CNO Practice Standard: Confidentiality and Privacy
Health Information Custodian
A custodian is an organization that provides care within the health care continuum. People providing care can also be custodians under this legislation. Nurses who receive information from custodians are responsible for complying with the legislation. They can only use the information for the purposes they identified when requesting it from the custodian.
Lockbox Provision
Clients have the right to instruct that a part of their personal health information not be shared with other providers
Collection
Gathering, acquiring, receiving or obtaining of personal health information
A friend of a family calls the ICU to ask how Helen is doing after suffering a heart attack. The nurse tells the friend that Helen is doing okay but will need to have further testing done. Has the nurse followed proper standard?
No, releasing information about treatment is considered a breach of privacy
Kayla is caring for Dale who is her best friend's ex boyfriend. Kayla tells her friend that Dale is in the hospital and he has to have chemotherapy. Is this following proper standard?
No, telling her friend about a patient and their treatment is a breach of confidentiality
A nurse had a patient last week who is still on the unit. She wants to follow up and see how the patients blood work turned out. She logs onto Meditech and checks on that patients lab results. Is this following proper standard?
No, this is considered a breach of privacy
Disclosure without consent
Nurses adhere to legislation that requires them to reveal confidential information to others. For example, the Child and Family Services Act, 1990 requires all health care professionals to report suspected child abuse to the Children's Aid Society; the Health Protection and Promotion Act permits reporting of certain conditions to the Medical Officer of Health. Additionally, required reporting information may be disclosed to the Workplace Safety and Insurance Board. The information CNO gathers during an investigation and shares with the members under investigation is confidential
Knowledgeable Consent and Substitute Decision Makers
Nurses ensure that clients are aware of their rights concerning their personal health information and have expressly consented to the collection, use and disclosure of information outside the health care team.
The client's right to access and amend his/her personal health information
Nurses respect the client's right to see/obtain a copy of his/her health information, to see his/her health file and to request correction to the information. The onus is on the client to prove that the record is incomplete or inaccurate, and any changes to the record must be tracked.
Personal Health Information Practices
Nurses share relevant information with the health care team, whose members are obliged to maintain confidentiality. Nurses must explain to clients that information will be shared with the health care team and identify the general composition of the health care team.
Express Consent
PHIPA does not require a specific form of express consent, which may be given verbally or in written form. It may be provided over the telephone or electronically if the nurse is sufficiently able to identify the person; however, express consent that is written helps avoid ambiguity. The content and format of the consent need not be elaborate.
Implied Consent
PHIPA specifies that several conditions must be met to assume a client's implied consent. It is a custodian's obligation to fulfil these conditions by posting a notice or providing a brochure that describes the purposes for the collection, use and disclosure of personal health information. This kind of notice is one way to fulfil the conditions for implied consent.
The Quality of Care Information Protection Act (QOCIPA)
This Act provides broad protection to quality of care information produced by a health care facility or a health care entity, or for a governing or regulatory body. Its purpose is to promote open discussion of adverse events, peer review activities and quality of care information, while protecting this information from being used in litigation or accessed by clients. This means that nurses' activities and records associated with the College's Quality Assurance Program cannot be used in legal proceedings.
Substitute decision makers can give consent if the client is incapable. True/False?
True
True/False. Clients have the right to correct their personal health information
True
Potential for harm
When a nurse learns information that, if not revealed, could result in harm to the client or others, she/he must consult with the health care team and, if appropriate, report the information to the person or group affected.
Disclosure
defined as making information available or releasing it to another custodian or person. Express consent is needed when personal health information is disclosed outside of the health care team or is not used to provide health care
Complying with the PHIPA includes:
designating a contact person to facilitate compliance with the Act and to respond to requests, inquiries and complaints from the public; providing a written public statement generally describing information practices, how to reach the contact person, the process for accessing records or requesting corrections, and the complaint process for clients; ensuring information practices comply with the Act and its regulations; ensuring information is accurate, complete and up-to-date; and ensuring information is secure
Professional Misconduct, Nursing Act 1991
giving information about a client to a person other than the client or his or her authorized representative, except with the consent of the client or his or her representative, or as required or allowed by law.
Personal Health Information Protection Act (2004) PHIPA,
governs health care information privacy in Ontario. Information privacy is defined as the client's right to control how his/her personal health information is collected, used and disclosed. PHIPA sets consistent rules for the management of personal health information and outlines the client's rights regarding his/her personal health information. This legislation balances a client's right to privacy with the need of individuals and organizations providing health care to access and share health information
Practitioners can disclose information without consent in the following situations:
if disclosure is needed to provide health care, and consent cannot be obtained quickly; to contact a relative or friend of an injured, incapacitated or ill client for consent; to confirm that a client is a resident or client in a facility, provide his/her location and comment on his/her general health status (unless there is an express request not to do so); or to eliminate or reduce a significant risk of serious bodily harm to another person or the public
Express Consent is required when:
personal health information has to be disclosed outside of the team; information is to be disclosed within the team for reasons other than providing care; information is used for fundraising; information is being collected for marketing
What is considered personal health information?
physical or mental health, including family health history; care previously provided (including the identification of people providing care); a plan of service (under the Long-Term Care Act, 1994); payments or eligibility for health care; donation of body parts or substances (e.g., blood), or information gained from testing these body parts or substances; a person's health number; or the name of a client's substitute decision-maker
Clients may be refused access to personal health information under the following conditions:
the information is Quality Assurance information or that generated for a regulatory college's Quality Assurance Program; it is raw data from standardized psychological tests or assessments; it may present a risk of serious harm to the treatment or recovery of the client, or of serious bodily harm to another person; or access to the information would reveal the identity of a confidential source of information
They can be denied to the right to correct their personal health information under the following conditions:
the request is frivolous, vexatious or made in bad faith; the custodian did not create the record and does not have sufficient knowledge, expertise or authority to make the correction; or the information is a professional opinion or observation made in good faith