Nurses should maintain confidentiality unless disclosure is required or permitted by legislation. Before disclosing, assess whether there is a significant risk of serious bodily harm, consider whether disclosure may cause harm, and consult the health care team and/or designated privacy officer, if needed. If disclosure is necessary, share only the information relevant to reducing the risk and follow your organization’s policy.

Nurses should not assume a family member can receive detailed personal health information because they identify as the primary contact or say they handle the client’s care. Before sharing personal health information with a family member, POA or SDM, confirm the person’s authority to receive the information and determine whether the client is capable of making their own decisions about disclosure. If the client is capable, the client’s consent is generally required before sharing information outside the health care team. If the client is incapable, the appropriate SDM may give, withhold or withdraw consent on the client’s behalf. Nurses should share only information relevant to the request, consider whether disclosure could cause harm, document consent or authority as appropriate, and seek guidance from the organization’s privacy officer or internal policies when authority is unclear or family members disagree.

Nurses should not assume that a request from a lawyer, insurer, police officer or other third party automatically authorizes disclosure. Before accessing or sharing a client’s personal health information, take reasonable steps to verify the requester’s identity and legal authority. This may include confirming the person’s role, reviewing required documentation such as a court order, legal authorization, power of attorney or substitute decision-maker authority, and following employer procedures for responding to requests connected to a legal process. If authority is unclear, seek guidance from the organization’s designated privacy officer or legal representative before releasing information. If disclosure is authorized, share only the information relevant to the request and document the rationale.

Clients have the right to instruct that part of their personal health information is not shared with other providers. This is a consent directive, commonly referred to as a lockbox provision. When a client provides consent to share only part of their personal health information, the nurse should disclose only the information the client has agreed to share and avoid including details outside that scope, such as in this case scenario, the client’s mental health history. If a client instructs a nurse not to release part of their personal health information to another practitioner, the nurse must advise the receiving practitioner that some relevant information is incomplete or has been withheld at the direction of the client. Nurses should document the client’s direction and follow their organization’s policy for communicating with external partners.

If a client asks that part of their personal health information not be shared, you must withhold it from the health care team. This is known as the lockbox provision. You should explain the possible implications so the client can make an informed decision, tell other practitioners that relevant information has been withheld at the client’s direction, and follow your organization’s policy for documenting locked information.

Express consent is generally required before disclosing personal health information outside the health care team, including to community partners such as shelters or housing agencies. Before sharing, confirm the client’s consent, the purpose of disclosure, and whether the receiving party has authority to receive the information. Nurses should share only the minimum information needed and use secure communication methods to transmit information.

Express consent is generally required before disclosing personal health information to an insurance provider. Confirm what information the client has agreed to share and disclose only what is needed for the insurance-related purpose. Nurses should document the client’s consent and follow their organization’s policy for releasing information.

The Mandatory Gunshot Wounds Reporting Act, 2005 requires hospitals and other prescribed health care facilities to report to police, as soon as possible, the client’s name, if known, and the location of the reporting facility.
The legislation does not specify who must make the report. Nurses should follow organizational or unit policy to determine roles, responsibilities and how to meet reporting obligations while maintaining the therapeutic relationship.

When intimate partner violence or another serious risk of harm is involved, nurses should seek the client’s consent to share information when it is safe and appropriate. If there is a significant risk of serious harm, Ontario privacy laws may permit disclosure without consent to an organization or service provider that can help reduce the risk, or the appropriate authority. Nurses also have a duty to report when required by law, including when there are reasonable grounds to suspect a child needs protection under the Child, Youth and Family Services Act, 2017. Before disclosing or reporting, nurses should assess the seriousness, likelihood and immediacy of the harm, consider whether disclosure could increase risk, follow employer policies or consult their organization’s privacy officer, share only the minimum necessary information and document the rationale.

For more information:

• IPC: Sharing Information in Situations Involving Intimate Partner Violence
• IPC: Sharing Information in Situations Involving Risk of Serious Harm