What is the PHIPA Circle of Care?
Ontario’s Personal Health Information Protection Act (PHIPA) requires that a health information custodian, such as a physician’s office or hospital, obtain patient consent before collecting, using, or disclosing personal health information. Under PHIPA, the two types of consent are express consent and implied consent. A patient gives express consent when the patient takes a specific affirmative act indicating consent, such as by providing a signature. Implied consent is consent that is implied from the circumstances. Under PHIPA, there is a special kind of implied consent called assumed implied consent. Here, a custodian may assume that the elements of consent have been fulfilled, unless that assumption is unreasonable. Assumed implied consent may only be used by individuals in what PHIPA calls the “Circle of Care.” The PHIPA Circle of Care is a group of individuals whose treatment relationship is sufficiently close to a patient, to permit them to assume that a patient has consented to their collecting, using, or disclosing personal health information for the purpose of providing or assisting in providing healthcare. The PHIPA Circle of Care is discussed in greater detail below.
The Types of Implied Consent
The term “implied consent” means consent that has been given by an individual, based on what that individual does or does not do in the circumstances.
Want to learn more about Canadian data privacy compliance? Click here.
For example, a health information custodian (HIC) is not required to obtain a patient’s written or verbal consent every time that patient’s personal health information is collected or used in the course of receiving medical care. It may be reasonable for the custodian to conclude that implied consent has been given to the collection or use of personal health information because of certain things a patient does in the context of a physician’s office, such as consenting to an examination or a medical test.
It may also be reasonable for a custodian to conclude that a patient has consented to the disclosure of his or her personal health information to another custodian for the purposes of providing or assisting in providing healthcare. For example, when a patient consents to a physician issuing a prescription, it may be reasonable for the physician to conclude that the patient has also given implied consent to the disclosure of his or her personal health information for the purposes of filling a prescription.
Similarly, by receiving the prescription from a patient or that patient’s physician, the pharmacist can reasonably conclude that the patient consented to the collection of this information for the same purposes.
In the case of assumed implied consent, a custodian may assume that all the elements of consent are fulfilled; the custodian need not specifically conclude that each element of consent is present. Assumed implied consent may only occur in the context of the Circle of Care.
PHIPA Circle of Care: Assumed Implied Consent
The “Circle of Care” is a colloquial phrase under PHIPA. The term describes a group of specific individuals who may rely on assumed implied consent when collecting, using, or disclosing personal health information for the purpose of providing or assisting in providing healthcare. These individuals are deemed by PHIPA to be sufficiently involved with a patient’s care, to permit them to rely on assumed implied consent.
Examples of individuals within the PHIPA Circle of Care include:
- For a physician’s office: The physician, nurses, a specialist, or other healthcare practitioner referred by the physician, and any other healthcare practitioner selected by the patient (e.g., a pharmacist).
- For a hospital: The attending physician and the “treatment team” (e.g., all residents, nurses, clerks, and employees assigned to the patient who are responsible for providing or assisting with the provision of care).
Additional examples of custodians who fall within the PHIPA Circle of Care include those individuals within long-term care homes and community care access centers who provide treatment or assist in providing treatment to a patient.
As implied by the name, the PHIPA Circle of Care does not include individuals who do not provide care to a patient. Therefore, custodians who are not part of an individual’s direct or follow-up treatment, and non-custodians (e.g., insurance companies and employers) are not part of the circle.
PHIPA Circle of Care Additional Requirements
For someone in the PHIPA Circle of Care to rely on assumed implied consent, several requirements in addition to those stated above must be met.
These requirements include:
- The personal health information to be collected, used or disclosed by the custodian must be received from the individual patient, a substitute-decision maker, or another custodian. This means that a custodian may not rely on assumed implied consent if, for example, the personal health information was received from an employer, insurance provider, or educational institution.
- The custodian must have received the personal health information that is being collected, used, or disclosed, for the specific purpose of providing or assisting in the provision of healthcare to the individual.
- A custodian may not rely on assumed implied consent if the personal health information was received for other purposes such as research, fundraising, marketing, or providing or assisting in the provision of healthcare to another individual or group of individuals.
