Privacy and Confidentiality Standard

    The public can expect that licensed healthcare professionals will protect their personal information, including health-related information, with the utmost care, respect, and discretion, and that they will use and share that information only as needed for safe, effective care and only for purposes that are reasonable and authorized under law or with consent.

    This Practice Standard applies to the collection, use, storage, disclosure, and disposal of all personal information in the context of providing health services.

    A licensee must:

    1. Meet legislative requirements, which include:
      1. The HPOA, the Regulations, and the CHCPBC Bylaws.
      2. The Freedom of Information and Protection of Privacy Act, RSBC 1996, c 165, which regulates the privacy practices of public bodies (and those who provide health services within public bodies).
      3. The Personal Information Protection Act, SBC 2003, c 63, which regulates the privacy practices of individuals and organizations in the private sector.

    1. Collect, use, store, and disclose information in accordance with legislative requirements, which includes the requirements to: 
      1. Clearly explain how information will be collected, used, stored, and disclosed. 
      2. Obtain consent to collect personal information, unless the collection is otherwise authorized or permitted by law, and collect only the information necessary to provide health services or fulfill legal requirements.
      3. Respect Indigenous data sovereignty, consistent with provincial commitments under UNDRIP and OCAP® principles, by being transparent when collecting personal information from self-identifying Indigenous patients. This includes explaining why the information is being collected, how it will be used, who will have access to it, and how Indigenous communities may exercise control over their members’ personal information.
      4. Use personal information only for the purposes identified at the time of collection, unless new consent is obtained for a different use or a different use is authorized or required by law. 
      5. Disclose personal information only with consent, unless required by law.
      6. Limit disclosure of information to the minimum amount of personal information necessary for the intended purpose.

    1. Safeguard personal information, which means to: 
      1. Take reasonable administrative, technical, and physical steps to safeguard and protect personal information from unauthorized access, loss, use, or disclosure. 

    1. Maintain privacy, which means to:
      1. Ensure the personal information of patients is not discussed in public or non-secure settings, including in-person, virtual, or electronic settings.
      2. Take steps to ensure appropriate physical and verbal privacy during examinations and care delivery.

    1. Respect access and correction rights, which means to: 
      1. Provide or facilitate access to records for the purpose of viewing or correcting information within 30 business days of receiving a request from a patient or authorized individual, in accordance with privacy legislation.

    1. Maintain confidentiality and privacy after termination of the professional relationship, which means to:  
      1. Continue to uphold and protect the confidentiality and privacy of patient information following the conclusion of the professional relationship. 

    1. Promptly address privacy breaches, which means to: 
      1. Take prompt steps to contain a privacy breach and prevent a reoccurrence.
      2. Report a privacy breach in a manner that complies with of privacy legislation.

    Glossary

    Consent: a voluntary, informed, and capable person’s agreement to receive a specific health service. Consent is valid only when:

    • The person is capable of making the decision;
    • The person receives the information that a reasonable person would require about the nature, purpose, benefits, risks, and alternatives to the proposed service;
    • The person is given an opportunity to ask questions and receive answers;
    • The decision is voluntary, not obtained through coercion, fraud, ormisrepresentation; and
    • The consent relates to the specific health service proposed.
      Consent may be expressed orally or in writing, or inferred from the person’s conduct, and may be withdrawn at any time.

    Health service: any service or activity provided by a licensee in relation to healthcare, including collecting information; assessing, diagnosing, preventing, monitoring, treating, or managing a person’s health or health-related condition; or providing health-related information to an individual or the public, whether or not treatment is provided.

    Patient: a person to whom health services are provided. Throughout the Ethics and Practice Standards, “patient” includes substitute decision-makers, parents, and guardians where applicable.

    Personal information: recorded information about an identifiable individual other than business contact information.

    Professional relationship: the relationship that arises when a licensee, acting in their professional or practice-related capacity, provides or undertakes to provide services, advice, assessment, care, treatment, education, supervision, consultation, or other professional activities to or for an individual, a client, a patient, a family, a group, an organization, or the public.

    Record: includes patient information, books, documents, drawings, photographs, letters, vouchers, papers, and any other thing on which information is recorded or stored by graphic, electronic, mechanical, or other means, but does not include a computer program or any other mechanism that produces records.

    Related standards and legislation

    Consent

    Records

    Freedom of Information and Protection of Privacy Act, RSBC 1996, c 165

    Personal Information Protection Act, SBC 2003, c 63