Generally, health information custodians must obtain your consent to collect, use and disclose your personal health information, unless the Personal Health Information Protection Act (PHIPA), allows for the collection, use or disclosure without your consent, as in the case of a medical emergency.
|When consent is required under PHIPA, it may be either express or implied, and must be:
Express consent to the collection, use or disclosure of your personal health information by a health information custodian is consent that has been clearly and unmistakably given by you. Express consent may be explicitly provided, either orally or in writing.
Implied consent to the collection, use or disclosure of your personal health information is consent that a health information custodian concludes has been given by you.
For example, when you disclose your personal health information for the purposes of filling a prescription, your pharmacist can reasonably assume your consent to the collection of this information.
Except in limited circumstances, your express consent is required:
- when your personal health information is disclosed to a person or an institution, such as an insurance company, that is not a health information custodian;
- when information is disclosed by one health information custodian to another for a purpose other than providing or assisting in providing health care;
- when the collection, use or disclosure of your personal health information is for:
- fundraising purposes (other than your name and mailing address); and
- marketing or marketing research.
Under PHIPA, a health information custodian is not required to obtain your written or verbal consent every time your personal health information is collected, used or disclosed. They may rely on your implied consent for most purposes. They may also assume consent to disclose your personal health information to another health information custodian for the purposes of providing or assisting in providing health care.
However, subject to limited exceptions, health information custodians cannot rely on implied consent when disclosing your personal health information to a person or institution that is not a health information custodian.
PHIPA distinguishes between “implied consent” and “assumed implied consent.”
In the case of implied consent, health information custodians must ensure that all the required elements of consent are fulfilled before collecting, using and disclosing your personal health information.
In the case of assumed implied consent, health information custodians may assume that all the elements of consent are fulfilled.
Furthermore, health information custodians can assume your implied consent for the purpose of providing health care within what is known as the “Circle of Care” — unless you have specifically expressed that you would like to withhold or withdraw your consent.
The “circle of care” is a term used to describe the conditions that allow health information custodians to rely on assumed implied consent when collecting, using or disclosing your personal health information for the purpose of providing health care.
The circle of care may include, a doctors, nurses, pharmacists, physiotherapists, clinical clerks and employees assigned to your health care. Not included are health information custodians who are not part of your direct or follow-up treatment.
For more information on when health information custodians can rely on assumed implied consent, please read our guidance document, Circle of Care: Sharing Personal Health Information for Health-Care Purposes.
You may, with limited exceptions, withdraw consent at any time for the collection, use or disclosure of your personal health information by providing notice to the health information custodian. However, a withdrawal of consent is not retroactive.
For more information on how you can withdraw your consent, please read our guidance document, Frequently Asked Questions: Personal Health Information Protection Act.
If an individual is incapable of making their own decisions regarding their personal health information, a substitute decision-maker, such as a relative, trustee, guardian or person with power of attorney, is permitted to make a decision on their behalf.
Ontario’s health privacy legislation lists in order of priority, the following substitute decision-makers who may consent on behalf of an individual when consent is required:
- a substitute decision-maker within the meaning of section 9, section 39 and section 56 of the Health Care Consent Act, if the purpose of the collection, use or disclosure is necessary for, or ancillary to, a decision about a treatment under Part II, a decision about admission to a care facility under Part III or a decision about a personal assistance service under Part IV of the Health Care Consent Act respectively;
- the guardian of the person or of the property;
- the attorney for personal care or for property;
- the representative appointed by the Consent and Capacity Board;
- the spouse or partner;
- a child or parent, including a children’s aid society;
- a parent who has a right of access;
- a sibling;
- a relative and if no other person meets the requirements;
- the Public Guardian and Trustee.