A8 Implied vs. Informed Consent & Health Links

Implied vs. Informed Consent & Health Links What to do about it Rodney Burns, Marc Gordon, & Charles Sagoe June 5, 2013

2

Workshop Agenda  Purpose and Objectives  10 Years of PHIPA  Circle Of Care and Health Links: Challenges  “Consent” - up close and personal  “Assumed Implied Consent” and the Health Links  When can one assume an Implied Consent  Myths about PHIPA, Sharing, & Consent  Who Is Outside The Circle of Care?  Can We Share Outside The Circle of Care?  Unique Challenges in Health Links implementation  Suggested Solutions Q&A

3

PURPOSE AND OBJECTIVES • Privacy level-setting • Privacy best practices and applications • Explore key considerations of consent, various options, and how they may be applied in the Health Links.

4

Privacy still matters!

5

PHIPA, 2004 • Almost 10 years since coming into force!

• Governs how personal health information (PHI) may be collected, used and disclosed • Roles of persons • Key definitions (PHI, healthcare practitioner, HIC, consent) http://www.e-laws.gov.on.ca/html/statutes/english/elaws_statutes_04p03_e.htm

KEY POINTS OF PHIPA

6

Definitions: • PHI Sched. A, s. 4 (1) • Key roles/persons Health Information Custodian (HIC) Sched. A, s. 3 (1) Agent, ESP, HINP, & 3rd Party Agent

• Consent Sched. A, s. 18, 19, 20 HINP

AGENT

ESP

HIC 3rd

Party

Agent

7

Gender, Date of Birth and Postal Code Are these PHI? Very easy to identify a client using a combination of these! “it is reasonably foreseeable in the circumstances that it could be utilized, either alone or with other information, to identify an individual.�

Sched. A, s. 4 (2).

8

PHI CONTINUUM as defined in PHIPA

COLLECT

USE

DISCLOSE

9

PHI CONTINUUM in Practice

COLLECT

USE

ACCESS

DISCLOSE

 Access - most likely area for privacy breach!  Critical to monitor Access for risk management

10

AOHC Privacy Survey, 2012    

Common Gaps/ Immature Solutions Documentation of privacy risk registers 22% have enterprise risk management programs Tools/processes for compliance monitoring and assessment  Privacy training (all staff and role-based)

11

12

“CIRCLE OF CARE” Sharing PHI for Healthcare Purposes • Allows certain HICs to collect, use or disclose PHI for the purposes of providing health care by assuming the client’s implied consent • It may change depending on the client • The term is not defined in the Act!

13

Is addressing social determinants of health part of delivering healthcare?

Model of Health & Wellbeing "I absolutely see the improvement in my patients' health. For patients that we do manage to get on income supports, their lives often really turn around.“ Dr. Gary Bloch

Recognize the privacy implications and address them accordingly Poverty & health, CBC

14

HEALTH LINKS, 2012 Bring together health care providers in a community to better and more quickly coordinate care for high-needs clients.

About Health Links, MOHLTC, Dec/12

15

Purpose of Health Links  Clients do not need to answer the same question from different providers  Have support to ensure they are taking the right medications appropriately  Have a care provider they can call, eliminating unnecessary provider visits  Have an individualized comprehensive plan, developed with the patient and his/her care providers who will ensure the plan is being followed http://news.ontario.ca/mohltc/en/2012/12/about-health-links.html

16

Purpose of Health Links “Clients do not need to answer the same question from different providers�

Is this achievable in the clinical context where clinicians will want to ensure information accuracy?

17

HEALTH LINKS

How do they relate??

CIRCLE OF CARE

18

Health Links are a better mechanism to deliver efficient care to clients within the Circle of Care

CIRCLE OF CARE

HEALTH LINKS

19

Transition comes with unique privacy challenges and opportunities • •

Consent management Ownership

20

“CONSENT” UP CLOSE & PERSONAL

21

CONSENT  Important component of all aspects of healthcare delivery

 PHIPA has very explicit consent requirements for HICs  At the core of PHIPA is the concept of a client’s understanding and knowledge of, and voluntary agreement to allow the collection, use, or disclosure of their PHI

22

CONSENT  Consent is client-centered

 Very much in line with AOHC’s Model of Health and Wellbeing

23

CONSENT

• Clients’ understanding, knowledge of, and voluntary agreement to allow the collection, use, or disclosure of the individual’s PHI.

24

CONSENT TREE Expressed (Verbal or Written)

CONSENT

Implied (Verbal or Written)

Assumed Implied (Verbal or Written)

25

EXPRESSED CONSENT: verbal/ written, unequivocal, freewill agreement by the client with what is being proposed or being done in relation to the collection, use, and disclosure of PHI. Must be and should not require any inference on HIC. Sched. A, s. 18 (1)

26

IMPLIED CONSENT: client is knowledgeable about and understands the purpose for collection, use, or disclosure, but does not object or withdraw consent.

Permits a HIC to infer from the surrounding circumstances that client would reasonably agree to the collection, use or disclosure of PHI. Sched. A, s. 18 (2)

27

ASSUMED IMPLIED CONSENT Allows certain HICs to assume the individual’s implied consent to collect, use and disclose PHI for the purpose of providing health care.

28

“Knowledgeable” Consent ≠ “Informed” Consent!

29

UNDER WHAT CONDITION(S) CAN YOUR CENTRE ASSUME AN IMPLIED CONSENT?

30

Can a HIC Rely on Implied Consent to: Comply with a legal requirement or participate in legal or administrative proceedings or contemplated proceedings?

Plan, deliver or monitor health-related programs or services?

Do you need consent to have intern or coop student to sit in on client interviews or meetings for educational purposes?

Sched. A, s. 37(1)

31

Consent Scenario • Violet Garden was transferred from Valley View Hospital to Oak Manor, a long term care facility.

• Greta, a registered physiotherapist staff at Oak Manor, has to prepare a plan to address Violet Garden’s mild hemiplegia due to a CVA. • Violet Garden is no longer capable and her SDM, the only son, is outside the country for a month.

• It is not an emergency situation, but Greta wants to start immediately a plan within days, not weeks. She needs more information, and found out that that her mother-in-law, Cindy, was the Physiotherapist on record at Valley View Hospital.

• She calls Cindy to see if she can provide a more detailed history and any suggestions for managing Violet Garden.

• Was it ok for Greta to call Cindy?

• Can Cindy help?

1. Must be a HIC to rely on assumed implied consent

32

• • • •

health care practitioners or a group practice persons or organizations providing a community service a community care access corporation A centre, program or service for community health or mental health whose sole purpose is provision of healthcare • public or private hospitals • psychiatric facilities or institution • an independent health facility Sched. A, s. 3(1)

33

2. PHI must come from the person or SDM • The person the PHI relates to; or • The substitute decision maker (SDM) should have provided the PHI

34

3. Collect PHI to use to provide or assist in provision of health care • The PHI collected MUST be used only for the purpose of providing or assisting in the provision of health care.

• You may not rely on assumed implied consent for other non-health care uses!

35

4. Receive PHI to provide or assist in provision of health care • The PHI received MUST be used only for the purpose of providing or assisting in the provision of health care.

• You cannot rely on assumed implied consent for other non-health care uses!

36

5. Disclose only to another HIC • Irrespective of the purpose, you cannot disclose to a non-HIC! EXAMPLE • Police, WSIB, insurance company

37

6. Be mindful of an expressed consent withdrawal!

The HIC receiving the PHI must absolutely not be aware that the client has expressly withheld/withdrawn consent.

The Lab will be breach if it sends a copy of the report to the family physician!

Family Physician

Social Worker

Walk in

OBG

Lab

38

BE MINDFUL OF WHO IS OUTSIDE THE CIRCLE!

HICs

Non HICs

Doctors

Police

Nurses Pharmacists

WSIB

Long Term Care

Revenue Canada

CHCs/AHACs Social Worker Public Health

Volunteers Aboriginal midwifes/healers

39

DISCLOSURE or USE OUTSIDE THE CIRCLE? No if: • You rely solely on assumed implied consent • Disclosing even to a HIC for non-health care purposes Yes, if: • The person gives expressed consent – written or verbal

40

Busting Some Myths: PHIPA, Data Sharing, Consent “I want to dispel the myth that PHIPA requires health-care providers to obtain express consent to share information with each other to provide care for their patients.”

“The suggestion that consent can only be implied where “it is not reasonably possible to obtain the individual’s consent in a timely manner,” is emphatically not the case.”

“The suggestion that consent can only be implied where “it is not reasonably possible to obtain the individual’s consent in a timely manner,” is emphatically not the case.”

Ann Cavoukian, Information and Privacy Commissioner of Ontario Toronto Star. January 24, 2013.

41

CHALLENGES for AOHC members in HEALTH LINKS

42

CHALLENGE 1: How to fulfill the 6 conditions for assumed implied consent 1. Must be a custodian to rely on assumed implied consent 2. PHI must come from the patient or SDM

3. Collect to use to provide or assist in provision of health care 4. Receive to provide or assist in provision of health care 5. Disclose only to another HIC

6. Must not be aware of expressed consent withdrawal

43

Litmus Tests to determine if you meet the requirements for assumed implied consent

DESTINATION

• Is my source or recipient a HIC who can rely on assume implied consent?

• Am I aware of any expressly withheld or withdrawn consent?

CLIENT

• Was the information collected from the client or the SDM?

PURPOSE

• Will the information be used to provide care or assist to provide care?

SOURCE/

44

Is assumed implied consent enough to allow collection, use and disclosure of PHI?

45

CHALLENGE 2: Not all HICs can rely on assumed implied consent!

• • • •

When a HIC is not part of the Circle of Care When there is expressed consent withdrawal MOHLTC and Medical Officer of Health Prescribed Entities - ICES, CCO, etc.

46

CHALLENGE 3: Working with non-HICs WSIB

School Board

Police Volunteers

Social Services

Revenue Canada

Aboriginal midwifes/healers

47

CHALLENGE 4: An otherwise HIC working for a non-HIC • A nurse working for the school where your client attends calls your CHC to look for information or discuss the client’s behavioral and nutritional challenges.

• Return to Work Programs

48

CHALLENGE 5: Efficient disclosure among qualified HICs

49

• < 2% of clients place restrictions on PHI • No need to be defensive • Be Proactive!

50

Balance between Privacy and Health care

Effective health care delivery Protect privacy

51

GOAL: “Facilitate the effective provision of health care” AND “protect the privacy of individuals”

They are not mutually exclusive!

52

SUGGESTED SOLUTIONS

53

Has your organization complied with all OIPC orders and decisions? http://www.ipc.on.ca/english/decisions-and-resolutions/ • • • •

Missing unencrypted laptop PC PHI accessed by a practitioner who was not providing care Lost USB stick containing PHI Abandoned records when a clinic closed

A good starting point!

54

Has your Organization….  Put in place information practices, that comply with the Act and its regulations?  Prepared and made available a written public statement about your information practices?  Designated a contact person to facilitate compliance with the Act [s. 15]?  Ensured that employees and all other agents are appropriately informed of their duties?  Taken reasonable steps to ensure PHI in your custody or control is protected against theft, loss, unauthorized use, disclosure, copying, modification, and disposal?  Ensured that PHI records in your custody or control are retained, transferred, and disposed of in a secure manner and in accordance with the regulations?

55

SUGGESTED SOLUTIONS • Staff education is crucial (look out for a series of privacy learning group activities in this fall) • Build a culture of privacy awareness

http://www.ipc.on.ca/english/Resources/Educational-Material/EducationalMaterial-Summary/?id=728

56

Effective disclosure/sharing for Health Links Use the assumed implied consent provision to review and select potential clients

Educate and provide answers to questions

Ask for an explicit/expressed consent from the client for the purposes of Health Links PHI sharing

57

EXPERIENCES FROM OTHERS?

58

59

• charles@aohc.org • rodney@aohc.org