Confidentiality and Privacy in Canadian Medical Practice

Show notes & transcript

Confidentiality and Privacy in Canadian Medical Practice

This episode explains how Canadian clinicians protect patient information, when it can be shared, and how to respond when privacy is compromised. The central principle is to use a valid consent or legal basis and share only what the situation requires.

Production note: Read the narration sections aloud. Section headings are optional transitions. The reference page is for preparation and is not part of the recording. All clinical examples are fictional.

Why confidentiality matters

Welcome to TopMedCast. Imagine a patient sitting in your office who says, “I need to tell you something, but I do not want my family to know.” Before you hear the concern, you are already facing an important responsibility: creating a safe place for an honest conversation.

Patients may disclose information about mental health, substance use, sexual health, violence, or difficulties at home. If they fear that this information will reach relatives, employers, or neighbours, they may withhold details that matter to their care.

Privacy concerns how personal information is collected, accessed, used, and disclosed. Confidentiality is the professional responsibility to protect information entrusted to us. Security is how we protect it in practice, through measures such as controlled access and secure communication. These responsibilities apply to the whole clinic, not only the physician. [1]

The Canadian legal framework

Canada does not have one identical set of health privacy rules for every clinical setting. Provincial and territorial legislation, professional standards, and sometimes federal law determine what applies. In Saskatchewan, the Health Information Protection Act, usually called HIPA, governs personal health information held by health trustees. Ontario has the Personal Health Information Protection Act, or PHIPA. Do not assume that an Ontario rule applies unchanged in another province. [2, 3]

For listeners, the practical question is straightforward: “What authorizes me to access or share this information, and how much is actually needed?” Being able to open a chart does not automatically mean that you are entitled to read it.

Consent and sharing for care

Consent to treatment and consent to share information are distinct. For express consent, explain what you will disclose, to whom, and why. Document the agreement and follow applicable authorization requirements. [3]

Ontario permits implied consent for necessary sharing within the circle of care when legal conditions are met and consent has not been withheld or withdrawn. This does not permit unrestricted staff access. Other jurisdictions have their own rules. [3]

Consider a fictional referral for persistent palpitations. The family physician sends the cardiologist the relevant symptoms, medications, examination findings, and test results. The information supports assessment. Sharing unrelated sensitive details simply because they are in the record deserves separate scrutiny.

If a patient asks you not to share a particular detail, explore the concern and explain how withholding it might affect care. Follow the applicable restriction rules and seek advice if the situation is unclear. Patients can restrict access in circumstances recognized by law. [4]

Family members and substitute decision makers

Imagine a spouse asking for blood test results. Marriage alone does not establish permission. Check the patient’s authorization or another legal basis before disclosing information. [3]

A useful response is: “I understand you are concerned. I can listen to what you would like us to know, but I need to check whether I can share information about your spouse.” Listening to a family member does not mean that you must disclose information in return.

When a patient lacks capacity for the relevant information decision, identify the person authorized under the applicable law. Do not assume that any accompanying relative has that authority. Share what is appropriately needed for the authorized role. [9]

Here is a brief fictional conversation. The patient says, “My daughter helps with my appointments, but I do not want her to know about my counselling.” The doctor replies, “Let us clarify what you want us to discuss with her. We will document your preferences and review any legal limits.” This makes the patient’s wishes part of the workflow rather than an informal promise.

Teenagers and confidential care

A teenager seeking contraception may ask whether their parents will be told. Across Canada, capacity and provincial rules matter; there is no single age rule that answers every privacy question. A capable minor can often control disclosure, but parental access rules and Quebec’s legal framework require particular attention. Encourage supportive family involvement when appropriate without promising either automatic disclosure or absolute secrecy. [5]

When disclosure without consent is justified

Canadian practice distinguishes between disclosures required by law and disclosures permitted by law. Required reporting can include a child in need of protection and certain communicable diseases. Driving fitness reporting also varies by jurisdiction. Confirm the applicable threshold, recipient, and information required. [6]

A separate public safety exception can permit disclosure to reduce a serious risk of harm. A specific threat with a plan and access to a weapon needs urgent assessment and protective action. An angry remark alone is not automatically sufficient. Consider the seriousness and immediacy of the risk and the applicable legal criteria. There is no identical automatic duty to warn across Canada. [6]

When disclosing, provide only the necessary information to an appropriate recipient. Explain the disclosure to the patient when appropriate and safe. Document the facts, legal basis, recipient, and information shared. Seek urgent advice when needed, without delaying immediate safety measures. [6]

Police requests require careful handling. A police officer’s request is not, by itself, unlimited authority to access a medical record. Verify consent or another valid legal basis. A warrant or court order must be reviewed for its scope. In most jurisdictions, a subpoena to attend court does not by itself authorize advance release of the record. Seek medico-legal advice when unsure. [7]

Consider this fictional exchange. A patient says, “Promise you will never tell anyone.” The doctor replies, “I will protect your information. There are limited situations where the law requires or permits me to share it, such as protecting a child or addressing a serious safety risk. If that becomes relevant, I will explain what I can, as safely as possible.”

Privacy in everyday clinic work

Privacy failures often begin with ordinary actions: a conversation overheard at reception, a screen left open, or a document sent to the wrong address. Build protection into routine work. Confirm identifiers, check recipients, restrict access to those who need it, and use appropriate safeguards for electronic information. [1]

For a telephone or video appointment, confirm who you are speaking with and whether they can talk privately. Ask about safe voicemail and messaging preferences. Consent to electronic communication does not remove the clinician’s responsibility to protect information. [8]

For example, leaving a detailed result on a shared household voicemail can expose a diagnosis to someone the patient never authorized. A safer workflow begins by agreeing on what messages can be left and where.

Digital tools teaching and public content

Artificial intelligence tools introduce another information-sharing question. Before using an AI scribe, understand what it records, where information is processed or stored, and how it may be reused. Obtain and document appropriate consent, comply with local requirements, and verify the clinical note. Consent does not replace adequate privacy safeguards. [10]

For podcasts and teaching, fictional cases are often the simplest way to illustrate an ethical issue. Removing a name from a real story may still leave the patient recognizable through their age, location, unusual condition, or circumstances. Do not assume that a case is anonymous merely because its name is missing. [1]

Public use of identifiable patient information needs an appropriate consent and legal basis. Consent to treatment does not authorize a podcast or social media post. [3]

Responding to a privacy breach

Suppose a clinic discovers that a referral was faxed to the wrong recipient. Act promptly to contain the breach, involve the privacy officer, assess what information was exposed, and preserve a factual account of what happened. Investigate the cause and put preventive measures in place. [11]

Notification duties differ across jurisdictions. Check the requirements for informing affected patients, privacy regulators, and any other relevant body. Saskatchewan’s privacy commissioner recommends notifying affected individuals and the commissioner as a best practice. Do not confuse a recommendation with a universal statutory reporting requirement. [11]

When speaking with a patient, explain what is known, what is still being investigated, what information was involved, and what steps are being taken. An appropriate apology and a clear contact for questions can help address the impact. [11]

A fictional disclosure might begin: “Your referral was sent to the wrong recipient. We are sorry this happened. We have taken steps to contain it and are checking whether it was accessed or shared. We will update you about what we learn and the changes we make.”

Closing narration

Confidentiality is part of safe, respectful medical care. Before accessing or sharing patient information, establish the purpose, identify the consent or legal authority, and limit the information to what is needed. When an exception applies, use it carefully and document the decision.

For patients, a clear explanation of privacy protections and their limits makes it easier to speak honestly. For clinicians, good systems turn that commitment into everyday practice.

Thank you for listening to TopMedCast. This episode provides general education. For a specific disclosure decision, consult the current law, your provincial or territorial college, your privacy officer, or the Canadian Medical Protective Association.