COLLEGE OF PHYSICIANS AND SURGEONS OF ONTARIO

P O L I C Y S TAT E M E N T # 8 - 0 5

Confidentiality of
Personal Health Information
APPROVED BY COUNCIL: November 2000
REVIEWED AND UPDATED: November 2005
PUBLICATION DATE: March/April 2006
TO BE REVIEWED BY: November 2010
KEY WORDS: Confidentiality, Disclosure, Consent, Professional Misconduct
RELATED TOPICS: Mandatory Reporting, Medical Records
LEGISLATIVE REFERENCES: Regulated Health Professions Act, 1991; Medicine Act, 1991, S.O. 1991, c.30,
Ontario Regulation 856/93, subsection 1(1) paragraph 10 and subsection
1(2)(a) (b); Personal Health Information Protection Act, 2004, S.O. 2004, c.3,
Sched. A
REFERENCE MATERIALS: A Medico-Legal Handbook for Canadian Physicians (1997, Canadian Medical
Protective Association); Office Practice Guidelines for the Care of Adolescents
(1994, Canadian Paediatric Society)
COLLEGE CONTACT: Physician Advisory Service
 Confidentiality of Personal Health Information

PURPOSE e) relates to the donation by the individual of any

This policy is designed to help physicians understand body part or bodily substance,
their legal and professional obligations to maintain f ) is the individual’s health number, or
patient confidentiality. It is intended to provide a gen- g) identifies an individual’s substitute decision-maker.
eral overview of the confidentiality requirements set
“identifying information” means information that
out under the Personal Health Information Protection
identifies an individual or for which it is reasonably
Act, 2004 (PHIPA)1 and to outline other professional
foreseeable in the circumstances that it could be utilized,
obligations related to patient confidentiality and the
either alone or with other information, to identify an
practice of medicine. It is not meant to be construed
individual.
as legal advice, nor does it address all matters pertain-
ing to the confidentiality of patient information. PRINCIPLES
Given the complexities of the legal requirements, 1. Physicians must act in accordance with all of their
physicians are reminded that whenever there is uncer- professional and legal obligations.
tainty, they are advised to contact the Physician 2. To establish and preserve trust in the physician-
Advisory Service at the College, their legal counsel, patient relationship, patients must be confident
the Canadian Medical Protective Association that their personal health information will remain
(CMPA)2 or the Information and Privacy confidential.
Commissioner of Ontario for further direction. 3. Maintaining confidentiality is fundamental to pro-
viding the highest standard of patient care. Patients
DEFINITIONS who understand that their information will remain
The terms noted below will appear throughout this confidential are more likely to provide the physi-
policy and have the following legal definitions under cian with complete and accurate health informa-
section 4 of PHIPA: tion, which in turn, leads to better treatment advice
“personal health information,” subject to certain from the physician.
exceptions,3 means identifying information about an
individual in oral or recorded form, if the informa- POLICY
tion, The College expects physicians to follow the regula-
a) relates to the physical or mental health of the indi- tions under the Medicine Act, 1991;4 and the rules
vidual, including information that consists of the under PHIPA when collecting, using or disclosing per-
health history of the individual’s family, sonal health information.5
b) relates to the providing of health care to the indi- While PHIPA establishes rules in relation to the “col-
vidual, including the identification of a person as a lection,” “use” and “disclosure” of personal health
provider of health care to the individual, information, this policy will focus only on those per-
taining to the “disclosure” of such information.
c) is a plan of service within the meaning of the Long-
Term Care Act, 1994 for the individual, Disclosure of personal health information
d) relates to payments or eligibility for health care in A physician can only disclose his or her patient’s personal
respect of the individual, health information:

1 S.O. 2004, c. 3 Sched. A. In force as of November 1, 2004.

2 The majority of physicians in Ontario have liability coverage with the CMPA. Any physician with liability coverage from another provider is advised to contact that provider if uncertainty arises
regarding the confidentiality of patient information.
3 Please refer to section 4 of PHIPA, which sets out the exceptions to “personal health information.”
4 Refer to section heading ‘Professional Misconduct’ for direction.
5 In this policy, the provisions in PHIPA should be considered as they apply to physicians.

2 CPSO POLICY STATEMENT – CONFIDENTIALITY OF PERSONAL HEALTH INFORMATION

• when he or she has the patient’s or substitute deci- medical record.
sion-maker’s consent and it is necessary for a lawful Alternatively, if the lock box creates a situation where
purpose; the physician feels the patient’s safety is at risk, the
• where it is permitted under legislation, without the physician can refuse to provide treatment when it is
patient’s or substitute decision-maker’s consent; or not an emergency situation. The physician should
• where it is required by law. explain the reasons for his or her decision not to treat
the patient and note all relevant discussions in the
Consent patient’s health record.
Generally, physicians need express or implied consent It is to be noted that patients may not prevent the
before disclosing personal health information.6 physician from disclosing personal health information
Physicians, however, are entitled to assume that they permitted or required by law.9
have the patient’s implied consent for the purposes of
providing or assisting in providing health care, unless Permitted disclosure under PHIPA
the physician disclosing the information is aware that PHIPA allows the disclosure of personal health infor-
the patient has expressly withheld or withdrawn con- mation without patient consent under certain circum-
sent.7 This means that, without reason to believe oth- stances. Physicians, however, are not prohibited from
erwise, physicians can share information with others seeking the patient’s consent. For this reason, the
involved within the patient’s circle of care8 without College advises physicians that, whenever possible,
asking for the patient’s consent. they should make every reasonable effort to obtain the
patient’s consent before disclosing his or her informa-
The patient’s express consent is required for providing
tion.
his or her personal health information outside of the
circle of care, except where otherwise directed by The following sections address a limited number of
statute. situations where disclosure of personal health infor-
mation is permitted without consent under PHIPA.10
“Lock boxes”
Disclosure for the provision of health care under
The term “lock box” applies to situations where the exceptional circumstances
patient has expressly restricted his or her physician
If the disclosure of personal health information is rea-
from disclosing specific personal health information
sonably necessary for the provision of health care and
to others — even to others involved in the patient’s
it is not reasonably possible to obtain the patient’s
circle of care.
consent in a timely manner, a physician may disclose
Where in the course of treatment, a physician is not the relevant information, unless the patient has
able to disclose to another physician or health care expressly instructed the physician otherwise.
provider all of the information reasonably necessary
For example, this type of disclosure allows the physi-
for providing care, the physician must notify the
cian to perform necessary medical services during
recipient of that fact. Physicians are advised to discuss
emergency situations.
with patients the potential health risks associated with
creating a lock box. These discussions and the patient’s Disclosure related to risks
decision should be well documented in the patient’s A physician may disclose personal health information

6 Under PHIPA, whether explicit or implicit, consent must: (i) be that of the individual; (ii) be knowledgeable; (iii) relate to the information at issue; and (iv) not be obtained through deception
or coercion. Where applicable, the substitute decision-maker or authorized representative may provide consent on behalf of the individual.
7 The patient is not able to withhold or withdraw his or her consent when the disclosure of personal health information is required by law (see section on ‘Required Disclosure’).
8 PHIPA does not define “circle of care,” however, the term refers to those in the health care team who are involved in the care or treatment of a particular patient. For example, it describes
health care practitioners, public or private hospitals, pharmacies, laboratories, ambulance services, community care access corporations. This definition of “circle of care” is supported by the:
Ontario Hospital Association, Ontario Hospital eHealth Council, Ontario Medical Association, and the Office of the Information and Privacy Commissioner of Ontario.
9 This statement refers to the provisions in PHIPA where a physician is permitted or required to disclose personal health information without the patient’s consent.
10 This list is not exhaustive. For a complete list of permissible disclosures of personal health information, please refer to sections 38 – 50 of PHIPA.

CPSO POLICY STATEMENT – CONFIDENTIALITY OF PERSONAL HEALTH INFORMATION 3

 Confidentiality of Personal Health Information

about an individual if the physician believes, on rea- Monitoring of claims for payment
sonable grounds, that the disclosure is necessary to In circumstances where the Ministry of Health and
eliminate or reduce a significant risk of serious bodily Long-Term Care is monitoring or verifying claims for
harm to a person or group of persons. The disclosure payment for health care, or for goods used for health
may be made to police, and in some instances, to the care that are funded wholly or in part by the Ministry,
intended victim(s). the physician must provide the patient’s personal
Physicians are expected to use their best judgment in health information to the Minister, upon his or her
these situations; however, physicians are advised to request.
contact the College’s Physician Advisory Service, their Summonses, subpoenas and court orders
lawyer, the CMPA, or the Information and Privacy In the course of litigation, physicians may be required
Commissioner of Ontario whenever they are uncer- by a summons, subpoena or a court order to disclose a
tain whether the disclosure is appropriate. Physicians patient’s personal health information and patient
should also document all activities in the patient’s records. The physician should read the summons, sub-
medical record, and when appropriate, advise the poena or court order carefully and not do more than
patient of their decision to disclose the relevant infor- it requires. For example, a summons may require a
mation. physician to attend a court at a particular time and to
Disclosure for the purpose of regulating the medical take a specific patient chart. The summons does not
profession authorize the physician to discuss the patient’s care
Disclosure of personal health information to the with, or show the record to, anyone in advance of the
College is permitted for the purposes of administering court appearance.
and enforcing the Regulated Health Professions Act,
Reports under the Workplace Safety and Insurance Act
1991 (RHPA). This includes disclosing personal health
Under the Workplace Safety and Insurance Act, a physi-
information for the purpose of carrying out the regu-
cian who is providing health care to a worker claiming
latory duties in the RHPA (i.e., Registrar’s
benefits under the workplace’s insurance plan must
Investigations and Quality Assurance peer assess-
promptly give the Workplace Safety and Insurance
ments).
Board (WSIB) the relevant personal health informa-
Required disclosure tion that the WSIB may require or that the patient
Physicians may be required by law, in a variety of cir- requests that the physician provide to the WSIB.
cumstances, to disclose personal health information PHIPA permits the physician to report the required
without the consent of the patient. information to the WSIB and/or the employer, with-
out the patient’s consent.11 If, however, the physician
Mandatory reports takes the position that the patient ought to be aware
Certain statutes have reporting provisions that may that his or her personal health information is being
require the physician to provide information about a provided to the WSIB and/or the employer, the physi-
patient. Examples of legislation requiring mandatory cian ought to notify his or her patient of that fact.
reports include the Regulated Health Professions Act,
1991; the Highway Traffic Act; the Child and Family Professional expectations regarding
Services Act; the Health Protection and Promotion Act; disclosure
the Aeronautics Act; the Coroners Act; and the Health Physicians are expected to act in accordance with all legal
Professions Procedural Code (see College policy on requirements, but must also use their best judgment to
Mandatory Reporting). practise medicine in a safe and humane manner.

11 Under section 43(1)(h), PHIPA, whereby a physician can disclose personal health information where permitted or required by law.

4 CPSO POLICY STATEMENT – CONFIDENTIALITY OF PERSONAL HEALTH INFORMATION

Disclosure with respect to incapacity The College, however, recognizes that there may be
When physicians have reasonable grounds to believe situations where it will not be possible to obtain con-
that another physician or health care professional is sent from the patient or the substitute decision-maker.
incapacitated,12 the College expects physicians to In this situation, the College advises physicians to
behave ethically and in the public interest by taking exercise caution and to use their best judgment when
appropriate action. providing information. Discussions with friends and
Appropriate action may include, depending on the family ought to be limited to basic information about
circumstances, contacting the Physician Health the patient’s general state of health.
Program at the Ontario Medical Association, the Other topics related to disclosure
Registrar of the CPSO or other relevant regulatory
college, or the individual’s friends and family. Since Disclosure to custodial and/or access parents
this action will likely require physicians to disclose the There may be instances when a physician receives a
individual’s personal health information, physicians request to disclose personal health information to a
are advised to exercise caution and ensure that they patient’s parents or a third party where the parents
uphold their obligations under PHIPA. have separated or divorced. If the child-patient has the
capacity to provide consent, the physician must first
Where disclosures are necessary to reduce or eliminate seek the consent of the patient before any disclosure is
a significant risk of serious bodily harm to a person or made.
a group of persons, or for the provision of care, physi-
cians may be able to disclose the individual’s personal In dealing with requests from parents to disclose
health information without contravening PHIPA. In information to the parent or a third party, physicians
addition, physicians may be permitted to disclose should be aware that, under provincial legislation,
information to relatives or friends of the incapacitated there are different rights for the custodial parent and
individual in order to obtain consent for treatment.13 the non-custodial/access parent. The law, a court
order or the terms of a separation agreement may
Physicians carry this ethical obligation to take action prevent one of the parents from making decisions
irrespective of whether there is a physician-patient with respect to the personal health information about
relationship with the incapacitated physician or health their child. Physicians are advised to act with sensitiv-
care professional. Physicians may wish to contact their ity and request a copy of the applicable separation
legal counsel or the CMPA for guidance in these agreement or court order prior to releasing any infor-
situations. mation.
Disclosure to a family member or friend When releasing a child’s medical record or disclosing
Situations may arise where physicians are asked by a the information in the record, physicians should
family member or friend about the condition of a exclude any reference or information pertaining to
patient. Patients are permitted to restrict the disclo- other family members and/or third parties. In addi-
sure of such information. For this reason, physicians tion, physicians are encouraged to keep copies of rele-
will be required to obtain express consent from the vant agreements or court orders in the patient’s
patient before they are able to disclose the patient’s medical record.
personal health information. Where the patient is not
capable to provide the required consent, physicians Disclosure to police
must seek consent from the patient’s substitute deci- It is not mandatory for physicians to provide confi-
sion-maker. dential material to the police in the absence of a legal

12 ‘Incapacitated’ as defined in section 1(1) of the Health Professions Procedural Code, Schedule 2 of the RHPA, S.O. 1991, c. 18 means that the member is suffering from a physical or
mental condition or disorder that makes it desirable in the interest of the public that the member no longer be permitted to practise or that the member’s practice be restricted.
13 Further details of these permitted disclosures can be obtained by consulting PHIPA directly.

CPSO POLICY STATEMENT – CONFIDENTIALITY OF PERSONAL HEALTH INFORMATION 5

 Confidentiality of Personal Health Information

obligation. At these times, the general rules regarding cians and all staff take every precaution to ensure that
consent and disclosure apply, meaning that express conversations regarding patient information are not
consent, either from the patient directly, or the substi- inadvertently overheard by others. Extra sensitivity is
tute decision-maker, will be required before the police required by physicians and staff when discussing
are provided with personal health information. patient matters, either on the telephone or in person
When personal health information is disclosed to the within hearing distance of others. For example, physi-
police, physicians are encouraged to record the offi- cians should be cautious if discussing matters of per-
cer’s name and badge number, the request for infor- sonal health with patients in emergency room areas,
mation, the information provided, and the authority or if a conversation is taking place with staff close to a
for the disclosure (e.g., consent, reporting obligation, reception area.
search warrant or summons). A photocopy of any
Technology
search warrant or summons should be included in the
Technology has provided physicians and patients alike
patient’s medical record. The police or Crown attor-
with a more efficient way of maintaining and commu-
ney will usually take the originals but leave the physi-
nicating personal health information. There are, how-
cian with copies of the record so that ongoing care
ever, several ways in which a physician using modern
can be given.
technology may inadvertently breach patient confi-
Proper information practices dentiality, for example: wireless network connections
Physicians have always been obligated to keep their can pose security problems; e-mails can be inadver-
patients’ personal health information confidential, tently sent to the wrong recipient; inappropriate read-
however, the introduction of PHIPA has also imposed ers may access computer files; and erased hard drives
a legal obligation on physicians to maintain and com- may contain private information. The College encour-
ply with information practices that, among other ages physicians to capitalize on the advantages that
things, keep their patients’ personal health informa- electronic record keeping and other technological
tion: advances have to offer, however, it is always the
responsibility of the physician to ensure that appropri-
• accurate, current and complete; and
ate security provisions have been made.
• protected against theft, loss or unauthorized use or
The College strongly advises that physicians obtain
disclosure.
patient consent to use electronic means for communi-
If personal health information is stolen, lost or cating personal health information. As part of obtain-
accessed by, or disclosed to an unauthorized person, ing consent, physicians must explain to patients the
patients must, subject to specific exceptions,14 be noti- inherent risks of using this form of communication.
fied at the first reasonable opportunity. As a way of recording the patient’s express consent,
Conversations with, or about, patients in the the CMPA has provided a written consent form that
health care setting can be used whenever possible. Completed consent
As a matter of practising medicine, physicians are forms should be included in the patient’s medical
required to ask many questions and/or discuss person- record.
al health matters with patients, other Voice messaging
physicians/health care professionals and/or office/hos- Physicians may sometimes wish to communicate with
pital staff. For this reason, it is essential that physi- patients by telephone, and should confirm and obtain

14 Exceptions include if the information is being held for research purposes as permitted under PHIPA or other prescribed exceptions under the Act.

6 CPSO POLICY STATEMENT – CONFIDENTIALITY OF PERSONAL HEALTH INFORMATION

consent to use this method of communication with
patients.
On certain occasions, it may be necessary to leave a
voice message on a machine or with a third party.
Physicians should be aware that when leaving voice
messages for patients, more than one person in a
home or an office may access messages. For this rea-
son, physicians are advised to exercise caution regard-
ing the content of any messages left for patients.
While it is acceptable for messages to contain the
name and contact information of the physician or the
physician’s office, the College advises that messages
should not contain any personal health information of
the patient, such as details about the patient’s medical
condition, test results or other personal matters.

PROFESSIONAL MISCONDUCT
Under the regulations to the Medicine Act, 1991, it is
an act of professional misconduct for a physician to:
“[give] information concerning the condition of a
patient or any services rendered to a patient to a
person other than the patient or his or her author-
ized representative except with the consent of the
patient or his or her authorized representative or as
required by law.” 15

15 Ontario Regulation 856/93, as amended (made under the Medicine Act, 1991) s. 1(1) paragraph 10.

CPSO POLICY STATEMENT – CONFIDENTIALITY OF PERSONAL HEALTH INFORMATION 7

CONFIDENTIALITY OF PERSONAL HEALTH INFORMATION

COLLEGE OF PHYSICIANS AND SURGEONS OF ONTARIO

80 COLLEGE STREET, TORONTO, ONTARIO M5G 2E2