Disclosure of Personal Health Information

AuthorHalyna N. Perun; Michael Orr; Fannie Dimitriadis
Pages342-441
342
1 S.O. 2004, c. 3, Sch. A [PHIPA].
2PHIPA, s. 1(a).
3Ibid., s. 2 “disclose.” The term “disclose” is further discussed in Chapter 2, Section
E(4). As explained there, a transfer of information between a custodian and its agents,
or among agents of the custodian, is a use of the information and not a disclosure.
4 In the context of the requirement for consent, the word “patient” includes the
patient’s substitute decision-maker, where the substitute is authorized to act on the
patient’s behalf. For further details about substitute decision-making, see Chapter 6.
A. PHIPA’S DISCLOSURE RULES: INTRODUCTION
1) Generally
Among the purposes of the Personal Health Information Protection Act, 20041is
the establishment of rules for the disclosure of personal health information
about patients by health information custodians.2PHIPA defines the term
“disclose” to mean, in relation to personal health information in the custody or
under the control of a health information custodian or a person, “to make the
information available or to release it to another health information custodian
or to another person, but does not include to use the information.”3
The Act sets out the circumstances in which a health information custodi-
an may disclose personal health information about a patient, with or without
the patient’s consent.4
10 Disclosure of Personal
Health Information
As with the collection and use of personal health information, the general
rule in PHIPA is that a health information custodian requires consent to dis-
close personal health information.5However, the Act goes on to specify the cir-
cumstances in which a custodian may disclose personal health information
without the patient’s consent.6
2) Disclosure of Personal Health Information Collected Prior to
PHIPA
PHIPA applies to a health information custodian’s disclosure of personal
health information on or after the day the Act came into force, even if the cus-
todian collected the information before the Act came into force.7Therefore, any
disclosure of information about a patient that a health information custodian
makes on or after 1 November 2004, even if the information was collected
before that date, is subject to the rules in PHIPA.8
3) Where Another Law Prevents a Disclosure
Although PHIPA may permit a health information custodian to disclose per-
sonal health information in certain circumstances, another law may prohibit
the custodian from making the disclosure. In general, where there is such a
conflict between PHIPA or its regulations and another Act or its regulations,
PHIPA prevails, unless PHIPA, its regulations, or the other Act specifically
provide otherwise.9For example, the Occupational Health and Safety Act pro-
hibits all persons from disclosing any information obtained in any medical
examination, test or x-ray of a worker made or taken under that Act except in a
form calculated to prevent the information from being identified with a partic-
ular person or case.10 PHIPA amended that Act to make clear that the section
of the Occupational Health and Safety Act containing this provision prevails,
Disclosure of Personal Health Information 343
5PHIPA, s. 29(a).
6Ibid., ss. 29(b), 38–48, and 50.
7Ibid., s. 7(1)(b)(i).
8 Note, however, that PHIPA provides that the Act does not apply to personal health
information about an individual after the earlier of 120 years after the record contain-
ing the information was created or 50 years after the death of the individual: PHIPA,
s. 91(1).
9PHIPA, s. 7(2). Such a conflict exists under PHIPA, s. 7(3) when it is not possible to
comply with both provisions at the same time, or when PHIPA permits a collection, use,
or disclosure that another Act prohibits: O. Reg. 329/04, s. 1(5) [PHIPA Regulation].
10 R.S.O. 1990, c. O.1, s. 63(1)( f) [OHSA].
despite anything to the contrary in PHIPA.11 There are provisions in other
statutes that prevail over PHIPA.12 A health information custodian must be
aware of other law that applies to the custodian in making disclosures of per-
sonal health information under PHIPA to ensure compliance with both
PHIPA and the other law.
4) Authority to Disclose Records Obtained from Others
Where PHIPA permits a health information custodian to disclose a record of
personal health information, whether with or without the consent of the
patient to whom the information relates, the custodian may disclose the
record, in the circumstances authorized by PHIPA, even if the custodian did
not create the record. A custodian need not refer a person who seeks a disclo-
sure of personal health information to the person who created the record. Fur-
ther, PHIPA does not require a health information custodian to consult with
the person who created a record of personal health information prior to dis-
closing the record.13
5) Disclosure and Verification of Recipient
Prior to giving a patient access to his or her record of personal health informa-
tion in accordance with Part V of PHIPA, a health information custodian is
required first to take reasonable steps to be satisfied as to the patient’s identi-
344
11 Ibid., s. 63(6), as amended by PHIPA, s. 93.
12 Further exceptions to this principle, such as those set out in PHIPA Regulation, above
note 9, s. 5, are discussed in Chapter 3, Section B. Where a health information custo-
dian is also subject to the Freedom of Information and Protection and Privacy Act, R.S.O.
Act, R.S.O. 1990, c. M.56 [MFIPPA], such a custodian must also be aware that some
of the non-disclosure provisions of those Acts, such as the requirement not to disclose
Cabinet records under FIPPA, continue to apply. These provisions are outlined in
Chapter 3, Section C, Table A.
13 Where the record is only provided to the custodian on the condition that the custodi-
an not disclose it further without permission, one can argue that since PHIPA per-
mits a disclosure without reference to such a condition, a subsequent disclosure of
the record is authorized without seeking further permission, where PHIPA permits
the disclosure without consent. On the other hand, one could argue that since gener-
ally PHIPA only gives a custodian discretion with respect to disclosures, it is open to
the custodian to agree to conditions that may constrain that disclosure. Such a condi-
tion, however, could not act as a barrier to any required disclosure. Also, since patient
access is required by PHIPA, and not merely permitted, it is clear that such a condi-
tion cannot act as a barrier to patient access, unless the circumstances in PHIPA,
s. 52(1)(e)(iii) apply.

To continue reading

Request your trial

VLEX uses login cookies to provide you with a better browsing experience. If you click on 'Accept' or continue browsing this site we consider that you accept our cookie policy. ACCEPT