PP 2 Personal Health Information Protection Act (PHIPA)

Personal health information act

"personal health information", subject to subsections (3) and (4), means identifying information about an individual in oral or recorded form, if the information, (a) relates to the physical or mental health of the individual (b) relates to the providing of health care to the individual (c) is a plan of service within the meaning of the Home Care and Community Services Act (d) relates to payments or eligibility for health care, or eligibility for coverage for health care, in respect of the individual, (e) relates to the donation by the individual of any body part (f) is the individual's health number (g) identifies an individual's substitute decision-maker.

According to PHIPA, Health Information Custodians can be

1. A health care practitioner 2. A service provider within the meaning of the Home Care and Community Services Act 3. A community care access corporation 4. A person who operates one of the following facilities, programs or services: i. A hospital ii. A long-term care home o A retirement home iii. A pharmacy iv. A laboratory v. An ambulance service vi. A home for special care vii. A centre, program or service for community health 5. An evaluator within the meaning of the Health Care Consent Act 6. A medical officer of health of a board of health 7. The Minister 8. Any other person prescribed as a health information custodian

Substitute decision makers

1. The incapable person's guardian of the person 2. The incapable person's attorney for personal care 3. The incapable person's representative appointed by the Board 4. The incapable person's spouse or partner 5. A child or parent 6. A parent who has only a right of access. 7. A brother or sister 8. Any other relative

Determination of capacity

An HIC is responsible for determining whether the individual is capable/incapable with respect to giving consent for the collection, use or disclosure of PHI

Different times

An individual can be capable for consenting for the collection, use or disclosure of PHI at one time, but incapable at another time

Different information

An individual can be capable for consenting for the collection, use or disclosure of some parts of PHI, but incapable of consenting with respect to other parts

Presumption of capacity

An individual is presumed to be capable with respect to giving consent for the collection, use or disclosure of PHI

Records may be transferred to a successor if

Reasonable efforts to give notice to individuals has been given before the transfer or as soon as possible

Powers of the board

The Consent and Capacity Review Board may confirm the determination of incapacity or may determine that the individual is capable of consenting to the collection, use or disclosure of PHI

A contact person is an agent of the health information custodian and is authorized on behalf of the custodian to ...

o Facilitate the custodians compliance with the PHIPA o Ensure that all the agents of the custodian are appropriately informed of their duties under the PHIPA o Respond to inquiries from the public about the custodian's information practices o Respond to requests of an individual for access to or correction of a record of PHI about the individual that is in the custody or under the control of the custodian o Receive complaints from the public about the custodian's alleged contravention of the PHIPA or its regulations

Correction to the record

o If an individual believes their record is not accurate or complete they may make a written request to the custodian to correct it. o The custodian has 30 days to respond and is obligated to correct an inaccurate of incorrect record unless they did not create the record or it consists of a professional opinion made in good health.

Access to records

o Individuals have a right of access to records of their own PHI and it applies to records that are dedicated primarily to the individual. o Requests should be in writing (although there is nothing in the act that prevents granting access in response to an oral request), and must provide enough information for the custodian to identify and locate the record. o A custodian has 30 days to respond and when granting access or providing a copy of a record, custodian may charge a reasonable cost of recovery.

Deceased Individual

o for the purposes of identifying the individual o for the purposes of informing any person whom is reasonable to inform in the circumstances o to the spouse, partner, sibling or child of the individual if the recipients of the information reasonably require the information to make decisions about their own health care or their children's health care

Consent

to the collection, use or disclosure of PHI about an individual may be expressed or implied

An HIC may keep a record of PHI about an individual in the Individuals home in any reasonable manner ...

to which the individual consents, subject to any restrictions set out in a regulation.

A consent to the disclosure of PHI about an individual must be expressed, and not implied, if

• A HIC makes the disclosure to a person that is not a HIC • A HIC makes the disclosure to another HIC and the disclosure is not for the purposes of providing health care or assisting in providing health care

Written public statement must include

• A general description of the custodian's information practices • How to contact the HIC • How an individual may obtain access to his or her own record or request correction of that record • How to make a complaint to the custodian or to the Privacy Commissioner

Responsibilities of Health Information Custodians (HIC):

• Ensures that PHI is kept secure and confidential • Ensures that PHI is accurate, complete and up to date • Protects PHI against theft, loss and unauthorized use or disclosure • Protects PHI against unauthorized copying, modification or disposal • Notifies the individual at the first reasonable opportunity if the information is stolen, lost, or accessed by unauthorized persons • Retains PHI for as long as necessary to allow the individual to exhaust any recourse under the PHIPA that he or she may have with respect to request of access to information by the individual (RMT's keep records for 10 years +)

About the PHIPA

• Implemented in 2004 • Provincial Law • Enforced by The Ontario Information and Privacy Commissioner (Privacy Commissioner) • Covers both the private and public sector organizations across the entire health sector • Applies to the collection, use and disclosure of Personal Health Information (PHI) • Establishes rules and regulations for ensuring that the PHI remains private, confidential and secure • Practitioners are subject to fines for breach of PHIPA (up to $50,000 for individuals and up to $250,000 for organizations), and to civil action for damages (including a max of $10,000 for mental anguish)

The HIC must provide a response to a request to access; these are their options

• Make the record available to be examined and, upon request, provide a copy and an explanation of any codes/terms it contains • Give the requester written notice that "after a reasonable search", the custodian has concluded that the record either does not exist or cannot be found • If the request is being refused provide a written response containing: o A statement that the request is being refused in whole or part o Reason for the refusal o A statement that the requester has the right to make a complaint to the commissioner about the refusal

Consent for the collection, use and disclosure

• Must be a consent of the individual • Must be knowledgeable • Must relate to the information • Must not be obtained through deception or coercion

Handling of records

• Must indicate how long records are kept for (keep in mind each health professional is required to keep their records for various periods of time)

Health Information Custodian

• Someone who collects, uses and discloses PHI for the purpose of providing health care

Withdrawal of consent

• The individual may ... for the collection, use and disclosure of PHI by providing reasonable notice to the HIC • The ... should have no negative effects for the individual

You can determine if the consent is knowledgeable if the individual knows,

• The purpose of the collection, use or disclosure • That the individual may give or withhold consent

PHIPA purpose

• To establish rules for the collection, use and disclosure of PHI about individuals that protects the confidentiality of information and the privacy of individuals with respect to that information, while facilitating the effective provision of health care • To provide individuals with a right of access to PHI about themselves, subject to limited and specific exceptions set out in the PHIPA • To provide individuals with a right to require the correction or amendment of PHI about themselves, subject to limited and specific exceptions set out in the PHIPA • To provide for independent review and resolution of complaints with respect to PHI • To provide effective remedies for contraventions of the PHIPA

The individual may consent for the collection, use and disclosure of PHI if the individual is able

• To understand the information that is relevant to deciding whether to consent to the collection, use or disclosure • To appreciate the reasonably foreseeable consequences of giving, not giving, withholding or withdrawing the consent

A privacy policy must outline

• When, how and the purpose for which the HIC routinely collects, uses, modifies, discloses, retains and disposes of PHI • The administrative, technical and physical safeguards and practices that the custodian maintains with respect to the information

Custodians must provide individuals with access to records containing their own health information unless

• a legal privilege restricting disclosure applies • another law prohibits the disclosure • the information was collected or created for a proceeding • the information was collected or created during an inspection, investigation or similar procedure • access could result in serious harm to any person or the identification of a person who was required to provide information or who has provided the information in confidence • the custodian is a government institution and the disclosure may be refused under certain provisions contained in access and privacy legislation that applies to government organizations

Correcting the record

• recording the correct information in the record • striking out the incorrect information in a manner that does not obliterate the record, or if that is not possible, labeling the information as incorrect, severing the incorrect information from the record, storing it separately from the record and maintaining a link in the record that enables a person to trace the incorrect information, • at the request of the individual, give written notice of the requested correction, to the persons to whom the custodian has disclosed the information.

A health practitioner may keep a record of PHI about an individual in a place other than the individuals home and other than a place in the control of the practitioner if ...

• the record is kept in a reasonable manner • the individual consents • the health care practitioner is permitted to keep the record in the place in accordance with a regulation, by-law or published guidelines