Privacy, Confidentiality & Documentation Standards
When campus service providers help support students with complex mental health and/or addiction challenges, sensitive information is shared. As campus professionals, it is essential that we are committed to providing a safe environment that maintains students/clients rights to privacy and confidentiality.
Ontario has two privacy laws, Freedom of Information and Protection of Privacy Act (FIPPA, R.S.O. 1990) and the Personal Health Information and Protection Act (PHIPA, 2004) which stipulate how personal health information must be collected, used, maintained, disclosed, and disposed of. Ontario’s postsecondary institutes and campus frontline service providers are required to adhere to PHIPA and FIPPA legislation. The resource section includes detailed information about PHIPA and FIPPA legislation.
Here is a summary of the general principles that need to be adhered to by postsecondary institutes.
In compliance with PHIPA, frontline campus service providers must ensure that the student/client relationship as well as the student’s personal health information is kept confidential. Personal health information is defined as any identifying information about a client. It can be in verbal, written or in electronic format, and does not necessarily include the client’s name. If a client can be recognized, the information is considered personal health information; it includes information in the client health record. Information that does not allow the client to be identified is not personal health information, and is not subject to PHIPA.
Consent to the collection, use & disclosure of a student’s personal health information
Campus frontline service providers cannot collect or disclose any personal health information about a student/client without their written informed consent, except where disclosure is permitted or required by law. A student’s/client’s personal health information is legally required to be disclosed if any of the following limits to confidentiality are met:
- If there is a clear and imminent risk of harm to self or others
- In a medical emergency
- When there are reasonable grounds to suspect that a child under the age of 16 is being abused or neglected
- When there are reasonable grounds to suspect sexual abuse by a regulated health professional
- In order to comply with a court order (subpoena, summons or warrant)
Frontline service providers must explain to students/clients the principle of client confidentiality and the legal limits to confidentiality, as noted above. Campus services and frontline service providers are also responsible for maintaining client information in a secure manner, so that unauthorized individuals do not gain access to records.
The following confidentiality principles must also be discussed with the student/client and stipulated in the informed consent form.
- Student access to their record and making amendments to their record:
Students may request access to their record, a copy of their record, or request that any errors contained in their record be corrected.
- Storage and Disposal of Records:
Student records will be kept for 10 years from the date of their last interaction with counselling, health and/or accessibility/disability services. After this period, student records will be destroyed in a secure manner.
Written or verbal consent must be obtained in order to collect or share personal health information.
Click HERE to view a sample form.
Note: This informed consent form is based on PHIPA and not the higher standards of confidentiality stipulated below by the College of Registered Psychotherapists of Ontario (CRPO).
- Release of client information: Circle of care and ‘lock box’ based on PHIPA
The terms “circle of care” and “lock box” are based on PHIPA and are defined by the Office of the Information and Privacy Commissioner, Ontario. The circle of care includes other health professionals who provide care to a client, other providers in a multidisciplinary setting, and other providers to whom the Member has referred a client. PHIPA allows health providers to assume in certain circumstances that a client has provided implied consent to disclose his or her personal health information to another individual within the circle of care or to a specific health care provider.
Despite this generality, however, a client may indicate that s/he does not want certain information (or any information) shared, even within that circle. In this circumstance, the practitioner must not share the information. This is called placing information in a “lock box”
Despite PHIPA provisions the College of Registered Psychotherapists of Ontario (CRPO) requires members to obtain explicit informed consent from clients for the disclosure of any client information as well as requires higher standards of confidentiality than PHIPA requires. See Section 3.1 Confidentiality and Section 3.2 Consent for CRPO Standards.
Release of Information Forms:
Click here to view a sample interdepartmental release of information/consent form — word doc at
Under heading, Georgian College Release of info form
- Click here to view a release of information form to a designated professional, agency, 3rd party (off campus)