What the New Personal Health Information Protection Act Means for Practitioners

By Richard Steinecke

On November 1, 2004 new provincial privacy legislation specifically designed for the handling of health information will go into effect. The legislation’s impact on practitioners will likely be largely positive. It will clarify matters about consent that may have been uncertain under the current federal legislation, the Personal Information Protection and Electronic Documents Act (PIPEDA).

The Personal Health Information Protection Act, 2004 (PHIPA) applies to any collection, use and disclosure of personal health information by a “health information custodian”. This is a significant expansion from PIPEDA which generally applied only to practitioners working in private practice. PHIPA will apply to almost all practitioners in clinical practice.

In essence, PHIPA applies to any personal health information collected, used or disclosed by a custodian (i.e., health practitioners and facilities) regardless of whether the custodian engages in commercial activities. Practitioners who work for a health facility or health agency will generally be able to fit under their information practices. Each custodian must appoint an information officer, called a “contact person”.

First the bad news. PHIPA imposes a few new, and perhaps, onerous obligations. For example, if there is a privacy breach, custodians have an obligation to notify their client of the theft, loss or unauthorized access. There is also an explicit duty on agents of custodians, like a practitioner employed by a health facility, to notify the custodian if the agent has been involved in a security breach.

PHIPA is enforced by the Ontario Information and Privacy Commissioner. The Commissioner has broad powers of investigation and can directly order a custodian to comply with their PHIPA obligations. Practitioners are also subject to prosecution for breaches of PHIPA and to civil actions for damages, including a maximum of $10,000 for mental anguish.
However, the good news is that PHIPA clarifies a number of ambiguities that exist under both PIPEDA and under the current patchwork quilt of statute and case law.

PHIPA provides more workable consent procedures for the collection, use and disclosure of personal health information. Generally implied consent will be sufficient in the course of providing health care. A poster or brochure readily available and likely to be seen by a client can be used to support implied consent. Practitioners can even assume implied consent for disclosure of personal health information to other custodians who are treating the client. In addition, practitioners can usually assume that a signed consent form relating to personal health information is valid. Also, the rules for substituted consent for information handling are very similar to those for substituted consent for treatment decisions.

Some recurring problem areas are also addressed by PHIPA. For example, a direction from a client not to record pertinent information is invalid. Also, if a client directs that relevant information not be provided to another custodian, practitioners can warn the recipient that they are receiving only part of the file.

PHIPA also provides for more scope for using and disclosing personal health information without the client’s consent. These include using the information for health care planning and delivery, risk management and education. Disclosure of personal health information can generally be made without consent to others on the health care team, to provide basic status reports on those admitted to facilities, to support families and friends of a deceased client, for audit and accreditation purposes, for serious safety issues and to successor custodians (e.g., the purchaser of a practitioner’s practice).

PHIPA requires that reasonable safeguards be taken to protect personal health information. As noted above, clients have the right to be advised of privacy breaches. IT suppliers to custodians must comply with certain standards. However, with client consent, records can be reasonably stored at the client’s home or at an off-site storage facility.

In addition, PHIPA provides for a more health-specific system for client access and correction of their records. For example, access requests can be refused for quality assurance information, for raw data from psychological tests and where there is a risk of significant harm to either the client or others. Correction requests can be declined for professional opinions and observations and, in many circumstances, where the record was provided by another custodian. In addition, custodians do not have to provide copies of corrected records (or statements of disagreements) to those the custodian has previously disclosed the disputed personal health information unless the notification would have an impact on the client’s care or otherwise benefit the client.

Most practitioners who have developed privacy policies to comply with PIPEDA will only have to make minor adjustments to them as a result of PHIPA.

Accompanying PHIPA is a related statute called the Quality of Care Information Protection Act, 2004. QCIPA protects certain information from being used against a practitioner or other custodian in any civil or other proceeding (including discipline proceedings). For example, information compiled by a risk management committee at a facility or by the College’s quality assurance program about a practitioner is protected. Even information collected by a practitioner in order to comply with the College’s quality assurance program cannot be used against the practitioner. This statute will provide greater assurance to practitioners so that, when they take steps to improve their practice or that of their facility, they will not be creating liability for themselves.

Richard Steinecke is the author of A Complete Guide to the Regulated Health Professions Act and has written and spoken extensively on privacy law.