Skip to primary content
Skip to main menu
Skip to section menu (if applicable)

Chapter 3 – Consent, Capacity and Substitute Decision-Making

This chapter provides an overview of when you must get express (written or oral) consent, when you can rely on a client’s implied consent, and when you are allowed to collect, use or disclose PHI without consent. It also provides you with a checklist to follow when you need to make decisions about consent (including for capable or deceased persons), capacity and substitute decision-making.

Key Points

A capable person of any age has the right to make his/her own decisions about the collection, use or disclosure of personal health information (PHI).

An individual who is capable and 16 years of age or older may designate someone else to make those decisions for him or her.

There are special rules about giving consent on behalf of a person who has died.

A capable person of any age is presumed to be capable of consenting to the collection, use or disclosure of their PHI. However, if a child is under the age of 16, a parent may also give consent on behalf of the child in certain circumstances. The rules in PHIPA are not the same as the rules in the Health Care Consent Act.

In some situations, it may not be reasonable to presume capacity. PHIPA creates a framework for substitute decision-making in cases where a person is found to be incapable of making these decisions.

Consent may be express (oral or written) or implied, unless the Act requires it to be express. In some cases, consent is not required at all for the collection, use or disclosure of PHI. Custodians and their agents need to pay special attention to these rules.

PHIPA reference

For more complete information, you should also look at the following sections of PHIPA: 18-28


In some cases, PHIPA requires that you have the consent of clients before collecting, using or disclosing their PHI. You can also refer to Chapters 4, 5 and 6 for more information on circumstances when you may proceed without consent.

Consent is valid under PHIPA if

  • it is the consent of the individual (or of the appropriate substitute decision-maker, if there is one),
  • it is knowledgeable (which can also be achieved by posting your notice of information practices, as discussed below),
  • it relates to the information, and
  • it is not obtained through deception or coercion.

When is consent knowledgeable?

PHIPA specifies that unless it is unreasonable in the circumstances, you may presume that your client knows why you are collecting, using or disclosing his/her PHI if you have posted or made readily available a notice describing those reasons. You must post it or make it available in such a way that your clients are likely to see and read it.

For example, you are required to prepare and make available a written public statement, such as a privacy notice, and that might be a good place to describe the purposes for which you collect, use or disclose PHI. As with other written materials prepared for the mental health and addictions communities, you may want to use a large, readable font in your notice and consider what may be the best timing and method of providing it to your clients. The Office of the Information and Privacy Commissioner has developed a series of “short notices” (posters and brochures) for the health care sector, which may help your clients to understand PHIPA. You can order free copies by sending an e-mail to or by telephone at 416-326-3333.

Where the Act does require consent, that consent can be express or implied, unless the Act requires express consent.

Express consent

Express consent is either written or oral. If the client gives you a written, signed consent, you should place it in the client’s health record. If you get oral consent, you should also make a note of that in the health record.

You must get express consent if you are

  • giving PHI to someone who is not a custodian (for example, a recipient under PHIPA, such as an employer, insurer or family member who is not the client’s substitute decision-maker),
  • giving PHI to someone who is a custodian, but for a purpose unrelated to health care (for example, to a nurse who reviews claims for an insurance company), or
  • sharing PHI within your agency or giving it to a third party for marketing purposes (or for fundraising purposes, unless the conditions for relying on an implied consent are met).

Implied consent

You can rely on the client’s implied consent for the collection, use and disclosure of PHI in a number of situations under PHIPA, including any of the following:

  • Any time PHIPA says consent of the client is required, unless it specifically says that the consent must be express (see “Express Consent” above). Once you have taken the steps to ensure that your client’s consent is knowledgeable and the other criteria are met, as set out above, his/her consent may be implied.
  • If you receive PHI from the client, his/ her substitute decision-maker or another custodian for the purpose of providing health care or assisting in providing health care, unless you are aware that the client has specifically withdrawn or withheld the consent.
  • For fundraising purposes, in very limited circumstances set out in the regulations to PHIPA.

You should never rely on implied consent if you have reason to believe that the client

  • would not give consent, or
  • gave consent previously but has since withdrawn it.

Questions and Answers

Q: Does implied consent apply to interagency service agreements that are not mandated by law?

A: Yes, if the service agreement is necessary to provide continuing care to the client and all of the participating agencies are health information custodians. If not, you will have to obtain the client’s express consent before giving the PHI to that agency. You should also make sure that the client is aware that you are sharing his/her PHI with other agencies, through your written public statement; or if the client, his/her substitute decision-maker or another custodian gave you the PHI, you may give it to another custodian for health care purposes unless you are aware that the client has withheld or withdrawn the implied consent.

Any custodian that is part of an interagency agreement is required to comply with PHIPA, and the agreement could reflect that.

Clients can withhold or withdraw consent

Individuals have the right to withhold or withdraw their consent for the collection, use or disclosure of PHI in certain situations. This means that a client may tell you not to collect, use or disclose their PHI, and if PHIPA says that it is a situation that requires the client’s consent, you must abide by that wish. For example, you must obtain express consent to give a client’s PHI to an insurance company. The client is allowed to change his/her mind about having told you to disclose that information. In other situations, a client may decide not to consent in the first place. A withdrawal cannot be retroactive.

If the disclosure is for the purpose of providing health care, you have a responsibility to inform the other custodians to whom you are disclosing the PHI that you do not have the client’s consent to give them information you think is relevant to the provision of health care. You are not allowed to provide any additional detail.

This type of withdrawal does not affect your right (and in some cases, responsibility) to use and disclose PHI without consent.

Your ability to use or disclose PHI without your client’s consent (including mandatory reporting) will be discussed in Chapters 5 and 6.

Any consent forms you use should state that consent may be withheld or withdrawn at any time. A sample consent form for disclosure of PHI is provided at the end of this chapter.

Questions and Answers

Q: We have always obtained a client’s express consent before sharing information with other health care providers. I am uncertain about the new rules about implied consent.

A: There is nothing in PHIPA to prevent you from continuing to ask clients for their express consent to collect, use or disclose their PHI. However, PHIPA was intended to remove barriers to timely health care and duplication of services, by allowing custodians who are involved in the client’s care to give each other PHI based on implied consent. You can do this unless you are aware that your client has specifically withheld or withdrawn his/her consent.

Clients have the right to withdraw implied consent, just as they would with express (oral or written) consent.

Consent and children

A young person has the right to make his/her own decisions about the collection, use or disclosure of PHI. If a child under the age of 16 has given his/her own consent under the Health Care Consent Act to treatment, or participated in counselling under the Child and Family Services Act, any information decisions relating to those two situations are the child’s to make. Otherwise, the decision with respect to the collection, use or disclosure of the child’s PHI may be made by either the capable child or, where the child is under 16, his/her parent.

If there is a conflict between the parent and the capable child who is under 16, the decision of the child overrides that of the parent.

If another person or a children’s aid society has the legal right to make decisions in place of the parent, the parent has no right to make the decision. In the case of divorce or separation, a “parent” means the custodial parent, and not a parent who has only a right of access.

The following is a checklist of steps to consider when a situation involves consent, capacity and substitute decision-making under PHIPA:

  • Check to see that this is a decision about collection, use and disclosure of PHI: PHIPA creates a framework for consent, capacity and substitute decision-making for the collection, use and disclosure of PHI.You may already be familiar with similar rules in the Health Care Consent Actthat deal with consent to treatment, admission to a care facility, and personal assistance services.The Health Care Consent Act is an Ontario law that many health-care practitioners rely on often, because it tells them
    • when they must get consent for a proposed treatment,
    • when to assess whether a person is capable of deciding whether to accept or refuse a particular treatment, and
    • when to turn to a substitute decision-maker to make the decision.

    It is important to remember that the PHIPA rules are comparable to, but not the same as, the rules about treatment under the Health Care Consent Act.

  • Determine what type of consent you should get, if any PHIPA tells you when you
    • need to get consent for collection, use or disclosure of PHI (implied or express),
    • need to get express consent for collection, use or disclosure of PHI (which can be written or oral),
    • are allowed to rely on the individual’s implied consent, and
    • can collect, use or disclose PHI without consent.
  • Who will give the consent? A capable client, of any age, has the right to make his/her own decisions about the collection, use and disclosure of PHI.If there is a substitute decision-maker entitled to make decisions under theHealth Care Consent Act for the client, that person automatically becomes the substitute decision-maker under PHIPA for information decisions that are necessary for, or ancillary to, the client’s treatment.There may be no substitute decision-maker for treatment under the Health Care Consent Act. In that case, if you determine that the client is incapable of making decisions about the collection, use or disclosure of his/her PHI, you must turn to the list of substitute decision-makers in PHIPA. (See below for further detail about capacity determinations.)
  • Consent of a capable person – the test When you do obtain consent under PHIPA, the general rule is that it must be the consent of a capable person.The test of whether or not a person is capable relates to
    • his/her ability to understand the information that is relevant to making a decision about the collection, use or disclosure of PHI, and
    • the ability to appreciate the reasonably foreseeable consequences of giving or not giving, withholding or withdrawing the consent.

    A capable person may decide to make his/her own decisions, or ask that someone else make these decisions. In the latter case, the person must designate the other person in writing and both must be at least 16 years old. The person who is designated, however, can be either an individual, or an organization such as a trust company.

  • Assumptions you can make about consent and capacity You can assume that a client is capable of giving consent under PHIPA. However, this should be a reasonable assumption, informed by the situation you are in.You can assume that consent you receive (from the client or someone else) is valid consent, and the person giving it to you has the authority to act for the incapable client. Again, this has to be a reasonable assumption. It is always best to be alert to any indications of incapacity. When in doubt, you should also satisfy yourself that anyone who says he/she can provide consent for an incapable client has authority under PHIPA to do so.
  • Capacity determinations If you have any doubts about the client’s capacity, you should determine his/her capacity.See below for helpful tips on determining capacity.
  • Rights advice If you have found the client incapable under PHIPA, you must provide the client with information about the consequences of such a determination, if it is reasonable under the circumstances to do so. The client may challenge the finding of incapacity to the Consent and Capacity Board.While there is no official standard, it is likely that many custodians in addictions and mental health settings will provide this type of information to their clients.
  • Consent on behalf of an incapable person PHIPA provides a ranking of substitute decision-makers who have the right to give, withhold or withdraw consent on behalf of an incapable person:
    1. The individual’s guardian of the person or guardian of property, if the consent relates to the guardian’s authority to make a decision on behalf of the individual.
    2. The individual’s attorney for personal care or attorney for property, if the consent relates to the attorney’s authority to make a decision on behalf of the individual.
    3. The individual’s representative appointed by the Consent and Capacity Board, if the representative has authority to give the consent.
    4. The individual’s spouse or partner.
    5. A child or parent of the individual, or a children’s aid society or other person who is lawfully entitled to give or refuse consent in the place of the parent. This paragraph does not include a parent who has only a right of access to the individual. If a children’s aid society or other person is lawfully entitled to consent in the place of the parent, this paragraph does not include the parent.
    6. A parent of the individual with only a right of access to the individual.
    7. A brother or sister of the individual.
    8. Any other relative of the individual.

    The Public Guardian and Trustee has discretion to act as the substitute decision-maker only if no one in the list above can fulfill that role.

  • Express versus implied consent In most cases, where PHIPA requires you to get your client’s consent, the consent may either be express (written or oral) or implied. However, as discussed above, there are a few circumstances where the consent cannot be implied, and you must get express consent.Clients should understand that consent may be withdrawn, or that they may choose not to give it in the first place.
  • Documentation of consent When you do get a client’s consent, it is important that it be documented. This could be a written consent signed by the client, or a documentation of the fact that the client gave you oral consent. You must also follow any standards for documentation of your professional college or other body that has provided you with a licence.

Consent in other situations

If a person is capable

Anyone who is mentally capable of making a decision about the collection, use or disclosure of his/her PHI may do so. Otherwise, if he/she is at least 16 years old, he/she may ask someone else to make those decisions by putting that request in writing.

The rules for decisions on behalf of children have already been explained above.

Another law may also give the authority for someone to act on behalf of the client.

If a person has died

An estate trustee (someone who is named in a legal will or who has applied to a court for this formal designation) may make these decisions on behalf of a person who has died. If there is no estate trustee, that authority goes to the person who has assumed responsibility for the deceased person’s estate. (This is not a formal appointment; often, it is a family member of the deceased person.)

Can I use a Form 14?

Form 14 was a form under the Mental Health Act that was signed by a patient of a psychiatric facility to permit the disclosure, transmittal, copying or examination of his/her clinical record. Although it was widely used in other sectors, it was never a legal form outside a psychiatric facility.

Form 14 is no longer a valid form under the Mental Health Act and should not be used. Many health information custodians have now replaced Form 14 with their own form. The form created by the Ministry of Health and Long-Term Care is provided at the end of this chapter and can be adapted for your purposes.

If you receive a Form 14, you may still accept it as long as the information it contains is similar to the requirements for consent to disclose information under PHIPA. One thing to look for in any consent that you receive is that it includes a statement that the individual or client is free to withhold or withdraw his/her consent at any time. If you have any doubts about whether the consent is valid or meets the requirements of PHIPA, you should ask the client to sign your agency’s own form.

PHIPA does not specify whether the consent form you use applies only to disclosure of PHI you already hold, or whether a client could sign a consent form for you to release PHI in the future. To address this issue, one solution might be to make the consent valid for a certain period of time. However, this approach creates a number of problems, including the fact that few agencies and programs have the administrative resources to track when the consent is valid or has expired.

A better approach may be to let clients know that by signing your consent form, their consent applies to future disclosures of their PHI, unless they tell you otherwise. To the extent possible, you should consider whether your clients understand the scope of the future disclosures. For example, a client may be happy right now for you to give PHI to his family member, but if circumstances change in the future, he may not be in a position to come back and ask that you stop giving the information to the family member.

When in doubt, you should go back and ask for new consent. However, PHIPA does not require you to go back and get new consent for every Form 14 that was signed before PHIPA became law; you can assume that the consent you received prior to that time are valid, unless you have reason to believe that they are not.

Sharing PHI with a client’s health care providers1

PHIPA allows custodians who are providing health care, or assisting in providing health care to a particular client, to share or disclose the information they need in order to provide that care. You can do this based on the client’s implied consent.

The client has the right to tell you not to share or disclose this information, and under the “lockbox” provisions (discussed in Chapter 6), you will have to honour that request unless you are permitted or required under PHIPA or another law to continue to share it or disclose it.

If the client asks you not to disclose specific PHI to another custodian and you think what is missing is relevant to the other custodian’s ability to provide health care to the client, you must advise the custodian that they are not receiving all PHI that, in your opinion, is relevant to care. You may also wish to discuss with the client the implications of shielding this PHI, and try to find out what he/she is concerned about.

If you feel that another custodian is not sharing PHI that can and should be shared between custodians to assist a client’s health care, there are at least two possible reasons:

Prior to PHIPA, sharing certain client information required express consent; the other custodian’s staff members do not want to disclose PHI to you because they are unsure who is covered under the new rules.
The other custodian has made a decision that in spite of what PHIPA allows, clients’ express consent will still be required before staff members will release the PHI.
Try to find out which situation applies and what the other custodian’s concerns are. Ideally, you will be able to work together to arrive at a solution that suits everyone, keeping in mind that one of PHIPA’s goals is to reduce barriers to care, including information barriers.

Questions and Answers

Q: We have courtesy privileges with other hospitals, health centres and agencies. This allows us to access health records for the purpose of identifying potential clients. Social workers also share or access information for the purposes of obtaining referrals and case findings, and they attend rounds and hear information about individuals who are not their clients. How does PHIPA affect this practice?

A: The issue of granting ‘privileges’ to certain community partners arose before PHIPA came into force, in part to remove barriers to health care and promote the appropriate sharing of information among a client’s health care providers.

Under PHIPA, most health care organizations have adopted a “need to know” policy: information is shared with those involved in a client’s care. As a reminder, you should anonymize information (or minimize the amount of PHI you use) where possible. You should take care not to disclose PHI if it is not necessary for someone to carry out their functions.

It is important that in any situation (such as rounds) where a number of clients are being discussed, you consider who is involved in each client’s care. If a social worker is not involved (and is unlikely to be involved because of staff coverage/vacation issues), you may want to change your way of doing things to limit who attends.

The Act does permit a health information custodian to share PHI with its agents for the purposes of educating them to provide health care. Sharing case findings for the purposes of education is fine, as long as the person receiving the information is an agent of the health information custodian. (And to be an agent, you must be collecting, using or disclosing PHI on behalf of that custodian, not for your own purposes.)

Related Resources

Template: Consent to Disclose Personal Health Information
Template: Capacity Determination Form

1 This is sometimes referred to as the client’s “circle of care.” This term is not used in PHIPA, but has been widely adopted in the health care community. Unfortunately, it sometimes leads to confusion about who falls under PHIPA. PHIPA is very specific in its definitions of “health information custodians,” “health care,” “personal health information,” “use” within a custodian, and “disclosure” to those outside the custodian. These definitions, with reference to people’s primary functions, should guide you in determining how widely a client’s PHI should be shared.