More   en français

Publications & Resources > The Standard > September 2004   

  Last modified August 27, 2004  

New privacy laws improve client’s access to information

Two important new health information acts that will affect how nurses collect and use client information will come into effect by the end of this year.

The Personal Health Information Protection Act (PHIPA) and the Quality of Care Information Act, 2004 (QCIPA) will take effect in November 2004.

The two acts have different, yet complementary, purposes. PHIPA provides the rules for the collection, use, disclosure and disposal of personal health information. It also establishes the Office of the Information and Privacy Commission to respond to concerns about client access to health information.

QCIPA protects information that is provided to a health entity’s quality of care committee (such as CNO’s Quality Assurance Committee) from disclosure.

PHIPA specifies that health information custodians — defined as a health care practitioner such as a nurse, or someone who runs a group practice, hospital, board of health, ambulance service or similar organization — should ensure that clients’ personal health information is kept confidential and secure.

PHIPA also ensures that clients have a right to access their health information records and sets out a process for access and corrections, should they be needed. The onus, however, is on the client to demonstrate that the record is incomplete or inaccurate, and any changes to the record must be tracked.

The federal government is now looking at whether the provincial PHIPA and the federal Personal Information Protection and Electronic Documents Act (PIPEDA) are substantively similar. If they are, then the provincial legislation will take precedence over the federal act in Ontario.

Nurses should check the CNO website (www.cno.org) for further updates on the acts. To get a copy of the acts go to www.e-laws.gov.on.ca.

What the new act means to nurses

“This legislation allows patients to have greater control over their personal health outside the circle of care. In the context of the circle of care, information should flow freely between health providers. This legislation should not impede the delivery of care.”

CNO asked Privacy Commissioner Ann Cavoukian to explain why Ontario needs privacy legislation and how the new Personal Health Information Protection Act (PHIPA) affects nurses.

CNO: Why is it important to have privacy legislation for Ontario’s health care sector?

Ann Cavoukian: It is really important to have a set of consistent rules for all health care professionals. Up to now, we have had different rules for different parts of the health care system. Different rules are less likely to allow for a comprehensive approach to the delivery of health care. A patchwork of privacy policies can cause problems when there is a need to integrate health care delivery. A patchwork means that there are different policies and privacy codes in different health care institutions.

The new privacy legislation ensures that we will have a level playing field, and you can only get that from a consistent set of rules entrenched in a statute.

CNO: How does the PHIPA address client rights?

AC: PHIPA gives patients greater control over whether and how their personal health information is collected, especially in a non-health care context. For example, patients will now be aware that they can choose to refuse to disclose personal health information to an insurance company or to other organizations outside the circle of care.

For the first time, PHIPA gives patients the legislated right of access to their own personal health information. The legislation recognizes that personal health information belongs to a patient and is simply being housed in the health care facility. While this right of access is not new (it is based on a 1992 Supreme Court decision), it is now a legislated right that will increase the transparency of personal health information.

PHIPA also establishes an independent oversight body (my office), which is known as the Office of the Information and Privacy Commissioner. We can investigate a complaint if, for example, a request to access personal health information is denied, and we will always try to mediate a resolution with the health information custodian as our method of first choice.

CNO: How will PHIPA affect nurses’ practice?

AC: Hopefully minimally. The legislation is designed to minimize the impact on care delivered to a patient, not to create barriers. It is based on an implied consent model within health care teams. For example, the legislation allows nurses to relay client information when transferring a client to another care setting. Nurses may also share client health information with other team members within the circle of care unless the client has specifically requested that certain information not be shared.

The legislation also permits nurses to confirm whether an individual is a client in an institution; provide the client’s location, such as the room number; and comment on her or his general health status, unless that individual has specifically requested that such information not be disclosed.

CNO: Are there any other changes nurses should know about?

AC: Yes, there are a couple of important changes in this legislation. If a patient requests a correction to their health information, either the Health Information Custodian or the designated contact person of the Health Information Custodian responsible for responding to access requests has 30 days to respond to the request. However, PHIPA also permits extensions beyond this 30-day time frame in limited circumstances as outlined in the legislation.

A nurse has to be more cautious in disclosing information to third parties without the express consent of a patient. It is preferable that express consent be written to avoid ambiguity, although it does not have to be elaborate. It could take the form of a note in the patient’s file. If a police officer approaches a nurse regarding domestic abuse, the nurse can only disclose personal health information if the officer has a court order. Information can be disclosed, but only with the patient’s consent. A nurse working in a doctor’s office may be approached by a friend or family member seeking information about a patient. Although it may be a genuine inquiry, a health care provider cannot release information without the express consent of the patient, except in compelling circumstances, such as for the purposes of contacting a friend, relative or potential substitute decision-maker of the patient who is injured, incapacitated or ill and unable to give consent for the disclosure.

This legislation allows patients to have greater control over their personal health outside the circle of care. In the context of the circle of care, information should flow freely among health providers. This legislation should not impede the delivery of care.

[top]