Releasing Personal Health Information

April 20, 2020: Important update regarding the novel coronavirus (COVID-19) pandemic

Under the Health Promotion and Protection Act, registrants who form the opinion that a patient has or may have COVID-19 must report this information to their region’s public health unit or medical officer of health as soon as possible.

Refer to Did You Know? Pharmacy Professionals and Public Health Reporting (PC Spring 2019) and COVID-19: Information for Pharmacy Professionals for more information.



Published: November 2013
Revised: July 2019

Legislative References:
Additional References:

College Contact: Pharmacy Practice


All regulated health professionals are legally and ethically obligated to protect the confidentiality of a patient’s personal health information. As health information custodians, registrants of the Ontario College of Pharmacists, including pharmacists, registered pharmacy students, interns and pharmacy technicians, have a responsibility to collect, disclose and dispose of personal health information according to the rules established in the Personal Health Information Protection Act, and to ensure that information is protected against theft, loss, and unauthorized use or disclosure. Except in specified circumstances, personal health information cannot be shared without the express consent of the person to whom it relates.

Personal Health Information Protection Act (PHIPA)

Disclosures Permitted

1. For the purpose of determining eligibility of the person to receive health care and related goods, services or benefits (PHIPA [s.39(1)(a)])

Where a pharmacist is disclosing personal health information to a third party who is being asked to provide payment for medication or related goods or services.(1)

2. To a person who compiles or maintains a registry of personal health information for purposes of facilitating or improving the provision of health care (PHIPA [s.39(1)(c)])

The Narcotics Safety and Awareness Act, 2010 permits the Ontario Ministry of Health and Long-Term Care to collect, use and disclose information, including personal information and personal health information that relates to the prescribing and dispensing of prescription narcotics and other monitored drugs. The legislation requires prescribers, dispensers and pharmacy operators to disclose information related to prescriptions to the Minister or executive officer.

3. To another College for the purpose of administration or enforcement of the Drug and Pharmacies Regulation Act, the Regulated Health Professions Act, 1991, or an Act named in Schedule 1 of that Act (PHIPA [s.43(1)(b)])

Circle of Care

Personal health information can be shared without express consent when it is shared between health information custodians who are providing health care to the same individual.(2) In this situation, the health providers are entitled to assume an individual’s implied consent to disclose personal health information for the purpose of providing health care.(3) A pharmacist and all other regulated health professionals providing care to the same patient are within the circle of care and can therefore exchange information quickly and efficiently to facilitate treatment.

Disclosures in specific circumstances

1. Disclosure to Police

    A health information custodian is not free to disclose personal health information about an individual without the express consent of the individual, or incapable individual’s substitute decision maker, or as required or permitted by law, for example, pursuant to a warrant or court order (PHIPPA [s.43(1)]).

Information may only be disclosed when the health professional is presented with a warrant, court order, production order, or under authority established in legislation, for example, the Coroners Act and the Missing Persons Act.

In the case of a missing person, if the pharmacist is satisfied that there are reasonable grounds for an officer’s request for personal health information, a pharmacist may disclose a patient’s information after receiving a written request from the officer (Missing Persons Act [s.5(1)]).

2. Disclosure to a parent / Cardholder of a Prescription Drug Plan

Ontario does not specify an age of consent with respect to the release of personal health information. A young person has the right to make his or her own decisions about the collection, use or disclosure of personal health information. If a child under the age of 16 has given his or her own consent under the Health Care Consent Act to treatment, or participated in counselling under the Child and Family Services Act, any decisions related to releasing information are the child’s to make. If there is a conflict between a parent and the capable child who is under 16, the decision of the child overrides that of the parent.(4) Where the cardholder of a prescription drug plan wants to know the details of drug usage by a family member covered under the plan, the family member who is not the cardholder would need to give permission or sign a consent form for the release of their own personal health information.


1. Information and Privacy Commissioner/Ontario. A Guide to the Personal Health Information Protection Act, December 2004. Retrieved at

2. Information and Privacy Commissioner/Ontario. Dispelling the Myths Under the Personal Health Information Protection Act; September 2012. Retrieved at

3. Information and Privacy Commissioner/Ontario. Circle of Care: Sharing Personal Health Information for Health-Care Purposes. Retrieved at

4. Information and Privacy Commissioner/Ontario. Commissioner’s PHIPA Highlights, March 2005. Retrieved at: