This article was first published in the January 2024 Communiqué
It is a fundamental responsibility of registrants to maintain client confidentiality at all times, including when requests are made for client information by third parties such as lawyers or insurance companies. In compliance with the Personal Health Information Protection Act, 2004 (PHIPA), registrants must ensure the professional relationship with the client and the client’s personal information are kept confidential, within legal limitations.
Do the same rules apply for a deceased client? See below for answers to common questions on this topic.
What is an RP responsible for in terms of upholding confidentiality for a deceased client?
The Personal Health Information Protection Act, 2004 (PHIPA) establishes the rules relating to confidentiality and privacy of personal health information in Ontario. PHIPA requires that personal health information be kept confidential and secure, including when a client passes away. A client’s right to privacy does not end with their death.
The following resources (linked in Related Resources below) from the Information and Privacy Commissioner (IPC) explain the circumstances when a health information custodian is permitted to disclose the personal health information of a deceased individual:
- Frequently Asked Questions Personal Health Information Protection Act (2015)
- Disclosure
- Obtaining Personal Health Information About a Deceased Relative (2008)
- Accessing Records of Deceased Relatives (2019)
- Accessing Your Deceased Relative’s Personal Information (2019)
Are there any specific documentation/reporting guidelines for a deceased client?
For a list of mandatory reporting obligations, please review the Mandatory Reporting Obligations for Registered Psychotherapists, linked in Related Resources below.
How long must I store a deceased client’s records?
CRPO Professional Practice Standard 5.1 Clinical Records states the following:
Retention
Where the RP is the custodian of the clinical record, they are expected to retain the record for at least 10 years from the date of the last interaction with the client, or for 10 years from the client’s 18th birthday, whichever is later. For example, if a child is seven years old at the time of the last interaction, the record would be kept until the client’s 28th birthday.
Who can get access to a deceased client’s records?
As noted in the resources linked below, PHIPA permits the disclosure of personal health information about a deceased individual in certain circumstances. A custodian may only disclose personal health information to a person who is not a custodian, such as a relative of a deceased individual, with consent or where the disclosure is permitted or required by PHIPA or another law. In the case of a deceased individual, the consent may be given by the person administering the deceased individual’s estate. If this person consents, the personal health information may be disclosed to a relative of the deceased individual.
PHIPA permits, but does not require, a custodian to disclose personal health information without consent for the purposes of identifying the individual or for informing people whom it is reasonable to inform, that the individual is deceased or reasonably suspected to be deceased and the circumstances of death, where appropriate. PHIPA also permits disclosure to the spouse, partner, sibling or child of the deceased individual if the recipients reasonably require the information to make decisions about their own, or their children’s health care.
In rare instances, a registrant may have concerns about how the estate administrator is exercising their authority over the deceased client’s personal health information. In such situations it is advisable to consult a lawyer regarding any available legal recourse.