Personal Health Information Consent – Key Points

• Generally, you need either express or implied consent before you may collect, use or disclose personal health information. When you collect, use and disclose personal health information for health care purposes, you can usually rely on implied consent. If the purpose is something other than health care, you must often obtain express consent. There are also specified circumstances where you may collect, use or disclose personal health information without consent.
• To be a valid consent, the patient must have the capacity to consent. Where  required, you must obtain consent from the patient’s substitute decision-maker if the patient does not have the capacity to consent.
• To be a valid consent, the consent must be obtained voluntarily and directly from the patient (or substitute decision-maker), and the consent must be knowledgeable and related to the information in question.
• Patients have the right to refuse, withdraw or place restrictions on their consent, if the purpose for which their personal health information is collected, used or disclosed requires consent.
• The Act has special rules for dealing with children and teenagers.
• The Mental Health Act has additional rules on mandatory and permitted disclosures without consent.

Personal Health Information Consent – The Rule

Generally, you need either express or implied consent before you may collect, use or disclose personal health information. When you collect, use and disclose personal health information for health care purposes, you can usually rely on implied consent. If the purpose is something other than health care, you must often obtain express consent. There are also specified circumstances where you may collect, use or disclose personal health information without consent.
To be a valid consent:

• the patient must have the capacity to consent (for more information on capacity see page),
• it must be obtained directly from the patient or someone with legal authority to consent for the patient (called a substitute decision-maker),
• it must be related to the information in question,
• it must be obtained voluntarily (without deception or coercion), and
• it must be knowledgeable, meaning it must be reasonable to believe that the patient understands:

1. why you are collecting, using or disclosing the information, and
2. that the patient has the right to withhold or withdraw consent.

Note: This section relates to consent to the collection, use and disclosure of personal health information, and not to consent to treatment.

Personal Health Information Consent – What You Need To Do

Implied Consent

There are many circumstances where you may rely on consent that can be implied from your patients’ behaviour. The following explains implied consent and when
you may rely upon it. It also sets out guidelines to ensure you are correctly relying on implied consent.

What is Implied Consent?

Implied consent permits you to conclude from surrounding circumstances that a patient would reasonably agree to the collection, use or disclosure of the patient’s
personal health information.
Example: If you ask patients for personal health information to open a record and they answer your questions, you can infer their consent to the collection of their information.

When is Implied Consent Acceptable?

You may rely upon your patients’ implied consent if you are:

• a health information custodian collecting, using and disclosing personal health information to provide health care,

Note: A health information custodian who receives a patient’s personal health information from the patient, the substitute decision-maker or another health information custodian for the purpose of providing or assisting in providing health care to the patient may assume that it has the patient’s implied consent to collect, use and disclose the information for health care purposes, unless the health information custodian is aware that the patient has expressly withheld or withdrawn the consent.

• collecting, using or disclosing names and mailing addresses for fundraising, or
• providing names and location within the hospital to someone representing the patients’ religious or other organization. See the discussion on Spiritual Care in the Managing Health Information section.

Guidelines for Relying on Implied Consent

To ensure that your reliance on implied consent is proper:

• give your patients the information they need to understand why you are collecting their information and how you may use or disclose it,
• do so by posting notices or placing brochures in high traffic areas and waiting rooms:

1. describing why you collect, use and disclose personal health information, and
2. informing patients that they may withhold or withdraw their consent and providing information on how they can do so,

• if you have done this, and your patients have not withheld or withdrawn their consent, you may rely on your patients’ implied consent.

Remember: Consent may never be implied if patients specifically state that their personal health information may not be collected, used or disclosed.