As a regulatory body that regulates professions, you may be receiving questions from your registrants about whether they have a legal obligation to report personal health information about a client or patient if they have reasonable grounds to suspect that their client or patient may have COVID-19 and is not taking appropriate steps to prevent the spread of the disease. The purpose of this bulletin is to review certain relevant provisions of the Personal Health Information Protection Act, 2004 regarding the disclosure of personal health information and some of the obligations under the Health Protection and Promotion Act and to whom they apply.
Personal Health Information Protection Act, 2004[1]
Under the Personal Health Information Protection Act, 2004, there is generally an obligation on health information custodians (as defined under that legislation) not to collect, use or disclose personal health information about an individual without their consent. Health information custodians include a “health care practitioner” (as defined under that Act). Health care practitioners are registrants of a regulatory body under the Regulated Health Professions Act who provide health care, as well as registrants of the Ontario College of Social Workers and Social Service Workers who provide health care.
The Personal Health Information Protection Act does permit the disclosure of personal health information without the consent of the patient or client to whom the information relates under certain circumstances. Under that Act, a health information custodian may disclose personal health information about an individual to the Chief Medical Officer of Health or a medical officer of health if the disclosure is made for the purpose of the Health Protection and Promotion Act.[2] In addition, a health information custodian may disclose personal health information about an individual without the consent of the individual if the custodian believes on reasonable grounds that the disclosure is necessary for the purpose of eliminating or reducing a significant risk of serious bodily harm to a person or a group of persons.[3]
The above two provisions of the Personal Health Information Protection Act permitting a health information custodian to disclose personal health information without consent do not apply to a health care practitioner who is employed by a custodian because such a health care practitioner is considered to be an agent, not a health information custodian.[4] However, the regulation made under the Personal Health Information Protection Act does provide an exception which permits an agent to disclose personal health information without the consent of the patient or client if the agent believes on reasonable grounds that the disclosure is necessary for the purpose of eliminating or reducing a significant risk of serious bodily harm to a person or a group of persons.[5]
Health Protection and Promotion Act[6]
What are the obligations under the Health Protection and Promotion Act to provide personal health information about a client or patient and to whom do they apply? Under that Act, there is a legal obligation on certain regulated health professionals, namely physicians, chiropractors, dentists, nurse practitioners, registered nurses, registered practical nurses, optometrists, and naturopaths,[7] to report, under certain circumstances, to the local medical officer of health, a disease of public health significance.[8] The circumstances under which this obligation arises is where the regulated health professional is providing professional services to a patient who is not a patient in a hospital or an out-patient of a hospital and he or she forms the opinion that the patient has or may have a disease of public health significance. COVID-19 is a disease of public health significance under the Health Protection and Promotion Act and its regulations.[9]
The report must be made as soon as possible after the regulated health professional listed above forms the opinion that the patient has or may have a disease of public health significance. The regulation on reports made under the Health Protection and Promotion Act [10] specifies the personal information and personal health information that the report must contain. There is also an obligation on these regulated health professionals to provide additional information which the medical officer of health considers necessary upon the request of the medical officer of health.[11]
There is also a duty to report to the local medical officer of health imposed on a physician or nurse practitioner who, while providing professional services, forms the opinion that the person is or may be infected with an agent of a communicable disease.[12] COVID-19 is a communicable disease under the Health Protection and Promotion Act and its regulations.[13] The regulation on reports provides the personal information and personal health information that the report must contain.[14]
It is also important for your registrants to understand that health information custodians could be served with an order by the Chief Medical Officer of Health directing the custodian to supply the Chief Medical Officer of Health or his or her delegate with any information specified in the order, including personal health information.[15] The Chief Medical Officer of Health may make such an order if he or she is of the opinion, based on reasonable and probable grounds, that the information is necessary to investigate, eliminate or reduce the immediate and serious risk to the health of any persons. As mentioned above, a health information custodian includes a “health care practitioner”.
Lastly, in providing advice to registrants, it is also important to bring to their attention any standards of practice, and practice guidelines or advisories, that apply to duties to report, and confidentiality and privacy of personal health information of clients and patients.
Please do not hesitate to contact us if we can be of assistance. We are open for business.
[1] Personal Health Information Protection Act, 2004, S.O 2004, c. 3, Sched. A.
[2] ibid, ss. 39(2).
[3] ibid, ss. 40(1).
[4] ibid, ss. 3(3) para. 1.
[5] O. Reg.329/04, s.7 para 2i.
[6] Health Protection and Promotion Act, R.S.O 1990, c. H.7 (“HPPA”).
[7] Section 25 of the HPPA contemplates the addition of other persons by regulation. To date, none have been added by regulation.
[8] HPPA, s. 25.
[9] O. Reg. 135/18, s.1 and Table, item 18.1.
[10] R.R.O. 1990, Regulation 569, Reports, ss. 1(1) and s. 5, para. 11.
[11] ibid, ss. 1(2).
[12] HPPA, s. 26.
[13] O. Reg. 135/18, s.1 and Table, item 18.1.
[14] R.R.O. 1990, Regulation 569, Reports, ss. 1(1) and s. 5, para. 11.
[15] HPPA, ss. 77.6(1).
The information and comments herein are for the general information of the reader and are not intended as advice or opinion to be relied upon in relation to any particular circumstances. For particular application of the law to specific situations, the reader should seek professional advice.