Circle of Care – Sharing Personal H

Circle of Care – Sharing Personal Health Information for Health Care Purposes Massage Therapists are often asked to share information on their clients. When is this allowed and when does it require additional consent from the client? Under the Personal Health Information and Protection Act (PHIPA) consent from a client may be expressed or implied. A Health Information Custodian (HIC) may disclose personal health information to another Health Information Custodian for the purpose of providing health care. The consent of the individual is implied, unless the individual has specifically withheld or withdrawn the consent. This situation is commonly referred to as Circle of Care. Express, or written, consent from a client is required to disclose personal health information to another health care provider where the intent is not to provide health care, or to a third party who is not a HIC. The term “circle of care” is not a defined term in the Personal Health Information Protection Act, 2004 (PHIPA). It is a term commonly used to describe the ability of certain health information custodians to assume an individual’s implied consent to collect, use or disclose personal health information for the purpose of providing health care, in circumstances defined in PHIPA. A health information custodian may only assume an individual’s implied consent to collect, use or disclose personal health information if all of the following six (6) conditions are satisfied. 1. The health information custodian must fall within a category of health information custodians that are entitled to rely on assumed implied consent. For the purpose of providing health care or assisting in the provision of health care to an individual, most health care practitioners or institutions may rely on assumed implied consent to collect, use and disclose personal health information. A health information custodian is a person or organization described in PHIPA with custody or control of personal health information as a result of, or in connection with, the performance of its powers, duties or work. Health information custodians include: • Health care practitioners • Long-term care homes • Community care access centres • Hospitals, including psychiatric facilities • Specimen collection centres, laboratories, independent health facilities • Pharmacies • Ambulance services • Ontario Agency for Health Protection and Promotion Some health information custodians are not entitled to rely on assumed implied consent. These include: • An evaluator within the meaning of the Health Care Consent Act, 1996; • An assessor within the meaning of the Substitute Decisions Act, 1992; • The Minister or Ministry of Health and Long-Term Care; • The Minister or Ministry of Health Promotion; • The Canadian Blood Services. 2. The personal health information to be collected, used or disclosed by the health information custodian must have been received from the individual, his or her substitute decision-maker or another health information custodian. Personal health information is defined in PHIPA as identifying information relating to the physical or mental health of an individual, the provision of health care to an individual, the identification of the substitute decision-maker for the individual and the payments or eligibility of an individual for health care or coverage for health care, including the individual’s health number. A substitute decision-maker is a person authorized under PHIPA to consent on behalf of an individual to the collection, use or disclosure of personal health information. It cannot be assumed that implied consent has been given if the personal health information to be collected, used or disclosed was received from a third party. For example, a health information custodian may not rely on assumed implied consent if the personal health information was received from an employer, insurer or educational institution. 3. The health information custodian must have received the personal health information that is being collected, used or disclosed for the purpose of providing or assisting in the provision of health care to the individual to whom it relates. If the personal health information received was obtained for a reason other than providing health care, express consent must be received in order to use that information. Personal health information obtained for the purposes of research, fundraising, marketing, etc. may only be used if express consent has been received from the individual or substitute decision maker. For example, a Massage Therapist may only use their client list as a marketing tool with the express consent from the client. 4. The purpose of the collection, use or disclosure of personal health information by the health information custodian must be for the provision of health care or assisting in the provision of health care to the individual. A health information custodian may collect information using implied consent for the purpose of providing health care to an individual. They may collect health information for other purposes, such as research, fundraising or marketing, with the express consent of the individual or substitute decision maker for the use of the information. 5. In the context of disclosure, the disclosure of personal health information by the health information custodian must be to another health information custodian. A health information custodian may not assume an individual’s implied consent in disclosing personal health information to a person or organization that is not a health information custodian, regardless of the purpose of the disclosure. Without express consent from the individual or substitute decision maker, personal health information may not be shared with a third party such as an insurance company or a non-Health information custodian such as a spa owner. 6. The health information custodian that receives the personal health information may not be made aware that the individual has expressly withheld or withdrawn his or her consent to the collection, use or disclosure. PHIPA permits an individual to expressly withhold consent to share personal health information. This is the concept of a “lock box” where the client can decide what information can and cannot be shared with other health care professionals. If the client has expressly withheld consent around personal health information, that information cannot be shared. Disclosure that there is information being withheld is up to the health information custodian providing the information. If the health information custodian providing the information is of the opinion that some of the information that has been locked is reasonably necessary for the provision of health care, they may disclose to the receiving custodian that there is additional information that cannot be disclosed. This allows the receiving custodian the opportunity to discuss the issue with the client to assist disclosure or to receive express consent to unlock the relevant information. The other exception to the “lock box” concept which can be found in PHIPA is if the health care professional has reasonable and probable grounds that disclosure of the information is necessary for the purpose of eliminating or reducing serious bodily harm to a person or group of persons. Further information For further information about the ability of an individual to expressly withhold or withdraw consent to the collection, use or disclosure of personal health information for health-care purposes, and the obligations on health information custodians in this context, please refer to the Lock-box Fact Sheet produced by the Information and Privacy Commissioner of Ontario, which is available at www.ipc.on.ca. Quick Reference Elements of Consent The consent of an individual for the collection, use or disclosure of personal health information by a health information custodian: • Must be a consent of the individual or his or her substitute decision-maker; • Must be knowledgeable; • Must relate to the information that will be collected, used or disclosed; and • Must not be obtained through deception or coercion. For consent to be knowledgeable, it must be reasonable to believe that the individual knows the purpose of the collection, use or disclosure and knows that he or she may give or withhold consent. It is a best practice that a health information custodian’s privacy policy includes an outline of circumstances where consent may be assumed to be implied. The privacy policy should include the purpose for the collection, use or disclosure of personal health information. The policy should be readily available to all clients either by physically posting the policy in the clinic, including the policy on the health history form, or posting the policy on the clinic’s website. CEU Questions 1. When is implied consent enough to share client information? 2. When would you need to get express consent? 3. Who can be a health information custodian? 4. Who might be within your client’s circle of care? 5. What are the elements of implied and express consent? Implied: Express: