PHIPA or Personal Health Information Protection Act enumerates a
set of rules that defines the collections, use, and sharing of
personal health information of a patient. It is in Ontario
legislation and established in 2004. A few points are
- PHIPA outlines that the custodian must obtain consent from the
individual to collect, use, and share personal health insurance.
This, consent can be expressed or implied. Thus, the consent must
be knowledgeable, must be voluntary, related to information given
in the question, and must be provided by the individual.
- The patient can also withhold or refuse to provide information
or certain sections of it. If a person is not competent(i.e
extremely ill), then the healthcare team can contact the substitute
decision-makers like relatives, family to obtain the agreement on
behalf of the patient
- This consent must include, what information needs to be a
collection, why it is collected, who will get access to it, how
would it be used, potential consequences of not giving the
information, etc.
- This must be in a written policy regarding the control and of
this information and how it would be used. However, the consent can
be both oral or written
- The patient must understand where all the information would be
accessed, like for billing and other administrative purposes,
etc.
- Organizations have limitations on the types of PHI that can be
collected, or shared. Plus, it must also be not sold except in the
case of public health activities, or research.
- There are also remedies for breach in legislation in this
regard
Thus, every information collected, used or shared must have
proper consent. It can be used for marketing purpose or
crowdfunding but only with the person's consent.