Compliance PATI EN T HEALTH INFOR MAT I ON PROT E CT I ON ACT ( PHI PA) C hiropractors interact with patient health information all day, every day. Good information is crucial to positive patient experiences and outcomes. How you collect, use and disclose that patient information is critical to meeting the regulatory obligations of the College of Chiropractors of Ontario (CCO) and a variety of laws. The Personal Health Information Protection Act (PHIPA) is one example of Ontario legislation with which chiropractors must be compliant. This article is designed to provide an overview of the specific requirements of PHIPA. CCO Standards of Practice S-002: Record Keeping and S-022: Ownership, Storage, Security and Destruction of Records of Personal Health Information identify and explain a number of the ways that PHIPA regulation overlaps with and complements the requirements set out by the CCO. Chiropractors are encouraged to ensure that they are in compliance with all aspects of that regulation. Compliance with PHIPA does not guarantee compliance with all regulations governing patient health information. Personal health information is broadly defined by the act. The definition includes all information that relates to: • the physical or mental health of the patient, including family medical histories, • the providing of health care to the patient, and, • payments or eligibility for health care, or eligibility for coverage for health care, in respect of the individual. PHIPA was first enacted in 2004 with the purpose of establishing rules for the collection, use and disclosure of personal health information that protect patient confidentiality and privacy without negatively impacting care. PHIPA also sets out patients’ rights to access their own personal health information and require corrections or amendments to that information. PHIPA applies to health information custodians, the definition of which includes chiropractors and clinic staff. Collecting Personal Health Information 24 FALL 2014 Whether the information is conveyed in oral or written form is not relevant. All information conveyed to a health information custodian is covered by PHIPA. A health information custodian may collect personal health information directly (from the patient) or indirectly (from someone else). As a general rule, direct collection is preferred. Consent is required for collection of health information with a few exceptions. When you share a patient with another health provider, consent to share the patient’s health information within the “circle of care” is implied unless it has been withdrawn by the patient. Patients should be kept informed about this. Indirect collection of personal health information requires the consent of the patient and that the information is reasonably necessary for providing health care. Information may only be collected indirectly if it is not reasonably possible to collect the information directly from the patient in a timely manner or when information collected directly cannot be reasonably relied upon to be accurate or complete. For example, a patient who is not fluent in English may not be able to provide complete, accurate personal health information in English and may consent to have a friend or family member answer a chiropractor’s questions on their behalf. While several other exemptions to the direct collection requirement are outlined in the statute, these are likely to be the most relevant to chiropractors. Keep in mind that a patient may withdraw their consent for their personal health information to be used by a health information custodian.