Skip to primary content
Skip to main menu
Skip to section menu (if applicable)

Chapter 9 – PHIPA from Your Client’s Perspective

This chapter sets out some of the areas of PHIPA that may be of particular importance to clients. It also identifies when clients have the right under PHIPA to complain about a custodian to the Information and Privacy Commissioner.

Key Points

Clients like to be informed about specific issues (such as one’s rights; substitute decision-making; access to one’s health record; and specifics about what is sometimes referred to as a “lockbox”).

You should also be familiar with the circumstances in which a client may make a complaint to the Information and Privacy Commissioner about your agency’s privacy and information practices.


Selected Client Issues

Topic Rights information
PHIPA When a health information custodian determines that a client is incapable to consent to the collection, use or disclosure of PHI, rights information may be provided if the custodian believes it is reasonable in the circumstances to do so.
Comment Formal rights advice is mandatory in the community only when a physician is considering issuing a community treatment order, and the advice is provided to both clients and their substitute decision-makers, if any.

Formal rights advice related to the collection, use or disclosure of PHI continues to be mandatory for clients of psychiatric facilities.


Topic Automatic role of substitute decision-maker under HCCA for PHIPA information decisions related to treatment
PHIPA An incapable client who has a substitute decision-maker under the Health Care Consent Act for treatment will have the same substitute decision-maker for information decisions that relate to the treatment.
Comment This eliminates the need for health information custodians to find a new substitute decision-maker under PHIPA.

Topic Determination of harm as basis of denying access to record now discretion of the custodian
PHIPA A health information custodian may deny a client’s access to a record of his/her PHI. There are rules about the types of responses a custodian must give, and for informing the client of the right to make a complaint about the response to the Information and Privacy Commissioner.

The custodian has the right but no obligation to consult with a physician or psychologist prior to denying access on that basis.

Comment Under the former Mental Health Act rules, the attending physician in a psychiatric facility who wished to withhold a patient’s clinical record had to apply to the Consent and Capacity Board for permission to do so.

Topic Timeframes for custodians to respond to access and correction requests now up to 60 days (previously 7 days)
PHIPA PHIPA has set timeframes in which you must respond to a client’s request for access to, or correction of, his/her record of PHI.
Comment Anyone who has ever been a patient in a psychiatric facility may raise the fact that access requests were answered within 7 days under the Mental Health Act. You may want to inform your clients when they make a request for access, or correction, of the new time frames under PHIPA, and that the rules apply in all health settings (including psychiatric facilities).

Topic “Lockbox” and its limitations
PHIPA Clients may instruct a custodian not to use or disclose their PHI in particular circumstances (mainly relating to health care purposes).
Comment Lockbox is limited in its scope. It cannot be used by clients to stop a custodian from using or disclosing PHI if the Act permits or requires the custodian to do so.

Topic Consent to have the custodian leave a copy of the client’s record of PHI in the client’s home or someplace else.
PHIPA A health information custodian may leave a record of the client’s PHI in the client’s home or in another location not under the custodian’s control in certain circumstances.
Comment Clients should consider their own ability to safeguard the record of PHI, and who may have access to it.

What can a client do under PHIPA?

A client has many rights under PHIPA, including the right to

  • withdraw or withhold his/her express or implied consent for collection (including indirect collection), use or disclosure of PHI,
  • request access to or correction of a record of PHI, or to attach a statement of disagreement,
  • request a fee waiver for access to a record of his/her PHI,
  • instruct the custodian not to use or disclose his/her PHI to other custodians for health care purposes
  • ask a custodian for a copy of its written public statement (which includes a description of the custodian’s information practices; who the contact person is for the custodian and how to reach him or her; and how to make a complaint to the Information and Privacy Commissioner),
  • ask for your help in narrowing an access request, and
  • make different types of complaints to the Information and Privacy Commissioner.