CONSENT
What is it and when do you need it?
Gary Dickson
Saskatchewan Information and Privacy
Commissioner
October 28, 2004 Privacy Laws and Health 1
Information: Making it Work
Introduction
• Do you need consent?
• If so, can it be implied?
• If not, must it be oral or written?
• If written, what does it look like?
• What is deemed consent?
• If deemed consent, can the patient say
“NO”?
October 28, 2004 Privacy Laws and Health 2
Information: Making it Work
Agenda
• Patient autonomy
• Privacy laws and consent – 3 different
approaches
• Is this the same as consent for treatment?
• HIPA and consent
• If you need consent…
• What is an informed consent?
• How to revoke consent?
• When you need it?
• Consent as a best practice
October 28, 2004 Privacy Laws and Health 3
Information: Making it Work
Patient Autonomy/Control
• “Existing Canadian case law provides patients with a
legitimate expectation that health information about
them will be kept confidential and not disclosed to
third parties without permission.”
• Timothy Caulfield and Nola M. Ries, Consent, Privacy
and Confidentiality in Longitudinal, Population Health
Research: The Canadian Legal Context
• See also:
– Canadian AIDS Society v. Ontario (1995) 25 O.R.(3d) 388
– R. v. Osolin (1993) 109 D.L.R. (4th) 478
– McInerney v. MacDonald (1992) 93 D.L.R. (4th) 415
October 28, 2004 Privacy Laws and Health 4
Information: Making it Work
Privacy Laws and Consent
- 3 different approaches
1. Private Sector (PIPEDA)
• Consent-driven, OR
2. Public sector (FOIP)
• Sanctioned sharing, OR
3. HIPA (or HIA, PHIA, PHIPA)
• Consent not required between trustees
October 28, 2004 Privacy Laws and Health 5
Information: Making it Work
Is this the same as consent for
treatment?
• Consent for treatment:
• Long established concept in healthcare
• Is a process not a document
• Can look behind the form
• Did the patient understand the explanation
• Was the patient functionally illiterate?
• Did the patient properly comprehend
English?
• Were the associated risks clear to the
patient?
October 28, 2004 Privacy Laws and Health 6
Information: Making it Work
Is this the same? (cont’d)
• Consent for HIPA purposes:
– Must be “informed” [s. 6(1)(b)]
– Informed means provided with info. that a
reasonable person in the same
circumstances would require in order to
make a decision about collection, use or
disclosure [s. 6(2)]
October 28, 2004 Privacy Laws and Health 7
Information: Making it Work
HIPA and consent
• Only required if no provision in HIPA
authorizes the use or disclosure
without consent [s. 5(2)]
• Collection doesn’t require consent
• Use doesn’t require consent
• Disclosure usually doesn’t require
consent if to another trustee with need
to know
October 28, 2004 Privacy Laws and Health 8
Information: Making it Work
HIPA and consent (cont’d)
• Deemed consent for:
– Purpose for which collected or consistent
purpose
– For arranging, assessing, providing,
continuing or supporting service
requested or required
– Disclosing to next of kin if
• Info. limited to current services and
• Patient hasn’t said NO
October 28, 2004 Privacy Laws and Health 9
Information: Making it Work
HIPA and consent (cont’d)
• Deemed consent also requires:
– If health professional, must comply with
ethical practices
– Otherwise, must have established
policies & procedures to restrict
disclosure
October 28, 2004 Privacy Laws and Health 10
Information: Making it Work
If you need consent …
• The consent must:
– Must relate to the purpose for which info.
required
– Must be informed
– Must be voluntary
– Must not be obtained through
misrepresentation, fraud or coercion
October 28, 2004 Privacy Laws and Health 11
Information: Making it Work
What is an informed consent?
• If individual is provided with the information
that a reasonable person in the same
circumstances would require to make a
decision about collection, use or disclosure
October 28, 2004 Privacy Laws and Health 12
Information: Making it Work
Other requirements for
consent
• Time limited consent is OK
• Consent may be express or implied
• Express consent can be oral or written
• If oral, consider how best to document
October 28, 2004 Privacy Laws and Health 13
Information: Making it Work
How to Revoke Consent
• Individual may revoke consent at any time
• Revocation is not retroactive
• Trustee must take all reasonable steps to
comply after receiving the revocation
October 28, 2004 Privacy Laws and Health 14
Information: Making it Work
When you need it
• Disclosure to non-trustee and not
permitted by law
• For trustee to obtain access to personal
health info. of an employee for any
employment related purpose
• For disclosure of personal health info.
about a health care professional to a
regulatory body unless ability to practice
in question
October 28, 2004 Privacy Laws and Health 15
Information: Making it Work
When you need it (cont’d)
• For research unless consent is not
reasonably practicable
October 28, 2004 Privacy Laws and Health 16
Information: Making it Work
Consent – as a best practice
• Consider the advantages of obtaining
consent:
– Empowers patients/clients
– Improves patient/client confidence and
satisfaction
– Avoids later misunderstandings and conflict
October 28, 2004 Privacy Laws and Health 17
Information: Making it Work
Questions
Saskatchewan Information and Privacy
Commissioner
• #100, 1230 Blackfoot Drive
• Regina, Saskatchewan S4S 7G4
• Phone: (306) 787-8350
• Fax: (306) 798-1603
• Email: gdickson@oipc.sk.ca
• Website: www.oipc.sk.ca
October 28, 2004 Privacy Laws and Health 18
Information: Making it Work