Collection, Use and Disclosure of Personal Health Information

Key Principle

When collecting, using or disclosing an individual’s personal health information, a key principle is that the patient’s consent is required.

Consent

Consent to the collection and use of personal health information about a patient may be:

Express or
Implied.

In order to be valid, the consent must be:

Be the consent of the patient.
Be knowledgeable (reasonable to believe the patient knows the purpose of the collection or use and knows that consent can be withheld).
Relate to the information.
Not be obtained through deception or coercion.
Withdrawal of consent shall not have a retroactive effect.

Capacity to Consent

A patient is capable of consenting if the patient is able to:

Understand the information that is relevant to the decision to consent to the collection, use or disclosure and
Appreciate the reasonably foreseeable consequences of giving, not giving, withholding or withdrawing the consent.

The patient may be capable of consent with respect to consenting to the collection, use or disclosure of some parts of personal health information, but incapable with respect to other parts, or capable at one time, but not another time.

The default position is that there is a presumption of capacity.

Determination of Incapacity

The hospital (a health information custodian) may rely on the “presumption of capacity” unless the hospital has reasonable grounds to believe that the patient is incapable of consenting to the collection, use or disclosure of personal health information.

If found incapable – the patient has an opportunity to apply to the Consent and Capacity Board for a review of the determination.

Direct Collection

Collection of personal health information directly from the patient requires consent, however, the hospital may collect personal health information about a patient indirectly even if the patient is incapable of consenting, if the collection is necessary for the provision of health care and it’s not reasonable to obtain consent in a timely manner.

Indirect Collection

The hospital may collect personal health information indirectly if:

The patient consents.
Reasonably necessary for providing health care and it’s not possible for the hospital to collect it directly from the patient accurately or in a timely fashion.
The hospital collects it from a non-health information custodian for research purposes (with Research Ethics Board approval).
The Commissioner authorizes the collection.
Permitted or required by law, treaty or agreement under a Act.
Permitted under FIPPA or MFIPPA (Freedom of Information and Protection of Privacy Acts).
Investigating a breach or contravention of a law.
Conducting a proceeding or possible proceeding.
Compiling statistics for the planning and management of the health care system.

Permitted Uses

Unless a patient expressly instructs otherwise, the hospital may use personal health information about the patient:

For the purposes for which the information was collected or created.
For planning or delivering programs or services, allocating resources, monitoring or preventing fraud regarding services or benefits.
For risk or error management, to maintain quality of care.
Educating agents to provide health care.
To seek the patient’s consent (only name and contact information).
In a proceeding or contemplated proceeding.
To obtain payment, processing, monitoring, verifying or reimbursing claims for payment.
For research with Research Ethics Board approval.
To comply with a legal requirement in this Act or another Act.

Agents

The hospital permitted to use personal health information may provide it to an “agent” who may use it for that purpose on behalf of the custodian. This is not considered a “disclosure” by the hospital to the agent, but rather a “use”.

An “agent” means a person that with the authorization of the hospital acts for or on behalf of the hospital not for the agent’s own purposes with respect to personal health information whether or not:

The agent has the authority to bind the hospital.
The agent is employed by the hospital.
The agent is being remunerated.

Permitted Disclosures

The hospital may disclose personal health information about the patient as follows:

Disclosure related to providing health care

To another health information custodian if the disclosure is reasonably necessary for the provision of health care and it’s not reasonable to obtain the patient’s consent in a timely manner, unless the patient has expressly instructed the hospital not to make the disclosure (effective November 1, 2005).
If a patient’s instruction prevents the hospital from disclosing all the personal health information necessary for the provision of health care to the patient, the hospital must make the recipient of the information aware of that fact.

For funding or payment

For the Minister or another health information custodian to determine or provide funding of payment to the hospital for the provision of health care.

Contacting a relative, friend or substitute decision maker

For contacting a relative, friend or potential substitute decision maker if the patient is injured, incapacitated or ill and unable to give consent personally.

Facilities that provide health care

Providing the hospital offers the patient the option to object to the disclosure and the patient does not do so, the hospital may disclose.

The fact that the patient is a patient or resident in the facility.
The patient’s general health status i.e. critical, poor, fair, stable or satisfactory.
The location of the patient in the facility.

Deceased individual (or presumed deceased)

For identifying the patient.
For informing any person about the death of the patient and circumstances where appropriate.
To the recipient i.e. spouse, partner, sibling or child of the patient who may require the information to make decisions about their own or their children’s health care.

For health or other programs

For determining or verifying eligibility to receive health care.
To a person conducting an audit or accreditation.
To a person who compiles or maintains a registry relating to the storage or donation of body parts or bodily substances.
To the Chief Medical Officer of Health or public health authority.

Disclosures related to risks

For eliminating or reducing significant risk or serious bodily harm to a person or group of persons.

Disclosure related to care or custody

To the head of a penal or other custodial institution in which the patient is being lawfully detained.
To the officer in charge of a psychiatric facility in which the patient is being detained for the purposes of assisting in making decisions concerning arrangements for the provision of health care to the patient or the placement of the patient into custody, detention, release, conditional release, discharge or conditional discharge.

For a proceeding

For a proceeding that in which the hospital or the agent or former agent of the hospital is a party or witness if the information relates to the proceeding or contemplated proceeding.
To a proposed litigation guarding or legal representative for the purposes of having the person appointed as such or to commence, defend or continue a proceeding on behalf of the patient.
To comply with a court order, summons etc. issued by an Ontario court.
To comply with a procedural rule compelling the production of information.
To the agent or former agents professional advisor for the purpose of providing advice or representation if the advisor is under a professional duty of confidentiality.

To a successor

To allow a potential successor to assess and evaluate the operation of the health information custodian but only if the successor enters into an agreement with the health information custodian to keep the information confidential and not retain it for longer than is necessary to carry out the assessment or evaluation.
To transfer the hospitals records to the hospitals successor after giving notice to the patient before transferring the records or if not reasonably practical than as soon as possible after the transfer took place.
To the Archives of Ontario.

Disclosure related to this Act or other Acts

For determining, assessing or confirming capacity under the Health Care Consent Act, The Substitute Decisions Act of this Act.
To a college within the meaning of the Regulated Health Professions Act for the purposes of administration or enforcement of the Drug and Pharmacies Act or the RHPA.
To the Board of Regents under the Drugless Practitioners Act for administration or enforcement.
To the Ontario College of Social Workers for administration or enforcement.
To the Public Guardian and Trustee, The Children’s Lawyer, a children’s aid society, a Residential Placement Advisory Committee under the Child and Family Services Act or the Registrar of Adoption Information to carry out their statutory functions.

For research

Refer to policy “Disclosure of Personal Health Information for Research”.

If the researcher submits a written application and research plan to the hospital.
The research plan meets certain requirements and is approved by the Research Ethics Board of the hospital.
The researcher enters into an agreement with the hospital about the research plan.

Mandatory disclosures

Aviation Medical Advisor (Aeronautics Act) if condition impacts the patient’s ability to perform job safely (flight crew, air traffic controllers etc).
Children’s Aid Society (Child and Family Services Act) if child needs protection.
Coroner or Police Officer (Coroner’s Act) for facts surrounding a death of a patient as a result of violence, negligence, malpractice or to a coroner if a patient dies while in hospital.
Medical Officer of Health ( Health Protection and Promotion Act) for communicable diseases.
Registrar of Motor Vehicles (Highway Act) if condition may make it unsafe to drive.
Registrar General (Vital Statistics Act) for births an deaths.

To the Minister of Health and Long Term Care

To any person appointed by the Minister for research purposes.
For purposes requested and approved by the Minister for centralized control of computerized health record.
To a Minister inspector.

To employees of a hospital

To fulfill their duties or functions.

To a psychiatric facility

To assess, observe, examine or detain the patient in accordance with the MHA.
To comply with Part 21 (Mental Disorder) or an order under that part.
To the Consent and Capacity Board for a proceeding.
To a physician issuing or renewing a community treatment order (CTO) or for consulting others concerning a CTO.
To a person named in the CTO plan providing the treatment (upon written request of the physician or other named person).
To a person providing advocacy services in “prescribed” circumstances.
To the Public Guardian and Trustee to enable investigations.
To respond to a summons, order, subpoena or similar legal requirement.

Disclosures outside of Ontario

With patient consent.
If the Act permits the disclosure.
The recipient performs functions comparable to the functions performed by a person within Ontario.
The disclosure is for the purposes of providing health care and the patient does not object.
The disclosure is required for payment or health care purposes.

To the Quality Care Committee of a hospital

To carry out the committee’s duties and responsibilities