Frequently Asked Questions > Health Information and Privacy


QUESTION — HEALTH INFORMATION AND PRIVACY
  1. When can I share a patient’s/client's personal health information and with whom can I share it?
  2. When do I need express consent before I can share personal health information? 
  3. What is "implied consent" to share information?
  4. What is meant by "circle of care"?
  5. When may I assume that I have the patient's/client's implied consent to share his or her personal health information? 
  6. I've satisfied the six conditions outlined by the Information and Privacy Commissioner, as described in this eTool's Question: "Health Information and Privacy - Assuming Implied Consent to Share Information". What does this mean in terms of my work, and interacting with members of my team?
  7. I haven't satisfied the six conditions outlined by the Information and Privacy Commissioner as listed in this eTool's Question: "Health Information and Privacy - Assuming Implied Consent to Share Information". What do I do now?
  8. What does relying on implied consent within the circle of care look like in practice?
  9. May I assume that if I have consent to treatment I also have consent to share personal health information? Or vice versa?
  10. Can all the professionals that are involved in an educational environment, such as a school team, be considered part of the “circle of care” for the student being discussed?
RESPONSE
  1. When can I share a patient’s/client's personal health information and with whom can I share it?

    Generally, health care providers need consent from the patient/client before they can share that patient's/client's personal health information with anyone else.  Consent may either be expressed or implied.

    In many circumstances, you will obtain your patient's/client’s express consent to disclose their personal health information.  However, it would be impractical or impossible to obtain explicit consent in every situation, especially where care is provided by a team.  Accordingly,  in certain circumstances you are entitled to assume that you have the patient's/client’s consent for the purposes of providing or assisting in providing health care unless you are aware that the patient has expressly withheld or withdrawn consent.  This means that unless you have reason to believe otherwise, you can share information with others involved in the patient's/client’s “circle of care” without asking for consent to do so. (Click here for “circle of care” information.)

    The legislation that establishes the rules about when and with whom the information may be shared is the Personal Health Information Protection Act, 2004[i] (“PHIPA”).

    Remember, the patient's/client’s expressed consent is required for providing his or her personal health information outside of the circle of care, except where otherwise permitted by statute.



    [i] Personal Health Information Protection Act, 2004, S.O. 2004, c. 3., Sched. A.

     

  2. When do I need express consent before I can share personal health information?

     PHIPA requires expressed consent (not implied) when:

    • You are disclosing personal health information to someone outside the circle of care; or
    • You are disclosing personal health information to someone within the circle of care BUT the disclosure is not for the purposes of providing health care, or to assist in providing care[i].


    [i] Section 18(3) of the Personal Health Information Protection Act, 2004, S.O. 2004, c. 3., Sched. A. 

  3. What is "implied consent" to share information?

    Implied consent is consent which is not expressly granted by a patient/client, but can be inferred from a patient's/client's actions. PHIPA gives an example of when you may assume that you have the patient's/client’s implied consent and it hinges on whether or not the professional with whom you would like to share information with is or is not in the “circle of care”. The circle of care is just one example of implied consent. 

  4. What is meant by "circle of care"?

    “Circle of care” refers to a specific type of consent (included in Ontario’s privacy law, Personal Health Information Protection Act, 2004[i] "PHIPA") that can authorize members of a health care team to assume they have consent to collect use and/or disclose personal health information, provided certain conditions are satisfied. The type of consent is formally called "assumed implied consent"[ii].

    PHIPA does not define the term “circle of care”, however, the Office of the Privacy Commissioner of Ontario has developed this concept to refer to those members of a health care team who are included in an individual’s implied consent to collect, use, and disclose a patient's/client’s personal health information for the purpose of providing health care in specific circumstances. In their document “Circle of Care: Sharing Personal Health Information for Health-Care Purposes”, it is stated that,

    “It is a term commonly used to describe the ability of certain health information custodians to assume an individual’s implied consent to collect, use or disclose personal health information for the purpose of providing health care, in circumstances defined in PHIPA.”[ http://www.ipc.on.ca/english/Resources/Best-Practices-and-Professional-Guidelines/Best-Practices-and-Professional-Guidelines-Summary/?id=885 ]

    Those circumstances are delineated in the “6 conditions” that must be met. Click here for access to the guide that describes these six conditions.



    [i] Personal Health Information Protection Act, 2004, S.O. 2004, c. 3., Sched. A.

    [ii] Section 20(2) of the Personal Health Information Protection Act, 2004, S.O. 2004, c. 3., Sched. A. 

     

  5. When may I assume that I have the patient's/client's implied consent to share his or her personal health information? 

    The following conditions must be met:

    1. You are a health care practitioner. (Health care practitioners need not be members of a regulated health profession, although they can be.)
    2. The personal health information you want to collect, use or disclose was given to you by the patient/client, the substitute decision maker, or another health care practitioner or other health information custodian[1].
    3. You were given the personal health information for the purpose of providing or assisting in providing health care to the patient/client. (Health care is defined very broadly in PHIPA, and will likely cover the typical interventions undertaken in a health care encounter. To confirm, see the definition of ‘health care’ in s.2 of PHIPA[i]).
    4. You are collecting, using and/or disclosing the personal health information for the purpose of providing or assisting in providing health care to the patient/client and in the circumstances it is not reasonable to simply obtain the information from the patient/client.
    5. If you are disclosing the personal health information, you are disclosing it only to another health care practitioner (or other health information custodian).
    6. The client has not expressly withheld or withdrawn consent to the personal health information being collected, used or disclosed.

    If you haven’t satisfied the conditions listed above, you cannot assume that you have implied consent to collect, use or disclose his or her personal health information. This means you cannot share any information with anyone else – even if it is medically important and you wish to share it with someone else in the Circle of Care.



    [1] If you are wondering what a health information custodian is, see s. 3(1) of PHIPA

     

  6. I've satisfied the six conditions outlined by the Information and Privacy Commissioner, as described in this eTool's Question: "Health Information and Privacy - Assuming Implied Consent to Share Information". What does this mean in terms of my work, and interacting with members of my team?

    If you have satisfied the six conditions. this means that you can rely on assumed implied consent to collect, use, and disclose personal health information. In other words, you can share and use the patient’s/client's information with members of the health care team to do things like confer about test results, discuss the patient’s/client's symptoms, and brainstorm different options for treatment without having to stop and ask the patient/client, or the substitute decision maker for consent (regarding the patient’s/client's information) each time.

    Please note: this description about the impact of the circle of care only relates to consent regarding personal health information. Separate obligations to obtain consent for treatment still apply. See the Health Care Consent Act, 1996 for further information. 

  7. I haven't satisfied the six conditions outlined by the Information and Privacy Commissioner as listed in this eTool's Question: "Health Information and Privacy - Assuming Implied Consent to Share Information". What do I do now?

    If you haven’t satisfied the conditions listed in the Question: "Health Information and Privacy - Assuming Implied Consent to Share Information", you cannot rely on the circle of care; you cannot assume that you have a patient’s/client's implied consent to collect, use, or disclose his or her personal health information. If you need or want to collect, use, or disclose the patient’s/client's personal health information, you will need some other form of authorization to do so.

    The type of authorization you can use will depend on the circumstances. You should consult the provisions in PHIPA, and where possible, get advice from either a privacy specialist, or from the Information and Privacy Commissioner’s Office, Ontario. Some guiding principles, however are as follows:

    • Under PHIPA you must either have consent to collect, use or disclose personal health information OR be authorized to do so without consent because one of the provisions that allows for collection, use or disclosure without consent applies.
    • Generally speaking, PHIPA allows for consent either to be implied or express (verbal or written consent)[i].
      • Express consent will be required when:
        • You are disclosing personal health information to someone who is not a health information custodian; or
        • You are disclosing personal health information to another custodian BUT the disclosure is not for the purposes of providing health care, or to assist in providing care[ii].


    [i] Section 18(2) of the Personal Health Information Protection Act, 2004, S.O. 2004, c. 3., Sched. A

    [ii] Section 18(3) of the Personal Health Information Protection Act, 2004, S.O. 2004, c. 3., Sched. A

     

     

  8. What does relying on implied consent within the circle of care look like in practice?

    If you have satisfied the six conditions outlined by the Information and Privacy Commissioner as listed in this eTool's Question: "Health Information Privacy - Assuming Implied Consent to Share information", you can assume you have consent to collect, use, and disclose the personal health information. You won’t need separate consent each time you share personal health information with members of the health care team (i.e., those within the circle of care) to confer about test results, discuss symptoms, or brainstorm different options for treatment.

  9. May I assume that if I have consent to treatment I also have consent to share personal health information? Or vice versa?

    No. Consent to treatment and consent to share personal health information are two different issues and must be dealt with separately.

    Implied consent under PHIPA only means you can share personal health information with others in the circle of care for the purposes of providing or assisting in providing health care to the patient/client. It does not mean that you have consent to provide the treatment. (See Questions on "Consent to Treatment".)

    Likewise, consent to provide treatment does not extend to consent to share personal health information.

  10. Can all the professionals that are involved in an educational environment, such as a school team, be considered part of the “circle of care” for the student being discussed?

    When considering consent to collect, use and disclose information, the healthcare professional in the school setting must comply with both the Personal Health Information Privacy Act, 2004 (PHIPA) and the Municipal Freedom of Information and Protection of Privacy Act, 1990 (MFIPPA). Under PHIPA, healthcare professionals, such as the school psychologist or speech-language pathologist are Health Information Custodians (HICs). The concept of “circle of care” allows for timely sharing of personal health information among HICs who are caring for the same individual. In these cases, implied consent is sufficient and understood to be of benefit to the individual receiving care. Thus, members of a healthcare team can share health information about a common patient/client, or in this case, a student, with implied consent. However, because the school team includes non-healthcare professionals such as teachers, educational assistants, social workers, etc., who are not HICs, health information cannot be shared amongst all team members. Further, under the Education Act, 1990, only supervisory officers and the principal and teachers of the school have access to the Ontario School Record (OSR) for the purpose of enhancing the instruction of the student. As health care professionals, care must be taken to ensure that consent has been obtained to share the health information with non-health team members and consent is needed to share the information from the OSR with the non-teaching team members.

    The healthcare professional is not required to personally obtain the required consent, however, it is advisable to ensure that this has in fact occurred. It is not unusual for a teacher to be unaware that this consent is required, given that consent to discuss students at team meetings is not required for teaching staff within the school system. 

     

LINKS

Circle of Care: Sharing Personal Heath Information for Health-Care Purposes (Ann Cavoukian, Privacy Commissioner Office, Ontario, Canada, September 2009)

Health Care Consent Act, S.O. 1996, c.2, Schedule A.

Personal Health Information Protection Act, 2004, S.O. 2004, c.3, Schedule A.

COLLEGE LINKS
Acupuncturists
Audiologists

Position Statement on the Disclosure of Test Materials and Data

Chiropodists
Chiropractors

Standard of Practice S-002: Record Keeping and Standard of Practice S-022: Ownership, Storage, Security and Destruction of Records of Personal Health Information

Dental Hygienists
Dental Technologists
Dentists

Practice Advisory – Change of Practice Ownership

 

Denturists
Dietitians

Health Consent Act - Dietetics 

Privacy Obligations

Record Keeping and Privacy Guidelines

Homeopaths
Kinesiologists
Massage Therapists
Medical Laboratory Technologists

CMLTO Professional Practice Learning Program (PPLP) “Professionalism and Collaboration” Learning Module

Medical Radiation Technologists

CMRTO Standards of Practice

What you must know about … Health Care Consent Act 

Midwives
Naturopaths
Nurses

Consent Practice Standard 

Consent Learning Module 

Confidentiality and Privacy Practice Standard 

Occupational Therapists

COTO Standards: Record Keeping

Privacy Legislation Guide

 

Opticians
Optometrists
Pharmacists

Expanded Scope of Practice Orientation Manual

Record Retention, Disclosure, and Disposal 

Pharmacy Technicians
Physicians and Surgeons

CPSO Policy Statement #8-05: Confidentiality of Personal Health Information

CPSO Policy Statement # 4-05: Consent to Medical Treatment

Physiotherapists

Briefing Note for Physiotherapists - Privacy Requirements in Ontario

Podiatrists
Psychologists
Psychotherapists
Respiratory Therapists

CRTO Standards of Practice: Accountability and Therapeutic and Professional Relationships 

Speech-Language Pathologists

Position Statement on the Disclosure of Test Materials and Data

Traditional Chinese Medicine and Acupuncturists