A health facility that collects, uses, communicates, and retains personal information, i.e. any information concerning a natural person and allowing them to be identified, must comply with several obligations regarding the protection of client data.
Therefore, only health facilities that the individual authorizes will have access to their personal information. Consent concerns strictly the disclosure of personal information; it must be expressed in a manifest, free, informed, specific, time-limited manner and can be withdrawn at any time.
Considering that consent to the communication from the persons concerned is:
Manifest — attested by a document (electronic or paper);
Free — expressed without condition, constraints, threats, or promises;
Informed — expressed with awareness of its scope;
Specific — authorizing the disclosure of specific personal information, to specific individuals, for specific purposes, and at a specific time;
Time-limited — valid for the duration required to achieve the purposes for which it is requested.
Here are two links that provide additional context:
The right to privacy implies that a person has a certain control over the circulation of information about themselves. You must therefore ensure that personal information cannot circulate without the prior authorization of the person concerned, by evaluating in particular the means by which you obtain this consent, the limits you assign to it, and the use you make of it.
However, certain exceptions specified by the Access Act authorize the communication of personal information without the prior consent of the individuals concerned (refer to sections 59, 59.1, 67, 67.1, 67.2, 68, and 68.1).
Personal information must be maintained up to date, be accurate and complete in order to adequately serve the purposes for which it was collected. You must therefore previously identify the personal information to be updated and subsequently record the last dates on which they were corrected. In this way, personal information evolves throughout its lifecycle in accordance with the situation of the persons concerned.
For more information on how the Collaborative Health Record (CHR) helps you protect your patients' personal data, refer to Privacy and security in the CHR.
Updated May 25, 2023