Allied health professionals who work with children must know how to navigate the unique legal status of minors, especially as it relates to access to personal health care information. In British Columbia, depending on what type of organization is holding the personal health information of a minor, different privacy legislation will apply. For private sector organizations, the Personal Information Protection Act, SBC 2003, c.63 ("PIPA") applies, whereas public sector organizations are governed by the Freedom of Information and Protection of Privacy Act ("FIPPA"). Both acts deal with an individual's right to access personal information, including health care records. This article focuses on private sector obligations under PIPA related to the disclosure of minor health care records.
Allied health professionals should also be familiar with any and all specific requirements imposed by their regulatory college or other professional oversight body. Allied health professionals should attempt to reconcile as best as possible any conflict between legislation and a regulatory bylaw, code of conduct, ethic or standard. If a conflict appears to be irreconcilable, we encourage allied health professionals to seek practice and/or legal advice.
Capacity to consent to release of a minor's personal health information
PIPA applies to private organizations and governs how personal information, including personal health care information, may be collected, used, and disclosed. Section 23 of PIPA relates to access to one's personal information, and specifically allows an individual to request from an organization a copy of their health care records. Generally, PIPA requires the health professional to respond within 30 days to any requests made for the disclosure of information (extensions may be granted in certain circumstances) and the health care professional may charge a "minimal fee" for access to the health care record.
When it comes to minors (persons under 19 years of age), the individual(s) who may consent to access and/or disclosure of personal health care information depends on the minor's cognitive maturity and their ability to exercise rights afforded to them in an informed and meaningful way. PIPA does not specify an age as to when a minor is capable of exercising their rights under the Act. Rather, the BC Office of the Privacy Commissioner ("OIPC-BC") understands that maturity can vary among minors and organizations must consider whether the minor understands the nature and consequences of exercising a right or power afforded under PIPA. This includes the decision to disclose or refuse disclosure of their personal health information.
However, note that the Office of the Privacy Commission of Canada ("OPC") takes the position that, in all but exceptional circumstances, a minor under the age of 13 is likely unable to provide meaningful consent. Thus, allied health professionals should be cautious about making the determination that a minor aged 12 or under has capacity to consent. Ultimately, the professional must be prepared to demonstrate that their process for assessing maturity resulted in meaningful and valid consent to disclosure of the health care record.
Where the health professional assesses the minor's level of maturity as being such that they can provide meaningful and valid consent, then the minor will have control over the disclosure of their information. Any release of personal health information of a mature minor will need to be consented to by the mature minor, even if the request is made by a parent (unless disclosure is otherwise permitted by law).
Allied health professionals are encouraged to review the seven guiding principles for obtaining meaningful consent, a document jointly produced by the OPC, the OIPC-BC and the Office of the Information and Privacy Commissioner of Alberta for further guidance.
Substitute decision makers when minor is incapable of meaningful consent
For children incapable of exercising their rights under PIPA, the Personal Information Protection Act Regulations, BC Reg 473/2003 (the "Regulations") allows consent to be achieved through authorized persons, such as a guardian or legal representative.
The term "guardian" is defined in the Family Law Act, SBC 2011, c 25 (s. 39), and states that generally parents are guardians. However, guardianship may be altered by agreement or court order. Additionally, a parent who has never resided with the minor is generally considered not to be the minor's guardian unless that parent regularly cares for the minor, or there is an agreement or order stating otherwise. Note also that a step-parent does not become a guardian by reason only of the marriage or marriage-like relationship to the minor's biological parent.
Before releasing medical records upon the request of a parent, the health professional must consider whether the requesting parent is entitled to the information (i.e. are they a guardian). At times this may be easy to determine, for instance when both biological parents are jointly involved in the health care of the child and there are no contentious family dynamics (divorce/separation). However, it may be necessary at times to request a copy of any agreement or court order that may exist which indicates the rights and responsibilities of the requesting parent in order to ascertain whether they are a guardian.
If the minor has a legal representative, PIPA also allows that representative to access the minor's health care records where that minor is incapable of exercising their rights under PIPA. A representative includes: (a) a committee under the Patients Property Act; (b) an attorney acting under an enduring power of attorney; (c) a litigation guardian; or (d) a representative under the Representation Agreement Act. If a health professional receives a request from the representative of a minor, before releasing the records the health professional should request documentation to confirm the legal status of the representative in relation to the minor.
Concluding remarks
When an allied health professional receives a request for the release of personal information of a minor, the health professional should determine the following:
- Whether the minor is capable of exercising their rights under PIPA, specifically do they have the physical, mental and emotional maturity to understand the nature and consequences of the decision to disclose or refuse disclosure of their personal health information.
- If the minor is mature and they are able to provide valid and meaningful consent, then the health professional must obtain the consent of the minor for the release of personal health information (unless disclosure without consent is otherwise permitted under PIPA or other relevant legislation).
- If the minor is not mature enough to provide valid and meaningful consent, then the health professional should assess the entitlement of the person making the request to access the minor's personal health information:
- If it is a parent asking for access to the minor's health care information, ensure that the parent is a guardian. The steps taken to ascertain whether a parent is a guardian may vary given the particular circumstances. Where there is a question as to whether the parent remains a legal guardian, the health professional should request relevant documentation (agreements or court orders relating to parental rights and responsibilities in relation to the minor).
- If the request comes from someone purporting to be a representative, the health professional should request appropriate documentation to confirm the representative's legal status in relation to the minor.
This article focuses on consent to release personal health care information, however, there are instances where disclosure without consent may be required or permitted by PIPA (s. 18) or other relevant legislation. For instance, where disclosure is required in order to comply with a subpoena, warrant or court order or where disclosure is permitted in light of safety concerns. There may also be requirements to redact certain third party information contained in the health care record prior to disclosure.
Allied health professionals should also be mindful that PIPA also stipulates instances where an organization must not disclose personal information despite a request from someone authorized to do so. Examples include where the disclosure could reasonably be expected to threaten the safety or physical/mental health of an individual other than the individual who made the request, or where disclosure can reasonable be expected to cause immediate or grave harm to the safety or the physical/mental health of the individual who made the request.
Note that there are many nuanced situations that may arise which are not fully canvased in this article. Allied health professionals are encouraged to contact their regulatory practice advisors and/or seek legal advice if it is unclear whether a person has the right to access a minor's health care records. This is especially important if there are contentious family dynamics and/or the health professional is tasked with interpreting court orders or other legal agreements. Additionally, the health professional should always consider what other specific professional obligations they may have in relation to disclosure of personal health information as stipulated by their professional regulatory bodies.