Releasing Personal Health Information


Legislative References:

A fact sheet summarizes relevant legislation in one place and is not intended to be legal or practice advice. Registrants are reminded to refer to legislation for full context.

Additional References:

College Contact: Pharmacy Practice


All regulated health professionals are legally and ethically obligated to protect the confidentiality of a patient’s personal health information[1] (PHI). Pharmacists and pharmacies are considered health information custodians[2] under the Personal Health Information Protection Act (PHIPA), which governs how PHI is collected, used and disclosed. PHIPA establishes rules for electronic health records and practices to protect PHI against theft, loss, and unauthorized access. Patients also have the right to request access to, and correction of, their PHI under this Act.

Hospitals are also institutions under the province’s Freedom of Information and Protection of Privacy Act (FIPPA), which is beyond the scope of this Fact Sheet. Please contact the Privacy Coordinator/Officer at your organization for guidance on the release of personal information under FIPPA.


Substitute Decision Maker: Where the term “patient” or “individual” is used, this includes their substitute decision maker: a person authorized to consent to the collection, use or disclosure of PHI on their behalf. (PHIPA, s5)

Personal Health Information Protection Act (PHIPA)

PHIPA establishes the mandate of the Information and Privacy Commissioner of Ontario, who acts independently of government to protect and promote privacy rights in Ontario. Individuals have the right to file a privacy complaint with the IPC if they believe their information has been improperly disclosed.

Consent (PHIPA, Part III)

Except in specified circumstances, PHI cannot be collected, used or disclosed without the consent of the person to whom it relates. PHIPA sets out circumstances when health information custodians can rely on implied consent and when express consent is required.

Express consent may be obtained in writing, or obtained verbally and documented; in either case, consent must be knowledgeable.

The Circle of Care[3]

Although not defined in PHIPA, the term “circle of care” is commonly used to describe the collection, use or disclosure of PHI, between health information custodians for the purpose of providing (or assisting in providing) health care to the same individual by assuming implied consent. The ability to assume implied consent within the circle of care enables pharmacy professionals to exchange PHI with other health care professionals in a timely manner to facilitate, and ensure continuity of, patient care.

Disclosures Permitted (PHIPA, Part IV)

Examples of disclosure of PHI by pharmacy professionals where express consent is not required:

  • For the purpose of determining eligibility of the person to receive (or to receive coverage for) health care and related goods, services or benefits (s 39(1)(a))
    • This includes medications publicly funded by the Government of Ontario or Canada and medications reimbursed by a private third party being asked to provide payment.
  • To a person who compiles or maintains a registry of personal health information for purposes of facilitating or improving the provision of health care (s 39(1)(c))
    • The Narcotics Safety and Awareness Act (NSAA) permits the Ontario Ministry of Health to collect, analyze and report on information related to the prescribing and dispensing of monitored drugs[4]. A dispenser or operator of a pharmacy shall disclose PHI as requested by the Minister for the purpose of this Act.
  • To another College for the purpose of administration or enforcement of the Drug and Pharmacies Regulation Act (DPRA), the Regulated Health Professions Act (RHPA) or another health discipline Act named in Schedule 1 of the RHPA (s 43(1)(b))
    • This includes attending a proceeding held before or under a College committee where a registrant has been issued a Summons to Witness.
Disclosures in specific circumstances

Disclosure to Law Enforcement

Personal health information cannot be disclosed to a person carrying out an inspection or investigation without the express consent of the individual, except in defined situations as required by law, such as:

  • To comply with a warrant, court order, summons, or order related to the production of information in a proceeding in which the registrant is, or is expected to be, a party or witness
  • For the purpose of facilitating an inspection or investigation or similar procedure under authority established in legislation (e.g., The Criminal Code (Canada), Coroners Act (Ontario), Missing Persons Act (Ontario), etc.)
    • In the case of a missing person, a patient’s PHI may be disclosed upon receiving a written request from the officer, if the registrant is satisfied that there are reasonable grounds for the request.

In urgent situations that do not allow the time to seek a warrant or court order, the registrant should ask the law enforcement agent to explain why it is not feasible to seek a court order, use their professional judgement, and document their rationale on the patient record.

Disclosure to a Parent / Cardholder of a Drug Plan

PHIPA does not specify an age of consent with respect to the collection, use or disclosure of PHI, which is dependent on the individual’s capacity to provide consent. A young person has the right to make their own decisions, unless the registrant has reasonable grounds to believe that the individual is incapable of consenting.

  • If a person under the age of 18 has given informed consent to treatment under the Health Care Consent Act, or participated in counselling under the Child, Youth and Family Services Act, they can make any decisions related to disclosure of their PHI.
    • If there is a conflict between a parent and the capable child, the decision of the child overrides that of the parent.
  • Where the cardholder of a drug plan requests information about drug usage by a family member covered under the plan, the family member needs to give express consent for the release of their PHI.

Disclosure to the Medical Officer of Health

Under the Health Promotion and Protection Act, registrants who form the opinion that a patient has, or may have, a disease of public health significance must report this information to their region’s public health unit or medical officer of health as soon as possible.

Support materials and contact information can be found via the Quick Links to the Office of the Information and Privacy Commissioner of Ontario (IPC) under Additional Resources.

Published: November 2013
Version #: 2.00
College Contact: Pharmacy Practice

Revision History


Version Date Action
1 November 2013 Published
1.1 July 2019 Addition of Missing Persons Act information.
2.0 July 2022 Reformatted and content updated


  1. Refer to PHIPA, s4
  2. Refer to PHIPA, s3
  3. Circle of Care: Sharing Personal Health Information for Health-Care Purposes
  4. “monitored drug” means a controlled substance as defined in the Controlled Drugs and Substances Act (CDSA) and any opioid that is not listed in the CDSA (O. Reg. 381/11)