Implied vs. Informed Consent & Health Links What to do about it Rodney Burns, Marc Gordon, & Charles Sagoe June 5, 2013
2
Workshop Agenda Purpose and Objectives 10 Years of PHIPA Circle Of Care and Health Links: Challenges “Consent” - up close and personal “Assumed Implied Consent” and the Health Links When can one assume an Implied Consent Myths about PHIPA, Sharing, & Consent Who Is Outside The Circle of Care? Can We Share Outside The Circle of Care? Unique Challenges in Health Links implementation Suggested Solutions Q&A
3
PURPOSE AND OBJECTIVES • Privacy level-setting • Privacy best practices and applications • Explore key considerations of consent, various options, and how they may be applied in the Health Links.
4
Privacy still matters!
5
PHIPA, 2004 • Almost 10 years since coming into force! • Governs how personal health information (PHI) may be collected, used and disclosed • Roles of persons • Key definitions (PHI, healthcare practitioner, HIC, consent) http://www.e-laws.gov.on.ca/html/statutes/english/elaws_statutes_04p03_e.htm
KEY POINTS OF PHIPA
6
Definitions: • PHI Sched. A, s. 4 (1) • Key roles/persons Health Information Custodian (HIC) Sched. A, s. 3 (1) Agent, ESP, HINP, & 3rd Party Agent
• Consent Sched. A, s. 18, 19, 20 HINP
AGENT
ESP
HIC 3rd
Party
Agent
7
Gender, Date of Birth and Postal Code Are these PHI? Very easy to identify a client using a combination of these! “it is reasonably foreseeable in the circumstances that it could be utilized, either alone or with other information, to identify an individual.� Sched. A, s. 4 (2).
8
PHI CONTINUUM as defined in PHIPA
COLLECT
USE
DISCLOSE
9
PHI CONTINUUM in Practice
COLLECT
USE
ACCESS
DISCLOSE
Access - most likely area for privacy breach! Critical to monitor Access for risk management
10
AOHC Privacy Survey, 2012
Common Gaps/ Immature Solutions Documentation of privacy risk registers 22% have enterprise risk management programs Tools/processes for compliance monitoring and assessment Privacy training (all staff and role-based)
11
12
“CIRCLE OF CARE” Sharing PHI for Healthcare Purposes • Allows certain HICs to collect, use or disclose PHI for the purposes of providing health care by assuming the client’s implied consent • It may change depending on the client • The term is not defined in the Act!
13
Is addressing social determinants of health part of delivering healthcare? Model of Health & Wellbeing "I absolutely see the improvement in my patients' health. For patients that we do manage to get on income supports, their lives often really turn around.“ Dr. Gary Bloch
Recognize the privacy implications and address them accordingly Poverty & health, CBC
14
HEALTH LINKS, 2012 Bring together health care providers in a community to better and more quickly coordinate care for high-needs clients. About Health Links, MOHLTC, Dec/12
15
Purpose of Health Links Clients do not need to answer the same question from different providers Have support to ensure they are taking the right medications appropriately Have a care provider they can call, eliminating unnecessary provider visits Have an individualized comprehensive plan, developed with the patient and his/her care providers who will ensure the plan is being followed http://news.ontario.ca/mohltc/en/2012/12/about-health-links.html
16
Purpose of Health Links “Clients do not need to answer the same question from different providers�
Is this achievable in the clinical context where clinicians will want to ensure information accuracy?
17
HEALTH LINKS
How do they relate??
CIRCLE OF CARE
18
Health Links are a better mechanism to deliver efficient care to clients within the Circle of Care
CIRCLE OF CARE
HEALTH LINKS
19
Transition comes with unique privacy challenges and opportunities • •
Consent management Ownership
20
“CONSENT” UP CLOSE & PERSONAL
21
CONSENT Important component of all aspects of healthcare delivery
PHIPA has very explicit consent requirements for HICs At the core of PHIPA is the concept of a client’s understanding and knowledge of, and voluntary agreement to allow the collection, use, or disclosure of their PHI
22
CONSENT Consent is client-centered
Very much in line with AOHC’s Model of Health and Wellbeing
23
CONSENT
• Clients’ understanding, knowledge of, and voluntary agreement to allow the collection, use, or disclosure of the individual’s PHI.
24
CONSENT TREE Expressed (Verbal or Written)
CONSENT
Implied (Verbal or Written)
Assumed Implied (Verbal or Written)
25
EXPRESSED CONSENT: verbal/ written, unequivocal, freewill agreement by the client with what is being proposed or being done in relation to the collection, use, and disclosure of PHI. Must be and should not require any inference on HIC. Sched. A, s. 18 (1)
26
IMPLIED CONSENT: client is knowledgeable about and understands the purpose for collection, use, or disclosure, but does not object or withdraw consent. Permits a HIC to infer from the surrounding circumstances that client would reasonably agree to the collection, use or disclosure of PHI. Sched. A, s. 18 (2)
27
ASSUMED IMPLIED CONSENT Allows certain HICs to assume the individual’s implied consent to collect, use and disclose PHI for the purpose of providing health care.
28
“Knowledgeable” Consent ≠ “Informed” Consent!
29
UNDER WHAT CONDITION(S) CAN YOUR CENTRE ASSUME AN IMPLIED CONSENT?
30
Can a HIC Rely on Implied Consent to: Comply with a legal requirement or participate in legal or administrative proceedings or contemplated proceedings? Plan, deliver or monitor health-related programs or services? Do you need consent to have intern or coop student to sit in on client interviews or meetings for educational purposes? Sched. A, s. 37(1)
31
Consent Scenario • Violet Garden was transferred from Valley View Hospital to Oak Manor, a long term care facility. • Greta, a registered physiotherapist staff at Oak Manor, has to prepare a plan to address Violet Garden’s mild hemiplegia due to a CVA. • Violet Garden is no longer capable and her SDM, the only son, is outside the country for a month. • It is not an emergency situation, but Greta wants to start immediately a plan within days, not weeks. She needs more information, and found out that that her mother-in-law, Cindy, was the Physiotherapist on record at Valley View Hospital. • She calls Cindy to see if she can provide a more detailed history and any suggestions for managing Violet Garden.
• Was it ok for Greta to call Cindy? • Can Cindy help?
1. Must be a HIC to rely on assumed implied consent
32
• • • •
health care practitioners or a group practice persons or organizations providing a community service a community care access corporation A centre, program or service for community health or mental health whose sole purpose is provision of healthcare • public or private hospitals • psychiatric facilities or institution • an independent health facility Sched. A, s. 3(1)
33
2. PHI must come from the person or SDM • The person the PHI relates to; or • The substitute decision maker (SDM) should have provided the PHI
34
3. Collect PHI to use to provide or assist in provision of health care • The PHI collected MUST be used only for the purpose of providing or assisting in the provision of health care.
• You may not rely on assumed implied consent for other non-health care uses!
35
4. Receive PHI to provide or assist in provision of health care • The PHI received MUST be used only for the purpose of providing or assisting in the provision of health care.
• You cannot rely on assumed implied consent for other non-health care uses!
36
5. Disclose only to another HIC • Irrespective of the purpose, you cannot disclose to a non-HIC! EXAMPLE • Police, WSIB, insurance company
37
6. Be mindful of an expressed consent withdrawal! The HIC receiving the PHI must absolutely not be aware that the client has expressly withheld/withdrawn consent. The Lab will be breach if it sends a copy of the report to the family physician!
Family Physician
Social Worker
Walk in
OBG
Lab
38
BE MINDFUL OF WHO IS OUTSIDE THE CIRCLE!
HICs
Non HICs
Doctors
Police
Nurses Pharmacists
WSIB
Long Term Care
Revenue Canada
CHCs/AHACs Social Worker Public Health
Volunteers Aboriginal midwifes/healers
39
DISCLOSURE or USE OUTSIDE THE CIRCLE? No if: • You rely solely on assumed implied consent • Disclosing even to a HIC for non-health care purposes Yes, if: • The person gives expressed consent – written or verbal
40
Busting Some Myths: PHIPA, Data Sharing, Consent “I want to dispel the myth that PHIPA requires health-care providers to obtain express consent to share information with each other to provide care for their patients.”
“The suggestion that consent can only be implied where “it is not reasonably possible to obtain the individual’s consent in a timely manner,” is emphatically not the case.”
“The suggestion that consent can only be implied where “it is not reasonably possible to obtain the individual’s consent in a timely manner,” is emphatically not the case.” Ann Cavoukian, Information and Privacy Commissioner of Ontario Toronto Star. January 24, 2013.
41
CHALLENGES for AOHC members in HEALTH LINKS
42
CHALLENGE 1: How to fulfill the 6 conditions for assumed implied consent 1. Must be a custodian to rely on assumed implied consent 2. PHI must come from the patient or SDM
3. Collect to use to provide or assist in provision of health care 4. Receive to provide or assist in provision of health care 5. Disclose only to another HIC
6. Must not be aware of expressed consent withdrawal
43
Litmus Tests to determine if you meet the requirements for assumed implied consent
DESTINATION
• Is my source or recipient a HIC who can rely on assume implied consent? • Am I aware of any expressly withheld or withdrawn consent?
CLIENT
• Was the information collected from the client or the SDM?
PURPOSE
• Will the information be used to provide care or assist to provide care?
SOURCE/
44
Is assumed implied consent enough to allow collection, use and disclosure of PHI?
45
CHALLENGE 2: Not all HICs can rely on assumed implied consent! • • • •
When a HIC is not part of the Circle of Care When there is expressed consent withdrawal MOHLTC and Medical Officer of Health Prescribed Entities - ICES, CCO, etc.
46
CHALLENGE 3: Working with non-HICs WSIB
School Board
Police Volunteers
Social Services
Revenue Canada
Aboriginal midwifes/healers
47
CHALLENGE 4: An otherwise HIC working for a non-HIC • A nurse working for the school where your client attends calls your CHC to look for information or discuss the client’s behavioral and nutritional challenges. • Return to Work Programs
48
CHALLENGE 5: Efficient disclosure among qualified HICs
49
• < 2% of clients place restrictions on PHI • No need to be defensive • Be Proactive!
50
Balance between Privacy and Health care
Effective health care delivery Protect privacy
51
GOAL: “Facilitate the effective provision of health care” AND “protect the privacy of individuals”
They are not mutually exclusive!
52
SUGGESTED SOLUTIONS
53
Has your organization complied with all OIPC orders and decisions? http://www.ipc.on.ca/english/decisions-and-resolutions/ • • • •
Missing unencrypted laptop PC PHI accessed by a practitioner who was not providing care Lost USB stick containing PHI Abandoned records when a clinic closed
A good starting point!
54
Has your Organization…. Put in place information practices, that comply with the Act and its regulations? Prepared and made available a written public statement about your information practices? Designated a contact person to facilitate compliance with the Act [s. 15]? Ensured that employees and all other agents are appropriately informed of their duties? Taken reasonable steps to ensure PHI in your custody or control is protected against theft, loss, unauthorized use, disclosure, copying, modification, and disposal? Ensured that PHI records in your custody or control are retained, transferred, and disposed of in a secure manner and in accordance with the regulations?
55
SUGGESTED SOLUTIONS • Staff education is crucial (look out for a series of privacy learning group activities in this fall) • Build a culture of privacy awareness
http://www.ipc.on.ca/english/Resources/Educational-Material/EducationalMaterial-Summary/?id=728
56
Effective disclosure/sharing for Health Links Use the assumed implied consent provision to review and select potential clients
Educate and provide answers to questions
Ask for an explicit/expressed consent from the client for the purposes of Health Links PHI sharing
57
EXPERIENCES FROM OTHERS?
58
59
• charles@aohc.org • rodney@aohc.org