Introduction

Health Unit agents collect personal information and personal health information in the management and delivery of public health services.  Individuals have the right to know why their personal information is being collected, how it is intended to be used and disclosed and to ultimately determine with whom they will share their personal information and personal health information.

Purpose:

The purpose of this policy is to inform Simcoe Muskoka District Health Unit Board of Health members, employees, students, volunteers, contractors (collectively defined as Health Unit agents) and members of the public of the requirement for obtaining consent for the collection, use, and disclosure of personal information including personal health information.

While this policy focuses on collection of personal information and personal health information, it should be interpreted within the context of the PERSONAL INFORMATION INCLUDING PERSONAL HEALTH INFORMATION PRIVACY – PRINCIPLES policy and the related set of policies that collectively define the information practices of the Health Unit for the purposes of all applicable privacy legislation.

Policy Definitions & Interpretations:
This policy and any specific terms used herein will be interpreted to ensure consistency with all applicable information privacy legislation, including MFIPPA, RHPA and PHIPA. This policy cannot fully describe how the legislation is to be applied in every instance by the Health Unit. As a result, there may be circumstances where the legislation itself should be referred to, or specialized advice regarding privacy should be obtained.

For the purposes of this policy statement:

“agent” means a person that, with the authorization of the Medical Officer of Health as a Health Information Custodian (HIC), acts for or on behalf of the HIC in respect of personal health information for the purposes of the HIC, and not for the agent’s own purposes, whether or not the agent has the authority to bind the HIC, whether or not the agent is employed by the HIC, and whether or not the agent is being remunerated;

“applicable privacy legislation” means MFIPPA, and PHIPA;

“health information custodian (HIC)” means a person or organization …who has custody or control of personal health information as a result of or in connection with performing the person’s or organization’s powers or duties or the work as a medical officer of health of a board of health within the meaning of the Health Protection and Promotion Act , 1990

“Health Unit” means the Simcoe Muskoka District Health Unit

“MFIPPA” – means Municipal Freedom of Information and Protection of Privacy Act, 1991

“PHIPA” – means Personal Health Information Protection Act, 2004

 “personal health information” means identifying information about an individual in oral or recorded form, if the information:

• relates to the physical or mental health of the individual, including information that consists of the health history of the individual’s family,
• relates to the providing of health care to the individual, including the identification of a person as a provider of health care to the individual,
• is a plan of service within the meaning of the Long-Term Care Act, 1994 for the individual,
• relates to payments or eligibility for health care in respect of the individual,
• relates to the donation by the individual of any body part or bodily substance of the individual or is derived from the testing or examination of any such body part or bodily substance,
• is the individual’s health number, or
• identifies an individual’s substitute decision-maker.

“personal information” means recorded information about an identifiable individual, including:

• information relating to the race, national or ethnic origin, colour, religion, age, sex, sexual orientation or marital or family status of the individual,
• information relating to the education or the medical, psychiatric, psychological, criminal or employment history of the individual or information relating to financial transactions in which the individual has been involved,
• any identifying number, symbol or other particular assigned to the individual,
• the address, telephone number, fingerprints or blood type of the individual,
• the personal opinions or views of the individual except if they relate to another individual,
• correspondence sent to an institution by the individual that is implicitly or explicitly of a private or confidential nature, and replies to that correspondence that would reveal the contents of the original correspondence,
• the views or opinions of another individual about the individual, and
• the individual’s name if it appears with other personal information including personal health information relating to the individual or where the disclosure of the name would reveal other personal information including personal health information about the individual.
  

"record" is broadly defined to include any record of information however recorded.  This includes correspondence, minutes, reports, photographs, computer tapes and disks, files, and any other recorded information regardless of medium or format.  The definition also includes a record that does not yet exist but which can be created from existing data in a computer system.

“RHPA” – means Registered Heath Professions Act, 1991

Policy

Personal information including personal health information is collected with the knowledge and consent of the individuals to whom the information relates.

Personal information including personal health information is collected without consent only in instances where the collection is authorized by law, and where it would otherwise be inappropriate in the circumstances to obtain consent.

Express written consent is obtained where reasonable given the nature of the personal information including personal health information to be collected, used or disclosed.

Consent may be written or verbal.  To be a valid consent, the following conditions must be met:

• The person must have the mental capacity to consent. Capacity is the ability to understand the information that is relevant to deciding whether or not to consent. A capable person, regardless of age or parental wishes, can consent to the collection, use or disclosure of their own personal or personal health information.
• It must be obtained directly from the individual or someone with the legal authority to consent for the individual.
• It must be related to the information in question.
• It must be obtained voluntarily and without deception or coercion.
• It must be reasonable to believe that the individual understands why you are collecting, using or disclosing the information and that the individual has the right to withhold or withdraw consent.

Individuals may place restrictions on their consent. Individuals may withdraw consent at any time.
When personal information including personal health information that has been collected is to be used for a purpose not previously identified, the new purpose will be identified. Unless the new purpose is permitted or required by law, consent is required before the information can be used for that purpose.
Specifically as it relates to personal health information, consent may be express or implied. 
Express consent is required if personal health information is to be collected, used or disclosed for other than the purpose of health care (e.g. employer, insurance company).
When an agent of the Health Unit is collecting, using and disclosing personal health information for health care purposes with other SMDHU health care providers implied consent is sufficient.  Consent may never be implied if clients specifically state that their personal health information may not be collected, used or disclosed.

Procedures

Consent:

• Inform the individual, in clear everyday language, of the specific reasons why their information is being collected, the authority under which the information is being collected, how the information will be used and under what circumstances it will be disclosed.  This can be done verbally or in writing.

See form A1.043 (F1) Consent to the Collection, Use and Disclosure.

• When consent is sought to provide personal information including personal health information to a third party, specify what information will be shared, with whom and why.  Only disclose the information for the purposes discussed with the individual.
• In the event that oral consent is sought and granted, fully document the consent, how it was obtained and the surrounding circumstances.
• Inform individuals that consent may be withdrawn at any time.
• Post notices or place brochures in high traffic areas and waiting rooms describing why personal health information is collected, used and disclosed informing clients that they may withhold or withdraw their consent and providing information on how they can do so.

Withdrawal of Consent:

• When an individual informs an agent that they have withdrawn their consent, the agent will note this in the individual/client record.
• The withdrawal of consent has no effect on information collected, used or disclosed before consent was withdrawn, but is in effect immediately upon receipt.
• If withdrawal of consent will compromise client care, this is discussed with the client and documented.  See form A1.043 (F2) Withdrawal of Consent.

Conditional Consent:

• Such a restriction does not prevent the documentation of information as required by law or established professional standards or agency practice.
• When an individual expressly instructs that specific information is not to be disclosed, and it is considered to be reasonably important for the appropriate delivery of service, the disclosure will note that the information is incomplete as per the request of the individual.
• An individual cannot restrict disclosure of information required by law.

Related Policies:
Policy A1.041  Personal Information Including Personal Health Information Privacy – Principles
Policy A1.042  Personal Information Including Personal Health Information Privacy – Accountability
Policy A1.043  Personal Information Including Personal Health Information Privacy – Consent
Policy A1.044  Personal Information Including Personal Health Information Privacy – Collection & Use
Policy A1.045  Personal Information Including Personal Health Information Privacy – Disclosure
Policy A1.046  Personal Information Including Personal Health Information Privacy – Access
Policy A1.047  Personal Information Including Personal Health Information Privacy – Correction
Policy A1.048  Personal Information Including Personal Health Information Privacy – Privacy Breach

See appendix A for more detailed information regarding collection, use and disclosure without consent.

Policy
Final Approval Signature: __________________________________
                                                            Board of Health

Review/Revision History:
2006-09-20 Revised

Procedure
Final Approval Signature: __________________________________
                                                            Executive Committee
                                                           
Review/Revision History:
2006-10-02 Revised