Legal Commentary

Disclosure of personal health info limited

By David Canton

For the London Free Press – September 28, 2009

Read this on Canoe

PRIVACY: The Personal Health Information Protection Act spells out three basic ways that such information can be released

The term “Circle of Care” is often used to describe the ability of health-care professionals to share patient information among those treating that patient.

But the term doesn’t actually appear in the Personal Health Information Protection Act (PHIPA),

A recent publication by Privacy Commissioner Ann Cavoukian and seven health organizations tries to reduce confusion over the term. This article is a summary; the full text is at www.ipc.on.ca/ images/Resources/circle-care.pdf.

Consent to disclose personal health information under the PHIPA is addressed in three basic ways:

First, information may be collected, used or disclosed without consent where permitted or required by PHIPA. For example, disclosure will be permitted for the purposes of the Health Protection and Promotion Act.

Second, information may be collected, used or disclosed with the express consent of the individual or his/her substitute decision-maker. Such consent must be informed, relate to the information collected, used or disclosed, and not obtained by deception or coercion.

Third, information may be collected, used or disclosed with the implied consent of the individual. This is crucial for efficient care.

A health information custodian can assume implied consent to collect, use or disclose personal health information only when all of these conditions are met:

- The information must fall within a category about which custodians are entitled to rely on assumed implied consent.

- The information must have been received from the individual, his or her substitute decision-maker or another custodian.

- The custodian must have received the information to provide or help provide health care to the individual.

- The information must be collected, used or disclosed by the custodian to provide or help provide health care to the individual.

- The information may only be disclosed to another health information custodian.

- The custodian receiving it must not be aware that the individual has expressly withheld or withdrawn consent for its collection, use or disclosure.

For example, implied consent would exist where a patient visits her family doctor and is referred to a specialist. Consent is implied for the doctor to disclose patient information to the specialist.

But assumed implied consent would not exist if the specialist tried to disclose the patient’s personal health information for use in research on the disease affecting the patient. That’s because the information would not be used to provide care to the patient.

Full post as published by eLegal Canton on September 28, 2009 (boomark / email).