The PET Scans Ontario program provides an information technology tool – the PET E-tool – that physicians and PET centres can use to electronically share necessary clinical information about a patient receiving a PET scan.
The program also collects data about PET scans for planning and managing the delivery and expansion of PET scan services in the province. The program’s objective is to help prevent unnecessary testing by having PET scans available only for situations where evidence shows that patients can benefit from the test.
Find information about our privacy roles and responsibilities related to the PET Scans Ontario program.
For more details contact Ontario Health's Privacy Office.
Table of Contents
Privacy for Patients
The information here is meant for patients receiving PET scan services through PET Scans Ontario, a program of Ontario Health (Cancer Care Ontario).
If you receive PET scan services in Ontario, your physician may use an electronic tool – the PET E-tool – to request those services. Ontario PET centres, where the PET scans are done, also use the tool to submit the results from PET scans done at their facilities.
We know your privacy is important to you. Here you can learn about:
- Ontario Health’s privacy roles and responsibilities relating to PET Scans Ontario
- how we meet these responsibilities
- services and safeguards we have put in place related to the PET Scans Ontario program
- who to contact if you have questions or concerns
The PET E-Tool
This electronic referral tool lets referring doctors and PET centres share information. Your doctor can send a PET scan request electronically to a PET centre to book an appointment. After a PET scan is completed, the PET centre puts the results into the PET E-Tool, where the doctor can get them.
Ontario Health’s role
Ontario Health (Cancer Care Ontario) provides the PET E-Tool to referring doctors and PET centres so they can disclose PET scan information to one another. We do this in our capacity as a “health information network provider” under the Ontario Personal Health Information Protection Act, 2004 (PHIPA).
Doctors and PET centres also use the PET E-Tool to disclose PET scan information to Ontario Health. We use this information to plan, manage and improve PET scan services in the province. We are allowed to collect and use this information under our authority as a “prescribed entity” under PHIPA.
Information Collected Through the PET E-Tool
To refer you for a PET scan, your doctor will need to send your personal health information to a PET centre. One way they can do this securely is through the PET E-Tool.
This information may include your name, health card number, diagnosis, medical history and the selected PET centre for your PET scan. The PET centre needs your personal health information to book and complete your PET scan.
Ontario Health also collects the information referring doctors and PET centres enter into the PET E-Tool. We do it to plan, manage, and improve PET scan services in the province.
Get Access to Your Personal Health Information in the PET E-Tool
You can ask your healthcare provider for a copy of the personal health information held about you in the PET E-Tool.
Who can Access Your Personal Health Information
The following groups of people can access your personal health information from the PET E-Tool through a secure website.
Referring doctors and PET centres
Healthcare providers have access to enter or view their patient information in the PET E-Tool. Their access must be authorized by a Registration Authority who verifies the user’s identity and confirms that they need access to the PET E-Tool.
PET Scans Ontario and Ontario Health Informatics staff
PET Scans Ontario and Ontario Health informatics staff have access to the PET E-Tool to:
- support the operations of the program
- support the application
- carry out requests for changes to patient records (for example, to correct errors)
- extract information for health system planning and management (based on Ontario Health’s “prescribed entity” status)
Ontario Health technical support staff
Technical support staff have the same access as PET Scans Ontario and Ontario Health Informatics staff. They also have physical access to the PET Scans Ontario server, which is securely located in Ontario Health’s data centre.
Ontario Health Protects Your Personal Health Information
The personal health information in the PET E-Tool is protected by administrative, technical and physical safeguards.
Administrative safeguards
PET centres using the PET E-Tool must sign a License Agreement with Ontario Health. The agreement contains detailed Terms of Use to be accepted by authorized users (employees, consultants and contractors) before they can access the PET E-Tool.
Referring physicians must accept detailed Terms of Service before they can access the PET E-Tool.
Both agreements require PET E-Tool users to keep confidential the personal health information they access through the PET E-Tool and their user credentials.
Ontario Health staff who have access to the PET Scans Ontario database must sign confidentiality agreements and regularly attend privacy and security training. This makes sure they understand the safeguards they must use to protect the personal health information kept in the database.
Technical Safeguards
PET E-Tool users are registered by a Registration Authority who validates the user’s identity and confirms that the user requires access to the PET E-Tool. Users access the PET E-Tool with a unique username and password, through a secure website.
Physical Safeguards
The PET Scans Ontario database is in Ontario Health’s secure data centre. Access to the data centre is limited to a small number of support staff, controlled by electronic access cards and monitored with video surveillance.
Privacy for Health Care Providers
Here we set out our privacy roles and responsibilities related to the PET Scans Ontario program and describe how we meet them. This information is intended for healthcare providers, and hospital privacy officers, administrators and security officers.
The PET E-Tool
The PET E-Tool provides web-based forms to physicians to request PET scans for their patients. It also provides web-based forms to PET centres to submit results from PET scans performed at their institutions.
Ontario Health (Cancer Care Ontario) uses the PET scan data collected from physicians and PET centres to analyze and report on the use and effectiveness of PET scans. We provide aggregate-level reports to the Ministry of Health and the Ontario PET Steering Committee.
Information Collected in the PET E-Tool
Physicians collect the following personal health information about patients through the PET E-Tool:
- Demographic Information: Patient’s name, birth date, gender, health card number, phone number, province and postal code
- Provider Information: Referring physician name, phone number, fax number, email and CPSO number, PET scan reading physician name
- Health Care Facility Information: PET centre
- Clinical Information: Disease information, diagnosis, clinical and pathological stage, purpose for PET scan, prior imaging studies, biomarkers, and other relevant clinical documentation
- PET Scan Result Information: PET scan date, PET scan findings, and source and type of radiopharmaceutical used
This information is kept in a secure database at Ontario Health.
Ontario Health’s Legislative Authority to Collect, Use and Disclose Personal Health Information
Ontario Health has three different types of legislative authority under the Personal Health Information Protection Act, 2004 (PHIPA).
Health information custodians
The collection, use, and disclosure of personal health information (e.g. patient name, health card number and PET scan results) by health care providers and Ontario Health is governed under the Personal Health Information Protection Act, 2004 (PHIPA). This Act establishes the rules that “health information custodians” and other parties in the health care continuum must comply with in managing the confidentiality of patient information. Referring physicians and PET centres, for example, are classified as “health information custodians” under section 3(1) of PHIPA.
Health information network provider
In providing the PET E-Tool to health information custodians so they can share information about their patients, Ontario Health is acting as an agent, as the term is defined in section 2 of PHIPA, of the health information custodians, and as a “health information network provider” as defined in section 6(2) of the Regulation to PHIPA. This section describes a health information network provider as a person who enables two or more health information custodians (e.g., physicians and PET centres) to use electronic means to share personal health information. In this capacity, our use of personal health information collected through the PET E-Tool is strictly limited to that which is necessary to support the provision of information technology services.
Ontario Health’s manages the PET Access Program domain. This includes facilitating an adjudicative process to determine patient eligibility to receive a PET scan. Under the PET Access Program domain, on behalf of the physicians and with a patient’s express consent, we anonymize PET scan request packages received through the PET E-Tool and provide the packages to a clinical expert panel. The panel reviews each PET scan request and determines a patient’s eligibility to receive a PET scan.
Prescribed entity
Ontario Health is listed as a “prescribed entity” under section 18 of the Regulation to PHIPA. Prescribed entities are organizations permitted under PHIPA to collect personal health information without a patient’s consent from health information custodians (e.g., referring physicians and PET centres) for the purposes of analysis or compiling of statistical information with respect to the evaluation, monitoring, management or planning of all or part of the health care system, or for allocating resources, including the delivery of health services (per section 45(5) of PHIPA).
Part of our mandate, for example, is to plan and coordinate Ontario's cancer services. Section 45(6) of PHIPA permits prescribed entities to use personal health information (without the patient’s consent) for the same purpose. This means that we are permitted to collect personal health information about cancer patients from health care providers and use this information to plan and coordinate cancer services in the province.
Patient Consent
PET Registry and PET Insured Services Domains
Health care providers may assume they have a patient’s implied consent to collect, use and disclose personal health information to provide or help provide health care, unless they know a patient has specifically withheld or withdrawn consent for this purpose.
The express instructions of a patient to withhold or withdraw consent for the use or disclosure of personal health information for purposes related to health care are described in sections 20(2), 37(1)(a) and 38(1)(a) of PHIPA. They are commonly called the “lock box.” This means that health care providers can assume they have their patient’s consent to submit and/or access the patient’s information through the PET E-Tool for the purpose of providing care under the PET Registry and PET Insured Services domains. However, patients may “lock” their personal health information from use by or disclosure to a particular provider or organization.
When a patient chooses to “lock” their information, the information should not be entered into the PET E-Tool (or, where applicable, will be removed from it).
PET Access Program Domain
Under the PET Access Program domain, health care providers must have the patient’s express consent to provide their information to Ontario Health through the PET E-Tool for the purpose of determining their eligibility to receive a PET scan.
Privacy Roles and Responsibilities of PET E-Tool Users
Physicians and PET centres are defined as “health information custodians.” That means they are subject to specific privacy requirements outlined in PHIPA. These include requirements to:
- appoint a privacy contact person
- have a privacy program
- notify affected patients if their personal health information is lost or stolen
Ontario Health hosts the PET E-Tool to give referring physicians and PET centres a secure way to share patient data relating to PET scans with one another for the purposes of completing PET scans for patients. The shared data includes personal health information. In this role, we are a “health information network provider.” We must comply with specific requirements set out in section 6(3) of the PHIPA Regulation.
Physicians and PET centres also use the PET E-Tool to disclose information related to PET scans to Ontario Health for the purposes of planning, managing and coordinating PET scan services in the province. As a “prescribed entity” under PHIPA, we are required to make publicly available a description of our functions and the privacy practices in place to protect the personal health information we collect (per section 18(2) of the PHIPA Regulation). Our Statement of Information Practices meets this requirement.
The Information and Privacy Commissioner/Ontario must review and approve our privacy practices every three years (per section 45(4) of PHIPA).
Access to the PET E-Tool – Audit Log
The PET E-Tool includes a role-based administrative function so privacy managers (or their delegates) can produce an audit log of accesses to and transfers of information held in the PET E-Tool. The Ontario Health Service Desk will support users in this function upon request.
Threat Risk Assessment
Ontario Health conducted a threat risk assessment that included an analysis of the PET E-Tool, and the servers and network supporting it. A copy of the assessment is available to hospital privacy or security officers who sign a non-disclosure agreement.