Disclosing Personal Health Information
Safeguarding patient information is a critical component of pharmacy practice. All regulated health professionals in Ontario—including pharmacists and pharmacy technicians—are legally and ethically obligated to protect the confidentiality of a patient’s personal health information. But are there situations where it may be appropriate to disclose a patient’s personal health information without their express consent?
Ontario’s Rules Surrounding Personal Health Information
Ontario’s Personal Health Information Protection Act (PHIPA) sets out rules for the collection, use and disclosure of personal health information while facilitating the effective provision of health care. These rules apply to all health information custodians—including pharmacy professionals and operators of pharmacies or hospitals—operating in Ontario. With some exceptions, the legislation requires health information custodians to obtain consent before they collect, use or disclose personal health information.
In addition to legislation, the College’s Code of Ethics expects that pharmacy professionals “respect the patient’s right to privacy and do not disclose confidential information without the consent of the patient unless authorized by law or by the need to protect the welfare of the patient or the public” (section 3.6).
When It May Be Appropriate to Disclose Personal Health Information
The College’s Fact Sheet — Releasing Personal Health Information describes some of the most common disclosures permitted by pharmacists/pharmacies as health information custodians under Ontario’s PHIPA. For example, information may be disclosed when a pharmacy professional is presented with a warrant, court order, production order, or under authority established in legislation, such as the Coroners Act and the Missing Persons Act. There may be other legislation—such as Canada’s Criminal Code or the province’s Child, Youth and Family Services Act— which may prevail over PHIPA.
College privacy-related FAQs also explore how to approach summons from another regulatory body requesting patient identifying information for an investigation, and providing details of a deceased patient’s profile to family members.
The Information and Privacy Commissioner of Ontario, who provides oversight of Ontario’s access and privacy laws including PHIPA, has additional resources to guide registrants in their decisions surrounding personal health information, including:
- Fact Sheet – Disclosure of Personal Information to Law Enforcement
- Fact Sheet – Disclosure of Information Permitted in Emergency or other Urgent Circumstances
- Yes, You Can. Dispelling the Myths About Sharing Information with Children’s Aid Societies
- Fact Sheet – Obtaining Personal Health Information About a Deceased Relative
- Circle of Care: Sharing Personal Health Information for Health-Care Purposes
As always, supporting documentation is essential as evidence of your decision-making process and rationale. If a registrant is uncertain about their obligations after reviewing the appropriate resources and legislation, they may wish to obtain independent legal advice or consult with their corporation’s privacy officer.