Approved by Council: November 2000
Reviewed and Updated: September 2004, April 2005, September 2005, June 2009. September 2012, October 2017
Other References: "A Duty to Report, A Chance to Protect" Dialogue, Issue 3, 2015
A number of new reporting obligations have come into force since the review of this policy. These amendments will be considered during the next policy review, however, in the interim, please refer to the relevant legislation for current reporting requirements. In the event of questions, please obtain independent legal advice.
Physicians have a legal and professional obligation to maintain the confidentiality of patient information. There are circumstances, however, where physicians are either required or permitted to report particular events or clinical conditions to the appropriate government or regulatory agency. This policy clarifies the circumstances under which physician reporting duties are mandatory or permissive.
Mandatory reports are legally required and considered necessary in the public interest. Depending on the origin of the mandatory reporting duty, physicians are required to include specific information and, at times, professional medical opinions in mandatory reports. While permissive reports may be legally permitted in certain circumstances, the decision to make a permissive report is at the physician’s discretion, and rooted in professional responsibility and ethics.
This policy does not represent an exhaustive list of physicians’ legal responsibilities, nor is it a substitute for legal advice regarding reporting obligations. The College encourages physicians to stay informed of their duties, and to seek the guidance of legal counsel or the Canadian Medical Protective Association (CMPA) where necessary.
The reporting obligations set out in this policy relate to the following principles of ethics and professionalism articulated in The Practice Guide:
- Maintain patient trust by keeping patient information confidential, except where required or permitted to report the information;
- Communicate effectively and openly by informing patients of physician reporting obligations, where it is prudent to do so.
The College expects all physicians to be aware of and comply with their legal, professional and ethical reporting obligations. This policy details mandatory reporting requirements, and instances where the disclosure of patient and/or personal information is permissible, but not required by law. In order to support a trusting physician-patient relationship, physicians are encouraged to communicate with patients about their reporting duties, where circumstances make it appropriate to do so.
A. Mandatory Reports
Please use the links below for a detailed description of mandatory reporting obligations in the following circumstances:
- Child Abuse or Neglect
- Impaired Driving Ability
- Long-Term Care and Retirement Homes
- Sexual Abuse of a Patient
- Facility Operators: Duty to Report, Incapacity, Incompetence and Sexual Abuse
- Terminating or Restricting Employment, Privileges and Partnerships
- Births, Still-births and Deaths
- Communicable and Reportable Diseases
- Controlled Drugs and Substances
- Community Treatment Plans
- Gunshot Wounds
- Pilots or Air Traffic Controllers
- Railway Safety
- Maritime Safety
- Occupational Health and Safety
- Correctional Facilities
- Preferential Access to Health Care
- Health Card Fraud
- Privacy Breaches
The purpose of the Child and Family Services Act (CFSA) is to promote the best interests, protection and well-being of children.1 Under the CFSA, physicians who have reasonable grounds2 to suspect a child is or may be in need of protection, must immediately report the suspicion, and the information upon which it is based, directly to a children’s aid society (CAS).3
Under the CFSA, a “child in need of protection” includes a child who has suffered, or is at risk of suffering abuse, neglect, or emotional harm.4
Physicians who have reasonable grounds to suspect a child is in need of protection must report directly to a CAS, and not rely on any other person to report on their behalf.5 The duty to report is ongoing. The CFSA requires that physicians make a further report to the CAS if there are additional reasonable grounds to suspect that the child is or may be in need of protection.6
Physicians have the same duty to report their suspicion that a child is in need of protection as any other member of the general public. The CFSA recognizes, however, that professionals working closely with children have a special awareness of the signs of child abuse and neglect, and a particular responsibility to make a report.7
Physicians are not obligated to report suspicions of abuse to the police. However, if information provided by the physician to the CAS alleges that a criminal offence has been perpetrated against a child, the CAS will immediately inform the police, and work with the police according to established protocols for investigation.8
Physicians who make a report about a child who is or may be in need of protection are generally protected from legal action unless the basis for doing so was malicious or without reasonable grounds.9 Physicians who fail to report a suspicion obtained in the course of their professional duties may be guilty of an offence punishable by fine.10
Physical Harm or Abuse
The child has suffered physical harm, including by way of neglect, or there is a risk that the child is likely to suffer physical harm.11
The child requires medical treatment to cure, prevent or alleviate physical harm or suffering, and the child’s parent or the person having charge of the child does not provide treatment, or refuses, is unavailable or unable to consent to the treatment.12
Sexual Harm or Abuse
The child has been sexually molested or sexually exploited, or there is a risk that the child is likely to be sexually molested or sexually exploited, by the person having charge of the child, or by another person where the person having charge of the child knows or should know of the possibility of sexual molestation or sexual exploitation and fails to protect the child.13
The child has suffered emotional harm,14 or there is a risk that the child is likely to suffer emotional harm as a consequence of the actions, inaction, or pattern of neglect by the child’s parent or person having charge of the child.15
The child has suffered emotional harm, or there is a risk that the child is likely to suffer emotional harm and the child’s parent, or the person having charge of the child does not provide, refuses or is unavailable or unable to consent to services or treatment to remedy or alleviate the harm.16
The child suffers from a mental, emotional or developmental condition that could seriously impair the child’s development if left untreated, and the child’s parent, or the person having charge of the child does not provide treatment, refuses, or is unable or unavailable to consent to treatment to remedy or alleviate the condition.17
The child has been abandoned, or the child’s parent is deceased, or is unavailable to exercise their custodial rights over the child, and has not made adequate provision for the child’s care and custody.18
The child is in a residential placement and the parent refuses, or is unable or unwilling to resume the child’s care and custody.19
The child is under the age of 12 and has killed or seriously injured another person or caused serious damage to another person’s property. The child’s parent or the person having charge of the child does not provide, refuses, is unable or unavailable to consent to the services or treatment necessary to prevent the child from committing the same or similar acts in the future.20
The child is under the age of 12 and has on more than one occasion killed or seriously injured another person or caused serious damage to another person’s property. The child’s parent or the person having charge of the child has encouraged these acts, or the acts have occurred due to inadequate supervision.21
The Highway Traffic Act requires that physicians report every individual 16 years of age or over attending upon the physician for medical services, who, in the opinion of the physician is suffering from a condition that may make it dangerous to operate a motor vehicle.22
While it is not necessary to obtain a patient’s consent before making a report under the Highway Traffic Act, where appropriate, the College encourages physicians to inform the patient in advance of doing so. In circumstances where the patient was not informed beforehand, the College recommends that physicians do so after the report has been made.
A report by a physician under the Highway Traffic Act will not automatically result in the suspension or downgrading of the patient’s licence. Upon receipt, the Ministry of Transportation will review information received in accordance with the Highway Traffic Act and national medical standards.25
Generally, physicians will not be subject to legal action for complying, in good faith, with reporting obligations under the Highway Traffic Act.26
Under the Long-Term Care Homes Act and Retirement Homes Act, long-term care and retirement homes are to be operated so that residents may live with dignity and in security, safety and comfort.27
When physicians have reasonable grounds to suspect that a resident of a nursing home or retirement home has suffered harm or is at risk of harm due to improper or incompetent treatment or care, unlawful conduct, abuse or neglect, they must immediately report their suspicion and the information upon which it is based to the Registrar of the Retirement Homes Regulatory Authority, or long-term care home director.28
Additionally, physicians have a duty to report suspicions of misuse or misappropriation of a resident’s money or of funding provided to a licensee.29
Physicians who make a report are generally protected from legal action or other proceedings unless the basis for doing so was malicious or without reasonable grounds.30 Physicians who fail to report their suspicions may be guilty of an offence punishable by fine.31
When a physician has reasonable grounds, obtained in the course of practising the profession, to believe that another physician or regulated health professional has sexually abused32 a patient, the physician must file a report in writing with the Registrar of the college to which the alleged abuser belongs.33 Physicians are not required to file a report if the name of the regulated health professional who would be the subject of the report is not known.34
Where information regarding sexual abuse is obtained from the patient, physicians must exercise their best efforts to advise the patient of the requirement to file the report before doing so.35
Reports must be filed within 30 days after the obligation to report arises. However, where the physician has reasonable grounds to believe that the alleged abuse will continue or that the member will sexually abuse other patients, the report must be made immediately.36
Reports must contain the following information:
- the name of the person filing the report;
- the name of the regulated health professional who is the subject of the report;
- an explanation of the alleged sexual abuse; and
- the name of the patient who may have been sexually abused (if the grounds for reporting are related to a particular patient, and the patient, or the patient’s representative has consented in writing).37
Where the reporting physician is providing psychotherapy to the alleged abuser, and is able to form an opinion as to whether the alleged abuser is likely to sexually abuse patients in the future, the report must also contain this opinion.38 In the event that the reporting physician has ceased to provide psychotherapy to the alleged abuser, the reporting physician must file an additional report to the same college immediately.39
Under the Health Professions Procedural Code (HPPC), physicians or others who operate a facility40 where one or more regulated health professionals practise, have specific reporting obligations.
Facility operators who have reasonable grounds to believe that a regulated health professional practising in the facility is incompetent,41 incapacitated42 or has sexually abused a patient, must file a report with the Registrar of the college to which the regulated health professional belongs.43 Facility operators are not required to file a report if the name of the regulated health professional who would be the subject of the report is not known.44
Generally, reports must be made 30 days after the obligation to report arises. Reports must be made immediately, however, when there are reasonable grounds to believe that:
- the regulated health professional will continue to sexually abuse the patient or will sexually abuse other patients; or
- the incompetence or incapacity of the regulated health professional is likely to expose a patient to harm or injury and there is urgent need for intervention.45
Reports must contain the name of the individual making the report, the name of the regulated health professional who is the subject of the report, an explanation of the alleged sexual abuse, incompetence, or incapacity and, if concerns relate to a specific patient, the name of that patient.46 In reports of alleged sexual abuse, however, patient names must only be included with the written consent of the patient or representative.47
Regulated Health Professions Act, 1991 (RHPA)
Anyone, including physicians, who employs or offers privileges to regulated health professionals or who associates in partnership with such professionals (“employers and affiliates”) has reporting obligations as set out below.
Employers and affiliates (including physicians) must report when they terminate the employment of a regulated health professional, or revoke, suspend or restrict their privileges, for reasons of professional misconduct,48 incompetence49 or incapacity.50
Similarly, anyone (including a physician) who dissolves a partnership, health profession corporation or association with a regulated health professional on the basis of professional misconduct, incompetence or incapacity must make a report to the relevant college.51
When a regulated health professional resigns, or voluntarily relinquishes or restricts their privileges, employers and affiliates must make a report if:
- they have reasonable grounds to believe that the resignation, relinquishment or restriction of the regulated health professional is related to that member’s professional misconduct, incompetence or incapacity51a; or
- the resignation, relinquishment or restriction takes place during or as a result of an investigation, conducted by or on behalf of the employer or affiliate, into allegations related to that member’s professional misconduct, incompetence or incapacity.51b
Reports must set out the details of the event (i.e., the reasons for the event or intended event, the grounds upon which the reporter’s belief is based, or the nature of the allegations being investigated).52 All reports must be made in writing to the Registrar of the appropriate college within 30 days after the obligation to report arises.53
A person who files a report in good faith under the HPPC will generally not be subject to legal action.54
Public Hospitals Act
Physicians or others acting as hospital administrators have specific reporting obligations in relation to disciplinary actions taken against physicians.
The obligation to report is triggered in the following circumstances:
- a physician’s application for appointment or reappointment to the medical staff of a hospital is rejected, or the physician’s privileges are restricted or cancelled, due to the physician’s incompetence, negligence, or misconduct;55
- a physician resigns from the medical staff of a hospital or restricts his or her practice within a hospital and there are reasonable grounds to believe that the resignation or restriction is related to the physician’s competence, negligence or conduct.56
- a physician resigns from the medical staff of a hospital or restricts his or her practice within a hospital during or as a result of an investigation into the physician’s competence, negligence or conduct.56a
The administrator of the hospital involved must forward a detailed report to the CPSO.56b
The Vital Statistics Act requires the registration of all live births, still-births and deaths. The Coroners Act sets out the types of death that require physicians to notify a coroner or police officer.
Physicians attending the birth of a child must give notice of the birth within two business days to the Registrar General. The notice should be given in the form approved by the Registrar General.57
Physicians attending a still-birth must give notice of the still-birth within two business days to the Registrar General.58
Physicians must also complete a medical certificate of still-birth setting out the cause of the still-birth. The medical certificate of still-birth must be delivered to the funeral director in charge of the body for the purpose of burial, cremation or other disposition.59
Both the notice of still-birth and medical certificate of still-birth must be provided in the form approved by the Registrar General.60
If there is no physician in attendance at the still-birth, or there is reason to believe the still-birth has occurred as a result of negligence, malpractice, misconduct or under circumstances that require investigation, a coroner must complete the medical certificate.61
A physician who has been in attendance during the last illness of a deceased person, or who has sufficient knowledge of the last illness, must complete and sign a medical certificate of death in the form approved by the Registrar General. The certificate must state the cause of death according to the International Statistical Classification of Diseases and Related Health Problems, as published by the World Health Organization, and be delivered to the funeral director immediately.62
Notification of Coroner
Under the Coroners Act, physicians are required to immediately notify a coroner or police officer if there is reason to believe that an individual has died:
- as a result of violence, misadventure, negligence, misconduct or malpractice;
- by unfair means;
- during pregnancy or following pregnancy in circumstances that might be reasonably attributed to the pregnancy;
- suddenly and unexpectedly;
- from disease or sickness for which he or she was not treated by a legally qualified medical practitioner;
- from any cause other than disease; or
- under circumstances that may require investigation.63
Notifications must include the facts and circumstances relating to the death.
Physicians who are appointed as Coroners should consult the Coroners Act to understand their obligations, and may wish to contact the CMPA for legal advice.
Notification of Coroner of Death Resulting from Medical Assistance in Dying
Physicians who provide medical assistance in dying must report the medically assisted death to a coroner.63a While a coroner must be notified of all medically assisted deaths, an investigation will only take place if the coroner deems one to be necessary.63b
Physicians must provide the coroner with any information about the facts and circumstances relating to the medically assisted death that the coroner considers necessary to form an opinion as to whether the death ought to be investigated.63c In practice, the College understands that physicians would typically fulfill this reporting obligation by contacting the coroner and submitting the section(s) of the patient’s medical record that pertains to the medically assisted death.63d Please see the College’s Medical Assistance in Dying policy for details on medical record keeping requirements in the medical assistance in dying context.
Under the Health Protection and Promotion Act (HPPA),physicians are required to report when, in the course of providing professional services, they have formed the opinion that an individual,
- has or may have a reportable disease64 and is not a patient in or an out-patient of a hospital;65
- is or may be infected with an agent of a communicable disease;66
- is under the care and treatment of the physician for a communicable disease, but refuses treatment, or neglects to continue treatment in a manner and to a degree that is satisfactory to the physician.67
Reports should be made as soon as possible to the Medical Officer of Health of the health unit in which the professional services were provided.
Reports made in relation to reportable or communicable diseases must contain the following information about the individual involved:
- name and address in full;
- date of birth in full;
- sex; and
- date of onset of symptoms.68
Where a patient is infected with an agent of AIDS, and the test was conducted in a designated clinic, physicians are exempt from reporting the patient’s name and address if, before the test was ordered, the patient received counselling about preventing the transmission of HIV infection.69 Despite this specified exemption, all other required information must be included in the report.
Reports made regarding the refusal of treatment for a communicable disease, or the neglect to continue with treatment for a communicable disease to the satisfaction of the physician, must contain the name and address of the individual.70
Reports regarding certain reportable or communicable diseases require the reporting physician to include additional information in the report. Physicians are advised to consult the Reports Regulations for further details on reporting requirements for specified communicable and reportable diseases. Furthermore, upon request of the Medical Officer of Health, physicians are required to provide additional information regarding the reportable or communicable disease, as the Medical Officer of Health deems necessary.71
Duty to Report death due to reportable disease
Any physician who signs a death certificate indicating that the cause of death of an individual was a reportable disease, or that a reportable disease was a contributing cause of death, must report this to the Medical Officer of Health for the health unit in which the death occurred. The report must be made as soon as possible after signing the certificate.72
Eyes of New-Born
When a physician attends the birth of a child and is aware that an eye of the new-born child has become reddened, inflamed or swollen, the physician must make a written report to the Medical Officer of Health within two weeks of the child’s birth.
The report must include the name, age, and home address of the child, the whereabouts of the child (if not at home), and the conditions of the eye that the physician has observed.73
Physicians who have information about an animal bite or animal contact that may result in rabies in persons, must as soon as possible notify the Medical Officer of Health and provide the Medical Officer of Health with the required information.74
Reactions to Immunizations
Under the HPPA, physicians must report when they recognize the presence of a reportable event while providing professional services to a person, and are of the opinion that the reportable event may be related to the administration of an immunizing agent.75
The HPPA defines a reportable event in relation to an immunizing agent as:
- persistent crying or screaming, anaphylaxis or anaphylactic shock occurring within 48 hours of being immunized;
- shock-like collapse, high fever or convulsions occurring within three days of being immunized;
- arthritis occurring within 42 days of being immunized;
- generalized urticarial, residual seizure disorder, encephalopathy, encephalitis, or any other significant occurrence occurring within 15 days of being immunized; or
- death occurring at any time and following upon a symptom as described above.76
Physicians are required to report the reportable event to the Medical Officer of Health of the health unit in which the professional services were provided within seven days.77
When a physician discovers or is informed that a controlled substance (including a targeted substance,78 a narcotic,79 or a controlled drug80) has been lost or stolen from their office, the physician must report the loss or theft to the Office of Controlled Substances, Federal Minister of Health, within 10 days.81
Physicians involved in the care of mentally ill patients who are following community treatment plans, have specific reporting duties under the Mental Health Act, and its regulations.82 These obligations include providing the police with information pertinent to the community treatment plan.
Where a physician issues an order for examination,83 the physician must ensure that the police have complete and up-to-date contact information of the physician responsible for completing the examination (including name, address and telephone number), and are informed immediately if the patient attends the examination or if the order is revoked for any other reason before it expires.84
Every facility that treats a person for a gunshot wound must disclose to local police services the following:
- the fact that a person is being treated for a gunshot wound;
- the person’s name, if known; and
- the name and location of the facility.85
The disclosure must be made orally, and as soon as it is reasonably practical to do so, without interfering with the person’s treatment or disrupting the regular activities of the facility. Facilities charged with this obligation are public hospitals, and prescribed organizations or institutions that provide health care services.86
The Aeronautics Act requires physicians to report patients they believe, on reasonable grounds, to be a flight crew member, an air traffic controller, or to hold a Canadian aviation document that imposes standards of medical or optometric fitness, where the physician is of the opinion that the patient has a medical or optometric condition that is likely to constitute a hazard to aviation safety.87
Physicians are required to direct the report to a medical advisor designated by the federal Ministry of Transportation, or to a medical advisor designated by the federal Minister of National Defence, if the report relates to a matter of defence.88 Reports should include the physician’s opinion regarding the patient’s condition, and the information upon which the opinion is based.89
Generally, physicians will not be subject to legal, disciplinary or other proceedings for complying, in good faith with reporting obligations under the Aeronautics Act.90
The Railway Safety Act requires physicians to notify the railway company’s Chief Medical Officer when they believe on reasonable grounds that a patient, occupying a position that is critical to railway safety,91 has a condition that is likely to pose a threat to safe railway operations.92
Physicians must first take reasonable steps to notify the patient, prior to sending a notice to the railway company’s Chief Medical Officer. Notifications, which are to be made without delay, must indicate the physician’s opinion regarding the condition, and the information upon which the opinion is based.
Physicians must also provide the patient with a copy of the notice.93
Physicians are generally protected from legal, disciplinary or other proceedings for complying, in good faith with reporting obligations under the Railway Safety Act.94
The Canada Shipping Act requires physicians to inform the Ministry of Transportation without delay if they believe on reasonable grounds that the holder of a certificate issued under the Act has a medical or optometric condition that is likely to constitute a hazard to maritime safety. Reports should include the physician’s opinion regarding the patient’s condition, and the information upon which the opinion is based.95
Physicians are generally protected from legal, disciplinary or other proceedings for complying in good faith with reporting obligations under the Canada Shipping Act.96
The Occupational Health and Safety Act and the Regulations enacted under this statute specify a number of reporting requirements for physicians who conduct medical examinations on individuals in relation to employment conditions or hazards.97 Physicians conducting such examinations should consult the legislation to understand their obligations and may wish to contact the CMPA for legal advice.
Physicians who are treating or attending to inmates at a provincial correctional facility are required to immediately report to the Superintendent of the facility when an inmate is seriously ill, injured, or unable to work due to illness or disability.98 Reports regarding injuries must be made in writing, and include the nature of the injury and the treatment provided. Reports regarding illness or disability must include, where applicable, whether the inmate is unfit to work or the work should be changed.99
Physicians who are of the opinion that a detainee is infected or may be infected with an agent of a communicable disease, must immediately notify the Medical Officer of Health of the health unit in which the institution is located.100
There may be occasions where physicians will be required, by court order, to report the results of a medical and/or psychological assessment of a young person to the court. Physicians are advised to consult the Youth Criminal Justice Act101 for further details, and may wish to contact the CMPA for legal advice.
When, in the course of professional duties, a physician has reason to believe that a person (either another physician or an individual) or entity has paid or conferred a benefit, or charged or accepted payment of a benefit in exchange for improved access to an insured health service, the physician must report the matter to the General Manager of the Ontario Health Insurance Plan.102
Physicians are generally protected by law from any retaliation or legal, disciplinary or other proceedings associated with making a report, as long as the physician has not acted maliciously and the information provided is true.103
Under the Health Insurance Act, physicians are required to report instances of health card fraud. The following situations are examples of health card fraud:
- An ineligible person104 receives or attempts to receive an insured service as if he or she were an insured person.
- An ineligible person obtains or attempts to obtain reimbursement by the Ontario Health Insurance Plan (OHIP) for money paid for an insured service as if he or she were an insured person.
- An ineligible person, in an application, return or statement made to OHIP or the General Manager, gives false information about his or her residency.105
Reports must be made promptly to the General Manager of OHIP.106
Physicians are generally protected from legal, disciplinary, or other proceedings for complying in good faith with reporting obligations under the Health Insurance Act, as long as the physician has not acted maliciously and the information on which the report is based is true.107
In this section, the term “privacy breach” is used to refer to any unauthorized collection, use, disclosure, retention or disposal of personal health information.107a The Personal Health Information Protection Act, 2004 (PHIPA) requires reporting of privacy breaches in a number of instances. Those duties pertinent to physicians are set out below.
A) Reporting to Affected Individuals
Physicians acting as health information custodians (HICs) are required to notify individuals where their personal health information is stolen, lost or used or disclosed without authority.107b
Notification must be made at the first reasonable opportunity and must include both the fact of the privacy breach and a statement that the individual is entitled to make a complaint to the Information and Privacy Commissioner (“IPC”).107c, 107d
In addition, the IPC’s Privacy Breach Protocol advises that the following information be disclosed to affected individuals:
- details of the breach, including the extent of the breach and what personal health information was involved;
- the steps the physician has taken to address the breach, including if the breach has been reported to the IPC; and
- contact information for someone within the organization who can provide additional information, assistance and answer questions.
The IPC advises that when determining the most appropriate form of notification (i.e., by telephone, in writing, or in person at the next appointment) physicians consider factors such as the sensitivity of the personal health information.107e
For more information about obligations in the event of a privacy breach, physicians are advised to contact the IPC directly and/or refer to the IPC’s guidance documents (i.e., Privacy Breach Protocol and What to do when faced with a privacy breach: Guidelines for the health sector).
B) Reporting to Regulatory Colleges
Physicians acting as HICs, who employ, extend privileges to, or are otherwise affiliated with physicians or other regulated health professionals (referred to below as “regulated professionals”)107f are required to notify the relevant regulatory body (such as the CPSO) if any of the following events occur:
- The regulated professional’s employment is terminated or suspended, or the regulated professional is subject to disciplinary action, as a result of a privacy breach by the regulated professional;107g
- The regulated professional resigns, and the HIC has reasonable grounds to believe that the resignation is related to an investigation or other action by the HIC with respect to an alleged privacy breach by the regulated professional;107h
- The regulated professional’s privileges or affiliation with the HIC are revoked, suspended or restricted as a result of a privacy breach by the regulated professional;107i
- The regulated professional relinquishes or voluntarily restricts his or her privileges or affiliation with the HIC, and the HIC has reasonable grounds to believe that the relinquishment or restriction is related to an investigation or other action by the HIC with respect to an alleged privacy breach by the regulated professional.107j, 107k
Physicians acting as HICs must give written notice of any of the events described above to the appropriate college within 30 days of the event occurring.107l
C) Reporting to Information and Privacy Commissioner
If an individual’s personal health information is stolen, lost or used or disclosed without authority, physicians acting as HICs must notify the IPC in certain circumstances. If at least one of the following situations applies, the HIC must notify the IPC:107m
- The HIC has reasonable grounds to believe that personal health information in their custody or control was used or disclosed without authority by a person who knew or ought to have known that they did not have authority to use or disclose the information.107n
- The HIC has reasonable grounds to believe that personal health information in their custody or control was stolen.107o
- The HIC has reasonable grounds to believe that, after an initial loss or unauthorized use or disclosure of personal health information in their custody or control, the personal health information was or will be further used or disclosed without authority.107p
- The loss or unauthorized use or disclosure of personal health information is part of a pattern of similar losses or unauthorized uses or disclosures of personal health information in the custody or control of the HIC.107q
- The HIC is required to notify a college regarding the employment, privileges or affiliation of a regulated professional (as outlined above), in circumstances involving the loss or unauthorized use or disclosure of personal health information.107r
- The HIC would be required to notify a college regarding the employment, privileges or affiliation of an agent (a person who acts for or on behalf of the custodian)107s if the agent were a regulated professional, in circumstances involving the loss or unauthorized use or disclosure of personal health information.107t
- The HIC determines that the loss or unauthorized use or disclosure of personal health information is significant.107u When determining whether a breach is significant, consideration must be given to all relevant circumstances, including the following:
- Whether the personal health information that was lost or used or disclosed without authority is sensitive;107v
- Whether the loss or unauthorized use or disclosure involved a large volume of personal health information;107w
- Whether the loss or unauthorized use or disclosure involved many individuals’ personal health information;107x and
- Whether more than one health information custodian or agent was responsible for the loss or unauthorized use or disclosure of the personal health information.107y
Physicians are encouraged to contact the IPC for advice regarding reporting and/or consult the IPC’s document Reporting a Privacy Breach to the Commissioner.
Tracking Breaches and Annual Reports
Starting in 2019, physicians and others acting as HICs are required to provide the IPC with an annual report setting out the number of times in the previous calendar year that personal health information in the HIC’s custody or control was stolen, lost, or used or disclosed without authority.107z Reports must be submitted on or before March 1st each year, and are required to be transmitted to the IPC by the electronic means and format determined by the Commissioner.107aa
The IPC has advised that in order to comply with this requirement HICs, including physicians, will be required to start tracking privacy breach statistics as of January 1, 2018.107bb Physicians with questions about tracking are advised to contact the IPC directly for guidance.
Physicians are advised that maximum fines for individuals and organizations who are found guilty of an offence under PHIPA are $100,000 and $500,000 respectively.107cc
B. Permissive Reports
There are circumstances where the disclosure of personal information is permitted by law or based in professionalism and ethics. Physicians hold discretionary power in this regard, and are expected to rely upon their professional judgment when assessing the appropriateness of disclosing such information.
Listed below are two instances in particular where reports by physicians are permissible and where the College would urge physicians to seriously consider their professional and ethical obligations to report. For details on additional permissible disclosures available under the Personal Health Information Protection Act, 2004 physicians are encouraged to review the College’s policy on Confidentiality of Personal Health Information.
Physicians are expected to rely upon their professional judgment when disclosing personal information, and are advised to contact the College’s Physician Advisory Service, their lawyer, the CMPA, or the Information and Privacy Commissioner of Ontario if they are uncertain whether disclosure is appropriate.
1. Disclosure to Prevent Harm
The Personal Health Information Protection Act, 2004 (PHIPA) permits the disclosure of personal health information to prevent harm where certain criteria are met. Additionally, there are court decisions that set out separate and distinct criteria for disclosure by physicians where there is an imminent risk of serious bodily harm or death.
Under PHIPA, physicians are permitted to disclose personal health information about an individual if they have reasonable grounds to believe disclosure is necessary to eliminate or reduce significant risk of serious bodily harm to a person or group of persons.108 There are no restrictions on the types of persons to whom the information may be disclosed.
The courts have set out circumstances in which concern for public safety may warrant the disclosure of confidential information to reduce or eliminate risk of harm. The factors for consideration are as follows:
- there is a clear risk to an identifiable person or a group of persons;
- there is a risk of serious bodily harm or death; and
- the danger is imminent.109
Reports should include only the information necessary to prevent harm to others.
2. Physician Incapacity and Incompetence
The College’s expectations with respect to physician incapacity110 and incompetence111 are based in professionalism and ethics. They are distinct from the legal obligation contained in the Health Professions Procedural Code, which requires health facility operators to report incapacity and incompetence. The reporting duty for facility operators is discussed in section 5 of this policy.
Physicians are expected to take appropriate and timely action when they have reasonable grounds to believe that another physician or health-care professional is incapacitated or incompetent. This includes circumstances where a colleague’s pattern of care, health or behaviour poses a risk to patient safety.
Appropriate action may include, depending on the circumstances, contacting the Physician Health Program at the Ontario Medical Association, the College’s Physician Advisory Service, the individual’s friends and family and/or employer. In a hospital setting, appropriate action may involve notifying the individual to whom the physician is accountable.
2. The Ontario Ministry of Children and Youth Services, which administers the CFSA, has defined “reasonable grounds” in this context as the information that an average person, using normal and honest judgment, would need in order to decide to report. Government of Ontario, Reporting Child Abuse and Neglect (Ontario: Ministry of Children and Youth Services, 2010).
iv. self-destructive or aggressive behaviour, or
v. delayed development.
23. The Canadian Medical Association publishes a “Driver’s Guide” to help physicians determine whether their patients are medically fit to drive a motor vehicle safely. The guide is available from the Canadian Medical Association.
24. Section 203(1) of the Highway Traffic Act; The Medical Condition Report form is available for medical practitioners, including physicians, to use when reporting a patient. This form is available on the Ministry of Transportation’s website.
25. Section 14 (1) of Drivers’ Licences, O. Reg.340/94 enacted under the Highway Traffic Act (hereinafter Highway Traffic Act, Drivers’ Licences Regulation); The national medical standards are those published by the Canadian Council of Motor Transport Administrators (CCMTA), and are referenced in Section 14(2) of the Highway Traffic Act, Drivers’ Licences Regulation.
27. Section 1 of the Long-Term Care Homes Act, 2007, S.O. 2007, c.8 (hereinafter Long-Term Care Homes Act); Section 1 of the Retirement Homes Act, 2010, S.O. 2010, c.11 (hereinafter Retirement Homes Act).
29. Section 2(1) of the Long-Term Care Homes Act defines ‘licensee’ as the holder of a licence issued under the Long-Term Care Homes Act, and includes the municipality or municipalities or board of management that maintains a provincially approved municipal home, joint home or First Nations home.
32. Section 1(3) of the Health Professions Procedural Code, Schedule 2 of the Regulated Health Professions Act, 1991, S.O. 1001, c.18 (hereinafter HPPC), defines sexual abuse of a patient by a member as: (a) sexual intercourse or other forms of physical sexual relations between the member and the patient (b) touching, of a sexual nature, of the patient by the member, or (c) behaviour or remarks of a sexual nature by the member towards the patient.
40. The terms ‘facility’ and ‘facility operator’ are not defined in the RHPA or the HPPC. For the purposes of providing guidance to the profession, the CPSO relies on the definition of “health facility” contained in the Independent Health Facilities Act, R.S.O. 1990, c.I.3, as a working definition. The Independent Health Facilities Act (IHFA)defines “health facility” as a place in which one or more members of the public receive health services and includes an independent health facility (s.1(1) IHFA).
41. Section 52(1) of the HPPC states that a panel shall find a member to be incompetent if the member’s professional care of a patient displayed a lack of knowledge, skill or judgment of a nature or to an extent that demonstrates that the member is unfit to continue to practise or that the member’s practice should be restricted.
42. Section 1(1) of the HPPC states that “incapacitated” means, in relation to a member, that the member is suffering from a physical or mental condition or disorder that makes it desirable in the interest of the public that the member’s certificate of registration be subject to terms, conditions or limitations, or that the member no longer be permitted to practise.
(a) the member has been found guilty of an offence that is relevant to the member’s suitability to practise;
(b) the governing body of a health profession in a jurisdiction other than Ontario has found that the member committed an act of professional misconduct that would, in the opinion of the panel, be an act of professional misconduct as defined in the regulations;
(b.0.1) the member has failed to co-operate with the Quality Assurance Committee or any assessor appointed by that committee;
(b.1) the member has sexually abused a patient; or
(c) the member has committed an act of professional misconduct as defined in the regulations.
49. Please see footnote 41 for definition of incompetence.
50. Please see footnote 42 for definition of incapacity.
57. Section 8 of the Vital Statistics Act, R.S.O. 1990, c. V.4 (hereinafter Vital Statistics Act); Section 1(2) and (3) of General, R.R.O. 1990, Regulation 1094 enacted under the Vital Statistics Act (hereinafter Vital Statistics Act, General Regulation).
63d. Following the provision of medical assistance in dying, the physician must notify a coroner by contacting provincial dispatch. Provincial dispatch will then contact the on-duty member of the Coroner’s MAID Review Team, who will obtain information from the reporting physician regarding the facts and circumstances relating to the death. Documentation pertaining to the medically assisted death is to be faxed, as soon as is reasonably possible, to the MAID review team at 416-848-7791.
64. A list of reportable diseases is contained in the Specification of Reportable Diseases Regulation, O. Reg 559/91 enacted under the Health Protection and Promotion Act, R.S.O. 1990, c. H.7 (hereinafter HPPA). A copy of this list can be obtained from the local Medical Officer of Health.
65. The reporting duty of hospital administrators arises if an entry in the hospital record states that a patient or an out-patient of the hospital has or may have a reportable disease, or may be infected with an agent of a communicable disease.
66. A list of communicable diseases is contained in the Specification of Communicable Diseases Regulation, O. Reg 558/91 enacted under the HPPA. A copy of this list can be obtained from the local Medical Officer of Health.
73. Section 33(1) of the HPPA; Section 1, paragraph 2 of Communicable Diseases – General, R.S.O. 1990, Regulation 557 enacted under the HPPA (hereinafter HPPA, Communicable Diseases – General Regulation).
75. Sections 38(1) and 38(3) of the HPPA; Section 38(1) of the HPPA defines an “immunizing agent” as a vaccine or combination of vaccines administered for immunization against diphtheria, tetanus, poliomyelitis, pertussis, measles, rubella, hepatitis B, rabies, Haemophilus influenza b infections, influenza, meningococcal-C, pneumococcal, varicella disease or a prescribed disease.
78. A list of targeted substances is contained in Schedule 2 of the Benzodiazepines and Other Targeted Substances Regulations, SOR/2000-217, enacted under the Controlled Drugs and Substances Act, S.C. 1996, c.19.
81. Sections 7(1) and 61(2) of the Benzodiazepines and Other Targeted Substances Regulations, enacted under the Controlled Drugs and Substances Act; Section 55(g) of the Narcotic Control Regulations, enacted under the Controlled Drugs and Substances Act; please also see CPSO policy titled Regulations Concerning Benzodiazepines and Other Targeted Substances.
82. Mental Health Act, R.S.O. 1990, c. M.7 (hereinafter Mental Health Act); General R.R.O. 1990, Reg. 741, enacted under the Mental Health Act, R.S.O. 1990, c. M.7 (hereinafter Mental Health Act Regulations).
83. Sections 33.3(1) and 33.4(3) of the Mental Health Act provide that physicians may issue an order for examination if they have reason to believe that the patient is not attending appointments, or is otherwise failing to comply with his or her treatment plan, or the patient (or substitute decision maker) withdraws consent for the treatment plan and refuses to allow the physician to review his or her condition. Section 33.5 of the Mental Health Act provides that physicians who issue or renew a community treatment order are responsible for the general supervision and management of the order.
87. Sections 3 and 6.5(1) of the Aeronautics Act, R.S.C. 1985, c. A.2 (hereinafter Aeronautics Act); further information on medical conditions of interest and reporting procedures can be found on the Transport Canada website, or by contacting the local Civil Aviation Medicine office.
88. Section 6.5(1) of the Aeronautics Act; Under Section 3 of Aeronautics Act, a matter relating to defence includes any matter relating to military personnel or a military aircraft, military aerodrome, or military facility of Canada or a foreign state.
91. Under Section 35(3) of the Railway Safety Act, R.S.C. 1985, c. 32 (hereinafter Railway Safety Act), at the time of any examination, patients must inform the physician if they hold a safety critical position.
92. Section 35(2) of the Railway Safety Act, R.S.C. 1985, c. 32 (hereinafter Railway Safety Act);Transport Canada has published a document titled Railway Medical Rules. This document, which is available on the Transport Canada website, provides guidance for physicians who examine patients in positions that are critical to railway safety.
95. Section 90(1) of the Canada Shipping Act, 2001, S.C. 2001, c.26 (hereinafter Canada Shipping Act); visit the Transport Canada website, or contact the Marine Medicine office by phone for additional information on medical conditions of interest and reporting procedures.
102. Sections 17(1) and 17(2) of the Commitment to the Future of Medicare Act, 2004, S.O. 2004, c.5; Section 7(1) of General Regulations, O. Reg. 288/04, enacted under the Commitment to the Future of Medicare Act, 2004, S.O. 2004, c.5.
104. Section 43.1(3) of the Health Insurance Act, R.S.O. 1990, c. H.6 (hereinafter Health Insurance Act), defines an “ineligible person” as a person who is neither an insured person nor entitled to become one.
106. Section 43.1(1) of the Health Insurance Act; Sections 43.1(5) and 43.1(6) of the Health Insurance Act provide that physicians may also make a voluntary report relating to the administration of the Act even if the information reported is confidential or privileged and despite any Act, regulation or other law prohibiting disclosure of the information.
107a. The definition of personal health information is set out in Section 4(1) of the Personal Health Information Protection Act, 2004, S.O. 2004, c. 3, Sched. A (hereinafter “PHIPA”) as well as in the College’s Confidentiality of Personal Health Information policy.
107d. Section 12(4) of PHIPA provides for an exception to this notification requirement if the HIC is a researcher and specific conditions are met. Further exceptions may be established by regulation, however no such regulations are currently in force.
107e. IPC’s Privacy Breach Protocol.
110. Please see footnote 42 for definition of incapacity.
111. Please see footnote 41 for definition of incompetence.