10.2 Medical Confidentiality, Privacy Laws (PIPEDA/PHIPA), & Disclosure of Harm

Ethical & Legal Foundations of Confidentiality

Medical confidentiality is a fundamental duty owed by physicians to their patients, rooted in the Hippocratic Oath, the Canadian Medical Association (CMA) Code of Ethics and Professionalism, and Canadian statutory law. Maintaining confidentiality fosters patient trust, ensuring individuals disclose sensitive clinical information necessary for accurate diagnosis and treatment. Personal Health Information (PHI) encompasses any identifying information regarding a patient's physical or mental health, diagnostic testing, treatment plans, health insurance numbers, or family history.

---

Canadian Privacy Legislation: PIPEDA & Provincial Health Privacy Acts

In Canada, health information privacy is regulated by a combination of federal and provincial statutes:

• PIPEDA (Personal Information Protection and Electronic Documents Act): The federal privacy law governing how private-sector organizations collect, use, and disclose personal information during commercial activities. PIPEDA applies across Canada unless a province has enacted substantially similar health privacy legislation.
• Provincial Personal Health Information Acts: Most Canadian provinces have enacted dedicated health-sector privacy statutes that take precedence over PIPEDA for health information custodians (HICs):
  • Ontario: Personal Health Information Protection Act (PHIPA)
  • Alberta: Health Information Act (HIA)
  • British Columbia: Freedom of Information and Protection of Privacy Act (FIPPA) / Personal Information Protection Act (PIPA)
  • Quebec: Act respecting the protection of personal information in the private sector (Law 25)

Health Information Custodians (HICs) vs. Agents

Under statutes like PHIPA, physicians, hospitals, clinics, and pharmacies act as Health Information Custodians (HICs)—entities responsible for safeguarding PHI. Nurses, medical trainees, administrative staff, and IT personnel act as Agents of the HIC and are bound by the same statutory duties of confidentiality.

---

The Circle of Care & Electronic Chart Privacy

The Circle of Care is a practical concept recognized in Canadian health privacy law. It refers to the team of healthcare professionals directly providing or assisting in providing health care to a specific patient.

Rules Governing the Circle of Care

1. Implied Consent: Within the circle of care, a physician may rely on implied consent to collect, use, or share PHI with other team members (e.g., consulting specialists, ward nurses, pharmacists) for the direct purpose of providing health care.
2. Lockbox Restrictions: A capable patient has the legal right to place a "lockbox" (express restriction) on their record, instructing a HIC not to disclose specific parts of their PHI to other healthcare providers, even within the care team (unless an emergency exception applies).
3. Prohibition of Snooping: Accessing electronic health records of patients outside one's care team—such as family members, friends, colleagues, or high-profile public figures out of curiosity—is illegal. Regulatory colleges (e.g., CPSO, CPSA) enforce zero tolerance for chart snooping, resulting in heavy fines, suspension, or revocation of license.

Exam Trap: A resident notices that her neighbor was admitted to the hospital psychiatric unit. Out of concern, the resident logs into the electronic medical system to view the neighbor's chart. This is a severe statutory privacy breach (PHIPA violation) and professional misconduct, even if the resident intended no harm and disclosed the information to no one!

---

Lawful Exceptions to Medical Confidentiality

Confidentiality is not absolute. A physician is legally obligated or permitted to breach confidentiality without patient consent in three distinct circumstances:

                     [Exceptions to Confidentiality]
                                   |
       +---------------------------+---------------------------+
       |                           |                           |
[1. STATUTORY OBLIGATIONS]   [2. COURT ORDERS / SEARCH]   [3. COMMON LAW DUTY TO WARN]
- Child abuse reporting     - Judicial subpoena           - Smith v. Jones criteria:
- Unfit driver reporting    - Search warrant              * Imminent risk
- Communicable diseases     - Court summons               * Serious bodily harm/death
- Impaired pilot/railway                                  * Identifiable person/group

1. Statutory Mandatory Reporting

Statutes explicitly require physicians to report specific conditions to public authorities (e.g., Child and Family Services, Ministry of Transportation, Medical Officers of Health). Statutory reporting overrides patient privacy rights.

2. Legal Process & Subpoenas

Physicians must disclose records when served with a valid court order, judge-signed warrant, or statutory summons. Note: A verbal request from a police officer does NOT authorize disclosure of PHI without a warrant or explicit statutory exemption.

3. The Common Law Duty to Warn/Protect (Smith v. Jones)

The Supreme Court of Canada decision in Smith v. Jones (1999) established the legal precedent for breaching confidentiality to protect third parties. To justify a breach of public safety exception, three criteria must be satisfied:

1. Clear Risk: There must be a clear and present danger to an individual or group.
2. Serious Bodily Harm or Death: The threatened harm must involve severe violence, serious injury, or death.
3. Imminence: The threat must be imminent, creating an urgent risk of harm.

Clinical Scenario: A patient tells his psychiatrist during a consultation, "I bought a gun today, and tonight I am going to kill my ex-wife Sarah at her house." The threat is clear, imminent, and involves severe harm to an identifiable victim. Under Smith v. Jones, the psychiatrist has a legal and ethical duty to notify law enforcement and warn the intended victim immediately.

---

Disclosure of Adverse Events and Harm (CMPA Guidance)

An adverse event is an unexpected or unintended event that results in harm to a patient during medical care. When an adverse event occurs, the Canadian Medical Protective Association (CMPA) and national regulatory standards require prompt, transparent, and honest disclosure to the patient or their substitute decision-maker.

The Four-Step CMPA Framework for Adverse Event Disclosure

1. Immediate Clinical Response: Provide urgent clinical care to mitigate harm and stabilize the patient's medical condition.
2. Initial Disclosure Meeting: Hold a face-to-face meeting as soon as practical after the event:
   • State the facts clearly without speculating on blame or negligence.
   • Describe the known consequences and immediate management plan.
   • Express sympathy and regret for the event (e.g., "I am very sorry that this complication occurred").
3. Investigation & Analysis: Perform a clinical review or root cause analysis to determine how and why the event occurred.
4. Follow-Up Disclosure: Meet again with the patient to share the findings of the investigation and explain the concrete system steps taken to prevent recurrence.

Apology Legislation in Canada

Every Canadian province and territory (except Quebec, which addresses this via civil law principles) has enacted an Apology Act. These statutes stipulate that an expression of sympathy, regret, or apology made by or on behalf of a healthcare provider:

• Does not constitute an admission of fault, liability, or legal guilt;
• Cannot be used as evidence of liability in any civil court proceeding or administrative hearing.

---

Managing Privacy Breaches (CMPA Guidelines)

When a breach of PHI occurs (such as a lost unencrypted laptop, stolen chart, or misdirected fax containing clinical notes), the HIC must take immediate containment measures:

1. Stop the breach immediately and recover the exposed information.
2. Notify the affected individuals so they can take protective measures.
3. Report the privacy breach to the provincial Information and Privacy Commissioner as required by statute.
4. Conduct an internal security audit to remediate system vulnerabilities.