Use of Personal Health Information
| Author | Halyna N. Perun; Michael Orr; Fannie Dimitriadis |
| Pages | 313-341 |
A.
PHIPA
’S USE RULES: INTRODUCTION
1) Generally
Among the purposes of the Personal Health Information Protection Act, 20041is
the establishment of rules for the use of personal health information about
patients by health information custodians.2PHIPA defines “use” to mean, in
relation to personal health information in the custody or control of a health
information custodian, to handle or deal with the information, but does not
include disclosure of the information.3For the purposes of PHIPA, the provi-
sion of personal health information between a health information custodian
and an agent of the custodian is a use by the custodian, and not a disclosure by
the person providing the information or a collection by the person to whom the
information is provided.4Where a custodian may use personal health informa-
tion, the custodian also may provide the information to the custodian’s agents,
who may use the information for that purpose on behalf of the custodian.5
313
1 S.O. 2004, c. 3, Sch. A [PHIPA].
2PHIPA, s. 1(a).
3Ibid., s. 2, definition of “use.”
4Ibid., s. 6(1). The term “use” is further discussed in Chapter 2, Section E(3).
5Ibid., s. 37(2).
9Use of Personal Health
Information
The Act sets out the circumstances in which a health information custodi-
an may use personal health information about a patient, whether with or with-
out the patient’s consent.6As with the collection and disclosure of personal
health information, the general rule in PHIPA is that a health information cus-
todian requires consent to use personal health information.7The Act goes on
to specify, however, the circumstances in which a custodian may use personal
health information without the patient’s consent.8
2) Change of Approach
The requirement for a health information custodian to have statutory authori-
ty to use personal health information is a change in the law in many settings.
Until the advent of PHIPA, legislation applicable to the health care sector in
Ontario typically did not require health care providers to seek consent for uses
of personal health information. Further, health sector legislation generally did
not specify the circumstances in which a patient’s information could be used
without the patient’s consent.9
Guide to the Ontario Personal Health Information Protection Act
314
6 In the context of the requirement for consent, the word “patient” includes the
patient’s substitute decision-maker, where the substitute is authorized to act on the
patient’s behalf. For further details about substitute decision-making, see Chapter 6.
7PHIPA, s. 29(a).
8Ibid., ss. 29(b) and 37(1).
9 Legislation pertaining to the Ministry of Health and Long-Term Care, for example,
generally has authorized a “use” of personal health information, collected directly or
indirectly from the individual, for specified purposes: see, for example, the Indepen-
the Long-Term Care Act, 1994, S.O. 1994, c. 26 [LTCA] and the Mental Health Act,
R.S.O. 1990, c. M.7 [MHA] dealt with “disclosures” and not “uses” (most of these per-
missible disclosure provisions have been repealed by PHIPA); also, professional mis-
conduct rules under health-profession-specific statutes make it a professional
misconduct for health professionals to disclose patient or client information without
consent. Given that “disclosure” in some circumstances covered what is now “use” in
PHIPA, such as where a health information custodian consults with his or her lawyer,
it is not to say that there were no rules about use in those settings where legislation
for disclosure of patient information existed; however, legislation was typically silent
about using patient information for record keeping, improvement of services, or shar-
ing information with the custodian’s insurer or lawyer — the kinds of permissible
uses without consent that are specifically set out now in PHIPA.
To continue reading
Request your trial