Collection, use and disclosure of health information

Special rules apply to the collection, use and disclosure of students’ health information when they receive health care in school. Heath care includes any health-related examination, assessment, service or procedure provided to students to:

• diagnose, treat or maintain their physical or mental wellbeing
• prevent disease or injury, or
• promote health

Examples include providing care to a student who is not feeling well, examining a student’s injury, and assessing a student for a condition such as a speech disorder.

The rules governing the collection, use and disclosure of students’ personal health information are outlined in the Personal Health Information Protection Act (PHIPA) and apply to health information custodians and those working on their behalf. Custodians are only allowed to collect, use or disclose a student’s personal health information if:

• they have the student’s consent (or the consent of a substitute decision-maker such as a parent), and it is necessary for a lawful purpose, or
• it is permitted or required by PHIPA

Custodians must take reasonable steps to keep health information secure. If personal health information is stolen, lost, or used or disclosed without authority, the custodian must notify the student or their substitute decision-maker, and in some cases must also notify the IPC.

What is Personal Health Information?

A student’s personal health information includes any identifying information about the student that relates to:

• the student’s physical or mental health, including their family health history
• providing health care to the student, including the identification of a health care provider
• payments, or eligibility for health care, or eligibility for coverage for health care
• the student’s health number
• the identity of the student’s substitute decision-maker

Personal health information can be in either oral or written form and includes any other information about the student contained in a health record.¹¹¹

Who is a Health Information Custodian?

A health information custodian is a certain person or organization that is involved in delivering health care and includes:

• health care practitioners such as physicians, nurses, psychologists, speech-language pathologists, dental hygienists and social workers providing health care
• a person who operates a group practice of health care practitioners
• a community health or mental health centre, program or service whose primary purpose is the provision of health care¹¹²

In some situations, a school board may be the custodian of students’ health records, such as where it is operating a group practice of practitioners. In other circumstances, a health care practitioner employed by the board may be the custodian. While different arrangements are possible, the school board must provide clarity about who is the custodian responsible for student health records.

For more information on custodians working for employers (including school boards) who are not custodians, please see the IPC’s fact sheet: Health Information Custodians Working for Non-Health Information Custodians at ipc.on.ca.

Who can consent to the collection, use and disclosure of health information?

Students can consent to the collection, use and disclosure of their personal health information if they can understand the information that is relevant to deciding whether to consent, and the possible consequences of that decision.

If a student is younger than 16, a parent¹¹³ or other authorized person can consent on their behalf.  This does not apply if the student has received treatment or counselling under the CYFSA on their own.¹¹⁴ The decision of a capable student prevails over a conflicting decision of a parent or other authorized person.¹¹⁵

If a student is incapable of consenting to the collection, use or disclosure of their personal health information, a substitute decision-maker can consent on their behalf.¹¹⁶

Can students request access to their health information?

Students or their substitute decision-makers, if applicable, can access the student’s health records, with some exceptions. For example, students would not have the right to access a record if it is subject to a legal privilege or if a court order prohibits its disclosure.¹¹⁷

Custodians must respond to a request within 30 days. This time limit can be extended by up to 30 additional days if the custodian gives written notice and an explanation for the extension.

Where the health care provider is employed by the school or acting on its behalf, the request must be made to the school board under MFIPPA.

Can a school board collect, use and disclose student health numbers?

Where a school board is not a custodian, it cannot collect, use or disclose a student’s health number except for certain purposes, including providing health services funded by the Government of Ontario.¹¹⁸ A school board cannot require students to present a health card for other purposes, such as to identify students for registration. However, the school board can ask to keep a student’s health number on file, on a voluntary basis, in case of a medical emergency. School boards should consider the privacy risks associated with collecting health numbers when developing their policies on this subject.

What about student immunization information?

Public health units in Ontario must keep up-to-date immunization records for every student in relation to nine designated diseases.¹¹⁹ If a student’s record is incomplete, a health unit can send the school a written order to suspend the student. Physicians or nurses immunizing a child must provide the parent with a confirmation that the immunization was administered.