How PHIPA Works with Other Law

• Author: Halyna N. Perun; Michael Orr; Fannie Dimitriadis
• Pages: 111-147

A. GENERALLY

To implement the rules set out in the Personal Health Information Protection

Act,1it is important for custodians and others to understand how the provi-

sions in PHIPA relate to provisions in other legislation. This chapter discuss-

es the interaction between PHIPA and

• other legislation and law generally, especially health sector legislation;

• Ontario’s public sector privacy legislation,2a matter of special interest for those

health information custodians that are also subject to that legislation; and

• the federal private sector privacy legislation,3a matter of special interest for

any non-governmental health information custodians engaged in commer-

cial activities.

111

1 S.O. 2004, c. 3, Sch. A [PHIPA].

2 Ontario’s public sector access to information and protection of privacy legislation is

the Freedom of Information and Protection of Privacy Act, R.S.O. 1990, c. F.31 [FIPPA]

and the Municipal Freedom of Information and Protection of Privacy Act, R.S.O. 1990,

c. M.56 [MFIPPA].

3Personal Information Protection and Electronic Documents Act, S.C. 2000, c. 5 [PIPEDA].

3How PHIPA Works

with Other Law

B. INTERACTION WITH OTHER LEGISLATION GENERALLY

1) Two Fundamental Policy Objectives

PHIPA’s interaction with other legislation generally reflects a balance between

two fundamental policy objectives: a consistent privacy framework across the

health sector and the preservation of special rules applicable to certain activi-

ties in parts of the health sector.

a) Uniform Sector-wide Rules

PHIPA aims to provide uniform and consistent rules across the health sector,

rather than a patchwork of different rules.4This objective is embodied in the rule

set out in the Act that, in the event of a conflict between PHIPA and any other

legislation, PHIPA prevails, subject to certain exceptions discussed below.5For

this reason, PHIPA included a number of complementary amendments to

health sector legislation to ensure consistency with PHIPA’s approach.6

b) Existing Special Rules Preserved

Second, in addition to providing uniform rules that apply to the whole health

sector, PHIPA aims to allow the continuing functioning of special rules partic-

ular to specific parts of the health sector. The most important example of this

Guide to the Ontario Personal Health Information Protection Act

112

4 Health Minister George Smitherman explained it: “Currently there are no consistent

rules covering what information can be collected, and how that information can be

used and disclosed. Existing laws that deal with health information apply in some

health care settings and not in others. This legislation addresses those problems. This

legislation begins to treat our health care system as a system, not just parts of it; all

parts of it are covered.” Ontario, Legislative Assembly, Official Report of Debates

(Hansard), (30 March 2004).

5PHIPA, s. 7(2). See Section B(2) below.

6 For example, sector-specific provisions relating to disclosures of personal health infor-

mation were generally removed from the Mental Health Act, R.S.O. 1990, c. M.7

[MHA] and Long-Term Care Act, 1994, S.O. 1994, c. 26 [LTCA], as were patients’ access

and correction rights under those statutes. Other provisions were added (PHIPA, s.

89 amending the LTCA; PHIPA, s. 90 amending MHA). Further, the three long-term

care facility statutes, the Nursing Homes Act, R.S.O. 1990, c. N.6 [NHA], the Charitable

Institutions Act, R.S.O. 1990, c. C.9 [CIA], and the Homes for the Aged and Rest Homes

Act, R.S.O. 1990, c. H.13 [HARHA] were amended for consistency with PHIPA:

PHIPA, ss. 77, 87, & 92. Regulations under health sector legislation were also modi-

fied for consistency with PHIPA and its regulation; for example, several provisions

that authorized disclosures of a medical record without consent in certain circum-

stances were removed from Hospital Management, R.R.O. 1990, Reg. 965, made

under the Public Hospitals Act, R.S.O. 1990, c. P.40 and from General, O. Reg. 57/92,

made under the Independent Health Facilities Act, R.S.O. 1990, c. I.3.

are the provisions that collections, uses, or disclosures permitted under other

laws without consent continue to be permitted under PHIPA without consent.7

Each of these two fundamental policy aspects of PHIPA will be discussed

in turn.

2) PHIPA Prevails over Other Ontario Legislation

As a general rule, in the event of conflict between a provision of PHIPA,

including its regulations, and a provision of any other Ontario legislation or

regulations, the provision of PHIPA or its regulation prevails; that is, one must

follow the PHIPA provision.8

This rule only applies, however, where it is not possible to comply with

both provisions at the same time.9If it is possible to comply with both provi-

sions, one must do so. For example, if a health information custodian is

required under other legislation to retain records for a lesser period of time

than that required by PHIPA10 (without requiring the record to be destroyed

after that time), one complies with both provisions by keeping the record for a

longer period; that is, complying with the more stringent standard.

The PHIPA Regulation clarifies this rule. It provides that where PHIPA or

its regulations permits a collection, use, or disclosure (or other action), and

another act or regulation forbids the collection, use, or disclosure, this is con-

sidered a situation where “it is not possible to comply with both” provisions,

and hence the PHIPA provisions take precedence, overriding the provision in

the other act or regulation.11 Therefore it appears that collections, uses, or dis-

How PHIPA Works with Other Law 113

7 Regarding collections of personal health information, see s. 36(1)(h), and note (g).

Regarding uses, see s. 37(1)(k). Regarding disclosures, see s. 43(1)(h). See further Chapter

8, Section C(7) & (8); Chapter 9, Section C(12); and Chapter 10, Section P. It is notewor-

thy that all of these are subject to any requirements and restrictions that may be pre-

scribed, allowing existing collections, uses, and disclosures to be narrowed or subject to

additional requirements by means of regulations under PHIPA. See Chapter 16 on

PHIPA Regulations. No such regulations have been put forward as of the date of writing.

8PHIPA, s. 7(2). The rationale for this may be that given the broad scope of PHIPA, it

was not possible to be confident that all statutory provisions that could possibly regu-

late the conduct of health information custodians for the collection, use, or disclosure

of personal health information, and other matters covered by PHIPA, were being

updated to repeal conflicting provisions, though it appears that an attempt was made

to do this.

9 This is implicit in the terms of PHIPA, s. 7(2) and is also made explicit in s. 7(3).

10 Currently PHIPA does not have regulations setting a fixed retention period, but

records that are subject to an access request are required to be retained until the

request and any associated appeals or processes are exhausted: PHIPA, s. 13(2).

11 General, O. Reg. 329/04, s. 1(5) [PHIPA Regulation].