Disclosing personal health information within the circle of care

YOUR client has been transferred from the hospital to the long‑term care home where you work as a dietitian. As you begin developing the client’s nutrition care plan, you determine that the client is incapable of providing information, and the substitute decision‑maker (SDM) is not available.

You also noticed that a former classmate authored the dietetic transfer note from the hospital. You consider calling them to obtain a more detailed history.

Can you obtain this information from your former classmate without consent from the client or their SDM?

Yes, in some circumstances.

Personal health information (PHI) may be shared within the “circle of care.” This means PHI can be shared among health information custodians (HICs) or their agents — if the purpose is to provide healthcare.

Dietitians who are HICs or agents of HICs may rely on assumed implied consent, to collect, use or disclose PHI for healthcare purposes, if certain conditions are met. You should also follow any relevant organizational or institutional policies when requesting information from another organization.

Conditions for relying on assumed implied consent

Assumed implied consent may be relied upon only if all six of the following conditions are met:

1. The parties involved must be health information custodians (HICs) entitled to rely on implied consent, such as health care practitioners, hospitals, pharmacies, and long‑term care homes.
2. The PHI being shared must have been originally collected from the individual, their SDM, or another HIC.
3. The PHI must have been received for the purpose of providing (or assisting in providing) healthcare to the client.
4. The disclosure, collection, or use of PHI must be for the purpose of providing healthcare or supporting the provision of healthcare.
5. Any disclosure must be from one HIC to another HIC.
6. The receiving HIC must is not aware of any express instruction from the client or SDM withholding or withdrawing consent.

If the client or SDM has clearly indicated that their PHI must not be shared with certain providers, then disclosure cannot occur, even within the circle of care.

When express consent is required

You must obtain express consent (verbal or written) before sharing PHI when:

• The information is disclosed to someone who is not a health information custodian (for example, family members, insurance representatives, organizations outside the healthcare system), or
• The information is shared with another HIC for reasons unrelated to the provision of healthcare.