Scenario Disclosing Personal Health Information

Your client is transferred from hospital to long-term care where you work as a dietitian.  You start to develop the client’s nutrition care plan, however, the client is not capable and the substitute-decision maker (SDM) is unavailable. You notice that a former classmate wrote the dietetic transfer note from the hospital. You call your former classmate to see if she can provide a more detailed history.

Can you obtain this information from your former classmate without the client or SDM’s consent?

Only health information custodians (HICs) or their agents can disclose personal health information within the health care team, which is the “circle of care”, as long as the information is being obtained for the purposes of providing healthcare.  We recommend that you check institutional policies for requesting  information from other institutions.

If you are the HIC or the agent of the HIC, you can assume implied consent, as long as all six conditions listed below apply.

1.  The health information custodians HIC must fall within a category of HIC that are entitled to rely on assumed implied consent (e.g. health care practitioners, long-term care homes, hospitals, pharmacies, etc.).

2.  The personal health information (PHI) to be collected, used or disclosed by the HIC must have been received from the individual, his or her SDM or another HIC.

3.  The HIC must have received the PHI that is being collected, used or disclosed for the purpose of providing or assisting in the provision of health care to the individual.

4.  The purpose of the collection, use or disclosure of the PHI by the HIC must be for the provision of health care or assisting in the provision of health care to the individual.

5.  In the context of disclosure, the disclosure of PHI by the HIC must be to another HIC.

6.  The HIC that receives the PHI must not be aware that the individual has expressly withheld or withdrawn his or her consent to the collection, use or disclosure.

Disclosure may be barred only if the client or the substitute decision-maker indicates that the information cannot be shared with other health providers.

Express consent (verbal or written) is needed to disclose personal health information to a non-custodian and to disclose personal health information to another custodian for purposes other than the provision of health care.