This article was first published in the July 2022 Communiqué and updated in September 2024
Registrants sometimes receive third-party requests for client information, for example from a client’s spouse or parent, third-party payors, insurance companies, Employee Assistance Programs, and lawyers.
When a registrant receives a request to release information to any third party, they must obtain the client’s informed consent to do so, unless a legal exception applies. When compelled to disclose client information for a legal proceeding, registrants should exercise prudence and are advised to consult their legal advisor to determine the best way to respond.
Below are some general principles to keep in mind when making decisions about releasing personal health information.
1.Client requests to share records with a third party
Clients have a right to access their own health records, unless an exception applies.
When a client or their representative requests a report or letter, registrants must provide one relating to the therapy provided, unless there is a valid reason not to. For example, if the information in question is subject to a legal privilege that restricts disclosure of the record or the information to the individual; access could reasonably be expected to result in a risk of serious harm to the treatment or recovery of the individual or serious bodily harm to the individual or another person; the information was collected in the course of an inspection, investigation or similar procedure and the resulting proceedings, appeals or processes have not yet been concluded; or another law prohibits the disclosure of that information.
What goes into the report is a separate question requiring professional judgment (see Item 4 below).
See the Information and Privacy Commissioner of Ontario resource page, “Access and correction,” Standard 5.1: Clinical Records, and Standard 5.2: Requests for Reports, linked in Related Resources below.
2. Informed consent
As outlined in CRPO Professional Practice Standard 3.1, Confidentiality, it is a fundamental responsibility of registrants to maintain client confidentiality at all times, including when requests are made for client information by third parties such as lawyers or insurance companies.
As outlined in Standard 5.2: Requests for Reports, upon receiving a request for a report, registrants should first seek express consent from their client or their authorized representative to provide the report and discuss the requested content. Registrants should ensure that only relevant and requested information is provided and should provide clients the opportunity to review the report prior to submission.
When sharing information directly with a third party, registrants must make reasonable efforts to ensure that the privacy of the client record is protected during any authorized transmission or disclosure of information. See Standard 5.6 Record Storage, Security and Retrieval linked in Related Resources below.
3. Informed consent when working with minors
In Ontario, there is no “age of consent” with respect to personal health care decisions. In general, clients of any age are considered capable of refusing or providing consent to their own treatment as long as they possess the maturity to reasonably understand the information provided and can appreciate the consequences of their decisions. Therefore, if a minor client is capable of providing their own consent, they are able to do so without a parent. This means the therapist is not permitted to share the information with a third party, including parents, without consent or where a legal exception applies.
See the Informed Consent Workbook linked in Related Resources below for information.
4. Deciding what information to share
In all cases, after receiving the client’s informed consent, registrants are expected to employ professional discretion, and to disclose only relevant and necessary personal health information.
Consider the following:
- Are there any risks to sharing complete files (e.g., confidential information gets into the wrong hands; some of the information is irrelevant)?
- Is it possible to share only relevant and necessary information instead of the entire file? For example, would preparing the required information in a format such as a summary letter be acceptable? Note: If a summary letter or report is not agreeable, the client has a right to their entire file.
- Is there a benefit to reviewing the file with the client to allow for the client’s full understanding of the contents?
In some cases, a client might request to disclose only certain information to the third party; however, doing so might not be in the client’s best interest. For example, for some benefit claims, an insurance/benefit provider might consider a partial record “incomplete information.” In this case, providing incomplete information could have serious consequences for a client, e.g., the claim might get delayed in processing or even refused. In such cases, it would be beneficial to encourage the client to consult with the third-party payor to understand the policies that apply to such claims, the process and expectations when making such claims, and who to talk to if there are questions about what information should be shared.
Clients who do not wish to disclose a complete clinical record may need to advocate with the third party.
5. Shared records
When a file is shared and includes the personal health information of another individual who also participated in therapy (e.g., couple or family therapy), an individual only has a right of access to the portion of personal health information about the individual in the record that can reasonably be severed from the record for the purpose of providing access. (See the Information and Privacy Commissioner of Ontario resource page, “Access and correction” linked in Related Resources below.)
Standard 5.1 notes that clients may access the entire record if all participants consent or submit a joint request (e.g., both members of a couple request access to the couple’s therapy record). If only one participant requests access to a joint record, and the others do not consent, they are entitled only to the information about themselves as well as any communal information (e.g., general themes) that is not attributable specifically to another participant.
6. Concerns about risk to clients
In situations where a registrant is concerned about how a client will perceive information in the clinical record, they are encouraged to provide support to the client in a manner appropriate to the situation. It would also be prudent to consult with trusted supervisors, legal counsel, and the Information and Privacy Commissioner to determine a safe and appropriate course of action for providing a client or their representative access to their personal health information.
7. Consent to release information forms
In some situations, a third party will provide a client with a form indicating their consent to release information. Such forms are intended to facilitate the exchange of client health information for the purpose of providing treatment, determining eligibility for benefits, or for legal proceedings.
If an RP is unsure of the implications of asking their client to sign such a form, they can speak with the relevant party issuing the form. As well, registrants should consider obtaining their own legal advice, so they understand how to navigate their confidentiality obligations within the specific situation.
Registrants can also direct clients to contact the third party with any questions about the form or how their information will be exchanged with healthcare providers or others.
Registrants should not treat such forms as a one-time consent process. Consent is an ongoing process and registrants should revisit the topic of information sharing with the client as needed.