ADVICE TO THE PROFESSION: REPORTING REQUIREMENTS

Physicians have legal and professional reporting requirements. The Reporting Requirements policy outlines the professional expectations the College of Physicians and Surgeons of Ontario (“CPSO”) has set. The Guide to Legal Reporting Requirements companion resource contains a non-exhaustive list of clinical conditions and events that physicians are legally required to report.

This document is intended to help physicians interpret and effectively discharge those reporting obligations and provide physicians with advice on how to address issues that may arise in practice.

General

What do I do if I have questions about my reporting requirements?

Physicians can contact the Canadian Medical Protective Association with any questions. Physicians may also wish to consult with the Office of the Information and Privacy Commissioner of Ontario, and/or CPSO’s Physician Advisory Service.

What will happen if my patient complains to CPSO about a report I made?

Physicians are generally protected from legal action and complaints that arise when complying with their reporting requirements in good faith.

What will happen if I do not comply with my reporting requirements?

Failing to comply with a reporting requirement may have serious repercussions and may amount to professional misconduct or professional negligence. 

What about my duty to maintain patient confidentiality?

As a general rule, personal health information cannot be disclosed without patient consent. However, this duty is not absolute and is overridden when there is a requirement to report, or a disclosure that is permitted by law, because a potential threat to public safety outweighs the need to preserve confidentiality. 

What details do I need to capture in the medical record when I make a report about a patient?

In general, documentation describing a report made about a patient will include:

• the rationale for the decision to report
• the date and time the report was made
• the person or agency to whom the report was made
• the information disclosed in the report that was made and
• if the report was discussed with the patient (and if the patient was not informed, the reasons for not informing them).

Many reports are made in writing (i.e., letter or form). Including a copy of the report in the patient’s medical record will often be sufficient to discharge this requirement, but physicians still need to ensure the record contains all the relevant details.

Where a report is not made in writing, it can be helpful to follow up on a verbal conversation by sending the other party a letter confirming what was discussed, and then including a copy of the letter in the patient’s medical record. 

The Canadian Medical Protective Association notes that physicians may wish to document their rationale for not reporting a patient in situations where they have considered whether a reporting requirement exists. If the situation relates to a non-patient (e.g., another regulated health professional), it may also be helpful to document the rationale for reporting or not reporting them in a personal and confidential file.

Can I disclose a patient’s personal health information (PHI) to the police?

Generally, physicians are not permitted to disclose PHI to the police (or any other third party) unless they have patient consent, or the disclosure is required by law. Disclosure required by law may include a legal requirement to report to the police under a legislation, a police request for information in the course of certain authorized investigations, or pursuant to a court order or warrant. Under section 40(1) of the Personal Health Information Protection Act, 2004,¹ physicians may also disclose PHI to the police without consent if they believe on reasonable grounds that the disclosure to the police is necessary for the purpose of eliminating or reducing a significant risk of serious bodily harm to a person or group of persons.

Absent patient consent, physicians will need to carefully consider any request for information and take steps to confirm that there is a lawful basis for disclosing PHI, which may include seeking advice from the Canadian Medical Protective Association (CMPA).²

What can I tell patients to best support them when I make a report?

It is important to explain anything the patient might find helpful, including:

• where a report is required by law, that the report must or had to be made, and that the reporting requirement overrides the duty of confidentiality
• the information that was or will be contained in the report and
• to whom the report was or will be made.

Being upfront and transparent about a report helps support and preserve a trusting physician-patient relationship. In addition, it may help avoid unnecessary complaints to CPSO and prevent patients from endangering themselves and others.

Timing and Notification of Reports

How and when do I notify patients of a reporting requirement?

While it is best practice to notify patients directly and in person, depending on the situation, it may be appropriate to inform the patient by telephone or in writing, or for a staff member or colleague to speak with the patient instead. In deciding how to notify patients of a duty to report, physicians will need to consider factors such as the immediacy of the risk and sensitivity of the personal health information involved.

Although it is ideal to notify patients before making a report, this may not always be possible. For example, a physician might notify a patient after making a report if the physician only realizes they must make a report after the patient leaves their office and the patient cannot be reached by telephone in a timely manner.

Importantly, it may not be appropriate to notify a patient of a report – either before or after it is made – where doing so would pose a genuine risk of harm to the physician or others, including staff, the patient, and the patient’s family members (e.g., where the physician is unable to have a discussion with the patient as a result of the patient’s abusive, erratic, and/or aggressive behaviour).

Specific Reporting Scenarios

Do I have a “duty to warn” if I suspect my patient is going to harm themselves or someone else? 

There is no mandatory legal “duty to warn” in Ontario. However, that does not mean that physicians cannot, or should not, take action when they believe that a patient may pose a danger to themselves or others. 

Section 40(1) of PHIPA³ allows physicians to disclose a patient’s personal health information (PHI) without consent if there is a significant risk of serious bodily harm to a person or group of persons, and the disclosure is necessary to eliminate or reduce the risk of harm. For example, as the Information and Privacy Commissioner (IPC) notes, a psychologist at a university could disclose a student’s PHI to the student’s family and physician if the psychologist believed it was necessary to reduce the risk of suicide.

As always, physicians will need to use their professional judgment to decide if disclosure without consent is required and share only the information necessary to address the risk of harm in such cases. The IPC also suggests documenting that PHI was shared.⁴ While there are no restrictions in PHIPA on the types of persons to whom the information may be disclosed, the disclosure must be made to someone who is in a position to reduce or eliminate the risk of harm.

Physicians are reminded that s. 40(1) of PHIPA does not apply in situations where the law already requires a physician to make a report (e.g. if the person who may be harmed is the patient’s child, a report to the Children’s Aid Society is required).

Am I required to report gunshot wounds?

According to the Mandatory Gunshot Wounds Reporting Act, 2005,⁵ every facility (e.g., a public hospital) that treats a person for a gunshot wound must report to the police.

While this requirement does not apply to physicians directly, physicians have a general professional duty to comply with their facilities’ policies, including policies that enable the facility to report gunshot wounds.

What do I tell individuals who have been affected by a privacy breach?

Among other things, the Information and Privacy Commissioner recommends disclosing:

• details of the breach, including the personal health information (PHI) involved
• the steps taken to address the breach, including if the breach was reported to the IPC, and
• contact information for a person in the organization who can address inquiries.

The IPC notes that there are many factors physicians may consider, such as the sensitivity of the PHI involved, when deciding how to notify a patient of a privacy breach (i.e., by telephone, in writing, or in person at the next appointment). 

What can I tell patients when reporting to the Ministry of Transportation (MTO)?

Recognizing how impactful a report to the MTO may be, it can be helpful to explain that:

• the law requires physicians to report to the MTO when a patient has certain conditions and/or impairments that make it dangerous for them to drive – even if the patient does not have a valid driver’s licence or says they will not drive. 
• These reports result in an automatic licence suspension. However, the patient has the right to appeal the suspension.

Physicians are also allowed to report other conditions that they believe might make it dangerous to drive, even if it involves disclosing confidential patient information. These reports do not always result in a licence suspension.⁶

Can I give personal health information (PHI) about a patient to the Children’s Aid Society (CAS) to assist in an investigation?

Yes. Both the Personal Health Information Protection Act, 2004,⁷ and Child, Youth and Family Services Act⁸ allow physicians to disclose PHI to help the CAS carry out its statutory functions. For more information, see: Yes, You Can. Dispelling the Myths About Sharing Information with Children’s Aid Societies.

What can I tell patients or caregivers when reporting to the Children’s Aid Society (CAS)?

Physicians can support patients by explaining, among other things:

• the threshold for reporting, which is based on a belief, not actual proof
• that they are legally required to report to the CAS once this threshold is met, and
• their role, which is to factually report their concerns to the CAS.

What can I do if I suspect a patient is a victim of elder abuse or intimate partner violence?

Physicians can support patients who may be experiencing elder abuse or intimate partner violence, by:

• talking to the patient and expressing concerns 
• helping the patient access local resources and available services
• supporting the patient with filing a report with the relevant authority, where appropriate
• encouraging the patient to develop a safety plan (e.g., compiling a list of emergency numbers, taking out money), and
• arranging for a follow-up appointment to monitor the patient’s situation and provide ongoing support.

Physicians are reminded that they cannot file a report without consent unless:

• they are legally required to report (i.e., a child, or a resident of a long-term care or retirement home, has experienced or is at risk of experiencing harm), or
• the patient is at significant risk of serious bodily harm, and disclosure is necessary to eliminate or reduce the risk of harm.⁹

Physicians may also find the following websites helpful:

• the Information and Privacy Commissioner has guidance to help health professionals make informed decisions about privacy in situations of intimate partner violence risk
• the Ministry of Children, Community and Social Services provides information and resources regarding intimate partner violence and elder abuse
• the Canadian Network for the Prevention of Elder Abuse and Elder Abuse Prevention Ontario both provide information about elder abuse

How do I take “appropriate and timely action” when I believe another physician or regulated health professional is incapacitated or incompetent?

When determining which action(s) are appropriate to take, it is important to choose action(s) that are proportionate to the risk, considering factors such as the regulated health professional’s level of awareness and insight, and whether there is a single concern or apparent pattern. Depending on the circumstances, “appropriate” action may include:

• facilitating the physician to contact the Physician Health Program (PHP) at the Ontario Medical Association
• contacting the Canadian Medical Protective Association (CMPA) for advice
• notifying the individual to whom the regulated health professional is accountable (e.g., a manager, employer, Medical Director, or Director of Care), or
• notifying the individual’s health regulatory college.

It can also be helpful to first have a conversation with the physician or regulated health professional directly, although this may not always be possible or appropriate.

In terms of taking “timely” action, what constitutes “timely” will depend on the circumstances, and the level of risk will guide how quickly the physician acts. For example, taking “timely” action may mean taking immediate action if another regulated health professional appears to be practising while under the influence of alcohol or drugs.

CPSO’s webpage on physician wellness has information on programs and resources that are available to support physicians struggling with their physical or mental health.