Ontario Ministry of Health and Long-Term Care; health card number and postal code are collected from the Canadian Institute for Health Information; and health card number and name are collected from pathology laboratories, etc. These different records are then linked to create a record that most likely represents the same individual. CCO can then produce reliable information on things such as cancer survival rates.

16. I don’t remember being asked if this type of information about me could be given to CCO. How does CCO get information about my health status without my knowledge or consent?

CCO is permitted to collect personal health information without consent under Ontario’s Personal Health Information Protection Act (PHIPA). CCO is a ’prescribed entity’ under Section 45 of PHIPA and its role and need to collect identifiable health information for management and planning of the health system are recognized by this special designation. CCO is also a ‘prescribed registry’ under Section 39 of PHIPA which grants CCO the authority to collect, use and disclose PHI for the purposes of facilitating or improving the provision of health care with respect to colorectal, cervical and breast cancer.

However, these designations also comes with special obligations under the Act. For example, CCO’s information and privacy practices must be reviewed by the Information and Privacy Commissioner / Ontario (OIPC) every three years to maintain this special designation. The OIPC reviewed and approved CCO’s information management practices effective November 2005 and renewed this approval in 2008, 2011, and 2014. The next approval will be in 2017.

17. What can I do if I don’t want my information to be shared with CCO?

An individual cannot choose to withhold their information as it is needed to conduct reliable analysis of cancer and cancer-related care in Ontario. For example, with respect to the New Drug Funding Program or the Ontario Cancer Registry, CCO is either administering a payment program or is collecting the data for the purpose of management and planning of the health system.

In the case of the ColonCancerCheck Program, the Ontario Cervical Screening Program, and the Ontario Breast Screening Program, individuals may choose to withdraw from receiving correspondence about these programs by:

  • calling our toll-free number 1-866-662-9233; or
  • completing the appropriate sections of the Cancer Screening Programs: Participant Information Form and mailing or faxing it to us at:
    Cancer Screening Contact Centre
    Cancer Care Ontario
    18-505 University ave
    Toronto, Ontario  M5G 1X3

    Fax: 1-866-682-9534
They can change their decision at any time.

18. Who has access to personal health information held by CCO?

Only a very limited number of staff have access to the data within CCO. A data steward is assigned to each holding, and that person is responsible for controlling access to the holding. Access is limited to those staff who need it to carry out their job at CCO, such as analysts and IT support staff. Such access is audited regularly and reviewed on an annual basis to ensure it remains appropriate.

19. Can I see the information CCO collects about me?

Generally, persons requesting access to their personal health information will be directed to those persons who originally collected the information – healthcare providers who are directly involved in the care and treatment of patients (e.g., your doctor or other health care organization). This is consistent with and supported by the Personal Health Information Protection Act, 2004 (PHIPA). Exceptions may be made in particular circumstances such as, for example, where an individual is researching their family’s cancer history.

20. Can CCO tell me about the status of my treatment?

CCO’s data holdings do not include the complete picture of your health record or your treatment program and cannot be used to provide you with information on the status of your treatment. In the case of the Ontario Cancer Registry and the New Drug Funding Program, for example, the holdings contain information necessary to undertake reliable statistical work and to make appropriate payments. These holdings are not used to manage patient care. They are snapshots of events that occurred in the past and, in the case of the OCR, are highly technical.

21. Can CCO give me information about my family’s cancer history?

CCO data holdings were not created for the purpose of providing information to individuals about their family cancer history. As such, analysis of the data to obtain information about a family’s cancer history requires interpretation by a genetics counsellor. CCO is not mandated or equipped to provide these services. However, in limited circumstances, for example where hospital records are not available or where a genetics counsellor is investigating a family’s history (on behalf of a family and with consent), CCO will consider such requests.

22. How does CCO protect my information?

CCO employs modern security technologies and controls to protect the privacy and integrity of information during transfer, storage and use. Data is encrypted during transmission to CCO and stored on secured servers. Regular security reviews are performed to ensure that CCO computer systems remain secure. Systems are tested and backed-up regularly, and CCO has an active Disaster Recovery Plan. All CCO staff are required to attend security training annually as a condition of employment.

CCO has an extensive privacy program that governs the use of personal health information, ensuring that it is accessed only for purposes consistent with CCO’s mandate; these practices undergo formal review by the Office of the Information and Privacy Commissioner / Ontario (OIPC) on a tri-annual basis. The OIPC reviewed and approved CCO’s information management practices effective November 2005 and renewed this approval in 2008 and 2011. CCO requires that all staff attend privacy training annually and sign a confidentiality agreement as a condition of employment. Employee access to CCO data is granted on a ‘need-to-know’ basis and access rights are reviewed on an annual basis.

23. How does CCO protect my identity?

CCO has strict policies in place that limit access to its data holdings and to the disclosure of data under its custody and control.

Only a very limited number of staff have access to the data within CCO. A data steward is assigned to each holding, and that person is responsible for controlling access to the holding. Access is limited to those staff who need it to carry out their job at CCO, such as analysts and researchers. Such access is audited regularly and reviewed on an annual basis to ensure it remains appropriate.

CCO will not disclose identifiable data unless it is required or permitted to do so under Ontario’s Personal Health Information Protection Act, 2004 (PHIPA) or has the consent of the individual. Data that are potentially identifiable are released only under certain circumstances and under agreement (e.g. subject to the conditions specified in a confidentiality agreement).

Aggregate (i.e. summed or categorized) data that are released by CCO in tables or reports are reviewed to minimize the risk of identifying an individual.

24. Does CCO give my information to anyone else? What about insurance companies or my employer?

CCO does not share identifiable information with insurance companies or employers.

CCO does not release personal health information with identifiers unless it is required or permitted to do so under the Personal Health Information Protection Act, 2004 (PHIPA). For example, CCO may disclose personal health information to researchers who comply with the research requirements set out in PHIPA, and if the research meets CCO’s scientific standards and is consistent with CCO’s mission and objectives.

Any personal health information that is disclosed must comply with CCO’s Data Use and Disclosure Standard.

25. What is CCO’s role in the provision of Information Technology (IT) services?

With respect to a CCO palliative care initiative, CCO serves as an IT service provider (e.g. by providing applications or network services) under the Personal Health Information Protection Act, 2004 (PHIPA). When operating in this capacity, CCO may only use the data collected in order to support IT services for health care providers (e.g. hospitals). CCO is not authorized under PHIPA to access any of the information collected for this purpose for its standard PHIPA Section 45 (‘prescribed entity’) planning and management functions.

26. What is CCO’s role in relation to the Wait Time Information System?

In November 2004, Ontario’s Ministry of Health and Long-Term Care launched the provincial Wait Time Strategy with the primary objective of creating a central reporting system to track, measure, and reduce wait times. To enable the monitoring of wait times, the Ontario Wait Time Strategy implemented the web-based Wait Time Information System (WTIS) to facilitate wait time management and to provide the public with wait time information on all provincially funded surgical and diagnostic procedures.

The WTIS is operated and managed by CCO in its capacity as a ‘prescribed entity’ under section 45 of the Personal Health Information Protection Act, 2004 (PHIPA). CCO established the Wait Time Information Office (WTIO), which is responsible for supporting and administering the WTIS and reporting on wait times on its behalf.

The WTIO has developed and implemented a CCO Privacy Policy, which outlines the privacy practices and safeguards WTIO staff employ to protect personal health information in the WTIS. The WTIO also has a Privacy Lead whose job is to ensure that all WTIO staff follow the CCO Privacy Policy and to act as the key resource for those who would like more information about WTIO privacy practices. The WTIO Privacy Lead reports jointly to CCO’s Chief Privacy Officer and the Lead – Wait Time Information Management System.

27. Who can I speak to if I have questions or complaints about CCO’s information practices and privacy program?

Questions related to CCO’s data holdings, information practices, and/or privacy program should be directed to:

CCO Privacy & Access Office
Cancer Care Ontario
620 University Avenue
Toronto, ON M5G 2L7
Phone: 416. 217.1816
Fax: 416.971.6888
Email: privacyandaccessoffice@cancercare.on.ca

Last modified: Fri, Jul 28, 2017
cancer care ontario | action cancer ontario   620 University Avenue Toronto Ontario, Canada M5G 2L7   Phone: 416.971.9800 Fax: 416.971.6888

Please help improve the quality of our website by answering 10 brief questions in our online survey. Would you like to participate?

YesNo