You are using an outdated browser. We suggest you update your browser for a better experience. Click here for update.
Close this notification.
Skip to main content Skip to search

COVID-19: Get the latest updates or take a self-assessment.

Collaborative Staging Privacy Frequently Asked Questions

This page helps healthcare providers at hospitals (as well as Privacy and IT Security Officers) understand the processes and safeguards Cancer Care Ontario uses when accessing cancer patient health records for the purpose of collecting cancer staging information.

The information also is helpful in answering questions from patients and their families. Cancer Care Ontario makes available to the public and patients a plain language description of the services and safeguards provided to protect the personal health information we retain.


How will my hospital be involved with cancer staging data collection?

Your hospital will appoint or reconfirm a Stage Physician Lead and Stage Health Records Lead to liaise with Cancer Care Ontario on all issues related to cancer stage data capture and reporting. Cancer Care Ontario’s Stage Capture Project Team will work with designated representatives from your hospital to implement collaborative staging data collection. Cancer Care Ontario’s Cancer Informatics Team will continue to operate the collection and reporting of cancer stage data after implementation.

What is the Stage Capture Project?

The Stage Capture Project is a multi-year initiative to expand the reporting of cancer stage at diagnosis to all new incident cancer cases across Ontario. One component of the project is centred on working with hospitals across Ontario to develop data collection processes, tools and supports to enable electronic collection of collaborative staging data by Cancer Care Ontario’s Cancer Informatics department.

What personal health information will Cancer Care Ontario collect as part of collaborative staging data collection?

Cancer Care Ontario will be collecting the following information on new incident cancer cases diagnosed or receiving primary treatment at your hospital from January 1, 2007 forward:

  • Hospital, provider and patient name and other identifiers (e.g., HIN #, chart #, date of birth, gender)
  • Description of cancer site, histology, behaviour, grade, diagnosis date and best method of tumour confirmation
  • Collaborative staging information:
    • CS tumour size (largest dimension of primary tumour)
    • CS extension (direct extension of tumour within organ of origin or neighbouring organs)
    • CS tumour/extension evaluation method (source of information for tumour size and extension)
    • CS lymph nodes (regional lymph nodes involved with cancer at time of diagnosis)
    • CS regional nodes positive (# of nodes examined by pathologist found to contain metastases)
    • CS regional nodes examined (# of nodes removed and examined by pathologist)
    • CS lymph nodes valuation method (source of information regarding nodal involvement)
    • Lymph-vascular invasion o CS metastases (presence/absence of distant metastases)
    • CS metastases evaluation method (source of information for metastases)
    • CS metastases at diagnosis (bone, lung, liver, brain)
    • Up to 25 site specific factors, as applicable (factors considered to be of clinical or prognostic importance that have an effect on stage or survival i.e., tumour markers)
    • Clinical and pathological T, N and M and group stage scores (if documented in health record)

Initial data collection will focus on the following types of cancers: breast, colorectal, prostate and lung. Over time CS data collection will expand to all sites/histologies. Currently, the CS System consists of approximately 135 schemas, most of which are site-specific; however, some cancers are coded according to the histology of the case.

Does Cancer Care Ontario have the authority to collect this data?

Yes. Cancer Care Ontario’s authority to collect personal health information derives from the Personal Health Information Protection Act, 2004 (PHIPA). Cancer Care Ontario is a “prescribed entity” which, in conjunction with the Cancer Act, grants it the authority to collect personal health information without patient consent for the purpose of cancer-related healthcare planning and management.

Has a Privacy Impact Assessment been done with respect to Collaborative Staging data collection?

Yes. Cancer Care Ontario’s Privacy Impact Assessment Policy requires a Privacy Impact Assessment if new data holdings are created or if significant re-engineering occurs. In consultation with external privacy experts, a Privacy Impact Assessment was completed in July 2008 and a summary of the assessment is available on our Privacy Assessments page.

Do hospitals need to obtain patient consent to disclose personal health information to Cancer Care Ontario?

No. Hospitals do not need to obtain patient consent for this purpose. Hospitals, in their capacity as health information custodians under Ontario’s Personal Health Information Protection Act, 2004 (PHIPA), are permitted to disclose personal health information to Cancer Care Ontario for cancer-related healthcare planning and management purposes.

How does Cancer Care Ontario protect the privacy of personal health information it retains?

Cancer Care Ontario has an extensive privacy program that governs the use of personal health information, ensuring that it is accessed only for purposes consistent with our mandate; these practices undergo formal review by the Office of the Information and Privacy Commissioner/ Ontario on a tri-annual basis. Cancer Care Ontario requires that all staff attend privacy training and sign a confidentiality agreement as a condition of employment. Employee access to Cancer Care Ontario data is granted on a “need-to-know‟ basis and access rights are reviewed annually.

How does Cancer Care Ontario ensure the security information systems used to collect and store personal health information?

Cancer Care Ontario employs industry-standard technologies to control and protect the confidentiality and integrity of information during transfer, storage and use. Additionally, strong administrative, technical and physical security measures are employed to secure data.

The transfer of data is protected by “128-bit SSL” a widely-used solution for securing transmissions of information over the Internet. This technology is also widely-used in Internet banking. Additionally, a strong authentication is used for remote connection to Cancer Care Ontario servers through the use of RSA tokens. This provides assurance regarding the identity of the person accessing Cancer Care Ontario systems and safeguards against unauthorized access. Cancer Care Ontario also has an active disaster recovery plan.

The collaborative staging abstractors use Cancer Care Ontario-supplied personal computers on which whole-disk encryption is used to protect information from unintended disclosure in case the device is lost or stolen. If that should happen, the information on the computer is completely inaccessible without proper authorization. Access to data at Cancer Care Ontario is granted in accordance with our Privacy Policy.

How does Cancer Care Ontario obtain access to hospital health records of cancer patients?

If the hospital’s health records are electronic, access to such patient health records may be by remote access to electronic health records. If the hospital’s health records are not in an electronic format or not accessible remotely (i.e., from Cancer Care Ontario), hospital staff can scan and upload health records documents to Cancer Care Ontario’s secure web portal, fax, or copy and courier to Cancer Care Ontario where collaborative staging abstractors will be able to access, review and abstract necessary information for staging purpose.

Who does Cancer Care Ontario disclose personal health information?

Cancer Care Ontario does not disclose personal health information unless permitted or required by law.

All requests by external researchers for access to Cancer Care Ontario data must meet the strict requirements set out in Ontario’s Personal Health Information Protection Act, 2004 (PHIPA). Accordingly, research protocols must be approved by a Research Ethics Board that is properly constituted in accordance with PHIPA, and any disclosure is subject to receipt of a confidentiality agreement entered into by the researchers.

In addition to oversight by a Research Ethics Board, Cancer Care Ontario provides privacy oversight to the research process directly through the Privacy Office and its involvement with the Data Access Committee. Beyond satisfying PHIPA requirements, researchers must meet Cancer Care Ontario’s scientific standards and be consistent with its mission and objectives.

Finally, Cancer Care Ontario also discloses personal health information back to the hospital from which it was originally provided.

Can patients access their personal health information held at Cancer Care Ontario?

Patients requesting access to their information held at Cancer Care Ontario will be re-directed to the healthcare provider who originally collected the information. This is consistent with the Personal Health Information Protection Act, 2004 (PHIPA), under which Cancer Care Ontario is not required to grant patients access to their records.


Accessing Further Information

Information practices or privacy program

For more information about Cancer Care Ontario’s information practices and privacy program, please refer to Privacy at CCO

If you require further information, please contact:

The Privacy Office
Cancer Care Ontario
620 University Avenue
Toronto, ON
M5G 2L7
Tel: 416-971-9800 ext. 3200


Collaborative staging data collection

If you have questions about collaborative staging data collection, please email