This article was produced in partnership with BMS Group Ltd.

Canada's privacy laws generally prohibit disclosing personal health information without patient consent. There are, however, limited circumstances where consent is not required for public health officials to receive personal health information. This is a means to protect citizen's health and safety, which often outweighs the privacy considerations.

Ontario's privacy laws permit health professionals to disclose COVID-19 information to public health authorities and to others facing a risk of serious harm caused by COVID-19. The authority to make such disclosures falls under the Personal Health Information and Protection Act ("PHIPA")1 and the Health Protection and Promotion Act ("HPPA").2

If a health care provider forms the opinion that a patient may have COVID-19, s 25(1)3 of the HPPA requires them to report to a Medical Officer of Health of their local health unit. Regulation 569 under the HPPA outlines what to include in the report.4

Furthermore, s 39(2)(a) of PHIPA allows a health information custodian to disclose an individual's personal health information to a Medical Officer of Health if it is done so for a purpose of the HPPA.

One of the HPPA's stated purposes is preventing the spread of disease, and promoting and protecting the health of those living in Ontario.5 Additionally, s 5(2) of the HPPA allows Public Health Units to control infectious diseases of public health significance.6

Contact tracing is a means to control the spread of COVID-19. Therefore, a health information custodian can rest assured that the HPPA and PHIPA allow latitude to disclose personal health information for COVID-19 contact tracing as a means to protect public health and prevent the spread of disease.

PHIPA also allows a health information custodian to disclose personal health information if they have reasonable grounds to believe disclosure is necessary to eliminate or reduce a significant risk of bodily harm to a person or group of persons.7 This provision may provide a basis for disclosing personal health information to an individual who is not a Medical Officer of Health during contact tracing. However, the health information custodian must have reasonable grounds to believe, based on reliable information that the patient may behave in a way that will put others at risk of COVID-19. Additionally, health information custodians must only reveal what information is necessary.

While health information custodians should strive to protect patient privacy, PHIPA does protect custodians and their agents from actions or proceedings if they act in good faith and do what is reasonable in the circumstances.8

While this protection has received little judicial consideration, it may apply to protect a health information custodian if PHIPA is contravened while attempting to stop the spread of COVID-19.

The COVID-19 outbreak raises important and significant privacy considerations. While this article speaks specifically to Ontario legislation, similar legislation exists federally and across Canada's provincial and territorial jurisdictions.

As privacy legislation continues to apply during the public health crisis, health professionals across Canada should educate themselves on the legislation that applies in their respective jurisdictions and consider the legislative authority to make such disclosures.

This article was authored by Nicole Hilliard, Articling Student at Gowling WLG.

1 Personal Health Information Protection Act, 2004, S.O. 2004, c. 3, Sched. A [PHIPA].

2 Health Protection and Promotion Act, R.S.O. 1990, c. H.7 [HPPA]

3 Ibid at s 25(1).

4 RRO 1990, Reg. 569: REPORTS.

5 HPPA, supra note 2 at s 2.

6 Ibid at s 5(2).

7 PHIPA, supra note 1 at s 40(1).