The Role of Individuals

The Role of Individuals Under PHIPA

PHIPA (Personal Health Information Protection Act) not only governs how Health Information Custodians (HICs) and Agents handle Personal Health Information (PHI) but also empowers individuals by granting them significant rights over their own health data. These rights ensure transparency, control, and accountability in how personal health data is collected, used, and shared.

1. Right to Access and Correct Personal Health Information

Individuals have the right to:

1. Request Access to Their Health Records
2. Correct Inaccuracies in Their Health Information

How to Request Access

• Individuals can request copies of their medical history, lab results, prescriptions, and treatment notes from a Health Information Custodian (HIC).
• Requests must be in writing and addressed to the relevant healthcare provider or organization.
• The HIC must provide access within 30 days, with a possible 30-day extension if needed.

Examples of Access Requests

1. Checking vaccination history – A patient requests immunization records for travel.
2. Reviewing a medical diagnosis – A patient wants to review notes from a specialist consultation.
3. Verifying past treatments – A patient wants to confirm past procedures before seeking a second opinion.

How to Request a Correction

If a record contains errors or outdated information, individuals can request corrections by providing:

1. A written explanation of the requested correction.
2. Supporting documents (if applicable) proving the information is incorrect.
3. Consent from the original healthcare provider (if the correction involves third-party reports).

Exceptions: A HIC can deny a correction request if:

• The record was not originally created by the HIC (e.g., lab results from an external facility).
• The HIC believes the record is accurate and complete.
• The requested change involves a professional opinion rather than a factual error.

Example of a Valid Correction Request:

• A misspelled name or incorrect date of birth in a medical record.
• A wrong prescription dosage listed in the file.

Example of a Denied Correction Request:

• A patient disagrees with a doctor’s diagnosis and wants it changed.

2. Right to Withdraw or Limit Consent

Individuals control how their PHI is shared and can withdraw consent under PHIPA.

What Individuals Can Do:

1. Withdraw consent for future disclosures of PHI.
2. Limit what information can be shared and with whom.
3. Opt-out of health data sharing with certain organizations (e.g., pharmacies, insurance providers).

Limitations of Consent Withdrawal:

1. Cannot apply retroactively – Past disclosures made with valid consent remain lawful.
2. Cannot override legal obligations – PHI must still be disclosed when required by law (e.g., public health reporting, court orders).
3. Must be communicated in writing – Patients must inform their healthcare provider of consent withdrawal.

Example of Consent Withdrawal:

• A patient opts out of having their prescription history shared with an external pharmacy.
• A patient limits access to their medical file, allowing only specific doctors to view it.

Example Where Consent Cannot Be Withdrawn:

• A doctor must report infectious diseases to public health authorities.
• A hospital shares emergency care records with paramedics treating a patient.

3. Right to File a Complaint (Privacy Violations & Breaches)

If an individual believes their PHI has been improperly collected, used, or disclosed, they can file a complaint with the Information and Privacy Commissioner of Ontario (IPC).

Grounds for Filing a Complaint

• Unauthorized access to PHI (e.g., a hospital employee snoops on a celebrity’s medical file).
• Failure to provide access to records within PHIPA’s required timeframe.
• Incorrect handling of a consent withdrawal request (e.g., a provider ignores the patient’s instruction to restrict PHI sharing).
• A privacy breach (e.g., lost or stolen patient files, data leaks).

Steps to File a Complaint with the IPC

1. Gather evidence – Collect emails, medical records, or proof of a privacy violation.
2. Contact the HIC – Before filing a complaint, try to resolve the issue directly with the healthcare provider.
3. File a complaint with the IPC – Submit a written complaint online, by mail, or by fax.
4. Investigation process – The IPC may conduct an inquiry, request additional information, or issue compliance orders.

Complaint Filing Website: Information Privacy Commissioner of Ontario

4. Right to Be Notified of Privacy Breaches

HICs must inform individuals if their PHI has been lost, stolen, or improperly accessed in a manner that could cause significant harm.

Examples of Breach Notifications

• A hospital accidentally emails PHI to the wrong person and must notify the affected patient.
• A healthcare IT provider experiences a data breach and must inform impacted individuals.

Individuals Can Take Action After a Breach:

• Request a full report from the HIC on what data was affected.
• Monitor their health records for any suspicious activity.
• File a complaint with the IPC if they believe the breach was due to negligence.

5. Right to Restrict PHI Sharing for Marketing Purposes

PHIPA prohibits using PHI for marketing or fundraising without explicit consent.

Example of Prohibited Use:

• A pharmacy sells patient prescription details to a marketing firm.
• A hospital uses patient data to send fundraising emails without consent.

Example of Permitted Use (With Consent):

• A patient opts in to receive newsletters from a health clinic.

Enforcement & Penalties for PHIPA Violations

Individuals Can Sue for Privacy Violations

• If a PHIPA violation results in harm, individuals can seek damages in court.

HICs and Agents Face Legal Consequences

IPC – Potential Consquences of a PHIPA Breach

• Individuals violating PHIPA (e.g., unauthorized data access) – Fines up to $50,000.
• Organizations violating PHIPA – Fines up to $500,000.