PHARMACY CONNECTION ARTICLE

Releasing Personal Health Information

Published on: August 1, 2013 banner personal health information

All regulated health professionals are legally and ethically obligated to protect the confidentiality of a patient’s personal health information. This article will provide an overview of what a member should consider in determining whether he or she has the authority to release a patient’s personal health information in selected circumstances. According to the rules established in 2004 under the Personal Health Information Protection Act (PHIPA), personal health information may only be disclosed by health information custodians if the individual consents, or if PHIPA specifically permits the disclosure without consent. Under the Act, health information custodians are both organizations (hospitals, long term care homes, pharmacies, etc.) and persons (health care practitioners).1 As health information custodians, members of the Ontario College of Pharmacists, including pharmacists, registered pharmacy students, interns and pharmacy technicians, have a responsibility to collect, disclose and dispose of personal health information according to the rules established in PHIPA, and to ensure that information is protected against theft, loss, and unauthorized use or disclosure.

In general, according to the Act, personal health information cannot be shared without the express consent of the person to whom it relates; however, personal health information can be shared without express consent when it is shared between health information custodians who are providing health care to the same individual.2 In this situation, the health providers are entitled to assume an individual’s implied consent to disclose personal health information for the purpose of providing health care.3 A pharmacist and all other regulated health professionals providing care to the same patient are within the circle of care and can therefore exchange information quickly and efficiently to facilitate treatment. As an illustration of how this ‘circle of care’ works, the Information and Privacy Commissioner provided the following examples:

“pharmacists are permitted to advise specialists about drug interactions; specialists are permitted to send reports to referring physicians; and Community Care Access Centres are permitted to provide test results to referring physicians to facilitate treatment of an individual” unless the person to whom the information relates explicitly states otherwise.4

There are additional circumstances where personal health information can be shared without the express consent of an individual. The following are examples that illustrate when such disclosure is permitted:

Disclosures Permitted

  1. For the purpose of determining eligibility of the person to receive health care and related goods, services or benefits (PHIPA [s.39(1)(a)])

Where a pharmacist is disclosing personal health information to a third party who is being asked to provide payment for medication or related goods or services.5

  1. To a person who compiles or maintains a registry of personal health information for purposes of facilitating or improving the provision of health care (PHIPA [s.39(1)(c)])

The Narcotics Safety and Awareness Act, 2010 permits the Ontario Ministry of Health and Long-Term Care to collect, use and disclose information, including personal information and personal health information that relates to the prescribing and dispensing of prescription narcotics and other monitored drugs. The legislation requires prescribers, dispensers and pharmacy operators to disclose information related to prescriptions to the Minister or executive officer.

  1. To another College for the purpose of administration or enforcement of the Drug and Pharmacies Regulation Act, the Regulated Health Professions Act, 1991, or an Act named in Schedule 1 of that Act (PHIPA [s.43(1)(b)])

But what about occasions when a request for information is not an administrative matter, such as when a police officer requests information about a patient; or, when a parent requests information about a minor child who has requested smoking cessation therapy or the morning after pill? Should a member release information to the policeman, or disclose information to a child’s parent?

Disclosures in specific circumstances

Disclosure to Police

What happens in the course of litigation, or when a law enforcement agent requests information in the course of carrying out an investigation?

A health information custodian is not free to disclose personal health information about an individual without the express consent of the individual, or incapable individual’s substitute decision maker, or as required or permitted by law, for example, pursuant to a warrant or court order (PHIPPA [s.43(1)]).

Information may only be disclosed when the health professional is presented with a warrant, court order, production order, or under authority established in legislation, for example, the Coroners Act. Should a warrant or court order be produced, care must be taken to ensure that only the information outlined in the document is released. For example, a summons may require a member to attend a court at a particular time and to take a specific patient record. In this case the summons does not authorize the member to discuss the patient’s care with, or show the record to, anyone in advance of the court appearance.

When information is disclosed, the member is required to document any details related to the disclosure in the patient record, including an officer’s name and badge number along with a photocopy of the warrant, court order, production order, or other authority relied upon to release the information.

Disclosure to a parent

Ontario does not specify an age of consent, whether with respect to treatment or related to the release of personal health information. This means that any person may consent to receive a medical treatment, regardless of age, if he or she is able to understand the information about the treatment, including possible risks and benefits. In terms of pharmacy, medical treatment includes receiving prescriptions for medications and products such as contraceptives and smoking cessation aids. Permission from a parent is not required for a minor child if the pharmacist believes the patient understands the information provided and is able to give an informed consent.

A young person also has the right to make his or her own decisions about the collection, use or disclosure of personal health information. If a child under the age of 16 has given his or her own consent under the Health Care Consent Act to treatment, or participated in counselling under the Child and Family Services Act, any decisions related to releasing information are the child’s to make. If there is a conflict between a parent and the capable child who is under 16, the decision of the child overrides that of the parent.6

What about the responsibilities of the pharmacist where the cardholder of a prescription drug plan wants to know the details of drug usage by a family member covered under the plan? Would the family member who is not the cardholder need to give permission or sign a consent form for the release of their own personal health information?

This circumstance would constitute disclosure of personal health information by a health information custodian to a non-health information custodian, which can only be done on the basis of express consent. Accordingly it would be required to seek consent from the other family member or members who are covered under the cardholder’s health plan. If the information the cardholder is seeking relates to his or her child under 16, it would be appropriate for the pharmacist to determine whether the child has the capacity to consent to the release of his or her own personal health information. If the child is capable and disagrees with the release, the child’s decision prevails.7

Under any circumstance when disclosing personal health information, a member is encouraged to keep copies of relevant agreements or court orders in the patient’s record. Documentation of a patient’s consent to disclose personal health information ought also to be kept. A printable form to document patient consent is available; it can be completed and scanned back into a record as required: http://www.health.gov.on.ca/english/providers/legislation/priv_legislation/consent/consent_disclose_form.pdf

Refusal to Disclose

Refusing disclosure to a patient

A patient may be refused access to their own information in a number of situations, including in those circumstances where the health information custodian believes that access:

  • Would result in a risk of serious harm to the treatment or recovery of the patient, or a risk of serious bodily harm to someone else;
  • Would interfere with an inspection or investigation under a statute, i.e. the Coroners Act and the matter is ongoing; or
  • Would reveal the identification of a person who provided health information to the member explicitly or implicitly in confidence and in circumstances in which it was appropriate that the person’s name be kept confidential.8

Conversations with, or about, patients

There are several instances where a member needs to ask questions and/or discuss personal health matters with a patient, another health care professional, and/or pharmacy staff. While not within the formal context of releasing personal health information, it is essential that precautions are taken to protect a patient’s information. Pharmacies are required to have a separate and distinct patient consultation area where a pharmacist can engage a patient in dialogue about medications.9 Members and pharmacy staff should be careful about discussing patient matters on the telephone, within hearing distance of others.

When it is necessary to leave a voice message for a patient on an answering machine, or with a third party, members are advised to exercise caution regarding the content of the message. While it is acceptable for messages to contain the name and contact information of the member or the pharmacy, messages should not contain any personal health information related to a patient, such as details of the patient’s medical condition, medications or other personal health matters. It should be noted that while social media are great tools to market health promotional materials, research medical information, and for patients to seek out communities, they are not appropriate for sharing personal health information between health care providers and patients. Regardless of the communication medium that is used, health care professionals remain subject to the same rules governing the security and privacy of patient information.10

In 2011, the Council of the Ontario College of Pharmacists approved a guideline in 2011 on Record Retention, Disclosure and Disposal which includes principles for working with personal health information. This is a useful a resource for members in determining their obligations under the legislation. If in doubt about the authority to release personal health information in circumstances beyond the routine delivery of care, it is recommended to err on the side of caution and seek advice or clarification using trusted resources, such as the ones that have been referenced in this article.

REFERENCES

  1. Personal Health Information Protection Act, 2004, SO 2004, c 3, Sch A http://canlii.ca/t/51xrp
  2. Information and Privacy Commissioner/Ontario. Dispelling the Myths Under the Personal Health Information Protection Act; September 2012. Retrieved at http://www.ipc.on.ca/images/Resources/dispelling-myths-under-phipa.pdf
  3. Information and Privacy Commissioner/Ontario. Circle of Care: Sharing Personal Health Information for Health-Care Purposes. Retrieved at http://www.ipc.on.ca/english/Resources/Best-Practices-and-Professional-Guidelines/Best-Practices-and-Professional-Guidelines-Summary/?id=885
  4. Toronto Star. “Dispelling myths on health privacy” Wednesday July 3, 2013. Retrieved at thestar.com
  5. Information and Privacy Commissioner/Ontario. A Guide to the Personal Health Information Protection Act, December 2004. Retrieved at http://www.ipc.on.ca/images/resources/hguide-e.pdf
  6. Information and Privacy Commissioner/Ontario. Commissioner’s PHIPA Highlights. Retrieved at: http://www.ipc.on.ca/images/Resources/up-phipa02_e.pdf
  7. Ibid.
  8. Canadian Mental Health Association, Ontario. Community Mental Health and Addictions Privacy Toolkit, September 2005, p.7-4. Retrieved at http://ontario.cmha.ca/files/2013/01/privacy_toolkit.pdf. P.7-5
  9. Ontario Regulation 58/11 s.22(1)(d)
  10. Canadian Medical Association. Social media and Canadian physicians – issues and rules of engagement. Retrieved at http://www.cma.ca/advocacy/social-media-canadian-physicians
Print page