Understanding Privacy in the Context of Mental Health: The Family Perspective

May 3, 2008Justice and Mental Health Conference

Mary Jane Dykeman

Barrister & Solicitor

Background

Personal Health Information Protection Act, 2004 came into force on November 1, 2004.

A mandatory 3-year review of PHIPA is about to begin.

3

Framework of PHIPAPart I: Interpretation and ApplicationPart II: Practices to Protect PHIPart III: Consent, Capacity & Substitute Decision-

MakingPart IV: Collection, Use & Disclosure of PHIPart V: Access to and Correction of Records of

PHIPart VI: Administration and EnforcementPart VII: GeneralPart VIII: Complementary AmendmentsPart IX: Commencement and Short Title

4

Key Concepts• What PHIPA covers, what it does not• Health information custodian (HIC) – who is one,

who is not• Personal health information (PHI) inside and

outside the ‘clinical record’• Identifiable PHI• Mixed record• Health care• Collection• Use v. disclosure

5

Key Clinical Issues

• Indirect Collection

• Consent: Express, Implied, or No Consent

• Withdrawal of Consent

• ‘Lockbox’ for (internal) Use and (external) Disclosure of PHI

• Access & Correction 

• Research

6

Role of Privacy Commissioner

• Information and Privacy Commissioner (IPC) has broad powers to investigate, make an order based on complaint or on own initiative

• 5 significant IPC orders to date: – improper disposal of records– abandoned records– improper access to health records– stolen laptop containing PHI– wireless camera in methadone clinic

7

Express Consent

• Consent must be express if PHI given to non-HIC

• Examples of non-HICs: lawyer, insurance company, employer, family member who is not an authorized substitute decision-maker

8

Implied Consent

• If HIC provides notice of its collections, uses and disclosures of PHI, PHIPA allows the HIC to assume that clients are “knowledgeable” and rely on their implied consent

9

Implied Consent – cont’d• If a HIC receives PHI from a client, the

client’s substitute decision-maker or another HIC

• May then collect, use or disclose the PHI based on implied consent for health care purposes unless aware client has withdrawn the implied consent (sharing between HICs commonly referred to as “circle of care”)

10

No Consent Required

• PHIPA sets out numerous circumstances in which a HIC has the right to collect, use and disclose PHI without first obtaining consent

11

Lockbox• As with “circle of care”, term “lockbox”

does not appear in PHIPA

• Refers to HIC’s ability to use and disclose PHI without consent in circumstances related to health care

• BUT individual can ask the HIC to shield certain parts of the record

• Recipient must be informed that records are incomplete

12

Lockbox• Reminder: ‘lockbox’ provisions apply only

in context of health care, NOT– Where necessary to disclose PHI to reduce or

eliminate significant risk of serious bodily harm– To identify who is the substitute decision-maker– Where disclosure is mandatory under other Acts

(including duty to report child abuse; or to report to public health authorities)

– As otherwise permitted or required under PHIPA

13

Lockbox Dilemmas

• Client instructs HIC not to give PHI externally to assist in his/her care (e.g. to another physician involved in his or her care)

14

Is my family member a client?

• If a client is capable, can instruct the hospital not to tell people he/she is in the hospital

• Many hospitals will release name, location and status unless client tells them not to

• Many mental health facilities do the opposite – will neither confirm nor deny the person is there

15

Collection Dilemmas

• General rule is that you may only collect PHI from someone other than the individual if you have consent; or the Commissioner has approved; or you have other legal authority to collect indirectly; or if you cannot get the information you need accurately or in a timely way

• If capable, patient could later instruct caregiver not to use or disclose that information

16

Capacity

• Individuals are presumed to be capable• When in doubt, care provider must

determine whether the client is capable to collect, use and disclose PHI

• Test for capacity

17

Substitute Decision-Making

• If client is incapable to consent to collection, use or disclosure of PHI, turn to list of decision-makers in PHIPA

• If there is already an SDM for treatment, admission to a care facility or personal assistance services under the Health Care Consent Act, that person is also the SDM for related information decisions

18

Access to PHI

• Clients may make a written request for access to PHI wherever it is held (e.g. team member’s notes outside client’s file)

19

Correction of PHI

• Clients may request that you make corrections to a record of PHI

• HIC may deny if:– Professional opinion made in good faith

OR– Original record was not the HIC’s and HIC

lacks sufficient authority, knowledge or expertise to make the requested change

20

Case Scenarios

• Elderly female client with possible addiction-induced paranoia but who may actually be subject to domestic abuse

• Husband comes to hospital asking for a copy of his wife’s record from a particular admission

• Is he the authorized substitute decision-maker?

21

Case Scenarios• Equally ranked children/siblings of a client cannot

agree on a treatment, placement or information decision

• First question always: has the client actually been found incapable?

• Staff can request that the family get it together and communicate a decision

• Public Guardian and Trustee decision-maker of last resort for treatment (“may” act re: PHI)

22

Mental Health and AddictionsPrivacy Toolkit

• Project led by CMHA Ontario Division

• Advisory Group of various addictions / mental health representatives

• Focus on plain language, Q&As specific to addictions and community mental health, templates

• Available at: www.privacytoolkit.ca

23

Other Resources

• Information and Privacy Commissioner’s website: www.ipc.on.ca

• Ministry of Health website: www.gov.on.ca/health

• Consent and Capacity Board website (www.ccboard.on.ca)

• www.advocacycentreelderly.org

24

Mary Jane DykemanMary Jane DykemanBarrister & SolicitorBarrister & Solicitor

(416) 949-5356(416) 949-5356maryjane.dykeman@sympatico.ca