An RP or organization may collect, use, or disclose a person’s personal health information only if the person consents or if the collection, use, or disclosure is otherwise permitted or required by law. A registrant should collect, use, or disclose no more information than is reasonably required in the circumstances.
Under PHIPA, collection, use, and disclosure of personal health information is permitted without consent in the following limited circumstances:
1. Disclosure to Other Healthcare Providers
Under PHIPA, RPs may assume that they have a client’s implied consent to disclose personal health information to the client’s other health providers unless the client instructs otherwise.* For example, in circumstances where it is necessary to provide care to an individual, but not reasonably possible to obtain consent in a timely manner, the client’s health information may be shared with other providers. However, to avoid misunderstandings, many practitioners do not disclose information to other providers without the client’s explicit consent, except in emergencies. Caution is particularly important where the information is sensitive.
Despite the circumstances in which sharing a client’s personal health information is permitted, when a client or client’s substitute decision-maker says that they do not want information to be shared, the information cannot be disclosed unless another provision in PHIPA permits it, e.g., to prevent a significant risk of serious harm.**
2. Disclosure to Members of the Client’s Family
Generally speaking, RPs must obtain consent before disclosing personal health information to members of a client’s family. However, personal health information may be disclosed in emergencies. It may also be disclosed for the purpose of contacting family members, friends, or other persons who may be potential substitute decision-makers, if the individual is injured, incapacitated, or ill, and not able to provide consent. This may be particularly relevant for registrants working in acute care settings.
3. Disclosure Related to Risk
An RP may disclose a client’s personal health information if the RP believes on reasonable grounds that disclosure is necessary to eliminate or reduce a significant risk of serious bodily harm to the person or anyone else.***
4. Missing Persons Act
Ontario’s Missing Persons Act, 2018 allows a police officer to require anyone to produce records for the purpose of locating a missing person. This power does not involve criminal investigations but is meant to ensure the safety of missing persons. The Act has several safeguards, including the following:
- An officer must have reasonable grounds before making an urgent demand for records, and they must use a specific form.
- If the officer agrees, the person with the relevant information may provide it orally instead of providing written records.
- Police officers must report their use of urgent demands for records within their police department.
- Police departments must report annually on their use of urgent demands for information to locate missing persons.
- The Minister of Community Safety and Correctional Services must review the Act within five years.
5. Disclosure under Other Laws or for Legal Proceedings
PHIPA allows disclosure of personal health information under other laws or for the purpose of a legal proceeding. For example, PHIPA permits disclosure of personal health information to CRPO if this information is required in a College process such as a complaint investigation or the Quality Assurance Program.
Disclosure of personal health information is permitted or required by many other Acts, including the following:
- The Healthcare Consent Act, 1996 (HCCA) or Substitute Decisions Act allow disclosure for the purposes of determining, assessing, or confirming capacity.
- Various Acts deal with compensation or benefits for injury or disability, e.g., workplace injury, social benefits, or motor vehicle accidents. If a client needs to prove the nature or extent of their disability, injury, or recovery, registrants may be requested or required to provide health information about the client.
- Disclosure to an investigator or inspector is permitted when authorized by a warrant, or by any provincial or federal law, for the purpose of complying with the warrant or facilitating the investigation or inspection.
Additionally, as discussed under Standard 1.3: Mandatory Reports, there are some circumstances in which disclosure of personal health information is required.
*Section 20(2). The IPC refers to this as the “circle of care”. See Information and Privacy Commissioner of Ontario, Circle of Care: Sharing Personal Health Information for Health-Care Purposes (2015): online:
https://www.ipc.on.ca/wp-content/uploads/resources/circle-of-care.pdf.
**The IPC refers to this as a ‘lock-box’. See Information and Privacy Commissioner of Ontario, Lock-box Fact Sheet (2005), online: https://www.ipc.on.ca/wp-content/uploads/resources/fact-08-e.pdf.
***For additional guidance about this limit to confidentiality, see CRPO’s guideline, Disclosing Information to Prevent Harm.