CONSENT AND THE PERSONAL HEALTH INFORMATION PROTECTION ACT, 2004

About This Presentation

Title:

CONSENT AND THE PERSONAL HEALTH INFORMATION PROTECTION ACT, 2004

Description:

CONSENT AND THE PERSONAL HEALTH INFORMATION PROTECTION ACT, 2004 PHIPA Summit 2005 November 3, 2005 Halyna Perun, Counsel, Ministry of Health and Long-Term Care – PowerPoint PPT presentation

Number of Views:186

Avg rating:3.0/5.0

Slides: 33

Provided by: ipc62

Category:

more less

Transcript and Presenter's Notes

Title: CONSENT AND THE PERSONAL HEALTH INFORMATION PROTECTION ACT, 2004

1
CONSENT AND THE PERSONAL HEALTH INFORMATION
PROTECTION ACT, 2004

PHIPA Summit 2005
November 3, 2005
Halyna Perun, Counsel, Ministry of Health and
Long-Term Care
Mary Jane Dykeman, Legal Counsel
Manuela Di Re, Counsel, Information Privacy
Commissioner
Notice This presentation should not be relied
on as legal advice. Consult the legislation,
regulations, and your legal counsel for
information related to specific circumstances.

2
Fundamental Consent Provisions

1. A health information custodian shall not
collect, use, or disclose personal health
information unless
Consent has been obtained and, to the best of
the health information custodians knowledge,
the collection, use or disclosure is necessary
for a lawful purpose OR
It is permitted or required by the Act
Consent may be express or implied, except when
the Act specifies that consent must be express
Consent, whether express or implied, must satisfy
the requirements of the Act
(Sections 18 and 29)

EXPRESS VERSUS
IMPLIED CONSENT

4
Express Versus Implied Consent

Consent may be express or implied, except when
the Act specifies that consent must be express
2. Express consent (consent explicitly provided
either orally or in writing) is required
To disclose personal health information to a
non-health information custodian (subject to
exceptions)
To disclose personal health information to
another health information custodian for a
purpose other than health care
To collect, use or disclose personal health
information for marketing or market research
To collect, use or disclose personal health
information for fundraising if use more than name
and address
(Section 18(3), 32 and 33)

5
Implied Consent for Health Care Purposes

Implied consent is a consent a health information
custodian concludes based on an individuals
action or inaction in particular factual
circumstances
Consent may be implied
To collect or use personal health information for
any purpose (other than for fundraising where
conditions of implied consent not met or for
marketing)
To disclose personal health information to
another health information custodian for the
purpose of providing or assisting in providing
health care
(Section 18(3), 32 and 33)

6
Assumed Implied Consent for Health Care Purposes

GENERAL RULE
Some health information custodians whose core
function is the provision of health care may
assume implied consent to the collection, use or
disclosure of personal health information for the
purpose of providing or assisting in providing
health care if the health information custodian
receives the information from another health
information custodian, the individual or the
individuals substitute decision maker
EXCEPTION
If the health information custodian is aware that
the individual has withheld or withdrawn consent
(Section 20(2))

7
Implied Consent for Non - Health Care Purposes

A health information custodian may imply consent
in the following situations for non-health care
purposes
To the disclosure of personal health information
to representatives of religious or other
organizations provided
The individual is offered an opportunity to
withhold or withdraw consent and
The individual has not withheld or withdrawn
consent
2. To the disclosure of personal health
information by a pharmacist to a third party
requested to provide payment to the pharmacist
for medications or related goods or services
3. To collect, use or disclose the name and
address of the individual or substitute decision
maker (where applicable) for fundraising if
section 10 of the Regulation is satisfied
(Sections 20(4) and 32 and Section 8 of
Regulation 329/04)

REQUIREMENTS FOR
VALID CONSENT

9
Requirements for Valid Consent

Consent, whether express or implied, must
Be the consent of the individual or his or her
substitute decision maker (where applicable),
Be knowledgeable, meaning it must be reasonable
to believe that the individual knows
The purpose of the collection, use or disclosure
and
That the individual may give or withhold consent
Relate to the information, and
Not be obtained by deception or coercion.
(Section 18(1))

10
Notice of Purposes

A health information custodian may rely on a
notice of purposes to support the reasonable
belief that the individual knows the purposes of
the collection, use, or disclosure of personal
health information
If a health information custodian wishes to rely
on a notice of purposes, the notice
Must be posted where it is likely to come to the
attention of the individual or must be provided
to the individual
Must outline the purposes for which the health
information collects, uses or discloses personal
health information and
Should advise the individual that he or she has
the right to give or withhold consent
A Notice of Purposes is not required where a
health information custodian may assume implied
consent but it is a best practice to have a
notice of purposes
(Section 18(6))

11
Assumption of Validity of Consent

Where consent is obtained or a document is
received purporting to record consent to the
collection, use or disclosure of personal health
information, a health information custodian is
entitled to assume that
the consent fulfils the requirements of the Act
and
the individual has not withdrawn the consent
unless it is not reasonable to assume so
Consent to collection, use or disclosure of
personal health information given before
November 1, 2004 is valid if it meets the
requirements for consent in the Act
(Sections 18(7) and 20(1))

WHO MAY CONSENT
ON BEHALF OF AN INDIVIDUAL

13
Consent and Capable Individuals

1. Where an individual is capable, consent may be
provided by
the individual, or
if the individual is sixteen or older, any
capable person sixteen years of age or older
authorized in writing by the individual to
provide consent on his or her behalf
An individual is capable if he or she is able to
Understand information relevant to deciding
whether to consent and
Appreciate the reasonably foreseeable
consequences of giving, not giving, withholding
or withdrawing consent
Individuals are presumed capable regardless of
age unless there are reasonable grounds to
believe otherwise
(Sections 21(1), 21(4) and 23(1))

14
Consent and Incapable Individuals

Where an individual is incapable, the following
persons (in the following order of priority) may
consent
A substitute decision-maker under the Health
Care Consent Act with respect to consent
necessary for or ancillary to a decision about
treatment, long-term care admission or a
personal assistance service
Guardian of the person or guardian of property
(with authority)
Attorney for personal care or attorney for
property (with authority)
Representative appointed by the Consent and
Capacity Board
Spouse or partner
Child or custodial parent (subject to
exceptions)
Parent with only a right of access
Brother or sister
Any other relative or
Public Guardian and Trustee (as a last resort).
(Sections 26(1) and 26(11))

15
Consent and Deceased Individuals

Where an individual is deceased, consent may be
provided by
The estate trustee or
If there is no estate trustee, the person
responsible for administering the estate
(Section 23(1) 4)

16
Consent and Children

If a child is capable, the child may consent
If a child is capable and 16 or older the child
may authorize another capable person who is at
least 16 years old to provide consent on his or
her behalf provided it is in writing
If a child is capable and less than 16, a
custodial parent, Childrens Aid Society or
person lawfully entitled to stand in the place of
a parent may consent EXCEPT
If the personal health information relates to
treatment about which the child has made a
decision on his or her own pursuant to Health
Care Consent Act, 1996
If the personal health information relates to
counselling in which child participated on his or
her own under the Child and Family Services Act
In event of conflict, the decision of the
capable child prevails
4. If a child is incapable, the same persons who
may consent for an incapable individual can
consent for an incapable child

17
Reliance on Assertions

Unless unreasonable in the circumstances, a
health information custodian may rely on the
accuracy of an assertion made by a person that
the person is entitled to consent to the
collection, use or disclosure of personal health
information of the individual
the person is over the age of sixteen
the person is not prohibited by a court order or
separation agreement from having access to the
individual
No other person ranked higher or equally exists
or if they exist, they would not object to the
person making the decision
(Section 71(4))

WITHDRAWING CONSENT AND EXPRESS INSTRUCTIONS

19
Meaning of the Term Lock Box

Lock Box is not a defined term in the Act
It is generally used to mean the qualified right
of an individual to
Withdraw consent to the collection, use and
disclosure of personal health information
pursuant to section 19 (1), including for the
provision of health care or
Provide an express instruction not to use or
disclose personal health information for
purposes of providing health care in
circumstances (generally without consent) set
out in sections 37(1)(a), 38(1)(a) and 50(1)(e)
of the Act

20
Delay in Implementation

Effective November 1, 2004, individuals are
entitled to withdraw consent to the collection,
use and disclosure of personal health
information, including for health care purposes
Extension to November 1, 2005, granted to public
hospitals only with respect to express
instructions
Related to uses of personal health information
where the information was collected pursuant to
section 36(1)(b) because it was reasonably
necessary for the provision of health care
(section 37(1)(a))
Related to disclosures of personal health
information to certain health information
custodians without consent that are reasonably
necessary for the provision of health care
(section 38(1)(a))
Related to disclosures of personal health
information to persons outside Ontario without
consent that are reasonably necessary for the
provision of health care (section 50(1)(e)).

21
Duties Arising From Lock Box Requests

1. A health information custodian must comply
with a withdrawal of consent or an express
instruction (subject to exceptions)
2. Compliance may be achieved through
Policies, procedures or manual processes
Electronic or technological means or
Combination of the above
3. Where a health information custodian is
prevented from disclosing to certain other
health information custodians personal health
information that is believed to be reasonably
necessary for the purpose of providing health
care
The disclosing health information custodian must
notify the other health information custodian of
that fact and
The receiving health information custodian may
explore the matter with the individual and seek
consent to access the locked information
(Sections 20(3) and 38(2))

22
Inapplicability of Lock Box

A health information custodian must comply with a
withdrawal of consent or an express instruction
unless
The individual changes his or her mind,
The Act permits the collection, use or
disclosure to be made without consent, except
uses where the personal health information was
collected with or without consent because the
collection was reasonably necessary for the
provision of health care (section 37(1)(a))
disclosures to certain health information
custodians without consent that are reasonably
necessary for the provision of health care
(section 38(1)(a))
disclosures to persons outside Ontario without
consent that are reasonably necessary for the
provision of health care (section 50(1)(e)).

PERMITTED INDIRECT COLLECTION WITHOUT CONSENT

24
Permitted Indirect Collections Without Consent

Permitted in certain circumstances, such as
where
It is reasonably necessary for providing health
care and it is not reasonably possible to collect
personal health information
that can reasonably be relied on as accurate
directly from the individual
directly from the individual in a timely manner
It is collected by a health information custodian
who is a FIPPA/ MFIPPA institution for purposes
of conducting a proceeding, investigating a
breach of agreement or law or its statutory
function
The Information and Privacy Commissioner
authorizes another manner of collection
It is collected from a person permitted or
required by law to disclose it to the health
information custodian
The health information custodian is permitted or
required by law to collect the personal health
information indirectly

PERMITTED USES
WITHOUT CONSENT

26
Permitted Uses Without Consent

Permitted in certain circumstances, such as
For purposes for which it was collected and for
all functions reasonably necessary for carrying
out that purpose (unless collected with consent
or under section 36(1) (b) and the individual
expressly instructs otherwise)
Planning or delivering health programs or
services
Obtaining payment, processing, monitoring,
verifying or reimbursing claims for payment
Risk or error management to improve or maintain
the quality of programs or services

27
Permitted Uses Without Consent (Continued)

5. Educating agents to provide health care
For a proceeding or contemplated proceeding in
which the health information custodian or agent
is a party or witness if it relates to a matter
at issue
Uses permitted or required by law
Research provided the following conditions are
met
A research plan prepared
The research approved by research ethics board
and
The researcher agrees to comply with the Act.

PERMITTED DISCLOSURES
WITHOUT CONSENT

29
Permitted Disclosures Without Consent

Permitted in certain circumstances, such as
To certain health information custodians when
reasonably necessary for providing health care
and cannot obtain timely consent (unless
individual expressly instructs otherwise)
To enable the Minister or another health
information custodian to determine or provide
funding or payment to the health information
custodian for the provision of health care
Where reasonable grounds to believe disclosure is
necessary to eliminate or reduce a significant
risk of serious bodily harm
For a proceeding or contemplated proceeding in
which the health information custodian or agent
is a party or witness if it relates to a matter
at issue
To comply with summons, court order or similar
requirement

30
Permitted Disclosures Without Consent (Continued)

6. To a researcher for research purposes
provided
Receive a written application
Receive a research plan that satisfies the Act
Receive a copy of the Research Ethics Board
decision
Enter into an agreement with the researcher that
satisfies the Act
7. To a person carrying out an inspection,
investigation or procedure authorized by warrant
or by law
8. To the Chief Medical Officer of Health or a
Medical Officer of Health for Health Protection
and Promotion Act purposes
9. To a regulatory college for purposes of
enforcement of the Drug and Pharmacies Regulation
Act, Regulated Health Professions Act, 1991 or an
Act mentioned in Schedule 1 to the Regulated
Health Professions Act, 1991
10. Where permitted or required by law

31
Permitted Disclosures Without Consent (Continued)

To the Public Guardian and Trustee, Childrens
Lawyer or Childrens Aid Society so that they can
carry out their statutory functions
A health information custodian that is a facility
that provides health may disclose to a person
the fact that an individual is a patient or
resident
the individuals general health status described
as critical, poor, fair, stable or satisfactory
and
the location of the individual in a facility
Provided the individual was offered, at the first
reasonable
opportunity, the ability to object and did not do
so

32
Tools and Resources

Tools and resources available on the Information
and Privacy Commissioner website at
www.ipc.on.ca
Frequently Asked Questions Personal Health
Information Protection Act
Guide to the Personal Health Information
Protection Act
Lock-box Fact Sheet
Consent and Form 14 Fact Sheet
Ontario Poison Information Centres and the
Circle of Care Fact Sheet
Disclosure of Information in Emergency/Urgent
Circumstances Fact Sheet
Frequently Asked Questions Health Cards and
Health Numbers
Reporting Requests under PHIPA Fact Sheet
Fundraising under PHIPA Fact Sheet
Safeguarding Personal Health Information Fact
Sheet
Link to website of Ministry of Health and Long
Term Care www.health.gov.on.ca