Page 10 - Policies

1.2.4 Consent Directive/Lockbox

Patients may withdraw their consent to the collection, use, and disclosure of their PHI for
the purpose of providing healthcare to them. This is commonly referred to as a “lockbox”.

Clinicians must request consent to override a lockbox for the purpose of providing care,
either from the patient or the substitute decision maker (SDM) for the patient. The clinical
user may override the lockbox citing an emergency only when:

• it is not reasonably possible to obtain this consent, and
• the risk of not accessing the locked information may lead to serious harm.

Other staff who require access for purposes such as billing, coding, scheduling, etc. do
not require express consent and may override the lock in the health information system
(HIS) by selecting the reason “Support Functions.”

Lockbox requests from patients are generally submitted using a Lockbox (Consent
Directive) Request Form and by contacting the Privacy Office at 416-340-4800 ext. 6937
or by email at privacy@uhn.ca.

1.2.5 Information and Privacy Commissioner

Patient privacy concerns should be escalated to UHN’s Privacy Office. In situations
where UHN Privacy is unable to resolve a concern, patients will be advised that they
may contact the IPC by email at info@ipc.on.ca or by phone at 416-326-3333.

1.2.6 Freedom of Information

As part of the broader public sector, all Ontario hospitals are subject to FIPPA. FIPPA
provides a public right of access (with limited exceptions) to records in the custody or
control of UHN. FIPPA does not apply to records of PHI.

All FIPPA requests must be submitted in writing to the UHN FIPPA Coordinator’s Office.
Requestors may be referred to UHN’s Freedom of Information website or to email at
FOI@uhn.ca to obtain further information.

1.2.7 Cooperation with the UHN Privacy Office

All UHN agents are required to cooperate with Privacy Office staff during a complaint,
breach investigation, containment or remediation of a privacy issue, a privacy impact
assessment, or an audit. Failure to cooperate with Privacy Office staff in their attempts to
ensure or support compliance with UHN policy or provincial privacy laws may result in
disciplinary measures.

This material has been prepared solely for use at University Health Network (UHN). UHN accepts no responsibility for use of this material by
any person or organization not associated with UHN. No part of this document may be reproduced in any form for publication without
permission of UHN. A printed copy of this document may not reflect the current, electronic version on the UHN Intranet.
Policy Number 1.40.007 Original Date 08/02
Section Privacy & Information Security Revision Dates 07/05; 11/14; 11/16; 11/23
Issued By Privacy Office Review Dates
Approved By Vice-president & Chief Legal Officer Page 3 of 16