Part 2 – Collection Use & Disclosure
Collection Use & Disclosure
Collection
Collection refers to any process through which a HIC gathers or receives PHI for the purpose of providing health care.
When and How can you Collect Personal Health Information (PHI)
Collection of PHI:
- Only collect PHI with consent
- Only collect PHI that is necessary for the purpose of providing health care services.
- Do not collect/use PHI if other information will serve the purpose.
- Agents who collect/use PHI must be able to explain and support their business need for the collection or use.
- With limited exceptions, only collect PHI directly from the individual involved.
- PHI may be collected through an in-person meeting with a University health care service staff, over the phone, or through paper or electronic documents.
Use
Use means to handle or deal with PHI, but does not include disclosing the information. The sharing of information between a HIC and its agent is permitted under PHIPA and is considered to be a use.
How can you Use PHI
Rules regarding Use:
- Use the information for the purpose for which it was collected as outlined in the consent.
- Take reasonable steps to ensure PHI is accurate, complete and up-to-date
When can PHI be Used without consent:
- Planning or delivering programs or services
- Risk management, error management or activities to improve or maintain the quality of care or any related program or service
- Educating agents to provide health care
- Obtaining payment or processing, monitoring, verifying or reimbursing health care claims
- Research, provided that specific requirements and conditions are met and
- If permitted or required by law
Examples of Use of PHI:
- An agent will use an individual’s PHI to provide them with health care.
- A HIC uses PHI when its agents access, review or manage PHI in any form.
- A health care practitioner will use an individual’s PHI in reviewing their clinical notes, and in discussing with the clinic’s other health care practitioners for advice about next steps.
Use of PHI for Research:
If you are a HIC, you may also use PHI without consent for research provided that certain conditions and restrictions are met. In some cases, review by the University’s Research Ethics Board may be required. Contact Manager, Privacy & Records Management if you intend to conduct research using health information.
Disclosure
Disclosure means to make the PHI available or to release it to another custodian or person.
When you can Disclose PHI
PHIPA Rules regarding Disclosure:
- As a general rule, consent is required to disclose an individual’s PHI, unless PHIPA allows the disclosure without consent.
- Consent may be express or implied, however, express consent is required whenever a HIC is disclosing PHI to a person who is not a HIC (e.g. to an employer or an insurer) or when the disclosure to another HIC but for a purpose other than providing health care. Express consent is also required for certain fundraising, marketing and market research activities.
- HICs can rely on implied consent to disclose information within what is known as the ‘circle of care‘ – that is, when the information was received from the individual (or their substitute decision maker) or another HIC, for the purpose of providing health care, and the information is being disclosed for the purpose of providing health care to the individual, is being disclosed to another HIC, and the individual has not withheld or withdrawn consent.
- HICs must not disclose PHI if other information will serve the purpose of the disclosure, and
- HICs may only disclose as much information as is necessary to meet the purpose.
- PHIPA allows the disclosure of PHI without patient consent under certain circumstances. See examples below.
Examples of when you can disclose PHI without consent:
- to another HIC if the disclosure is reasonably necessary for providing health care and consent cannot be obtained in a timely manner, unless the individual has instructed the HIC not to make such a disclosure (e.g. unconscious patient transferred to a hospital)
- in order for a HIC to provide funding or payment to a HIC
- for the purpose of contacting a relative or friend of an individual who is injured, incapacitated or ill and unable to give consent personally
- where the custodian believes on reasonable grounds that disclosure is necessary for the purpose of eliminating or reducing a significant risk of serious bodily harm
- For example to the CARE team where the therapist sees a probable imminent risk
- for the purposes of administration and enforcement by the professional Colleges
- legal proceedings
- research, subject to restrictions and conditions
- as required or permitted by law
Privacy Notice
Each of Brock’s HICs have a written privacy notice providing more details about its privacy commitments and practices. The Privacy Notice poster located in each clinic, advises patients that the physicians and staff of Brock University’s health care services treat patient PHI with respect and in accordance with PHIPA and all other applicable laws. The poster outlines how we protect patient’s privacy by informing patients of the above collection, use and disclosure practices.
Key Points
- COLLECTION:
- Only collect PHI with consent, unless otherwise permitted by PHIPA.
- Only collect PHI that is necessary.
- With limited exceptions, only collect PHI directly from the individual involved.
- USE:
- Limit the use to only those who need access to do their job.
-
Use the information for the purpose for which it was collected.
- Limit the use to only those who need access to do their job.
- DISCLOSURE:
- Consent is required to disclose an individual’s PHI, unless PHIPA allows the disclosure without consent.
- You can disclose PHI without consent for the purpose of eliminating or reducing a significant risk of serious bodily harm.
Learn More
- Practices to Protect your Personal Health Information
- IPC’s: Disclosure of Information Permitted in Emergency or other Urgent Circumstances
Click here for the next module: Part 3 – Consent