Part 3 – Consent
Consent is permission that one person gives for the activities of another person or organization that affect or could affect an individual.
When you need Consent
Only collect PHI with consent.
Consent must:
- Be a consent of the individual
- Be knowledgeable
- Relate to the information, and
- Not be obtained through deception or coercion.
For consent to be knowledgeable, you must ensure the patient understands the purpose of the collection, use or disclosure and know that they can give or withhold consent.
Consent may be provided verbally or in writing.
In practice, a custodian is not required to obtain an individual’s written or verbal consent every time PHI is collected, accessed, used or disclosed. Custodians may rely on the implied consent of an individual to collect and use PHI for most purposes. You may also infer consent to disclose PHI to another custodian for the purposes of providing or assisting in providing health care, but Brock’s preferred practice is to require written consent for any disclosure to any third party. Subject to limited exceptions, custodians cannot rely on implied consent when disclosing PHI to a person or organization that is not a custodian, or when disclosing PHI for a purpose other than providing or assisting in providing health care.
To ensure implied consent is knowledgeable, Brock has Privacy Notice posters readily available in each clinic that is likely to come to the individual’s attention, describing the purposes for the collection, use and disclosure of personal health information (PHI).
Circumstances when you may assume Implied Consent
PHIPA permits a HIC to assume an individual’s implied consent to collect, use of disclose PHI for the purpose of providing health care, in circumstances defined in PHIPA.
A HIC may only assume an individual’s implied consent to collect, use or disclose personal health information if all of the following six (6) conditions are satisfied:
- The HIC must fall within a category of HICs that are entitled to rely on assumed implied consent.
- The PHI to be collected, used or disclosed by the HIC must have been received from the individual, his or her substitute decision-maker or another HIC.
- The HIC must have received the PHI that is being collected, used or disclosed for the purpose of providing or assisting in the provision of health care to the individual.
- The purpose of the collection, use or disclosure of PHI by the HIC must be for the provision of health care or assisting in the provision of health care to the individual.
- the disclosure of PHI by the HIC must be to another HIC.
- The HIC that receives the PHI must not be aware that the individual has expressly withheld or withdrawn his or her consent to the collection, use or disclosure.
Circle of Care
The term “circle of care” refers to the ‘circle’ of health care providers (HICs) who may share Personal Health Information of an individual for the purpose of providing health care, on the basis of implied consent. Further information about disclosing PHI within an individual’s circle of care can be found within the IPC’s Circle of Care guidelines.
Key Points
- PHIPA allows you to rely on implied consent to disclose PHI within the circle of care
- Preferred practice is to require written consent for any disclosure to any third party
- Ask patient to sign Brock’s Release of Information form when Brock is being asked to disclose PHI to a third party.
Here is Brock’s Release of Information form:
Examples
Example 1
If a patient wants their records to go to their family doctor, have the patient send you a signed Release of Information form. Once it is reviewed for completion, the Brock HIC can then send the health record directly to the patient’s doctor.
Example 2
If a patient requires a review by the Campus Assessment, Response & Education (CARE) team, please be aware that the CARE team members are not HICs, thus not in the circle of care. However, a student accessing the services of Student Wellness and Accessibility Services should have signed a consent form permitting disclosure to the CARE team. In such circumstances, the HIC may provide information on a “need to know” basis to the CARE team. For example, if the CARE team asks “Did the patient come into your clinic for an appointment?”, the HIC may provide a Yes or No response and should not provide additional details unless needed by the CARE team.
When can PHI be disclosed without Consent
There are circumstances where a HIC may be permitted to disclose PHI without consent, namely:
- To eliminate or reduce a significant risk of serious bodily harm
- In the context of a legal proceeding if the custodian or agent is a party or witness
- To a regulatory college (for example, in the context of an investigation of a complaint).
When consent can be Withdrawn
- PHIPA allows patients to withdraw consent for the use and disclosure of their PHI.
- Consent can be withdrawn at any time by providing notice to the custodian. However, withdrawal of consent is not retroactive and may be subject to exceptions.
- HICs are required to accommodate the request
Key Takeaways
Consent:
- Only collect PHI with consent
- As a general rule, consent is required to disclose an individual’s PHI, unless PHIPA allows the disclosure without consent.
- Consent is not required where the disclosure is necessary to reduce a significant risk of serious bodily harm
Learn More
- Access to Information and Privacy
- Circle of Care
- Frequently Asked Questions: Personal Health Information Protection Act.
Click here for the next module: Part 4 – Breach of Personal Health Information
