Confidentiality and its limits, on one page

1PHIPA in brief

• No collection, use or disclosure without informed consent, except as permitted or required by law (Standard 3.1.1).
• Private practice: you are the custodian. Employed: usually the employer's agent.
• Personal health information: any identifying information, oral or recorded, on health or care, payment included.
• Circle of care: implied consent only for health care, to another custodian, never against the client's instruction. CRPO strongly encourages express consent.

2Six notable limits (Standard 3.1)

1. A significant risk of serious harm, physical or psychological, to the client or others; a duty to warn may arise
2. Mandatory reports (Standard 1.3)
3. Legal proceedings: a summons, subpoena or other legal requirement
4. Investigations authorized by warrant or by law
5. Contacting a relative, friend or potential substitute when an injured, incapacitated or ill client cannot consent
6. Disclosure to a College under the RHPA (a complaint, quality assurance)

3Records (Standard 5)

• Accurate, complete, legible. Amend openly: what, when, who, why, the original still legible.
• Where the RP is the custodian: at least 10 years from the last interaction or the client's 18th birthday, whichever is later.
• Access is the client's right: reply as soon as possible, within 30 days (one extension of up to 30), sever what is exempt, refuse only on a ground the Act lists.
• Lost, stolen, or used or disclosed without authority: tell the client at the first reasonable opportunity, and the IPC where required.

4Requests from third parties

• Lawyers, insurers, employers, schools, relatives: outside the circle of care; release needs the client's specific consent or legal authority.
• Verify the authorization, send only what is needed, and mark fact and opinion (Standard 5.2.2).
• A summons compels you to attend with what it names, not to hand the file to a party: legal advice, tell the client, let the court rule.
• Police: without consent or legal authority, confirm nothing, not even that the person is a client; ask what authority they rely on, and tell the client.

5Electronic practice (Standard 3.4)

• Informed consent specific to the technology, which is secure, confidential and suited to the client.
• Insurance for electronic services before you start; licensing where the client is.
• No therapy on social media; no email for confidential information unless the client consents and no practical alternative exists.
• Written therapy messages go in the record.

6After a client dies

• Confidentiality survives death. The estate trustee or administrator consents in the client's place (PHIPA s. 23 (1)).
• PHIPA s. 38 (4) permits, never requires, disclosure to identify the person, to tell those it is reasonable to inform of the death, and to a spouse, partner, sibling or child who needs it for their own or their children's health care.