- Express consent is required to share personal health information for health care purposes
- Express consent must be provided in writing
- Individuals do not have a right to see or obtain a copy of their own records
- Personal health information cannot be used for educational purposes
- Personal health information can never be shared with family members
The presentation also provides a summary of ways to address common causes of privacy breaches. This presentation provides specific direction to health care providers and supports the IPC’s recent report “A Policy is Not Enough” – which we blogged about last week.
The key take away messages for health care organizations are:
- A culture of privacy must be nurtured. It requires ongoing efforts to reinforce. Health care providers are obliged to engage in a dialogue with staff about what “privacy” means in their context. It means privacy training for new staff and refresher training for existing staff on the changing privacy standards set by the IPC.
We have had an opportunity to train hundreds of front line staff in hospitals, family health teams, community health centres and long-term care homes in privacy principles. The same issues come up in every health care environment. Staff want to know:
- How to answer questions posed by patients’ family members – what do I do when my patient’s spouse calls and wants test results?
- How to navigate their way in “friendly communities” – what do I do when someone approaches me in the grocery store and wants to talk about their care?
- How to respect patient privacy when serving children and youth – how do I explain privacy to parents of teenagers?
- How to communicate with patients – am I allowed to leave a message on a patient’s voice mail? are there rules about communicating with patients via email?
It really helps to play out scenarios with staff and share lessons learned about how to maximize patient privacy in busy health care practices.
- Technological advances in health care create privacy opportunities and challenges. Provincial and local efforts to improve continuity of care across the health care system are laudable – and require special attention to the privacy principles of consent and safeguards. Privacy impact assessments should be performed at the outset so as to avoid costly delays with shared information technology systems.