Lumeo Health Information System
A Regional Health Information System (RHIS) called Lumeo provides a single source of health information and clinical tools that help health care workers coordinate and deliver safe, high-quality care throughout the region.
The Lumeo System went live across Southeastern Ontario at the beginning of December 2024. This means that healthcare providers at all six organizations have seamless access to personal health information records while meeting privacy requirements.
Lumeo will enable the following organizations to share personal health information about you:
- Brockville General Hospital
- Kingston Health Sciences Centre
- Lennox and Addington County General Hospital
- Perth and Smiths Falls District Hospital
- Providence Care
- Quinte Health
What is my personal health information?
Personal health information includes any identifiable information about your health or health care history. It can include things like your medical history, details of visits, test results or your health card number.
Kingston Health Sciences Centre as a Health Information Network Provider for Lumeo
Kingston Health Sciences Centre (KHSC) is the “health information network provider” (HINP) for Lumeo. A HINP is defined by Ontario’s health privacy law (Personal Health Information Protection Act or PHIPA) as someone “who provides services to two or more health information custodians to use electronic means to disclose personal health information”. The six organizations listed above are “health information custodians” as defined by PHIPA and, as the HINP, KHSC is enabling the sharing of personal health information (PHI) between them using the Lumeo system.
Kingston Health Sciences Centre as a Health Information Network Provider for the Ontario eHub Health Information Exchange (HIE)
In addition to Lumeo, KHSC is acting as the HINP for the Ontario eHub Health Information Exchange (HIE). The HIE is powered by Oracle Health. The HIE connects the health information systems of 27 Ontario-based organizations and 375 long-term care homes to help improve client (patient, client, resident) care through better information access. The HIE will help these healthcare organizations share client data more easily and securely, improve care to clients, and reduce the burden on clients and these organizations. KHSC is also working with TransForm Shared Service Organization to manage the HIE.
For a list of organizations participating in the HIE, as well as what information they share, select the links below:
Can I limit who sees my personal health information in Lumeo or the HIE?
You can limit access to your personal health information for healthcare purposes by asking for a consent directive. If you want to add a consent directive to your record, contact the Privacy Office where you normally receive care for more information.
In KHSC’s role as the HINP for both Lumeo and the HIE, they are responsible for implementing administrative, physical and technical safeguards to protect the privacy and security of PHI in Lumeo. These safeguards include, but are not limited to:
Administrative Safeguards:
- Establishing appropriate agreements between the Participating Organizations, as well as anyone else who may have access to PHI in Lumeo or the HIE.
- Making this plain language statement available to both the public and participating organizations so they are aware of the safeguards in place to protect the PHI in Lumeo and the HIE.
- Identifying individuals who will be responsible for the privacy and security of the PHI in Lumeo and the HIE.
- Training personnel on privacy awareness and security best practices and having them sign confidentiality agreements when they join an organization and on an annual basis.
- Privacy and security policies and procedures, as well as breach management protocols and disaster recovery plans, are in place and regularly reviewed.
- Assessing the privacy and security of the information system to help ensure that it protects personal health information, including completing privacy impact assessments (PIAs) and threat risk assessments (TRAs), as required.
Physical Safeguards:
- Environmental controls to protect against threats such as flooding, fire and power outages.
- Physical security mechanisms such as card reader access onsite to detect and prevent unauthorized access.
- Secure disposal of media, equipment and hard drives.
Technical Safeguards:
- Establishing logging, auditing and monitoring policies and procedures, including the communication of these controls to HICs.
- Role-based user access that defines and limits the information to which personnel have access.
- Network security measures such as firewalls, anti-malware, and intrusion detection.
We encourage you to contact us with any questions or concerns you might have about our privacy practices. You can reach our Privacy Office and Freedom of Information Office at:
Providence Care
752 King Street West
Kingston, ON K7L 4X3
Email: privacyoffice@providencecare.ca
Telephone: 613-544-4900, Ext. 53548
If, after contacting us, you feel that your concerns have not been addressed to your satisfaction, you have the right to complain to the Information and Privacy Commissioner of Ontario. The Commissioner can be reached at:
Information and Privacy Commissioner of Ontario
2 Bloor Street East, Suite 1400
Toronto, Ontario M4W 1A8
1-800-387-0073
1-416-325-9195 (fax)
or visit the IPC website via www.ipc.on.ca
