ACCESS TO AND DISCLOSURE OF PATIENT HEALTH INFORMATION
Manual/Section: ADMINISTRATIVE/HEALTH RECORDS / Policy No. 67Table of Contents
PAGE
PURPOSE / 3POLICY / 3
I.Access
/ 3Access to Health Information for HealthCare Professionals
/ 3Access to Electronic Information
/ 3Individual Access to His/Her Record of Personal Information / 3
II.Disclosure
/ 4Disclosure of Patient Health Information / 4
Consent for Disclosure of Information
/ 5Withdrawal of Consent / 5
Disclosure of Information for Spiritual Support / 5
Disclosure of Information for Fundraising / 5
Disclosure of Information to Media / 5
Disclosure of Information Related to Patient Status / 6
Disclosure of Information to Police / 6
Disclosure of Information Related to Gunshot Wounds
/ 6Requests for Disclosure of Information from Patient Record / 6
Permitted Disclosures Without Consent / 7
Disclosures Related to Providing Health Care / 7
Disclosures Related to Risks
/ 7Disclosures Related to Care or Custody
/ 7Disclosures About Deceased Individuals
/ 7Disclosures Related to Proceedings, Summons, Order, or Warrant / 7
Disclosures/Access to Records for Research/Audits/Reviews / 8
Disclosures to Successor / 9
Disclosures for Health or Other Programs / 9
Disclosures for Planning and Management of Health System / 9
Disclosures Related to Other Acts / 9
Method of Transmittal / 10
Telephone Disclosures / 10
Response to Requests for Individual Access or Disclosure of Information / 10
Fees / 10
Disclosure of Non-Patient Specific Hospital Information / 11
Unauthorized Disclosures / 11
SCOPE / 12
ACCESS TO AND DISCLOSURE OF PATIENT HEALTH INFORMATION
Manual/Section: ADMINISTRATIVE/HEALTH RECORDS / Policy No. 67Table of Contents
PAGEDEFINITIONS / 12
RESPONSIBILITY / 13
PROCEDURE
Disclosures Related to Police Investigations / 13
Disclosures Arising from Court Order/ Subpoenas/Summons / 13
Disclosures to Lawyers / 14
Disclosures Arising from Litigation/ Notice Of Action / 14
Disclosures to Children’s Aid Society: / 14
Disclosures of Photographs / 14
Disclosures of Proof Of Death / 15
Disclosures of Proof Of Admission, Treatment / 15
Disclosures to Nursing Students / 15
CROSS-REFERENCES / 15
ATTACHMENTS / 15
Consent for Disclosure of Personal Health Information / 17
Withdrawal of Consent for Further Use/Disclosure of Personal Health Information / 19
Application for Retrospective Chart Review of Patient Records / 21
Standard Fee Schedule for Release of Information / 22
ACCESS TO AND DISCLOSURE OF PATIENT HEALTH INFORMATION
Manual/Section: ADMINISTRATIVE/HEALTH RECORDS / Policy No. 67Key Words: Disclosure, Personal health information, Patient record
1. PURPOSE: / 1.To ensure access to personal health information is limited to those with a legitimate right to access the information.
2.To ensure patient health information is not disclosed without proper authority.
3.To ensure appropriate documentation in the patient health record of all requests for, and all disclosures of, personal information.
2. POLICY: / Patient information, in paper or electronic form, is the property of Children's Hospital of Eastern Ontario. All personal health information is deemed private and confidential. CHEO is responsible for ensuring that the information in its control is restricted from unauthorized access or disclosure.
I.ACCESS:
Access To Health Information For Health Care Professionals
Access to personal health information will be given on a “need to know” basis, to CHEO staff involved in the care of a patient.
Authorized persons may remove patient records from Health Records department for the purposes of patient care. Health records must be returned to the Health Records daily.
The security and confidentiality of the health record shall be the responsibility of the requester until the record is returned to Health Records.
Access to Electronic Health Information
Refer to Access Control CHEO Information Services Policy.
Individual Access to His/Her Health Record
An individual has the right to access his or her record of personal health information. Upon request, an individual will be informed of the existence of his or her personal information and will be given access to that information. In certain instances, CHEO may choose to make sensitive medical information available through a health care provider.All requests for individual access to health information should be substantiated in writing and signed by the person with authority to do so. (Refer to section on Consent for Disclosure of Personal Health Information below)
In certain situations, CHEO may not be able to provide access to all the personal information it holds about an individual. Examples may include information that is prohibitively costly to provide, information that contains references to other individuals, information that cannot be disclosed for legal, security, or commercial proprietary reasons, and information that is subject to solicitor-client or litigation privilege.
In such cases, the reasons for denying access will be provided to the individual upon request.
Access to personal information does not include quality of care information or raw test data from standarized tests or assessments. Nor does it include information used solely for the purposes of research.
CHEO will not give an individual access to personal information if doing so would likely reveal personal information about a third party, or if doing so could reasonably be expected to result in a risk of serious harm to the treatment or recovery of the individual or a risk of serious bodily harm to the individual or another individual. However, if that information is severable from the record containing any other information for which access is requested, CHEO shall give the individual access after severing.
It is generally recommended that individual access to health records be done after the patient is discharged from hospital when the chart has been properly assembled and audited for completeness.
At no time should an individual be left unattended with the health record. Ideally, a health care provider should be with the individual during the review of the chart to answer questions about, or clarify any documentation.
II.DISCLOSURE
Disclosure of Patient Personal Health InformationPatient’s personal health information shall not be disclosed for purposes other than those for which it was collected, except with the knowledge and consent of the patient/substitute decision maker, or as required by law.
Disclosure of personal information to any third party will only be done by personnel authorized to do so, and in accordance with the rules and regulations governing the disclosure of personal information.
Consent for Disclosure of Personal Health Information
Consent for the disclosure of personal health information may be express or implied depending on the circumstance. Consent must be express for disclosures to a) a non Health Information Custodian, or b) to a Health Information Custodian, but not for purposes of providing health care to the patient. Consent may be implied for disclosure to another Health Information Custodian for the purposes of providing health care.
If express consent is required for the disclosure, the request must be signed by the person who has authority to consent to the disclosure. Consent to Disclosure of Personal Health Information (Form No. 4010) is available for this purpose. Any written request (including a letter) that specifies the information to be disclosed, to whom, and is dated and signed by the appropriate person will also serve as a valid consent.
In accordance with Personal Health Information Protection Act, 2004, the following may consent to the disclosure of information:
- If the individual is at least 16 years of age and capable, the individual or any person who the individual has authorized in writing to act on his/her behalf.
- If the individual is a child less than 16 years of age, a parent or other person who has lawful custody ("parent" does not include a parent who has only a right of access to the child) unless the information relates to treatment about which the child has made a decision on his or her own. NOTE: If there is a conflict between substitute decision-maker and the capable child less than 16 years of age related to consenting to the collection, use or disclosure of the information, the decision of the child prevails.
- If the individual is incapable, a substitute decision maker (SDM)
- If the individual is deceased, the deceased’s estate trustee.
Withdrawal/Restriction on Consent for Disclosure of Personal Health Information
An individual may withdraw their consent, or place restrictions on their consent for the use or disclosure of their information, subject to legal or contractual restrictions and reasonable notice. Withdrawal of consent has no retroactive effect. CHEO will inform the individual of the implications of such withdrawal.
Anyone wishing to withdraw or place restrictions on their consent for use or disclosure of their information is to be referred to Health Records to complete a “Withdrawal of Consent for Further Use/Disclosure of Personal Health Information” (Form No. 1139), which will be placed on the patient record.
Disclosure of Information for Spiritual Support
If a patient provides information about his or her religious or other organizational affiliation upon admission, it may be assumed that the patient has given implied consent to provide his or her name and location in the facility for spiritual support purposes, unless the patient indicates otherwise.Disclosure of Information for Fundraising
Consent for disclosure of personal health information for the purpose of fundraising activities may be implied if the information is restricted to the individual's name and the mailing address. Otherwise, express consent is required.
Disclosure of Information to Media
Requests for information regarding the patient or family from the press must be referred to Communications and Public Relations. The procedure to follow is outlined in General Administration Policy#9 - Media Relations CodeDisclosure of Information to Police:
Personal Health Information may be disclosed to police:
- with patient consent, or
- with a search warrant for patient records
The Mandatory Gunshot Wound Reporting Act, 2005 requires every facility that treats a person for a gunshot wound to disclose to the local municipal or regional police force or the local Ontario Provincial Police detachment the fact that a person is being treated for a gunshot wound, the person’s name, if known, and the name and location of the facility.
The disclosure must be made orally and as soon as it is reasonably practicable to do so without interfering with the person’s treatment or disrupting the regular activities of the facility.
Disclosure of Information Related to Patient Status:
Personal Health Information Protection Act permits the following personal health information to be disclosed about a patient, if the patient was given the opportunity to object to the disclosure and has not:
- The fact that the individual is a patient in the facility.
- The individual's general health status described as critical, poor, fair, stable or satisfactory, or in similar terms.
- The location of the individual in the facility
(d)All requests for disclosure of information from the patient’s health record or requests for access to the health record should be referred to the Health Records.
All requests for disclosure of information must be substantiated in writing and will be placed in the patient’s health record.
(e)
Permitted Disclosures Without Consent
Personal Health Information Protection Act permits disclosure of personal health information as follows:
a)Disclosures related to providing health care:
- to another health information custodian if the disclosure is reasonably necessary for the provision of health care and it is not reasonably possible to obtain the individual's consent in a timely manner, but not if the individual has expressly made instruction not to disclose the information. If the patient’s instruction prevents the disclosure of all the PHI that CHEO considers necessary for the provision of health care, CHEO must make the recipient of the information aware of that fact.
- to determine or provide funding or payment to CHEO for the provision of health care
- for the purpose of contacting a relative, friend or potential substitute decision maker, if the patient is injured, incapacitated or ill and unable to give consent personally
- if CHEO believes on reasonable grounds that the disclosure is necessary for the purpose of eliminating or reducing a significant risk of serious bodily harm to a person or group of persons.
- to the head of a custodial institution or to the officer in charge of a psychiatric facility in which the patient is being lawfully detained
- for the purpose of identifying the individual
- for the purpose of informing any person whom it is reasonable to inform that the individual is deceased and the circumstances, where appropriate
- to the spouse, partner, sibling or child of the individual if the recipients of the information reasonably require the information to make decisions about their own health care or their children’s health care.
- for the purposes of a proceeding or contemplated proceeding
- to comply with a summons, court order, or warrant
- to a researcher for the purposes of research if the researcher submits an application in writing that includes:
- a research plan outlining the affiliation of each person involved in the research, and the objectives of the research
- a copy of CHEO’s Research Ethics Board approval
- The researcher must then:
- comply with any conditions specified by the CHEO Research Ethics Board
- use the information only for the purposes set out in the research plan as approved by the CHEO Research Ethics Board
- not publish the information in a form that could reasonably enable a person to ascertain the identity of the individual
- not disclose the information except as required by law
- not make contact or attempt to make contact with the individual, directly or indirectly, unless CHEO first obtains the individual's consent to being contacted
- notify CHEO immediately in writing if the researcher becomes aware of any breach of the agreement.
- collect the information in an unidentifiable format.
- store securely all working papers including patient lists, generated duringthe review, and destroy when finished.
- Authorization to access patient health records to conduct research/audits/reviews will be given by Director, Health Records/ Patient Registration PSU only when an application form “Application for the Retrospective Chart Review of Patient Records” (Form No. 4005), authorized by the Department/Division Chief, and signed by the investigators, has been completed. Access to records for the purpose of research/audits/reviews is dependent on the following guidelines:
- Charts will be reviewed in the Health Records department.
- CHEO staff, or research assistants working for CHEO staff, will conduct the reviews.
- Projects to be conducted by external groups will be sponsored by the department/division Chief or Director of PSU under review.
- Records will only be out of file for 1 month due to space limitations and the need for chart control,. If the review has not begun by this time the principle investigator will be contacted and the charts returned. Costs for re-retrieval will apply.
- to allow a potential successor to assess and evaluate the operation of CHEO, with a confidentiality agreement
- to transfer CHEO’s records to the successor after giving notice to the patient
- for the purpose of determining or verifying the benefit eligibility of the individual to receive health care or related goods, services or benefits
- to a person conducting an audit or reviewing an application for accreditation
- to the following prescribed registries:
- Cardiac Care Network of Ontario
- Information System for Cytology (INSCYTE)
- Ontario Joint Replacement Registry
- Canadian Stroke Registry
- to the Chief Medical Officer of Health or to a public health authority
- for the purpose of analysis or compiling statistical information with respect to the management of, evaluation or monitoring of, or planning for the health system, including delivery of services
- to the following prescribed entities:
- Cancer Care Ontario
- Canadian Institute for health Information
- Institute for Clinical Evaluative Sciences
- Pediatric Oncology Group of Ontario
- to a health data institute approved by the Minister
- for determining capacity (Health Care Consent Act, Substitute Decisions Act)
- to a College within the meaning of the Regulated Health Professions Act for the purpose of administration or enforcement of the Drug and Pharmacies Regulation Act and Regulated Health Professions Act
- to the Board of Regents under the Drugless Practitioners Act for administration or enforcement.
- to the Ontario College of Social Workers and Social Service Workers under Social Work and Social Services Act for administration or enforcement
- to the Public Guardian and Trustee, the Children’s Lawyer, a children’s aid society, the Registrar of Adoption Information, a Residential Placement Advisory committee under the Child and Family Services Act to carry out their functions.
- to: (Public Hospitals Act, 1990 (Reg. 965, 22):
- comply with a summons
- an inspector
- a coroner, or delegate
opersons appointed by the Minister
- College of Physicians and Surgeons for the purposes of investigating medical care provided to a patient.
- General Manager for the Ontario Health Insurance Plan
- the Ontario Cancer Treatment and Research Foundation
- persons for the purposes of information and data collection, organization and analysis
- to the Children’s Aid Society if a health care professional has reasonable grounds to suspect abuse. (Child and Family Services Act (68(3)). Refer to CHEO Policy #3 - Child Protection.