Sharing of Personal Health Information

Thank you for your MedicASK question.

This is a challenging area to provide concrete answers to as there is some judgement by the paramedic required. Under the Personal Health Information Protection Act, 2004 (PHIPA) and Health Care Consent Act, 1996 (HCCA) that regulate paramedics, we cannot disclose information if the patient has asked us not to, irrespective of age. The exception to this is if the paramedic:

Is subpoenaed by court
Reporting suspected child abuse
To warn intended victims (e.g., if plans to hurt another person are described)
The paramedic can also release confidential information to the young person’s substitute decision-maker, if the young person has been judged incapable.
The paramedic must determine if the patient has capacity. All people are presumed to have capacity unless the provider has reasonable grounds to believe the person is incapable. Once capacity is confirmed then the patient, irrespective of age, may withdraw consent (if it had been previously given) and/or strictly state they do not allow the paramedic to share their personal health information.

I have taken the following directly from Personal Health Information Protection Act, 2004.

Withdrawal of consent

19 (1) ** If an individual consents to have a health information custodian collect, use or disclose personal health information about the individual, the individual may withdraw the consent, whether the consent is express or implied, by providing notice to the health information custodian, but the withdrawal of the consent shall not have retroactive effect. 2004, c. 3, Sched. A, s. 19 (1).

Capacity to consent

21 (1) An individual is capable of consenting to the collection, use or disclosure of personal health information if the individual is able,

(a) to understand the information that is relevant to deciding whether to consent to the collection, use or disclosure, as the case may be; and

(b) to appreciate the reasonably foreseeable consequences of giving, not giving, withholding or withdrawing the consent. 2004, c. 3, Sched. A, s. 21 (1).

Additionally, another great resource is the Information and Privacy Commissioner of Ontario. This is their explanation regarding the situation you asked about:

“A custodian may obtain consent for the collection, use and disclosure of personal health information from a capable child, regardless of age. As discussed above, individuals are capable of consent if they are able to understand information relevant to deciding whether to consent to the collection, use or disclosure of their personal health information, and to appreciate the reasonably foreseeable consequences of giving, not giving, withholding or withdrawing their consent.

If the child is less than 16 years old, a parent of the child or a children’s aid society or other person who is lawfully entitled to give or refuse consent in the place of the parent may also give, withhold or withdraw consent. However, this does not apply in the context of information that relates to treatment within the meaning of the Health Care Consent Act, about which children have made a decision on their own, or counselling in which children have participated on their own under the Child and Family Services Act. A parent does not include a parent who has only a right of access to the child. If there is a conflict between a capable child who is less than 16 years old, and the person who is entitled to act as the child’s substitute decision-maker, the decision of the capable child regarding giving, withholding or withdrawing consent prevails.”

The Information and Privacy Commissioner of Ontario also discusses how people are capable of “locking” their personal information and expressing directly to their care provider to not share any of that information.

“Once an individual locks personal health information, a custodian subject to the withdrawal or withholding of consent or express instruction cannot collect, use or disclose, as the case may be, that personal health information for health care purposes, unless the individual provides express consent and informs the custodian accordingly or unless PHIPA otherwise permits the collection, use or disclosure to be made without consent.”

Regarding nurses and police, they fall under different regulations than paramedics and therefore may be able to do things that paramedics cannot. Though they (nurses, police) may be sharing patient information, if the patient has requested the paramedic not share it, paramedics are required to follow the rules that govern them.

I have provided the links to the relevant acts and the IPC website if you are interested in any further reading.