CONSENT AND THE PERSONAL HEALTH INFORMATION PROTECTION ACT, 2004

1
CONSENT AND THE PERSONAL HEALTH INFORMATION
PROTECTION ACT, 2004

• PHIPA Summit 2005
• November 3, 2005
• Halyna Perun, Counsel, Ministry of Health and
  Long-Term Care
• Mary Jane Dykeman, Legal Counsel
• Manuela Di Re, Counsel, Information Privacy
  Commissioner
• Notice This presentation should not be relied
  on as legal advice. Consult the legislation,
  regulations, and your legal counsel for
  information related to specific circumstances.

2
Fundamental Consent Provisions

• 1. A health information custodian shall not
  collect, use, or disclose personal health
  information unless
• Consent has been obtained and, to the best of
  the health information custodians knowledge,
  the collection, use or disclosure is necessary
  for a lawful purpose OR
• It is permitted or required by the Act
• Consent may be express or implied, except when
  the Act specifies that consent must be express
• Consent, whether express or implied, must satisfy
  the requirements of the Act
• (Sections 18 and 29)

3

• EXPRESS VERSUS
• IMPLIED CONSENT

4
Express Versus Implied Consent

• Consent may be express or implied, except when
  the Act specifies that consent must be express
• 2. Express consent (consent explicitly provided
  either orally or in writing) is required
• To disclose personal health information to a
  non-health information custodian (subject to
  exceptions)
• To disclose personal health information to
  another health information custodian for a
  purpose other than health care
• To collect, use or disclose personal health
  information for marketing or market research
• To collect, use or disclose personal health
  information for fundraising if use more than name
  and address
• (Section 18(3), 32 and 33)

5
Implied Consent for Health Care Purposes

• Implied consent is a consent a health information
  custodian concludes based on an individuals
  action or inaction in particular factual
  circumstances
• Consent may be implied
• To collect or use personal health information for
  any purpose (other than for fundraising where
  conditions of implied consent not met or for
  marketing)
• To disclose personal health information to
  another health information custodian for the
  purpose of providing or assisting in providing
  health care
• (Section 18(3), 32 and 33)

6
Assumed Implied Consent for Health Care Purposes

• GENERAL RULE
• Some health information custodians whose core
  function is the provision of health care may
  assume implied consent to the collection, use or
  disclosure of personal health information for the
  purpose of providing or assisting in providing
  health care if the health information custodian
  receives the information from another health
  information custodian, the individual or the
  individuals substitute decision maker
• EXCEPTION
• If the health information custodian is aware that
  the individual has withheld or withdrawn consent
• (Section 20(2))

7
Implied Consent for Non - Health Care Purposes

• A health information custodian may imply consent
  in the following situations for non-health care
  purposes
• To the disclosure of personal health information
  to representatives of religious or other
  organizations provided
• The individual is offered an opportunity to
  withhold or withdraw consent and
• The individual has not withheld or withdrawn
  consent
• 2. To the disclosure of personal health
  information by a pharmacist to a third party
  requested to provide payment to the pharmacist
  for medications or related goods or services
• 3. To collect, use or disclose the name and
  address of the individual or substitute decision
  maker (where applicable) for fundraising if
  section 10 of the Regulation is satisfied
• (Sections 20(4) and 32 and Section 8 of
  Regulation 329/04)

8

• REQUIREMENTS FOR
• VALID CONSENT

9
Requirements for Valid Consent

• Consent, whether express or implied, must
• Be the consent of the individual or his or her
  substitute decision maker (where applicable),
• Be knowledgeable, meaning it must be reasonable
  to believe that the individual knows
• The purpose of the collection, use or disclosure
  and
• That the individual may give or withhold consent
• Relate to the information, and
• Not be obtained by deception or coercion.
• (Section 18(1))

10
Notice of Purposes

• A health information custodian may rely on a
  notice of purposes to support the reasonable
  belief that the individual knows the purposes of
  the collection, use, or disclosure of personal
  health information
• If a health information custodian wishes to rely
  on a notice of purposes, the notice
• Must be posted where it is likely to come to the
  attention of the individual or must be provided
  to the individual
• Must outline the purposes for which the health
  information collects, uses or discloses personal
  health information and
• Should advise the individual that he or she has
  the right to give or withhold consent
• A Notice of Purposes is not required where a
  health information custodian may assume implied
  consent but it is a best practice to have a
  notice of purposes
• (Section 18(6))

11
Assumption of Validity of Consent

• Where consent is obtained or a document is
  received purporting to record consent to the
  collection, use or disclosure of personal health
  information, a health information custodian is
  entitled to assume that
• the consent fulfils the requirements of the Act
  and
• the individual has not withdrawn the consent
• unless it is not reasonable to assume so
• Consent to collection, use or disclosure of
  personal health information given before
  November 1, 2004 is valid if it meets the
  requirements for consent in the Act
• (Sections 18(7) and 20(1))

12

• WHO MAY CONSENT
• ON BEHALF OF AN INDIVIDUAL

13
Consent and Capable Individuals

• 1. Where an individual is capable, consent may be
  provided by
• the individual, or
• if the individual is sixteen or older, any
  capable person sixteen years of age or older
  authorized in writing by the individual to
  provide consent on his or her behalf
• An individual is capable if he or she is able to
  
• Understand information relevant to deciding
  whether to consent and
• Appreciate the reasonably foreseeable
  consequences of giving, not giving, withholding
  or withdrawing consent
• Individuals are presumed capable regardless of
  age unless there are reasonable grounds to
  believe otherwise
• (Sections 21(1), 21(4) and 23(1))

14
Consent and Incapable Individuals

• Where an individual is incapable, the following
  persons (in the following order of priority) may
  consent
• A substitute decision-maker under the Health
  Care Consent Act with respect to consent
  necessary for or ancillary to a decision about
  treatment, long-term care admission or a
  personal assistance service
• Guardian of the person or guardian of property
  (with authority)
• Attorney for personal care or attorney for
  property (with authority)
• Representative appointed by the Consent and
  Capacity Board
• Spouse or partner
• Child or custodial parent (subject to
  exceptions)
• Parent with only a right of access
• Brother or sister
• Any other relative or
• Public Guardian and Trustee (as a last resort).
• (Sections 26(1) and 26(11))

15
Consent and Deceased Individuals

• Where an individual is deceased, consent may be
  provided by
• The estate trustee or
• If there is no estate trustee, the person
  responsible for administering the estate
• (Section 23(1) 4)

16
Consent and Children

• If a child is capable, the child may consent
• If a child is capable and 16 or older the child
  may authorize another capable person who is at
  least 16 years old to provide consent on his or
  her behalf provided it is in writing
• If a child is capable and less than 16, a
  custodial parent, Childrens Aid Society or
  person lawfully entitled to stand in the place of
  a parent may consent EXCEPT
• If the personal health information relates to
  treatment about which the child has made a
  decision on his or her own pursuant to Health
  Care Consent Act, 1996
• If the personal health information relates to
  counselling in which child participated on his or
  her own under the Child and Family Services Act
• In event of conflict, the decision of the
  capable child prevails
• 4. If a child is incapable, the same persons who
  may consent for an incapable individual can
  consent for an incapable child

17
Reliance on Assertions

• Unless unreasonable in the circumstances, a
  health information custodian may rely on the
  accuracy of an assertion made by a person that
• the person is entitled to consent to the
  collection, use or disclosure of personal health
  information of the individual
• the person is over the age of sixteen
• the person is not prohibited by a court order or
  separation agreement from having access to the
  individual
• No other person ranked higher or equally exists
  or if they exist, they would not object to the
  person making the decision
• (Section 71(4))

18

• WITHDRAWING CONSENT AND EXPRESS INSTRUCTIONS

19
Meaning of the Term Lock Box

• Lock Box is not a defined term in the Act
• It is generally used to mean the qualified right
  of an individual to
• Withdraw consent to the collection, use and
  disclosure of personal health information
  pursuant to section 19 (1), including for the
  provision of health care or
• Provide an express instruction not to use or
  disclose personal health information for
  purposes of providing health care in
  circumstances (generally without consent) set
  out in sections 37(1)(a), 38(1)(a) and 50(1)(e)
  of the Act

20
Delay in Implementation

• Effective November 1, 2004, individuals are
  entitled to withdraw consent to the collection,
  use and disclosure of personal health
  information, including for health care purposes
• Extension to November 1, 2005, granted to public
  hospitals only with respect to express
  instructions
• Related to uses of personal health information
  where the information was collected pursuant to
  section 36(1)(b) because it was reasonably
  necessary for the provision of health care
  (section 37(1)(a))
• Related to disclosures of personal health
  information to certain health information
  custodians without consent that are reasonably
  necessary for the provision of health care
  (section 38(1)(a))
• Related to disclosures of personal health
  information to persons outside Ontario without
  consent that are reasonably necessary for the
  provision of health care (section 50(1)(e)).

21
Duties Arising From Lock Box Requests

• 1. A health information custodian must comply
  with a withdrawal of consent or an express
  instruction (subject to exceptions)
• 2. Compliance may be achieved through
• Policies, procedures or manual processes
• Electronic or technological means or
• Combination of the above
• 3. Where a health information custodian is
  prevented from disclosing to certain other
  health information custodians personal health
  information that is believed to be reasonably
  necessary for the purpose of providing health
  care
• The disclosing health information custodian must
  notify the other health information custodian of
  that fact and
• The receiving health information custodian may
  explore the matter with the individual and seek
  consent to access the locked information
• (Sections 20(3) and 38(2))

22
Inapplicability of Lock Box

• A health information custodian must comply with a
  withdrawal of consent or an express instruction
  unless
• The individual changes his or her mind,
• The Act permits the collection, use or
  disclosure to be made without consent, except
• uses where the personal health information was
  collected with or without consent because the
  collection was reasonably necessary for the
  provision of health care (section 37(1)(a))
• disclosures to certain health information
  custodians without consent that are reasonably
  necessary for the provision of health care
  (section 38(1)(a))
• disclosures to persons outside Ontario without
  consent that are reasonably necessary for the
  provision of health care (section 50(1)(e)).

23

• PERMITTED INDIRECT COLLECTION WITHOUT CONSENT

24
Permitted Indirect Collections Without Consent

• Permitted in certain circumstances, such as
  where
• It is reasonably necessary for providing health
  care and it is not reasonably possible to collect
  personal health information
• that can reasonably be relied on as accurate
  directly from the individual
• directly from the individual in a timely manner
• It is collected by a health information custodian
  who is a FIPPA/ MFIPPA institution for purposes
  of conducting a proceeding, investigating a
  breach of agreement or law or its statutory
  function
• The Information and Privacy Commissioner
  authorizes another manner of collection
• It is collected from a person permitted or
  required by law to disclose it to the health
  information custodian
• The health information custodian is permitted or
  required by law to collect the personal health
  information indirectly

25

• PERMITTED USES
• WITHOUT CONSENT

26
Permitted Uses Without Consent

• Permitted in certain circumstances, such as
• For purposes for which it was collected and for
  all functions reasonably necessary for carrying
  out that purpose (unless collected with consent
  or under section 36(1) (b) and the individual
  expressly instructs otherwise)
• Planning or delivering health programs or
  services
• Obtaining payment, processing, monitoring,
  verifying or reimbursing claims for payment
• Risk or error management to improve or maintain
  the quality of programs or services

27
Permitted Uses Without Consent (Continued)

• 5. Educating agents to provide health care
• For a proceeding or contemplated proceeding in
  which the health information custodian or agent
  is a party or witness if it relates to a matter
  at issue
• Uses permitted or required by law
• Research provided the following conditions are
  met
• A research plan prepared
• The research approved by research ethics board
  and
• The researcher agrees to comply with the Act.

28

• PERMITTED DISCLOSURES
• WITHOUT CONSENT

29
Permitted Disclosures Without Consent

• Permitted in certain circumstances, such as
• To certain health information custodians when
  reasonably necessary for providing health care
  and cannot obtain timely consent (unless
  individual expressly instructs otherwise)
• To enable the Minister or another health
  information custodian to determine or provide
  funding or payment to the health information
  custodian for the provision of health care
• Where reasonable grounds to believe disclosure is
  necessary to eliminate or reduce a significant
  risk of serious bodily harm
• For a proceeding or contemplated proceeding in
  which the health information custodian or agent
  is a party or witness if it relates to a matter
  at issue
• To comply with summons, court order or similar
  requirement

30
Permitted Disclosures Without Consent (Continued)

• 6. To a researcher for research purposes
  provided
• Receive a written application
• Receive a research plan that satisfies the Act
• Receive a copy of the Research Ethics Board
  decision
• Enter into an agreement with the researcher that
  satisfies the Act
• 7. To a person carrying out an inspection,
  investigation or procedure authorized by warrant
  or by law
• 8. To the Chief Medical Officer of Health or a
  Medical Officer of Health for Health Protection
  and Promotion Act purposes
• 9. To a regulatory college for purposes of
  enforcement of the Drug and Pharmacies Regulation
  Act, Regulated Health Professions Act, 1991 or an
  Act mentioned in Schedule 1 to the Regulated
  Health Professions Act, 1991
• 10. Where permitted or required by law

31
Permitted Disclosures Without Consent (Continued)

• To the Public Guardian and Trustee, Childrens
  Lawyer or Childrens Aid Society so that they can
  carry out their statutory functions
• A health information custodian that is a facility
  that provides health may disclose to a person
• the fact that an individual is a patient or
  resident
• the individuals general health status described
  as critical, poor, fair, stable or satisfactory
  and
• the location of the individual in a facility
• Provided the individual was offered, at the first
  reasonable
• opportunity, the ability to object and did not do
  so

32
Tools and Resources

• Tools and resources available on the Information
  and Privacy Commissioner website at
  www.ipc.on.ca
• Frequently Asked Questions Personal Health
  Information Protection Act
• Guide to the Personal Health Information
  Protection Act
• Lock-box Fact Sheet
• Consent and Form 14 Fact Sheet
• Ontario Poison Information Centres and the
  Circle of Care Fact Sheet
• Disclosure of Information in Emergency/Urgent
  Circumstances Fact Sheet
• Frequently Asked Questions Health Cards and
  Health Numbers
• Reporting Requests under PHIPA Fact Sheet
• Fundraising under PHIPA Fact Sheet
• Safeguarding Personal Health Information Fact
  Sheet
• Link to website of Ministry of Health and Long
  Term Care www.health.gov.on.ca