Protecting client confidentiality and privacy is a shared accountability. Under Ontario's privacy legislation, health information custodians (HICs) are responsible for establishing and maintaining privacy systems that protect personal health information.

Nurses commonly act as agents of a HIC when they access, collect, use or disclose personal health information on the HIC's behalf to provide care or complete work-related duties. Nurses who are self-employed (see CNO's Independent Practice guideline), or those employed in health services in non-health care settings (for example, school nurses) may be considered HICs rather than agents. Nurses acting as HICs have additional responsibilities.

Together, nurses acting as agents and HICs have distinct but connected responsibilities for protecting the confidentiality and privacy of client information. It is important, as a nurse, whether you are acting as an agent or a HIC, to understand how these shared accountabilities work together in practice.

Expectations and roles

Employer / Health Information Custodian

  • Create and maintain privacy policies, procedures and safeguards, such as training.

  • Ensure staff and agents understand their privacy duties, limits and who to contact, such as the organization’s Privacy Officer.

Nurse / Agent

  • Meet CNO standards, legislation and organizational policies and procedures.

  • Advocate for policies and procedures that protect confidentiality when none exist.

Access, collection and use

Employer / Health Information Custodian

  • Develop processes for how records are created, stored, accessed and maintained.

  • Establish processes on how information is safely shared, such as by email, phone, fax or virtual care platforms.

  • Determine how records or devices are securely destroyed or removed when no longer needed.

Nurse / Agent

  • Access only the information needed to provide nursing care.

  • Collect only the information needed and use it for the intended purpose when providing nursing care.

  • Inform clients or substitute decision-makers when information may be used for purposes other than client care, such as quality improvement or research.

Client rights and records

Employer / Health Information Custodian

  • Provide notice, support access and correction requests, and manage lockbox processes.

  • Develop processes to ensure client records are accurate, complete, up-to-date and securely managed.

Nurse / Agent

  • Keep information confidential when providing nursing care and advise the client of any duty to report information as required by legislation.

  • Take reasonable steps to provide care interactions in a private setting to maintain confidentiality.

  • Share information only with people who are permitted to receive it within and outside the health care team, after confirming their authority to receive the information.

  • Respect the client’s right to understand and make decisions about how their personal health information is used or shared, including obtaining, confirming and documenting consent when required by legislation or organizational policy.

Disclosure

Employer / Health Information Custodian

  • Establish processes for authorized disclosure of personal health information, including when disclosure is permitted or required by legislation.

  • Designating a contact person to facilitate compliance with PHIPA and respond to access or correction requests, inquiries and complaints form the public.

Nurse / Agent

  • Confirm authority to disclose personal health information.

  • Obtain expressed consent from the client or substitute decision-maker before disclosing client information outside the health care team, unless otherwise permitted or required by legislation.

  • Disclose only the information needed and seek guidance when unsure.

  • Assess whether disclosure may result in harm to the client and consult the health care team when there are concerns.

Technology and digital tools

Employer / Health Information Custodian

  • Assess and manage privacy risks in digital systems, shared platforms and AI tools.

  • Ensure devices, such as computers, phones, tablets or other tools that may contain health information are secure.

  • Set out accountabilities for agents and others acting on the HIC’s behalf, including third-party service providers or vendors.

Nurse / Agent

  • Use only employer approved tools, devices and systems.

  • Protect personal health information when using employer-approved electronic records, digital platforms, mobile devices and AI tools.

Privacy breach

Employer / Health Information Custodian

  • Have clear processes in place for reporting privacy breaches.

  • Notify clients and, where legally required, the Information and Privacy Commissioner of Ontario when health information is stolen, lost, used or disclosed without authority.

Nurse / Agent

  • Recognize privacy risks, follow organizational processes and report concerns to your employer promptly.