Understanding Privacy in the Context of Mental Health: The Family Perspective May 3, 2008 Justice and Mental Health Conference Mary Jane Dykeman Barrister & Solicitor

Background Personal Health Information Protection Act, 2004 came into force on November 1, A mandatory 3-year review of PHIPA is about to begin.

3 Framework of PHIPA Part I: Interpretation and Application Part II: Practices to Protect PHI Part III: Consent, Capacity & Substitute Decision-Making Part IV: Collection, Use & Disclosure of PHI Part V: Access to and Correction of Records of PHI Part VI: Administration and Enforcement Part VII: General Part VIII: Complementary Amendments Part IX: Commencement and Short Title

4 Key Concepts What PHIPA covers, what it does not Health information custodian (HIC) – who is one, who is not Personal health information (PHI) inside and outside the ‘clinical record’ Identifiable PHI Mixed record Health care Collection Use v. disclosure

5 Key Clinical Issues Indirect Collection Consent: Express, Implied, or No Consent Withdrawal of Consent ‘Lockbox’ for (internal) Use and (external) Disclosure of PHI Access & Correction Research

6 Role of Privacy Commissioner Information and Privacy Commissioner (IPC) has broad powers to investigate, make an order based on complaint or on own initiative 5 significant IPC orders to date: –improper disposal of records –abandoned records –improper access to health records –stolen laptop containing PHI –wireless camera in methadone clinic

7 Express Consent Consent must be express if PHI given to non-HIC Examples of non-HICs: lawyer, insurance company, employer, family member who is not an authorized substitute decision-maker

8 Implied Consent If HIC provides notice of its collections, uses and disclosures of PHI, PHIPA allows the HIC to assume that clients are “knowledgeable” and rely on their implied consent

9 Implied Consent – cont’d If a HIC receives PHI from a client, the client’s substitute decision-maker or another HIC May then collect, use or disclose the PHI based on implied consent for health care purposes unless aware client has withdrawn the implied consent (sharing between HICs commonly referred to as “circle of care”)

10 No Consent Required PHIPA sets out numerous circumstances in which a HIC has the right to collect, use and disclose PHI without first obtaining consent

11 Lockbox As with “circle of care”, term “lockbox” does not appear in PHIPA Refers to HIC’s ability to use and disclose PHI without consent in circumstances related to health care BUT individual can ask the HIC to shield certain parts of the record Recipient must be informed that records are incomplete

12 Lockbox Reminder: ‘lockbox’ provisions apply only in context of health care, NOT –Where necessary to disclose PHI to reduce or eliminate significant risk of serious bodily harm –To identify who is the substitute decision-maker –Where disclosure is mandatory under other Acts (including duty to report child abuse; or to report to public health authorities) –As otherwise permitted or required under PHIPA

13 Lockbox Dilemmas Client instructs HIC not to give PHI externally to assist in his/her care (e.g. to another physician involved in his or her care)

14 Is my family member a client? If a client is capable, can instruct the hospital not to tell people he/she is in the hospital Many hospitals will release name, location and status unless client tells them not to Many mental health facilities do the opposite – will neither confirm nor deny the person is there

15 Collection Dilemmas General rule is that you may only collect PHI from someone other than the individual if you have consent; or the Commissioner has approved; or you have other legal authority to collect indirectly; or if you cannot get the information you need accurately or in a timely way If capable, patient could later instruct caregiver not to use or disclose that information

16 Capacity Individuals are presumed to be capable When in doubt, care provider must determine whether the client is capable to collect, use and disclose PHI Test for capacity

17 Substitute Decision-Making If client is incapable to consent to collection, use or disclosure of PHI, turn to list of decision-makers in PHIPA If there is already an SDM for treatment, admission to a care facility or personal assistance services under the Health Care Consent Act, that person is also the SDM for related information decisions

18 Access to PHI Clients may make a written request for access to PHI wherever it is held (e.g. team member’s notes outside client’s file)

19 Correction of PHI Clients may request that you make corrections to a record of PHI HIC may deny if: –Professional opinion made in good faith OR –Original record was not the HIC’s and HIC lacks sufficient authority, knowledge or expertise to make the requested change

20 Case Scenarios Elderly female client with possible addiction- induced paranoia but who may actually be subject to domestic abuse Husband comes to hospital asking for a copy of his wife’s record from a particular admission Is he the authorized substitute decision- maker?

21 Case Scenarios Equally ranked children/siblings of a client cannot agree on a treatment, placement or information decision First question always: has the client actually been found incapable? Staff can request that the family get it together and communicate a decision Public Guardian and Trustee decision-maker of last resort for treatment (“may” act re: PHI)

22 Mental Health and Addictions Privacy Toolkit Project led by CMHA Ontario Division Advisory Group of various addictions / mental health representatives Focus on plain language, Q&As specific to addictions and community mental health, templates Available at:

23 Other Resources Information and Privacy Commissioner’s website: Ministry of Health website: Consent and Capacity Board website (

24 Mary Jane Dykeman Barrister & Solicitor (416)