Government organizations are only permitted to disclose the personal information that they collect in accordance with FIPPA or MFIPPA. Health information custodians are only permitted to disclose personal health information in accordance with PHIPA.
Under FIPPA and MFIPPA, some of the circumstances in which government organizations are permitted to disclose personal information include:
- where the individual has consented to the disclosure;
- for the purpose for which the personal information was obtained or compiled or for a consistent purpose;
- where the disclosure is necessary and proper in the discharge of the organization’s functions;
- for the purpose of complying with another Act;
- for law enforcement purposes;
- in compelling circumstances affecting the health or safety of an individual;
- in compassionate circumstances, to facilitate contact with the next of kin or a friend of an individual who is injured, ill or deceased;
- to the Information and Privacy Commissioner; and
- to the Government of Canada in order to facilitate the auditing of shared cost programs.
Educational institutions may also disclose personal information in its alumni records for fundraising purposes.
Under PHIPA, personal health information may only be disclosed by health information custodians if the individual consents or if PHIPA specifically permits the disclosure without consent. Permitted disclosures of personal health information without the consent of the individual generally fall within the following categories:
- disclosures relating to providing health care;
- disclosures by a facility that provides health care;
- disclosures relating to a deceased individual;
- disclosures for health or other programs;
- disclosures related to risks;
- disclosures related to care and custody;
- disclosures for proceedings;
- disclosures to a successor;
- disclosures related to this or other Acts;
- disclosures for research;
- disclosures for planning and management of health system;
- disclosures for monitoring of health care payments;
- disclosures for analysis of the health system; and
- disclosures with the Commissioner’s approval.
PHIPA includes a number of conditions and limitations for many of the above categories of disclosures. For more information on the permitted disclosure of personal health information under PHIPA, please refer to our paper, A Guide to the Health Information Protection Act.