CONSENT AND THE PERSONAL HEALTH INFORMATION PROTECTION ACT, 2004

1. CONSENT AND THE PERSONAL HEALTH INFORMATION PROTECTION ACT, 2004 PHIPA Summit 2005 November 3, 2005 Halyna Perun, Counsel, Ministry of Health and Long-Term Care Mary Jane Dykeman, Legal Counsel Manuela Di Re, Counsel, Information & Privacy Commissioner Notice: This presentation should not be relied on as legal advice. Consult the legislation, regulations, and your legal counsel for information related to specific circumstances.

2. Fundamental Consent Provisions 1. A health information custodian shall not collect, use, or disclose personal health information unless: • Consent has been obtained and, to the best of the health information custodian’s knowledge, the collection, use or disclosure is necessary for a lawful purpose; OR • It is permitted or required by the Act • Consent may be express or implied, except when the Act specifies that consent must be express • Consent, whether express or implied, must satisfy the requirements of the Act (Sections 18 and 29)

3. EXPRESS VERSUS IMPLIED CONSENT

4. Express Versus Implied Consent • Consent may be express or implied, except when the Act specifies that consent must be express 2. Express consent (consent explicitly provided either orally or in writing) is required: • To disclose personal health information to a non-health information custodian (subject to exceptions) • To disclose personal health information to another health information custodian for a purpose other than health care • To collect, use or disclose personal health information for marketing or market research • To collect, use or disclose personal health information for fundraising if use more than name and address (Section 18(3), 32 and 33)

5. Implied Consent for Health Care Purposes • Implied consent is a consent a health information custodian concludes based on an individual’s action or inaction in particular factual circumstances • Consent may be implied: • To collect or use personal health information for any purpose (other than for fundraising where conditions of implied consent not met or for marketing) • To disclose personal health information to another health information custodian for the purpose of providing or assisting in providing health care (Section 18(3), 32 and 33)

6. Assumed Implied Consent for Health Care Purposes GENERAL RULE Some health information custodians whose core function is the provision of health care may assume implied consent to the collection, use or disclosure of personal health information for the purpose of providing or assisting in providing health care if the health information custodian receives the information from another health information custodian, the individual or the individual’s substitute decision maker EXCEPTION If the health information custodian is aware that the individual has withheld or withdrawn consent (Section 20(2))

7. Implied Consent for Non - Health Care Purposes A health information custodian may imply consent in the following situations for non-health care purposes: • To the disclosure of personal health information to representatives of religious or other organizations provided: • The individual is offered an opportunity to withhold or withdraw consent; and • The individual has not withheld or withdrawn consent 2. To the disclosure of personal health information by a pharmacist to a third party requested to provide payment to the pharmacist for medications or related goods or services 3. To collect, use or disclose the name and address of the individual or substitute decision maker (where applicable) for fundraising if section 10 of the Regulation is satisfied (Sections 20(4) and 32 and Section 8 of Regulation 329/04)

8. REQUIREMENTS FOR VALID CONSENT

9. Requirements for Valid Consent Consent, whether express or implied, must: • Be the consent of the individual or his or her substitute decision maker (where applicable), • Be knowledgeable, meaning it must be reasonable to believe that the individual knows: • The purpose of the collection, use or disclosure; and • That the individual may give or withhold consent • Relate to the information, and • Not be obtained by deception or coercion. (Section 18(1))

10. Notice of Purposes • A health information custodian may rely on a notice of purposes to support the reasonable belief that the individual knows the purposes of the collection, use, or disclosure of personal health information • If a health information custodian wishes to rely on a notice of purposes, the notice: • Must be posted where it is likely to come to the attention of the individual or must be provided to the individual; • Must outline the purposes for which the health information collects, uses or discloses personal health information; and • Should advise the individual that he or she has the right to give or withhold consent • A Notice of Purposes is not required where a health information custodian may assume implied consent but it is a best practice to have a notice of purposes (Section 18(6))

11. Assumption of Validity of Consent • Where consent is obtained or a document is received purporting to record consent to the collection, use or disclosure of personal health information, a health information custodian is entitled to assume that: • the consent fulfils the requirements of the Act; and • the individual has not withdrawn the consent unless it is not reasonable to assume so • Consent to collection, use or disclosure of personal health information given before November 1, 2004 is valid if it meets the requirements for consent in the Act (Sections 18(7) and 20(1))

12. WHO MAY CONSENT ON BEHALF OF AN INDIVIDUAL

13. Consent and Capable Individuals 1. Where an individual is capable, consent may be provided by: • the individual, or • if the individual is sixteen or older, any capable person sixteen years of age or older authorized in writing by the individual to provide consent on his or her behalf • An individual is capable if he or she is able to: • Understand information relevant to deciding whether to consent; and • Appreciate the reasonably foreseeable consequences of giving, not giving, withholding or withdrawing consent • Individuals are presumed capable regardless of age unless there are reasonable grounds to believe otherwise (Sections 21(1), 21(4) and 23(1))

14. Consent and Incapable Individuals Where an individual is incapable, the following persons (in the following order of priority) may consent: • A substitute decision-maker under the Health Care Consent Act with respect to consent necessary for or ancillary to a decision about treatment, long-term care admission or a personal assistance service; • Guardian of the person or guardian of property (with authority); • Attorney for personal care or attorney for property (with authority); • Representative appointed by the Consent and Capacity Board; • Spouse or partner; • Child or custodial parent (subject to exceptions); • Parent with only a right of access; • Brother or sister; • Any other relative; or • Public Guardian and Trustee (as a last resort). (Sections 26(1) and 26(11))

15. Consent and Deceased Individuals Where an individual is deceased, consent may be provided by: • The estate trustee; or • If there is no estate trustee, the person responsible for administering the estate (Section 23(1) 4)

16. Consent and Children • If a child is capable, the child may consent • If a child is capable and 16 or older the child may authorize another capable person who is at least 16 years old to provide consent on his or her behalf provided it is in writing • If a child is capable and less than 16, a custodial parent, Children’s Aid Society or person lawfully entitled to stand in the place of a parent may consent EXCEPT : • If the personal health information relates to treatment about which the child has made a decision on his or her own pursuant to Health Care Consent Act, 1996 • If the personal health information relates to counselling in which child participated on his or her own under the Child and Family Services Act In event of conflict, the decision of the capable child prevails 4. If a child is incapable, the same persons who may consent for an incapable individual can consent for an incapable child

17. Reliance on Assertions Unless unreasonable in the circumstances, a health information custodian may rely on the accuracy of an assertion made by a person that: • the person is entitled to consent to the collection, use or disclosure of personal health information of the individual; • the person is over the age of sixteen; • the person is not prohibited by a court order or separation agreement from having access to the individual; • No other person ranked higher or equally exists or if they exist, they would not object to the person making the decision (Section 71(4))

18. WITHDRAWING CONSENT AND EXPRESS INSTRUCTIONS

19. Meaning of the Term “Lock Box” • “Lock Box” is not a defined term in the Act • It is generally used to mean the qualified right of an individual to: • Withdraw consent to the collection, use and disclosure of personal health information pursuant to section 19 (1), including for the provision of health care; or • Provide an express instruction not to use or disclose personal health information for purposes of providing health care in circumstances (generally without consent) set out in sections 37(1)(a), 38(1)(a) and 50(1)(e) of the Act

20. Delay in Implementation • Effective November 1, 2004, individuals are entitled to withdraw consent to the collection, use and disclosure of personal health information, including for health care purposes • Extension to November 1, 2005, granted to public hospitals only with respect to express instructions: • Related to uses of personal health information where the information was collected pursuant to section 36(1)(b) because it was reasonably necessary for the provision of health care (section 37(1)(a)) • Related to disclosures of personal health information to certain health information custodians without consent that are reasonably necessary for the provision of health care (section 38(1)(a)) • Related to disclosures of personal health information to persons outside Ontario without consent that are reasonably necessary for the provision of health care (section 50(1)(e)).

21. Duties Arising From “Lock Box” Requests 1. A health information custodian must comply with a withdrawal of consent or an express instruction (subject to exceptions) 2. Compliance may be achieved through: • Policies, procedures or manual processes; • Electronic or technological means; or • Combination of the above 3. Where a health information custodian is prevented from disclosing to certain other health information custodians personal health information that is believed to be reasonably necessary for the purpose of providing health care: • The disclosing health information custodian must notify the other health information custodian of that fact; and • The receiving health information custodian may explore the matter with the individual and seek consent to access the locked information (Sections 20(3) and 38(2))

22. Inapplicability of “Lock Box” A health information custodian must comply with a withdrawal of consent or an express instruction unless: • The individual changes his or her mind, • The Act permits the collection, use or disclosure to be made without consent, except: • uses where the personal health information was collected with or without consent because the collection was reasonably necessary for the provision of health care (section 37(1)(a)) • disclosures to certain health information custodians without consent that are reasonably necessary for the provision of health care (section 38(1)(a)) • disclosures to persons outside Ontario without consent that are reasonably necessary for the provision of health care (section 50(1)(e)).

23. PERMITTED INDIRECT COLLECTION WITHOUT CONSENT

24. Permitted Indirect Collections Without Consent Permitted in certain circumstances, such as where: • It is reasonably necessary for providing health care and it is not reasonably possible to collect personal health information: • that can reasonably be relied on as accurate directly from the individual; • directly from the individual in a timely manner • It is collected by a health information custodian who is a FIPPA/ MFIPPA institution for purposes of conducting a proceeding, investigating a breach of agreement or law or its statutory function • The Information and Privacy Commissioner authorizes another manner of collection • It is collected from a person permitted or required by law to disclose it to the health information custodian • The health information custodian is permitted or required by law to collect the personal health information indirectly

25. PERMITTED USES WITHOUT CONSENT

26. Permitted Uses Without Consent Permitted in certain circumstances, such as: • For purposes for which it was collected and for all functions reasonably necessary for carrying out that purpose (unless collected with consent or under section 36(1) (b) and the individual expressly instructs otherwise) • Planning or delivering health programs or services • Obtaining payment, processing, monitoring, verifying or reimbursing claims for payment • Risk or error management to improve or maintain the quality of programs or services

27. Permitted Uses Without Consent (Continued) 5. Educating agents to provide health care • For a proceeding or contemplated proceeding in which the health information custodian or agent is a party or witness if it relates to a matter at issue • Uses permitted or required by law • Research provided the following conditions are met: • A research plan prepared; • The research approved by research ethics board; and • The researcher agrees to comply with the Act.

28. PERMITTED DISCLOSURES WITHOUT CONSENT

29. Permitted Disclosures Without Consent Permitted in certain circumstances, such as: • To certain health information custodians when reasonably necessary for providing health care and cannot obtain timely consent (unless individual expressly instructs otherwise) • To enable the Minister or another health information custodian to determine or provide funding or payment to the health information custodian for the provision of health care • Where reasonable grounds to believe disclosure is necessary to eliminate or reduce a significant risk of serious bodily harm • For a proceeding or contemplated proceeding in which the health information custodian or agent is a party or witness if it relates to a matter at issue • To comply with summons, court order or similar requirement

30. Permitted Disclosures Without Consent (Continued) 6. To a researcher for research purposes provided: • Receive a written application • Receive a research plan that satisfies the Act • Receive a copy of the Research Ethics Board decision • Enter into an agreement with the researcher that satisfies the Act 7. To a person carrying out an inspection, investigation or procedure authorized by warrant or by law 8. To the Chief Medical Officer of Health or a Medical Officer of Health for Health Protection and Promotion Act purposes 9. To a regulatory college for purposes of enforcement of the Drug and Pharmacies Regulation Act, Regulated Health Professions Act, 1991 or an Act mentioned in Schedule 1 to the Regulated Health Professions Act, 1991 10. Where permitted or required by law

31. Permitted Disclosures Without Consent (Continued) • To the Public Guardian and Trustee, Children’s Lawyer or Children’s Aid Society so that they can carry out their statutory functions • A health information custodian that is a facility that provides health may disclose to a person: • the fact that an individual is a patient or resident; • the individual’s general health status described as critical, poor, fair, stable or satisfactory; and • the location of the individual in a facility Provided the individual was offered, at the first reasonable opportunity, the ability to object and did not do so

32. Tools and Resources Tools and resources available on the Information and Privacy Commissioner website at www.ipc.on.ca: • Frequently Asked Questions: Personal Health Information Protection Act • Guide to the Personal Health Information Protection Act • Lock-box Fact Sheet • Consent and Form 14 Fact Sheet • Ontario Poison Information Centres and the ‘Circle of Care’ Fact Sheet • Disclosure of Information in Emergency/Urgent Circumstances Fact Sheet • Frequently Asked Questions: Health Cards and Health Numbers • Reporting Requests under PHIPA Fact Sheet • Fundraising under PHIPA Fact Sheet • Safeguarding Personal Health Information Fact Sheet • Link to website of Ministry of Health and Long Term Care www.health.gov.on.ca