Physicians have a professional responsibility as well as a legal obligation to protect the confidentiality of patient information. Owing to privacy legislation and the legal complexities surrounding the ownership and management of patient information, many physicians are wary about when they may or may not release such information to patients and other parties.
In Canada, physicians, institutions, and clinics own the record, regardless of the format, and they hold patient information contained in those records in trust for the care and benefit of the patient. Each patient retains a right of access to their personal health information, including information derived from other sources such as consultant reports.
As a general rule, information about a patient should be disclosed only on the written authorization of the patient or the patient's substitute decision maker, on receipt of a court order, or when the request is expressly for a purpose authorized by legislation. A substitute decision-maker is someone who is legally authorized to make decisions on behalf of the patient when the patient is mentally incapacitated (incompetent). Their authority may be granted by the patient with a legal document such as an advance directive or a power of attorney for personal care, by provincial or territorial legislation, or by the courts.
When information is not disclosed to the patient
Patients have the right to the information in their medical record. In exceptional situations, physicians can refuse to disclose the information in the record to the patient, but only if they reasonably believe there is a significant likelihood that disclosing the information will have a substantial adverse effect on the patient's physical, mental, or emotional health, or cause harm to a third party. The onus in such circumstances is on the physician to justify denying a patient access to information in their medical record.
Transfer of records
Information in medical records may need to be transferred between physicians such as when a patient transfers to another doctor. A copy of the information may be sent directly from the former physician to the new one, or the patient may request to receive the record. The CMPA recommends that physicians not release the original files. Instead, the pertinent information may be transferred by other means such as a report summarizing the relevant entries in the record, or a photocopy or scan of the file may be provided if requested.
For more information see the article, "How to manage your medical records: Retention, access, security, storage, disposal, and transfer".
Release of records to lawyers and other third parties
Physicians may release patient information to lawyers and other parties when requested to do so only if the patient or the patient's substitute decision-maker has given authorization, preferably in writing, or if authorized by law or a court order.
When information is released with the patient's or the patient's substitute decision-maker's authorization, the authorization or order should specify which record the patient consents to release and to whom the record can be released. A photocopy of the requested information — which may include clinical notes, investigation reports and results, and consultation reports — should then be provided. It is always prudent to review the information and to discuss the contents with the patient if there is sensitive information included which is not directly relevant to the request.
When the release of patient information is authorized by a court order or by legislation, it is prudent for a physician to notify the patient.
For more information see the articles, "Did you know? You need authorization to provide medical records to lawyers" and "When to disclose confidential information."
Release of children's records
Physicians receive requests for children's medical records from parents, often when there are issues between the parents concerning decision-making responsibility (custody) and parenting time (access). Before releasing medical records, physicians must first consider whether a specific parent is entitled to the information. This can depend on several factors including the age of the child, whether the child is deemed to have the capacity to control access to the record, and whether the parent has the right to the information about their child. If in doubt about a parent’s right to access their children’s records, request a copy of any parenting or separation agreement (custody and access agreement) or court order pertaining to access. Neither parent would normally have access if the physician determines that the child is a "mature minor" — the child's physical, mental, and emotional development allows for an understanding of the consequences of disclosing or refusing disclosure of their personal health information. In Québec, the Civil Code generally establishes the age of consent at 14 years, below which the consent of the parent or guardian, or of the court, is required.
In instances of potential child abuse, physicians may be required to release personal health information from a child's medical record. Physicians in every province and territory have a legal duty to report any suspected child abuse to the child protection agency. When making such a report, physicians may disclose information from a child's medical record. In other circumstances, the child protection agency may request information from a treating physician because they have received information from another source that a child is being abused. In either a physician's report or response to the child protection agency, physicians must ensure only necessary and relevant personal health information is released.
For more information see the articles, "Responding to requests for children's medical records" and "When to disclose confidential information."
Advice from the CMPA
If in doubt about how to respond to a request for a patient's personal health information, members are encouraged to contact the CMPA for advice.
