Personal Health Information Protection Act
General Information
August 2007
Disclaimer: This Infoguide is intended for use as general information and is prepared for purposes of convenience only. It is not to be relied upon as legal advice or legal authority. If you have inquiries as to legal proceedings, or if you would like more detailed information regarding legislation, you should consult a lawyer.
What is the Personal Health Information Protection Act?
- The Personal Health Information Protection Act (PHIPA) became law on November 1, 2004. It determines what happens to your health information when it is being collected, used or disclosed by people or organizations known as health information custodians. Health information custodians (HICs) include:
- health care practitioners, such as your doctor or dentist;
- hospitals;
- pharmacies;
- homes for special care;
- community health and mental health programs; and
- community care access centres.
- Before November 1, 2004, the Mental Health Act regulated what happened to your “clinical record” in a psychiatric facility. PHIPA now determines what happens to your record of personal health information (previously a “clinical record”). The Form 14 “Consent to the Disclosure, Transmittal or Examination of a Clinical Record” and the Form 28 “Request to Examine or to Copy Clinical Record” under the Mental Health Act should no longer be used. There are no specific forms which replace the Form 14 and Form 28. Each HIC may create their own form or use generic forms. A sample “Consent to Disclosure” form is available on the Ministry of Health and Long-Term Care website at www.health.gov.on.ca/english/providers/legislation/priv_legislation/consent/consent_disclose_form.doc
- A sample “Request to Access” form is available on the Information and Privacy Commissioner’s website at
www.ipc.on.ca/images/Resources/up-phipa_accfrm_e.pdf.
What is personal health information?
- Personal health information (PHI) is the information that health care providers (e.g., doctors, hospitals, dentists and pharmacies) collect about you and use to treat you. PHI includes information about:
- your physical health and mental health;
- your health history;
- your family health history;
- the health care you have received;
- your health card number; and
- the name of your substitute decision-maker.
What is a record of personal health information?
- It is the record kept by HICs who provide you with health care. The record may contain information which is written, printed, computerized or photographic. The record may include non-medical information such as the information collected from your family, friends and acquaintances. For example, your family may provide information about an incident which occurred prior to you being hospitalized. It was previously referred to in the Mental Health Act as the “clinical record.”
What is “collection, use or disclosure” under PHIPA?
- “Collection” occurs when the HIC obtains PHI about you in any form (e.g., oral, written, x-ray) and from any source including family and friends. For example, a hospital may send an emergency room visit report to your family physician.
- “Use” refers to the HIC using the PHI they have regarding you. For instance, information in your record of PHI at a hospital may be used if you are again admitted to that hospital for the same or a different reason.
- “Disclosure” occurs when the information in the possession of a HIC is shared with another HIC or a non-HIC. For example, the hospital may disclose information to a community program you will be attending upon discharge from the hospital.
Do I control the “collection, use or disclosure” of my personal health
information?
- Yes. If you are capable of consenting to the collection, use or disclosure of your PHI, you are able to control it. PHIPA does contain some exceptions to the general rule. Some of these exceptions are discussed in the companion InfoGuide called “Disclosure of Your Personal Health Information.”
What does it mean to be “capable” to consent to the collection, use or disclosure of personal health information?
- Everyone is presumed to be capable regarding PHI unless found otherwise. If you are capable, you can make decisions regarding the collection, use or disclosure of PHI. You will say “yes” or “no” to the collection, use or disclosure of your PHI. If you are incapable, decisions about the collection, use or disclosure of PHI will be made by your substitute decision-maker (SDM). The SDM will say “yes” or “no” to the collection, use or disclosure of your PHI. PHIPA specifies the people who may act as your substitute decision-maker if you are found to be incapable.
- An individual is capable if he or she is able
- to understand the information necessary to decide whether to consent or not consent to the collection, use or disclosure of PHI; and
- to appreciate the reasonably foreseeable consequences of giving, not giving, withholding or withdrawing consent.
- If you fail either part of the test, you are incapable. Capacity can fluctuate so you may be capable at some times and incapable at others. You may be capable regarding some parts of your PHI and not other parts. For example, you may be capable regarding information about your broken arm but incapable regarding information about your mental health.
What happens if I am incapable?
- A HIC (e.g., doctor, dentist) may determine that you are incapable. If the HIC is a hospital or other institution, the person making the determination is not specified in the legislation. This means that someone other than a health practitioner may decide that you are incapable e.g., a social worker. If it is reasonable in the circumstances, the HIC is to provide the incapable person with information about the consequences of the determination of incapacity.
What happens if I am incapable and an inpatient in a psychiatric facility?
- The doctor will probably make the determination about your capacity regarding PHI. Special rules apply if you are an inpatient in a psychiatric facility and 14 years of age or older. If you are determined to be incapable regarding PHI, you will
- promptly receive a written notice telling you that you are incapable (“Notice to Patient” Form 33); and
- promptly receive a visit from a Rights Adviser.
What if I disagree with the finding of incapacity?
- You have two options. First, you may talk to the person who made the decision to see if he or she will change your capacity from incapable to capable. Second, you may apply to the Consent and Capacity Board (the Board) for a hearing to challenge the decision that you are incapable regarding PHI.
Can I apply to the Consent and Capacity Board (CCB)?
- Yes. The application to the Board is a Form P-1. You can apply to the Board once in each six month period. The Board may allow an application earlier than six months if it is satisfied that there has been a material change in circumstances. However, you can not apply to the Board if you are incapable of consenting to treatment and have a substitute decision-maker in place.
What can the Consent and Capacity Board do?
- The Board will review the evidence and reasons why the HIC made a determination of incapacity regarding PHI. If the Board agrees that you are incapable, your substitute decision-maker will make the decisions regarding your PHI. If the Board does not agree, you will be considered capable and will make your own decisions regarding PHI.
If I am incapable, can someone I want make decisions for me?
- Yes. If you are 16 years of age or older, you may apply to the Board for the appointment of a representative who will be authorized to make decisions regarding your PHI. Another person who is 16 years of age or older may also apply to the Board to be appointed as your representative. There are some exceptions to this right.
- When appointing a representative, the Board may limit the time for the appointment, impose conditions, limit the scope of the decisions, or terminate the appointment. A person can not be appointed as your representative over your objection.
If I am capable, can I ask that a specific person make decisions for me?
- Yes. If you are at least 16 years of age, you may authorize someone in writing to make decisions about PHI on your behalf. The person you authorize must be at least 16 years of age and capable of consenting to the collection, use or disclosure of your PHI.
Do I own my record of personal health information?
- No. The record of PHI is owned by the HIC who has possession of it. You may request access to or a copy of all or part of the record. You may also consent to disclosing the record to others. The companion InfoGuides called “Access to Your Personal Health Information” and “Disclosure of Your Personal Health Information” discuss these topics.
What is a “lock box”?
- PHIPA allows you to identify certain PHI and to instruct the HIC not to disclose that information. This information is placed in the so-called lock box and may not be disclosed without your specific consent. However, there are some limitations in certain circumstances. For example, the lock box will not prevent disclosure if the HIC has reasonable grounds to believe that disclosure is necessary because of the possibility of harm to you or someone else.
- If the disclosing HIC is prevented from disclosing information about you to a second HIC that he or she considers necessary for the provision of health care, the disclosing HIC may notify the receiving HIC that there is information in a lock box. The receiving HIC will then be able to discuss with you the lock box situation and the information necessary to provide the health care.
Questions?
If you have any questions, you may contact your local Patient Advocate or Rights Adviser, or call the central office of the Psychiatric Patient Advocate Office at 1-800-578-2343.
Related PPAO Guides
Information and Privacy Commissioner
Telephone 416-326-3333 in Toronto or 1-800-387-0073
TDD/TYY 416-325-7539
www.ipc.on.ca
