Skip to main content
Search
  

 PHIPA : General Information

Printer Friendly Version

 

This Info guide has been prepared by the Psychiatric Patient Advocate Office in the Ministry of Health and Long-Term Care for general Informational purposes only.  It does not contain legal advice.  If you have a question of would like advice about your specific legal situation, you should contact a lawyer.

June 2016

What is the Personal Health Information Protection Act?
  • The Personal Health Information Protection Act, 2004 (PHIPA) became law on November 1, 2004. It sets out rules for the collection, use and disclosure of “personal health information”. These rules apply to people or organizations known as “health information custodians”. Health Information Custodians include:
    • health care practitioners, such as your doctor or dentist;
    • hospitals;
    • pharmacies;
    • homes for special care;
    • community health and mental health programs; and
    • community care access centers.

 

What is personal health information?

  • Personal health information includes the following information about you:
    • your physical health and mental health;
    • your health history;
    • your family health history;
    • the health care you have received;
    • your health card number; and
    • the name of your substitute decision-maker.
  • A Health Information Custodian may keep a record of personal health information in written, computerized or photographic form. Information that you provide to a Health Information Custodian in oral form is also considered to be personal health information.
  • Any other non-medical information about you that is included in your record (i.e. your address) is also treated as personal health information by a health information custodian.

 

What do “collect”, “use” and “disclose” mean under Personal Health Information Protection Act?

  • A Health Information Custodian “collects” your personal health information when the health information custodian receives or obtains the personal health information in any form (e.g., oral, written, x-ray) and from any source including family and friends. For example, your family physician, a health information custodian, may collect personal health information about you contained in an emergency room report sent to the physician by a hospital.
  • A Health Information Custodian “uses” your personal health information when it handles or deals with the personal health information, including reading or reviewing it. . For instance, information contained in your record of personal health information at a hospital may be used if you are again admitted to that hospital for the same or a different reason.
  • A Health Information Custodian “discloses” your personal health information when it makes it available to another Health Information Custodian or other person. For example, a hospital may disclose your personal health information to a community program you will be attending upon discharge from the hospital.

 

When can a Health Information Custodian Collect, Use and Disclose my Personal Health Information?

  • The general rule that is set out in the Personal Health Information Protection Act is that a Health Information Custodian must not collect, use or disclose personal health information about you unless:
    • You consent to the collection, use or disclosure of your personal health information; or
    • Personal Health Information Protection Act permits the Health Information Custodian to collect, use or disclose your personal health information without your consent.
      • For example, Personal Health Information Protection Act permits a Health Information Custodian to disclose your personal health information without your consent for the purpose of contacting your friend, relative, or Substitute Decision Maker, if you are injured and unable to consent personally.

 

What does it mean to be “capable” to consent to the collection, use or disclosure of personal health information?

  • You are presumed to be capable of consenting to the collection, use and disclosure of your personal health information unless the Health Information Custodian has reasonable grounds to believe that you are incapable of consenting. You are capable of consenting to the collection, use or disclosure of your personal health information if you are able:
    • to understand the information that is relevant to deciding whether to consent to or refuse to consent to the collection, use or disclosure of personal health information and
    • to appreciate the reasonably foreseeable consequences of giving, not giving, withholding or withdrawing consent.
  • If you don’t satisfy either part of the test, you are incapable. Capacity can fluctuate so you may be capable at some times and incapable at others. You may be capable regarding some parts of your personal health information and not be capable of other parts. For example, you may be capable of consenting to the collection, use and disclosure of personal health information about your broken arm, but incapable regarding information about your mental health.

 

What happens if I am incapable?

  • A Health Information Custodian (e.g., doctor, dentist) may determine that you are incapable under Personal Health Information Protection Act. If the Health Information Custodian is a hospital or other institution, the person making the determination is not specified in the legislation. This means that someone other than a health practitioner, but who is acting on behalf of the institution, may decide that you are incapable e.g., a social worker. If it is reasonable in the circumstances, the Health Information Custodian must provide the incapable person with information about the consequences of the determination of incapacity.

 

What happens if I am an inpatient in a psychiatric facility?

  • In most cases your doctor will make the determination about your capacity to consent to the collection, use or disclosure of your personal health information. If you are an inpatient in a psychiatric facility, 14 years of age or older and found to be incapable regarding personal health information, you will:
    • promptly receive a written notice telling you that you are incapable (“Notice to Patient” Form 33); and
    • promptly receive a visit from a Rights Adviser.

 

What if I disagree with the finding of incapacity?

  • You have two options. First, you may talk to the person who made the finding to see if he or she will change the finding from incapable to capable. Second, you may apply to the Consent and Capacity Board for a review of the determination that you are incapable of consenting to the collection, use or disclosure of your personal health information.

 

How do I apply to the Consent and Capacity Board?

  • You apply to the Consent and Capacity Board by completing a Form P-1. You can apply to the Consent and Capacity Board for a review of a determination of incapacity to consent to the collection, use or disclosure of your personal health information once in each six month period. The Consent and Capacity Board may allow an application earlier than six months if it is satisfied that there has been a material change in circumstances. The Consent and Capacity Board may not accept your application if you are incapable of consenting to treatment and have a substitute decision-maker in place.

 

What can the Consent and Capacity Board do?

  • The Consent and Capacity Board will review the evidence and reasons why the Health Information Custodian made a determination of incapacity regarding personal health information. The Consent and Capacity Board may confirm the determination of incapacity or may determine that you are capable of consenting to the collection, use or disclosure of your personal health information.

 

If I am incapable, can I choose who will consent to the collection, use and disclosure of my personal health information for me?

  • Yes. If you are 16 years of age or older, you may apply to the Consent and Capacity Board for the appointment of a representative who will be authorized to make decisions regarding your personal health information. Another person who is 16 years of age or older may also apply to the Consent and Capacity Board to be appointed as your representative. There are some exceptions to this right.
  • When appointing a representative, the Consent and Capacity Board may limit the time for the appointment, impose conditions, limit the scope of the decisions, or terminate the appointment. A person cannot be appointed as your representative over your objection.

 

If I am capable, can I ask that a specific person make decisions about the collection, use and disclosure of my personal health information for me?

  • Yes. If you are at least 16 years of age, you may authorize someone in writing to make decisions about personal health information on your behalf. The person you authorize must be at least 16 years of age and capable of consenting to the collection, use or disclosure of your personal health information.

 

Do I own my record of personal health information?

  • No. The record of personal health information is owned by the Health Information Custodian who has possession of it. However, you may request access to or a copy of all or part of the record. You may also consent to the disclosure of the record to others. For information on accessing your personal health information, see the companion Info Guide “Access to Your Personal Health Information.”

 

What is a “lock box”?

  • Personal Health Information Protection Act allows you to identify certain personal health information and to instruct a Health Information Custodian not to disclose that information. This information is placed in the so-called “lock box” and may not be disclosed without your specific consent. There are some limitations to this. For example, the lock box will not prevent disclosure if the Health Information Custodian has reasonable grounds to believe that disclosure is necessary because of the possibility of significant harm to you or someone else.
  • If you “lock” your personal health information and a Health Information Custodian is prevented from disclosing it in a circumstance where the Health Information Custodian feels the disclosure of the personal health information to another Health Information Custodian is necessary to provide your care, the Health Information Custodian who is prevented from disclosing the personal health information must notify the other Health Information Custodian of this fact. The other Health Information Custodian may decide to discuss this further with you.

 

Questions?

  • If you have questions about the rules regarding the collection, use and disclosure of your personal health information, you may wish to contact the:
    • Information and Privacy Commissioner
    • Telephone 416-326-3333 in Toronto or 1-800-387-0073
    • TDD/TYY 416-325-7539
  • If you have questions contact your local Patient Advocate or Rights Adviser or call the Psychiatric Patient Advocate Office at 1-800-578-2343.
   

CONTACT US | ACCESSIBILITY | PRIVACY | © QUEEN'S PRINTER FOR ONTARIO | IMPORTANT NOTICES