Disclosure of Personal Health Information

• Author: Halyna N. Perun; Michael Orr; Fannie Dimitriadis
• Pages: 342-441

342

1 S.O. 2004, c. 3, Sch. A [PHIPA].

2PHIPA, s. 1(a).

3Ibid., s. 2 “disclose.” The term “disclose” is further discussed in Chapter 2, Section

E(4). As explained there, a transfer of information between a custodian and its agents,

or among agents of the custodian, is a use of the information and not a disclosure.

4 In the context of the requirement for consent, the word “patient” includes the

patient’s substitute decision-maker, where the substitute is authorized to act on the

patient’s behalf. For further details about substitute decision-making, see Chapter 6.

A. PHIPA’S DISCLOSURE RULES: INTRODUCTION

1) Generally

Among the purposes of the Personal Health Information Protection Act, 20041is

the establishment of rules for the disclosure of personal health information

about patients by health information custodians.2PHIPA defines the term

“disclose” to mean, in relation to personal health information in the custody or

under the control of a health information custodian or a person, “to make the

information available or to release it to another health information custodian

or to another person, but does not include to use the information.”3

The Act sets out the circumstances in which a health information custodi-

an may disclose personal health information about a patient, with or without

the patient’s consent.4

10 Disclosure of Personal

Health Information

As with the collection and use of personal health information, the general

rule in PHIPA is that a health information custodian requires consent to dis-

close personal health information.5However, the Act goes on to specify the cir-

cumstances in which a custodian may disclose personal health information

without the patient’s consent.6

2) Disclosure of Personal Health Information Collected Prior to

PHIPA

PHIPA applies to a health information custodian’s disclosure of personal

health information on or after the day the Act came into force, even if the cus-

todian collected the information before the Act came into force.7Therefore, any

disclosure of information about a patient that a health information custodian

makes on or after 1 November 2004, even if the information was collected

before that date, is subject to the rules in PHIPA.8

3) Where Another Law Prevents a Disclosure

Although PHIPA may permit a health information custodian to disclose per-

sonal health information in certain circumstances, another law may prohibit

the custodian from making the disclosure. In general, where there is such a

conflict between PHIPA or its regulations and another Act or its regulations,

PHIPA prevails, unless PHIPA, its regulations, or the other Act specifically

provide otherwise.9For example, the Occupational Health and Safety Act pro-

hibits all persons from disclosing any information obtained in any medical

examination, test or x-ray of a worker made or taken under that Act except in a

form calculated to prevent the information from being identified with a partic-

ular person or case.10 PHIPA amended that Act to make clear that the section

of the Occupational Health and Safety Act containing this provision prevails,

Disclosure of Personal Health Information 343

5PHIPA, s. 29(a).

6Ibid., ss. 29(b), 38–48, and 50.

7Ibid., s. 7(1)(b)(i).

8 Note, however, that PHIPA provides that the Act does not apply to personal health

information about an individual after the earlier of 120 years after the record contain-

ing the information was created or 50 years after the death of the individual: PHIPA,

s. 91(1).

9PHIPA, s. 7(2). Such a conflict exists under PHIPA, s. 7(3) when it is not possible to

comply with both provisions at the same time, or when PHIPA permits a collection, use,

or disclosure that another Act prohibits: O. Reg. 329/04, s. 1(5) [PHIPA Regulation].

10 R.S.O. 1990, c. O.1, s. 63(1)( f) [OHSA].

despite anything to the contrary in PHIPA.11 There are provisions in other

statutes that prevail over PHIPA.12 A health information custodian must be

aware of other law that applies to the custodian in making disclosures of per-

sonal health information under PHIPA to ensure compliance with both

PHIPA and the other law.

4) Authority to Disclose Records Obtained from Others

Where PHIPA permits a health information custodian to disclose a record of

personal health information, whether with or without the consent of the

patient to whom the information relates, the custodian may disclose the

record, in the circumstances authorized by PHIPA, even if the custodian did

not create the record. A custodian need not refer a person who seeks a disclo-

sure of personal health information to the person who created the record. Fur-

ther, PHIPA does not require a health information custodian to consult with

the person who created a record of personal health information prior to dis-

closing the record.13

5) Disclosure and Verification of Recipient

Prior to giving a patient access to his or her record of personal health informa-

tion in accordance with Part V of PHIPA, a health information custodian is

required first to take reasonable steps to be satisfied as to the patient’s identi-

Guide to the Ontario Personal Health Information Protection Act

344

11 Ibid., s. 63(6), as amended by PHIPA, s. 93.

12 Further exceptions to this principle, such as those set out in PHIPA Regulation, above

note 9, s. 5, are discussed in Chapter 3, Section B. Where a health information custo-

dian is also subject to the Freedom of Information and Protection and Privacy Act, R.S.O.

1990, c. F.31 [FIPPA], or the Municipal Freedom of Information and Protection of Privacy

Act, R.S.O. 1990, c. M.56 [MFIPPA], such a custodian must also be aware that some

of the non-disclosure provisions of those Acts, such as the requirement not to disclose

Cabinet records under FIPPA, continue to apply. These provisions are outlined in

Chapter 3, Section C, Table A.

13 Where the record is only provided to the custodian on the condition that the custodi-

an not disclose it further without permission, one can argue that since PHIPA per-

mits a disclosure without reference to such a condition, a subsequent disclosure of

the record is authorized without seeking further permission, where PHIPA permits

the disclosure without consent. On the other hand, one could argue that since gener-

ally PHIPA only gives a custodian discretion with respect to disclosures, it is open to

the custodian to agree to conditions that may constrain that disclosure. Such a condi-

tion, however, could not act as a barrier to any required disclosure. Also, since patient

access is required by PHIPA, and not merely permitted, it is clear that such a condi-

tion cannot act as a barrier to patient access, unless the circumstances in PHIPA,

s. 52(1)(e)(iii) apply.