Question

Describe who (in a medical office setting) is permitted to release information to in an emergency situation and in a non-emergency situation based on PHIA and why. Remember to discuss confidentiality, power of attorney, and guardianship. Use evidence found in literature to support your ideas by citing the references.

Answer 1

Medical emergencies may not be common in the office setting, but that's precisely why you need to practice your response to them. For many years, common medical practice meant that physicians made decisions for their patients. This paternalistic view has gradually been supplanted by one promoting patient autonomy, whereby patients and doctors share the decision-making responsibility. Consequently doctor-patient relationships are very different now than they were just a few decades ago. However, conflicts still abound as the medical community and those it serves struggle to define their respective roles.

The Personal Health Information Act (PHIA) came into force on December 11, 1997 and governs the collection, use, disclosure, retention, disposal and destruction of personal health information. The act recognizes both the right of individuals to protect their personal health information and the need of health information trustees to collect, use and disclose personal health information to provide, support and manage health care.

Personal health information is any information that:

•     is recorded in any form;
•     can be linked to an identifiable individual; and
•    relates to an individual’s health, health history, genetic makeup, health care, personal health identification number (PHIN) or other identifying information collected in the course of providing health care. See s. 1(1) of the Act.

For the most part, the Act focuses on the obligations of trustees in dealing with personal health information. The Act divides trustees into four categories:

•     health care facilities
•     some health professionals
•    health services agencies (organizations which provide health care under an agreement with another trustee—the Victorian Order of Nurses and We Care are two examples)
•     public bodies (such as provincial government departments and agencies, municipal
•     governments, educational institutions and regional health authorities).

The Act also imposes duties on information managers (who are hired by trustees to process, store or destroy personal health information, or to manage or service information systems) as well as employees of trustees.

The Act defines “health care facility” as:

•     a hospital
•     a personal care home
•     a psychiatric facility
•     a medical clinic
•     a laboratory

A trustee’s obligations fall into two main categories.

•     A duty to assist individuals in gaining access to their own personal health information.
•    A duty to protect the privacy of individuals in the collection, use, disclosure, security, retention and destruction of their personal health information.

The Act puts in statutory form the common-law right of an individual to access his or her own personal health information. There are three elements to this right:

•     A right to examine personal health information.
•     A right to obtain a copy of personal health information.
•     A right to seek a correction of personal health information.

Under the changes to PHIA, a trustee is required to provide individuals with notice of their right to examine and receive a copy of their personal health information and how they can exercise this right. The notice must also state that an individual has the right to authorize another person to examine and receive a copy of their personal health information.

A trustee must use a sign, poster, brochure or other similar type of means to provide this notice to individuals. This notice must be prominently displayed in as many locations and in such numbers as the trustee reasonably considers adequate to ensure that the information is likely to come to the individuals’ attention.

The Act imposes on trustees an obligation to assist an individual in gaining access to his or her personal health information. Trustees are to respond to access requests “without delay, openly, accurately and completely.” Upon request, trustees must provide an explanation of any terms, codes or abbreviations that the individual does not understand.

The Act permits trustees to withhold personal health information that falls into certain restricted categories. For example, access to personal health information may be refused if:

•     revealing it would disclose confidential information about a third party
•     there is a reasonable expectation that it would result in harm to the individual or someone else
•     it has been compiled for litigation purposes.

Even when trustees are allowed to refuse access to portions of an individual’s personal health information, they still have an obligation to allow access to those portions of the individual’s personal health information that are not exempted by the Act.

Trustees must respond to requests for access as promptly as required in the circumstances but no later than

•     24 hours after receiving a request from an in-patient in a hospital to see information about his or her current care,
•    72 hours after receiving a request from a person who is not a hospital in-patient for information about his or her current care, and
•    30 days after receiving the request for any other requests.

A failure to respond within the required time frame will be considered a refusal to permit access.

The Act gives an individual the right to obtain a copy of any personal health information he or she is entitled to examine.

An individual has a right to point out information he or she believes is incorrect and to ask the trustee to correct it. It is up to the trustee to decide whether a correction is needed. A trustee has 30 days to investigate the issue and make a decision about the request for a correction.

If the trustee agrees to the correction, the mistaken information should be stroked out (not erased) and the correct information added or cross-referenced in a way that anyone reading the record would be aware of it.

If the individual and the trustee disagree about a correction, the individual has a right to file a statement of disagreement, which must be attached to and form part of his or her health record.

A trustee must pass on the correction or the statement of disagreement to anyone to whom the personal health information has been disclosed over the previous year.

All rights of an individual may be exercised by a representative of that individual. The Act identifies several representatives, including:

•     a person with a written authorization to act on behalf of the individual
•     the individual’s proxy appointed in a health care directive
•     the individual’s committee appointed under The Mental Health Act
•     the individual’s parent or guardian if the individual is a child who is too young to make his or her own health care decisions. For a complete list of representatives.

If a person is incapacitated and no individual described above is available the first adult listed below who is readily available and willing to exercise the person’s rights under PHIA:

    The individual’s spouse, or common-law partner, with whom the individual is cohabiting;

•     a son or daughter;
•     a parent, if the individual is an adult;
•     a brother or sister;
•     a person with whom the individual is known to have a close personal relationship;
•     a grandparent;
•     an aunt or uncle;
•     a nephew or niece.

No one other than the individual the personal health information is about, that individual’s representative or, if the person is incapacitated and no representative is available, a person authorized as outlined above has a right to access his or her personal health information. A request for access to personal health information by anyone other than the individual or the individual’s representative must be assessed under the provisions of the Act dealing with use and disclosure of personal health information.

A trustee’s obligations, as set out in the Act, affect the:

•     collection
•     use
•     disclosure
•     security
•     retention and
•     destruction of personal health information.

A trustee has three main duties when collecting personal health information:

•     To notify the individual of the purpose for the collection of personal health information.
•     To collect only necessary personal health information—that is, the minimum amount required for the stated purpose.
•     To collect personal health information from the individual whenever possible.

Determining the purpose for collecting personal health information is a critical requirement of the Act. The Act requires trustees to notify the individual of this purpose at the time the information is collected. Besides meeting this statutory obligation, identifying the purpose for the collection will help determine what information can be collected and how it can later be used.

The purpose for collecting personal health information will depend on the function of the particular facility as well as the circumstances in which the collection takes place. For example, a psychiatric facility is likely to collect personal health information for a different purpose than the emergency ward of a hospital. The personal health information needed when an individual comes to a clinic for an inoculation will likely be different from what is needed when someone enters a
personal care home.

This requirement is based on the principle that an individual has a right to make decisions about his or her own health care. Informing the individual as fully as possible about the reasons for collecting personal health information will allow him or her to make an informed decision about providing personal health information. This principle is so important that the Act requires that, when personal health information is collected by someone who is not a health professional, he or she must advise the individual about someone who can be contacted to gain more information about the purposes for collecting the information.

Stressing the need to respect individual privacy, the Act generally permits the collection from individuals of only as much information as is needed for specific purposes. What a trustee needs to know will largely depend on his or her purpose in collecting personal health information. The Act prohibits the collection of personal health information for:

•     illegal purposes;
•     purposes unrelated to the function or activity of the trustee; and
•     purposes other than those disclosed to the individual as the reasons for the collection of the personal health information.

The Act requires that, whenever possible, trustees must collect personal health information directly from the individual the information is about.

This rule serves at least three important purposes:

•     It helps ensure the accuracy of the information.
•     It prevents trustees from revealing personal health information to others by the questions they pose.
•     It ensures that personal health information the individual wants to keep private is not revealed to the trustee.

The Act permits collection from other sources (including other trustees) in specified circumstances. For example, it is permissible to do so when the individual has authorized it, when circumstances do not permit collection of the information from the person, or when the information supplied by the individual is likely to be inaccurate. For a complete list of exceptions.

For the purposes of The Personal Health Information Act, “use” refers to what is done with the personal health information within the trustee organization. “Disclosure” involves revealing personal health information outside the trustee organization to other trustees, to the individual’s friends and family or to other individuals. Both use and disclosure involve revealing the information to someone. This may be done by permitting others to read it, sending it to them by mail, fax, or e-mail, or by revealing the information orally.

Trustees cannot use or disclose personal health information unless:

•     it is necessary to accomplish the purpose for which the personal health information was collected; or
•     the trustee has the informed consent of the individual it is about.

There are some exceptions to this general rule. For example, trustees may use personal health information for a purpose directly related to the purpose for which it was collected. In some cases, personal health information may be disclosed without the individual’s consent as it is required to provide health care or for specific humanitarian purposes such as contacting the relative or friend of someone who is ill or injured, informing relatives of someone’s death, and assisting in identifying a deceased person.

Trustees may also use or disclose personal health information to prevent or ease a serious and immediate threat to the mental or physical health or safety of the individual, another individual or the public.

Trustees may disclose to a person’s immediate family or a close personal friend information about the care that the person is current receiving as a patient or resident in a health care facility if the disclosure is made in accordance with good medical and other professional practice and the trustee reasonably believes the disclosure to be acceptable to the person.

In addition, trustees may disclose information where such disclosure is authorized or required by   an enactment of Manitoba or Canada. For example, The Gunshot and Stabwounds Mandatory Reporting Act, whichcame into force on December 1, 2008 requires a health care facility to report to police gunshot and stab wounds treated by the facility.

Health care facilities may use or disclose personal health information without consent:

•     to deliver, monitor or evaluate a health care program; or
•     for research and planning related to health care.

Health Care Facilities may also disclose information to:

    A religious organization, unless asked by the individual NOT to share this information. The only information that can be shared would be the individual’s name, general health status and location in the facility.
    A charitable fundraising foundation associated with the facility, unless the patient tells the facility not to. The only information that can be shared would be the name and mailing address of any patients or residents or former patients or residents.