Page 8 - Policies

Consent for the Collection, Use & Disclosure of Personal Health
Information

The knowledge and consent of the individual are required for the collection, use, or
disclosure of personal health information, except where inappropriate. (Refer to Consent
for the Collection, Use & Disclosure of Personal Health Information on the Privacy
website.)

In certain circumstances, PHI can be collected, used, or disclosed without the
knowledge and consent of the individual. For example, legal, medical, or security
reasons may make it impossible or impractical to seek consent. Seeking consent may be
impossible or inappropriate, for example when the individual is seriously ill or mentally
incapacitated. In these circumstances, consent of the individual’s substitute decision
maker will be sought, where feasible.

UHN may use or disclose personal health information for research purposes without an
individual’s consent if strict conditions are met (e.g. the approval of a Research Ethics
Board), as per PHIPA. For example, a custodian who uses PHI for research and,
similarly, a researcher who seeks disclosure of personal health information for research,
must both submit a detailed research plan to the UHN Research Ethics Board (REB) for
approval. In reviewing a research proposal involving the use and disclosure of personal
health records, the REB must consider:

 whether the research cannot be reasonably accomplished without access to the
information
 the public interest in conducting the research and in protecting privacy
 whether obtaining consent directly is impracticable
 whether adequate safeguards are in place to protect the privacy of individuals
and the confidentiality of their information

Limiting the Collection, Use & Disclosure of Personal Health Information

The collection of PHI will be limited to that which is necessary for the purposes identified
by UHN; information will be collected by fair and lawful means.

At or before the time PHI is collected, UHN will identify the purposes for which the
personal health information is collected. Permitted purposes include:

 the delivery of direct patient care
 the administration of the health care system
 research
 teaching
 statistics
 fundraising
 meeting legal and regulatory requirements as described in PHIPA

This material has been prepared solely for use at University Health Network (UHN). UHN accepts no responsibility for use of this material by
any person or organization not associated with UHN. No part of this document may be reproduced in any form for publication without
permission of UHN. A printed copy of this document may not reflect the current, electronic version on the UHN Intranet.
Policy Number 1.40.007 Original Date 08/02
Section Privacy & Information Security Revision Dates 07/05; 11/14; 11/16
Issued By Privacy Office Review Dates
Approved By Senior Vice-president & Chief Information Page 2 of 8
Officer