Part 5 – Access & Correction
ACCESS
With limited exceptions, PHIPA provides individuals with a general right to access their personal health information (PHI) held by a custodian and sets out a formal procedure for access requests.
When a PHIPA access request for information is filed, you are legally required to produce any requested records that are in the University’s custody or under its control. Time is of the essence, as access requests must be responded to under strictly legislated timelines.
Requests for information:
- Under PHIPA, a HIC is required to respond within 30 days to a patient’s request for access to or correction of her records of PHI.
- PHIPA authorizes a HIC to deny a patient’s access request under specific conditions set out in the Act.
- All PHIPA requests are to be submitted to the Clinical Manager.
- Access requests are handled in accordance with Brock’s Practices to Protect your Personal Health Information (see page 3)
The Clinic’s Contact Person, or designate, will process all PHIPA requests, and may contact the physician or staff in order to the meet PHIPA’s requirements as follows:
- assist in locating records requested;
- determine if the requested record might contain PHI or third party information that affects the interests of someone other than the requester and, if so, allow the affected third party to make representations about the disclosure of this information;
- within 30 calendar days of receipt of a request, make records available, deny access or cite extraordinary circumstances resulting in a delay;
- give a written reason for denial; and
- inform the person being denied access of his or her right to appeal to the Information and Privacy Commissioner of Ontario (IPC)
Records excluded:
The right of access does not apply to:
- records that contain quality of care information,
- PHI required for quality assurance programs,
- raw data from psychological tests or assessments,
- PHI used solely for research purposes or
- PHI that is in the custody or under the control of a laboratory in respect of a test, where an individual has the right of access to that information from the health care practitioner and the practitioner has not directed the laboratory to provide the information directly to the individual.
Can we refuse to provide access to an individual’s PHI?
Generally, custodians are responsible for providing individuals with access to their records of PHI.
You may only refuse access in limited situations, including:
- the information in question is subject to a legal privilege,
- access could reasonably be expected to result in a risk of serious harm to the treatment or recovery of the individual or serious bodily harm to the individual or another person,
- the information was collected in the course of an inspection, investigation or similar procedure and the resulting proceedings, appeals or processes have not yet been concluded or
- another law prohibits the disclosure of that information.
If an exception applies, an individual still has a right of access to the part of the record that can reasonably be severed from the part containing the information to which the individual does not have the right of access.
Access Requests:
- PHIPA sets out a formal procedure for access requests.
- The Contact Person is required to respond to privacy inquiries and complaints from patients and the public.
- The Contact Person is also required to respond to a patient’s request for access or correction.
- Before providing a requester with a copy of their chart, the Contact Person is to ask the person who treated the patient to review the chart. The records include all PHI that the custodian holds about the individual, and not only what the custodian defines as its health record.
Examples
Scenario:
A student asks you for a copy of their health record so they can provide proof to their instructor of a need for an accommodation for a disability.
Solution:
You may advise the student as follows:
- There is no obligation for a student to share their medical diagnosis or health record with their instructor.
- Students are not required to share their primary health records with instructors. Instead, health care practitioners should complete the University’s Medical Verification Form to ensure the information provided is limited to what is needed by an instructor.
- If student still wants to obtain a copy of their own health records, ask them to send you a completed Request for Access form (see form below).
Please note, in determining and implementing appropriate accommodations, the University has an obligation to:
- Accept requests for accommodation in good faith.
- Limit requests for information to those reasonably related to the nature of the limitation or restriction, to assess needs and make the accommodation.
- Never ask for or share a student’s confidential medical information, such as the cause of the disability, diagnosis, symptoms or treatment, unless these clearly relate to the accommodation being sought, or the student’s needs are complex, challenging or unclear and more information is needed. For further information, please review the OHRC’s Policy on accessible education for student with disabilities.
Request for Access form
Patient’s may submit a completed Request for Access form when requesting their health records for their personal use.
CORRECTION
Under PHIPA, the HIC is required to respond to a patient’s request for correction of PHI.
CAN INDIVIDUALS CORRECT ERRORS IN THEIR PHI?
An individual who believes that PHI is incomplete or inaccurate may request that a custodian correct the record. It is your responsibility to ensure that PHI is complete and accurate.
You are required to retain the information that was subject to the correction alongside the new, corrected information.
Even if the Contact Person refuses the patient’s request, the Contact Person must attach a notice of disagreement to the patient’s record.
Learn More
- Access to Information and Protection of Privacy Policy
- Access to Personal Health Information Procedure
- Practices to Protect your Personal Health Information
- IPC: Your health information: Your access and correction rights
Click here for the next module: Part 6 – Your Working Environment
