Consent and your personal health information

The general rule is that a health information custodian (“custodian”) needs to obtain your consent for the collection, use or disclosure of personal health information. Under the Personal Health Information Protection Act (PHIPA) consent must generally satisfy the following conditions:

• must be your consent or the consent of your substitute decision-maker
• must be knowledgeable
• must relate to the information that will be collected, used or disclosed
• must not be obtained through deception or coercion

For consent to be knowledgeable, you must understand the purpose of the collection, use or disclosure and know that you can give or withhold consent.

Consent under PHIPA may be either express or implied, unless PHIPA requires express consent.

Additional conditions apply if you are under the age of 16, or if you have a substitute decision-maker due to incapacity.

Express consent is given either verbally or in writing, to a custodian to collect, use or disclose your personal health information.  Except in circumstances where PHIPA permits the collection, use or disclosure without consent, express consent is required if:

• personal health information is disclosed to a person or an organization, such as an insurance company, that is not a custodian
• personal health information is disclosed by one custodian to another for a purpose other than providing or assisting in providing health care
• a custodian collects, uses or discloses personal health information for the purpose of marketing or market research
• a custodian collects, uses or discloses personal health information for the purpose of fundraising activities if the information consists of more than your name and certain contact information (implied consent is all that is required for a name and contact information.) 

Just like it is possible to provide express consent, it is also possible to expressly withhold or refuse to give consent to the collection, use or disclosure of personal health information. If consent is withheld or not given, then the custodian cannot collect, use or disclose your personal health information unless PHIPA otherwise allows the practice without consent.

Implied consent is not defined in PHIPA; however, it is understood to be consent that one concludes has been given based on what an individual does or does not do in the circumstances.

For example, a custodian is not required to obtain your written or verbal consent every time your personal health information is collected or used in the course of receiving medical care. It may be reasonable for the custodian to conclude that consent has been given to the collection or use of personal health information because of certain things you do in the context of a physician’s office, such as consenting to an examination or a medical test.

It may also be reasonable for a custodian to conclude that you have consented to the disclosure of your personal health information to another custodian for the purposes of providing or assisting in providing health care. For example, when you consent to a physician issuing a prescription, it may be reasonable for the physician to conclude that you have given implied consent to the disclosure of your personal health information for the purposes of filling a prescription. Similarly, by receiving the prescription from you or your physician, the pharmacist can reasonably conclude that you consented to the collection of this information for the same purposes.

PHIPA distinguishes between “implied consent” and “assumed implied consent.”

In the case of implied consent, custodians must ensure that all the required elements of consent are fulfilled before collecting, using and disclosing your personal health information.

In the case of assumed implied consent, custodians may assume that all the elements of consent are fulfilled. Assumed implied consent may only occur in the context of the “Circle of Care.”

Unless you have specifically withheld or withdrawn your consent, custodians will assume your implied consent for providing health care within the “Circle of Care.”

The term “Circle of Care” describes the ability of certain custodians to assume your implied consent to collect, use or disclose personal health information for the purpose of providing health care.

The “Circle of Care” may include the doctors, nurses, pharmacists, physiotherapists, clinical clerks and employees assigned to your health care. Custodians who are not part of your direct or follow-up treatment are not included within the “Circle of Care.”

For more information on when custodians can rely on assumed implied consent, please read our guidance document, Circle of Care: Sharing Personal Health Information for Health-Care Purposes.

Consent can be withdrawn at any time by providing notice to the custodian. However, withdrawal of consent is not retroactive and may be subject to exceptions.

For more information on how you can withdraw your consent, please read our guidance document, Frequently Asked Questions: Personal Health Information Protection Act.

You are presumed to be capable of providing consent unless a custodian has reason to believe otherwise. Under PHIPA, you are capable of providing consent if you are able:

• to understand the information that is relevant to deciding whether to consent to the collection, use or disclosure; and
• to appreciate the reasonably foreseeable consequences of giving, not giving, withholding or withdrawing consent.

You may be capable of consenting to the collection, use or disclosure of some parts of personal health information, but not other parts. You may also be capable at one point, but not capable later. Under PHIPA, it is understood that capacity can be fluid and is assessed by the custodian in the specific circumstances of a collection, use or disclosure of personal health information. If you do not agree with a custodian’s determination of incapacity, you can challenge the determination by making an application to the Consent and Capacity Board.

If you are incapable of making your own decisions regarding your personal health information, a substitute decision-maker is permitted to make a decision on your behalf. A substitute decision-maker is a person authorized under PHIPA to consent on your behalf to the collection, use or disclosure of personal health information. The following is a list of possible substitute decision-makers, in ranked order of priority:

• a substitute decision-maker within the meaning of the Health Care Consent Act, if the collection, use or disclosure of information is connected to the decision of a substitute decision-maker about your medical treatment
• the guardian of the person or of the property
• the attorney for personal care or for property
• the representative appointed by the Consent and Capacity Board
• the spouse or partner
• a child or parent, including a children’s aid society
• a parent who has a right of access
• a sibling
• a relative
• the Public Guardian and Trustee, if no other person meets the requirements

What if I am a minor?

If you are 16 or older and capable of consenting, only you can consent to the collection, use or disclosure of your personal health information unless you have designated a substitute decision-maker.

Circumstances can be different if you are below the age of 16. Generally, your parent, a children’s aid society, or another person who is legally entitled to give consent on your behalf, will act as your substitute decision-maker. That person can consent to the collection, use or disclosure of your personal health information, except in certain circumstances.

For example, if you make a decision on your own about medical treatment, only you can consent to the collection, use or disclosure of personal health information relating to your treatment. This can empower you to receive medical treatment without your parents knowing about it.

If you are capable, you can also disagree with a decision made by your parent about the collection, use or disclosure of your personal health information. In such a case, it is your decision that matters – not your parents’ – allowing you to provide, withhold or withdraw consent to the collection, use or disclosure of your personal health information.