Consent and Your Personal Health Information

WHAT ARE THE REQUIRED ELEMENTS FOR CONSENT UNDER ONTARIO’S HEALTH PRIVACY LEGISLATION?

Generally, health information custodians must obtain your consent to collect, use and disclose your personal health information, unless the Personal Health Information Protection Act (PHIPA)allows for the collection, use or disclosure without your consent, as in the case of a medical emergency.

 

When consent is required under PHIPA, it may be either express or implied, and must be:

  • knowledgeable, meaning you understand why your information is being collected and used and that you can either give or withhold consent;
  • voluntary;
  • related to the information in question; and
  • given by you.

 

 

WHAT IS THE DIFFERENCE BETWEEN EXPRESS AND IMPLIED CONSENT?

Express consent to the collection, use or disclosure of your personal health information by a health information custodian is consent that has been clearly and unmistakably given by you. Express consent may be explicitly provided, either orally or in writing.

Implied consent to the collection, use or disclosure of your personal health information is consent that a health information custodian concludes has been given by you.

For example, when you disclose your personal health information for the purposes of filling a prescription, your pharmacist can reasonably assume your consent to the collection of this information.

 

WHEN IS MY EXPRESS CONSENT REQUIRED?

Except in limited circumstances, your express consent is required:

  • when your personal health information is disclosed to a person or an institution, such as an insurance company, that is not a health information custodian;
  • when information is disclosed by one health information custodian to another for a purpose other than providing or assisting in providing health care;
  • when the collection, use or disclosure of your personal health information is for:
    • fundraising purposes (other than your name and mailing address); and
    • marketing or marketing research.

 

WHEN IS IMPLIED CONSENT SUFFICIENT?

Under PHIPA, a health information custodian is not required to obtain your written or verbal consent every time your personal health information is collected, used or disclosed.  They may rely on your implied consent for most purposes.  They may also assume consent to disclose your personal health information to another health information custodian for the purposes of providing or assisting in providing health care.

However, subject to limited exceptions, health information custodians cannot rely on implied consent when disclosing your personal health information to a person or institution that is not a health information custodian.

 

WHAT IS THE DIFFERENCE BETWEEN IMPLIED CONSENT AND ASSUMED IMPLIED CONSENT?

PHIPA distinguishes between “implied consent” and “assumed implied consent.”

In the case of implied consent, health information custodians must ensure that all the required elements of consent are fulfilled before collecting, using and disclosing your personal health information.

In the case of assumed implied consent, health information custodians may assume that all the elements of consent are fulfilled.

Furthermore, health information custodians can assume your implied consent for the purpose of providing health care within what is known as the “Circle of Care” — unless you have specifically expressed that you would like to withhold or withdraw your consent.

 

WHAT IS THE CIRCLE OF CARE?

The “circle of care” is a term used to describe the conditions that allow health information custodians to rely on assumed implied consent when collecting, using or disclosing your personal health information for the purpose of providing health care.

The circle of care may include, a doctors, nurses, pharmacists, physiotherapists, clinical clerks and employees assigned to your health care. Not included are health information custodians who are not part of your direct or follow-up treatment.

For more information on when health information custodians can rely on assumed implied consent, please read our guidance document, Circle of Care: Sharing Personal Health Information for Health-Care Purposes.

 

CAN I WITHDRAW MY CONSENT?

You may, with limited exceptions, withdraw consent at any time for the collection, use or disclosure of your personal health information by providing notice to the health information custodian. However, a withdrawal of consent is not retroactive.

For more information on how you can withdraw your consent, please read our guidance document, Frequently Asked Questions: Personal Health Information Protection Act.

 

WHAT HAPPENS WHEN A PATIENT IS INCAPABLE OF PROVIDING CONSENT?

If an individual is incapable of making their own decisions regarding their personal health information, a substitute decision-maker, such as a relative, trustee, guardian or person with power of attorney, is permitted to make a decision on their behalf.

Ontario’s health privacy legislation lists in order of priority, the following substitute decision-makers who may consent on behalf of an individual when consent is required:

  • a substitute decision-maker within the meaning of section 9, section 39 and section 56 of the Health Care Consent Act, if the purpose of the collection, use or disclosure is necessary for, or ancillary to, a decision about a treatment under Part II, a decision about admission to a care facility under Part III or a decision about a personal assistance service under Part IV of the Health Care Consent Act respectively;
  • the guardian of the person or of the property;
  • the attorney for personal care or for property;
  • the representative appointed by the Consent and Capacity Board;
  • the spouse or partner;
  • a child or parent, including a children’s aid society;
  • a parent who has a right of access;
  • a sibling;
  • a relative and if no other person meets the requirements;
  • the Public Guardian and Trustee.