Can public health agencies, government organizations, and other facilities, such as long-term care homes, release information about the numbers of infected individuals and deaths due to COVID-19? Does privacy prevent this kind of information from being disclosed to the public?
Privacy does not prevent the release of non-identifying information related to COVID-19 infections and deaths in Ontario.
Public health agencies, long-term care facilities, hospitals, and other organizations can release non-identifying information, especially in situations where the information relates to incidences of infection, numbers of deaths, or other information that can help control the spread of the virus and keep the public safe. This vital information should be shared with the public as soon as it is possible to do so.
People need to know if they have been exposed to the virus so they can take steps to self-isolate or otherwise protect themselves and their families. In public health matters, privacy is not a barrier to sharing information that is crucial to public well-being.
Non-identifying information could include the numbers of affected individuals, demographic data such as gender and approximate age of affected individuals. It can also include the geographic locations of infected or deceased individuals, including long-term care facilities and workplaces, especially if they are in a location where large numbers of people might have gathered.
It is important to note that in exceptional circumstances, identifiable information can be released. Under Ontario’s health privacy law, the Personal Health Information Protection Act (PHIPA), a health information custodian can disclose personal health information about an individual if the custodian believes on reasonable grounds that the disclosure is necessary for eliminating or reducing a significant risk of serious bodily harm to a person or group of persons.
Similarly, under Ontario’s public sector access and privacy law, institutions can disclose personal information in compelling circumstances affecting the health or safety of an individual (if, upon disclosure, notification is mailed to the last known address of the individual to whom the information relates).
