Frequently Asked Questions - Information and Privacy ...

1 Frequently Asked Questions personal health Information Protection Act September 2015. This Frequently Asked Questions (FAQ) provides a general overview of the personal health Information Protection Act and Regulation 329/04. The Information contained in this document is for general reference purposes only and should not be considered as legal advice. Legal counsel should be consulted for all purposes of interpretation. This FAQ is not binding on the Information and Privacy Commissioner of Ontario (IPC) and should not be construed to interfere with the IPC's ability to discharge its duties under the personal health Information Protection Act.

2 This publication is also available on the IPC website. Cette publication est galement disponible en fran ais. CONTENTS. 1. What is the personal health Information Protection Act and why is it necessary?.. 1. 3. What is the purpose of PHIPA?.. 3. What rights do individuals have?.. 3. What is the relationship between PHIPA and the federal personal Information Protection and Electronic Documents Act (PIPEDA)?.. 4. What is the relationship between PHIPA, the Freedom of Information and Protection of Privacy Act (FIPPA) and the Municipal Freedom of Information and Protection of Privacy Act (MFIPPA)?

3 5. Interpretation and Application of 6. To whom does PHIPA apply?.. 6. What is personal health Information ?.. 6. What does health care mean?.. 7. What is a custodian?.. 7. Is a health care practitioner working for a non-custodian considered to be a custodian? .. 8. What is an agent?.. 9. Does PHIPA apply to insurance companies or employers?.. 10. What is an electronic service provider?.. 10. What is a health Information network provider?.. 10. Who is a prescribed person?.. 11. What is a prescribed entity?

4 12. Practices to Protect personal health 13. How does PHIPA protect personal health Information ?.. 13. What are the notification requirements in PHIPA in the event of a breach?.. 14. Do custodians have responsibilities with respect to accountability and openness?.. 14. What are the requirements for the treatment of personal health records in the event of a change in practice?.. 15. Frequently Asked Questions : personal health Information Protection Act Consent Concerning personal health 16. What are the requirements for consent?

5 16. What is the difference between express and implied consent?.. 16. When is express consent required?.. 17. When is implied consent sufficient?.. 17. What is the circle of care'?.. 18. When can custodians assume implied consent?.. 19. Are pharmacists required to obtain express consent from an individual to disclose personal health Information to a third party benefits payor?.. 20. Can individuals control what personal health Information is recorded in their file?.. 20. Can individuals withdraw their consent?

6 20. What is a lock-box'?.. 21. What are the restrictions and limitations on the lock-box?.. 21. What happens when an individual is incapable of providing consent?.. 22. Can a child under 16 years old provide consent?.. 23. Can another person, such as a family member, provide consent on an individual's behalf when picking up or dropping off a prescription?.. 23. Collection, Use and Disclosure of personal health 24. What are the general limitations on the collection, use and disclosure of personal health Information ?

7 24. 24. What is a collection of personal health Information under PHIPA?.. 24. What are the rules regarding the collection of personal health Information ?.. 25. When can custodians indirectly collect personal health Information ?.. 25. 26. What is a use of personal health Information under PHIPA? .. 26. What are the rules regarding the use of personal health Information ?.. 26. When can personal health Information be used without consent?.. 26. Frequently Asked Questions : personal health Information Protection Act 27.

8 What is a disclosure of personal health Information under PHIPA?.. 27. What are the rules regarding the disclosure of personal health Information ?.. 27. When can personal health Information be disclosed without consent?.. 28. Can personal health Information be disclosed in the event of an emergency?.. 29. Does PHIPA permit disclosure of personal health Information about a deceased individual?.. 30. Can a custodian disclose personal health Information to the Workplace Safety and Insurance Board (WSIB) about an injured worker without the individual's consent?

9 31. Can a custodian store, access or disclose personal health Information outside of Ontario?.. 31. Fundraising and 33. Can custodians collect, use or disclose personal health Information for fundraising activities?.. 33. Can personal health Information be collected, used or disclosed for marketing purposes?.. 34. 35. What are the requirements for the collection, use and disclosure of personal health Information for research?.. 35. Are there any requirements for research ethics boards and research plans?

10 36. Ontario health Cards and health 37. Who can collect, use or disclose Ontario health numbers and under what circumstances?.. 37. Are other organizations permitted to request the production of a health card?.. 37. Access to Records of personal health Information and 39. 39. Are individuals permitted to access their own personal health Information ?.. 39. Frequently Asked Questions : personal health Information Protection Act How do an individual obtain access to their personal health Information ?.. 40. How long does a custodian have to respond to an individual's request for access to personal health Information ?