Patient confidentiality

This act governs health care information privacy in Ontario. It is defined as the client’s right to control how his/her personal health information is collected, used and disclosed. PHIPA permits the sharing of personal health information amongst health care team members to facilitate efficient and effective care. PHIPA requires that personal health information be kept confidential and secure.

In many cases, posting a notice or providing a brochure that describes the purposes for the collection, use and disclosure of PHI fulfills implied consent. 

Consent can be obtained verbally or in written form.  It may be provided over the telephone or electronically; however, express consent that is written helps avoid ambiguity.  Express consent is required in the following situations:

• Personal health information is to be disclosed outside of the health care team.
• Information is to be disclosed for purposes other than providing or helping to provide care.
• Personal health information is used for fundraising.
• Personal information is being collected for marketing research or marketing activities.

With informed consent the health care practitioner has to not only explain what consent is about and what it is the client is consenting to, but he/she has a duty to ensure that the client has understood and that he can appreciate the consequences of the decision. 

If a client cannot provide consent, then a substitute decision-maker may make decisions and provide health information.  Rules for who may act as a SDM vary if the client is in hospital or if he/she is in the community.  In the community, the SDM of 1992 has set determinants for power of attorney; guardianship and the levels are different whether it is for personal property or personal care.  In hospital, the next of kin (parent, sibling, family member) is usually the person to provide alternate consent, as per the Health care consent act (1996).

Disclosure is defined as making information available or releasing it to another person or service.  Express consent is needed in this case. As such, consent is required for releasing confidential information to family members or anyone else except where other legislation requires or permits the release of information.

Professional misconduct is considered as giving information about a client to a person other than the client or his/her authorized representative, except with the consent of the client or his/her representative, or as required or allowed by law.