Consent and your personal health information
The general rule is that a health information custodian (“custodian”) needs to obtain your consent for the collection, use or disclosure of personal health information. Under the Personal Health Information Protection Act (PHIPA) consent must generally satisfy the following conditions: For consent to be knowledgeable, you must understand the purpose of the collection, use or disclosure and know that you can give or withhold consent. Consent under PHIPA may be either express or implied, unless PHIPA requires express consent. Additional conditions apply if you are under the age of 16, or if you have a substitute decision-maker due to incapacity.
Express consent is given either verbally or in writing, to a custodian to collect, use or disclose your personal health information. Except in circumstances where PHIPA permits the collection, use or disclosure without consent, express consent is required if: Just like it is possible to provide express consent, it is also possible to expressly withhold or refuse to give consent to the collection, use or disclosure of personal health information. If consent is withheld or not given, then the custodian cannot collect, use or disclose your personal health information unless PHIPA otherwise allows the practice without consent.
Implied consent is not defined in PHIPA; however, it is understood to be consent that one concludes has been given based on what an individual does or does not do in the circumstances. For example, a custodian is not required to obtain your written or verbal consent every time your personal health information is collected or used in the course of receiving medical care. It may be reasonable for the custodian to conclude that consent has been given to the collection or use of personal health information because of certain things you do in the context of a physician’s office, such as consenting to an examination or a medical test. It may also be reasonable for a custodian to conclude that you have consented to the disclosure of your personal health information to another custodian for the purposes of providing or assisting in providing health care. For example, when you consent to a physician issuing a prescription, it may be reasonable for the physician to conclude that you have given implied consent to the disclosure of your personal health information for the purposes of filling a prescription. Similarly, by receiving the prescription from you or your physician, the pharmacist can reasonably conclude that you consented to the collection of this information for the same purposes.
PHIPA distinguishes between “implied consent” and “assumed implied consent.” In the case of implied consent, custodians must ensure that all the required elements of consent are fulfilled before collecting, using and disclosing your personal health information. In the case of assumed implied consent, custodians may assume that all the elements of consent are fulfilled. Assumed implied consent may only occur in the context of the “Circle of Care.” Unless you have specifically withheld or withdrawn your consent, custodians will assume your implied consent for providing health care within the “Circle of Care.”
The term “Circle of Care” describes the ability of certain custodians to assume your implied consent to collect, use or disclose personal health information for the purpose of providing health care. The “Circle of Care” may include the doctors, nurses, pharmacists, physiotherapists, clinical clerks and employees assigned to your health care. Custodians who are not part of your direct or follow-up treatment are not included within the “Circle of Care.” For more information on when custodians can rely on assumed implied consent, please read our guidance document, Circle of Care: Sharing Personal Health Information for Health-Care Purposes.
Consent can be withdrawn at any time by providing notice to the custodian. However, withdrawal of consent is not retroactive and may be subject to exceptions. For more information on how you can withdraw your consent, please read our guidance document, Frequently Asked Questions: Personal Health Information Protection Act.
You are presumed to be capable of providing consent unless a custodian has reason to believe otherwise. Under PHIPA, you are capable of providing consent if you are able: You may be capable of consenting to the collection, use or disclosure of some parts of personal health information, but not other parts. You may also be capable at one point, but not capable later. Under PHIPA, it is understood that capacity can be fluid and is assessed by the custodian in the specific circumstances of a collection, use or disclosure of personal health information. If you do not agree with a custodian’s determination of incapacity, you can challenge the determination by making an application to the Consent and Capacity Board. If you are incapable of making your own decisions regarding your personal health information, a substitute decision-maker is permitted to make a decision on your behalf. A substitute decision-maker is a person authorized under PHIPA to consent on your behalf to the collection, use or disclosure of personal health information. The following is a list of possible substitute decision-makers, in ranked order of priority:
What if I am a minor? If you are 16 or older and capable of consenting, only you can consent to the collection, use or disclosure of your personal health information unless you have designated a substitute decision-maker. Circumstances can be different if you are below the age of 16. Generally, your parent, a children’s aid society, or another person who is legally entitled to give consent on your behalf, will act as your substitute decision-maker. That person can consent to the collection, use or disclosure of your personal health information, except in certain circumstances. For example, if you make a decision on your own about medical treatment, only you can consent to the collection, use or disclosure of personal health information relating to your treatment. This can empower you to receive medical treatment without your parents knowing about it. If you are capable, you can also disagree with a decision made by your parent about the collection, use or disclosure of your personal health information. In such a case, it is your decision that matters – not your parents’ – allowing you to provide, withhold or withdraw consent to the collection, use or disclosure of your personal health information.
This post is also available in: French
