Collection, Use and Disclosure of Personal Health Information


Under the Personal Health Information Protection Act (PHIPA) a health information custodian (custodian) is prohibited from collecting, using or disclosing personal health information, unless:

  • consent has been obtained and the collection, use or disclosure is, to the best of the custodian’s knowledge, necessary for a lawful purpose; or
  • the collection, use or disclosure is permitted or required by PHIPA.

According to PHIPA, you cannot collect, use or disclose personal health information if other information will suffice. For example, you may be able to provide a researcher conducting a study with de-identified information, rather than disclosing personal health information. As a custodian, you also cannot collect, use or disclose more personal health information than is reasonably necessary to serve the purposes of the collection, use or disclosure. For example, if a patient requests a doctor’s note to give to his or her employer, the doctor should only include the minimum information necessary, rather than the patient’s entire health history. These limitations do not apply to personal health information that a custodian is required by law to collect, use or disclose.

Where you have collected personal health information in contravention of PHIPA, you cannot use or disclose it unless required by law.

For more information about the collection, use and disclosure of personal health information, please refer to the IPC’s Frequently Asked Questions: Personal Health Information Protection Act.

WHAT IS A COLLECTION OF PERSONAL HEALTH INFORMATION UNDER PHIPA? PHIPA defines the term “collect” as the gathering, acquiring, receiving or obtaining of personal health information by any means from any source. This means that you, or your authorized agent–such as a nurse who is employed by a hospital–can collect personal health information in several ways. For example, when a doctor makes notes about a patient or when a pharmacist receives a prescription to be filled, they are collec...
WHAT IS CONSIDERED A USE OF PERSONAL HEALTH INFORMATION UNDER PHIPA? The term “use” is defined under PHIPA as meaning to view, handle or otherwise deal with personal health information, but does not include the disclosure of the information. Where you are authorized to use the information, you may also provide it to an agent to use it for the same reason, on your behalf. The sharing of information between you and your agent is considered to be a use and not a disclosure or a collection. ...
WHAT IS A DISCLOSURE OF PERSONAL HEALTH INFORMATION UNDER PHIPA? The term “disclose” means to make the personal health information available or to release it to another health information custodian or person. It does not include using the personal health information or providing it back to the person who provided it or disclosed it in the first place, whether or not it has been manipulated or altered, as long as it does not include additional identifying information.   WHAT ARE THE R...