How PHIPA Works with Other Law

AuthorHalyna N. Perun; Michael Orr; Fannie Dimitriadis
To implement the rules set out in the Personal Health Information Protection
Act,1it is important for custodians and others to understand how the provi-
sions in PHIPA relate to provisions in other legislation. This chapter discuss-
es the interaction between PHIPA and
other legislation and law generally, especially health sector legislation;
Ontario’s public sector privacy legislation,2a matter of special interest for those
health information custodians that are also subject to that legislation; and
the federal private sector privacy legislation,3a matter of special interest for
any non-governmental health information custodians engaged in commer-
cial activities.
1 S.O. 2004, c. 3, Sch. A [PHIPA].
2 Ontario’s public sector access to information and protection of privacy legislation is
c. M.56 [MFIPPA].
3Personal Information Protection and Electronic Documents Act, S.C. 2000, c. 5 [PIPEDA].
3How PHIPA Works
with Other Law
1) Two Fundamental Policy Objectives
PHIPA’s interaction with other legislation generally reflects a balance between
two fundamental policy objectives: a consistent privacy framework across the
health sector and the preservation of special rules applicable to certain activi-
ties in parts of the health sector.
a) Uniform Sector-wide Rules
PHIPA aims to provide uniform and consistent rules across the health sector,
rather than a patchwork of different rules.4This objective is embodied in the rule
set out in the Act that, in the event of a conflict between PHIPA and any other
legislation, PHIPA prevails, subject to certain exceptions discussed below.5For
this reason, PHIPA included a number of complementary amendments to
health sector legislation to ensure consistency with PHIPA’s approach.6
b) Existing Special Rules Preserved
Second, in addition to providing uniform rules that apply to the whole health
sector, PHIPA aims to allow the continuing functioning of special rules partic-
ular to specific parts of the health sector. The most important example of this
4 Health Minister George Smitherman explained it: “Currently there are no consistent
rules covering what information can be collected, and how that information can be
used and disclosed. Existing laws that deal with health information apply in some
health care settings and not in others. This legislation addresses those problems. This
legislation begins to treat our health care system as a system, not just parts of it; all
parts of it are covered.” Ontario, Legislative Assembly, Official Report of Debates
(Hansard), (30 March 2004).
5PHIPA, s. 7(2). See Section B(2) below.
6 For example, sector-specific provisions relating to disclosures of personal health infor-
mation were generally removed from the Mental Health Act, R.S.O. 1990, c. M.7
[MHA] and Long-Term Care Act, 1994, S.O. 1994, c. 26 [LTCA], as were patients’ access
and correction rights under those statutes. Other provisions were added (PHIPA, s.
89 amending the LTCA; PHIPA, s. 90 amending MHA). Further, the three long-term
care facility statutes, the Nursing Homes Act, R.S.O. 1990, c. N.6 [NHA], the Charitable
Institutions Act, R.S.O. 1990, c. C.9 [CIA], and the Homes for the Aged and Rest Homes
Act, R.S.O. 1990, c. H.13 [HARHA] were amended for consistency with PHIPA:
PHIPA, ss. 77, 87, & 92. Regulations under health sector legislation were also modi-
fied for consistency with PHIPA and its regulation; for example, several provisions
that authorized disclosures of a medical record without consent in certain circum-
stances were removed from Hospital Management, R.R.O. 1990, Reg. 965, made
under the Public Hospitals Act, R.S.O. 1990, c. P.40 and from General, O. Reg. 57/92,
made under the Independent Health Facilities Act, R.S.O. 1990, c. I.3.
are the provisions that collections, uses, or disclosures permitted under other
laws without consent continue to be permitted under PHIPA without consent.7
Each of these two fundamental policy aspects of PHIPA will be discussed
in turn.
2) PHIPA Prevails over Other Ontario Legislation
As a general rule, in the event of conflict between a provision of PHIPA,
including its regulations, and a provision of any other Ontario legislation or
regulations, the provision of PHIPA or its regulation prevails; that is, one must
follow the PHIPA provision.8
This rule only applies, however, where it is not possible to comply with
both provisions at the same time.9If it is possible to comply with both provi-
sions, one must do so. For example, if a health information custodian is
required under other legislation to retain records for a lesser period of time
than that required by PHIPA10 (without requiring the record to be destroyed
after that time), one complies with both provisions by keeping the record for a
longer period; that is, complying with the more stringent standard.
The PHIPA Regulation clarifies this rule. It provides that where PHIPA or
its regulations permits a collection, use, or disclosure (or other action), and
another act or regulation forbids the collection, use, or disclosure, this is con-
sidered a situation where “it is not possible to comply with both” provisions,
and hence the PHIPA provisions take precedence, overriding the provision in
the other act or regulation.11 Therefore it appears that collections, uses, or dis-
How PHIPA Works with Other Law 113
7 Regarding collections of personal health information, see s. 36(1)(h), and note (g).
Regarding uses, see s. 37(1)(k). Regarding disclosures, see s. 43(1)(h). See further Chapter
8, Section C(7) & (8); Chapter 9, Section C(12); and Chapter 10, Section P. It is notewor-
thy that all of these are subject to any requirements and restrictions that may be pre-
scribed, allowing existing collections, uses, and disclosures to be narrowed or subject to
additional requirements by means of regulations under PHIPA. See Chapter 16 on
PHIPA Regulations. No such regulations have been put forward as of the date of writing.
8PHIPA, s. 7(2). The rationale for this may be that given the broad scope of PHIPA, it
was not possible to be confident that all statutory provisions that could possibly regu-
late the conduct of health information custodians for the collection, use, or disclosure
of personal health information, and other matters covered by PHIPA, were being
updated to repeal conflicting provisions, though it appears that an attempt was made
to do this.
9 This is implicit in the terms of PHIPA, s. 7(2) and is also made explicit in s. 7(3).
10 Currently PHIPA does not have regulations setting a fixed retention period, but
records that are subject to an access request are required to be retained until the
request and any associated appeals or processes are exhausted: PHIPA, s. 13(2).
11 General, O. Reg. 329/04, s. 1(5) [PHIPA Regulation].

To continue reading

Request your trial

VLEX uses login cookies to provide you with a better browsing experience. If you click on 'Accept' or continue browsing this site we consider that you accept our cookie policy. ACCEPT