How to Protect Your Private Health Information in Canada
Thanks to the pandemic, many more parents in Ontario are choosing to exercise their Personal Health Information Protection Act (PHIPA)-protected right to withhold consent to the collection and storage of their own or their child’s private health information (PHI).
A document from the Information and Privacy Commissioner of Ontario (IPC) outlines how to put your private medical records into a Lock-Box. This “Lock-Box Fact Sheet” can be found HERE.
PHIPA outlines that parents may choose to withhold or withdraw consent to disclosing their or their child’s private health information (including vaccination status).
18 (1) If this Act or any other Act requires the consent of an individual for the collection, use or disclosure of personal health information by a health information custodian, the consent,
(a) must be a consent of the individual;
(b) must be knowledgeable;
(c) must relate to the information; and
(d) must not be obtained through deception or coercion. 2004, c. 3, Sched. A, s. 18 (1).
Knowledgeable Consent
(5) A consent to the collection, use or disclosure of personal health information about an individual is knowledgeable if it is reasonable in the circumstances to believe that the individual knows,
(a) the purposes of the collection, use or disclosure, as the case may be; and
(b) that the individual may give or withhold consent. 2004, c. 3, Sched. A, s. 18 (5).
PHIPA Section 39 (2) an information custodian cannot collect private health information without consent, Section 39 applies AFTER they have voluntarily consented to allow the collection of their private medical records. The definitions of collect and disclose in PHIPA clarify the difference. However, if a person chooses to withhold consent, as outlined in PHIPA Section 19(5)(b), then section 39 does not apply, as the health custodian cannot disclose information to other information custodians, if that information was never provided to them.
39. (2) If consent is given, a health information custodian may disclose personal health information about an individual:
(a) to the Chief Medical Officer of Health or a medical officer of health within the meaning of the Health Protection and Promotion Act if the disclosure is made for a purpose of that Act or the Immunization of School Pupils Act;
(a.1) to the Ontario Agency for Health Protection and Promotion if the disclosure is made for a purpose of the Ontario Agency for Health Protection and Promotion Act, 2007; or
(b) to a public health authority that is similar to the persons described in clause (a) and that is established under the laws of Canada, another province or a territory of Canada or other jurisdiction, if the disclosure is made for a purpose that is substantially similar to a purpose of the Health Protection and Promotion Act or the Immunization of School Pupils Act. 2004, c. 3, Sched. A, s. 39 (2); 2007, c. 10, Sched. K, s. 32; 2020, c. 5, Sched. 6, s. 5.
Personal Health Information Protection Act, 2004, S.O. 2004, c. 3, Sched. A
*************************************************************************************************************************************************