When campus service providers help support students with complex mental health and/or addiction challenges, sensitive information is shared. As campus professionals, it is essential that we are committed to providing a safe environment that maintains students/clients rights to privacy and confidentiality.
Ontario has two privacy laws, Freedom of Information and Protection of Privacy Act (FIPPA, R.S.O. 1990) and the Personal Health Information and Protection Act (PHIPA, 2004) which stipulate how personal health information must be collected, used, maintained, disclosed, and disposed of. Ontario’s postsecondary institutes and campus frontline service providers are required to adhere to PHIPA and FIPPA legislation. The resource section includes detailed information about PHIPA and FIPPA legislation.
Here is a summary of the general principles that need to be adhered to by postsecondary institutes.
In compliance with PHIPA, frontline campus service providers must ensure that the student/client relationship as well as the student’s personal health information is kept confidential. Personal health information is defined as any identifying information about a client. It can be in verbal, written or in electronic format, and does not necessarily include the client’s name. If a client can be recognized, the information is considered personal health information; it includes information in the client health record. Information that does not allow the client to be identified is not personal health information, and is not subject to PHIPA.
Consent to the collection, use & disclosure of a student’s personal health information
Campus frontline service providers cannot collect or disclose any personal health information about a student/client without their written informed consent, except where disclosure is permitted or required by law. A student’s/client’s personal health information is legally required to be disclosed if any of the following limits to confidentiality are met:
Frontline service providers must explain to students/clients the principle of client confidentiality and the legal limits to confidentiality, as noted above. Campus services and frontline service providers are also responsible for maintaining client information in a secure manner, so that unauthorized individuals do not gain access to records.
The following confidentiality principles must also be discussed with the student/client and stipulated in the informed consent form.
Students may request access to their record, a copy of their record, or request that any errors contained in their record be corrected.
Student records will be kept for 10 years from the date of their last interaction with counselling, health and/or accessibility/disability services. After this period, student records will be destroyed in a secure manner.
Written or verbal consent must be obtained in order to collect or share personal health information.
Click HERE to view a sample form.
Note: This informed consent form is based on PHIPA and not the higher standards of confidentiality stipulated below by the College of Registered Psychotherapists of Ontario (CRPO).
The terms “circle of care” and “lock box” are based on PHIPA and are defined by the Office of the Information and Privacy Commissioner, Ontario. The circle of care includes other health professionals who provide care to a client, other providers in a multidisciplinary setting, and other providers to whom the Member has referred a client. PHIPA allows health providers to assume in certain circumstances that a client has provided implied consent to disclose his or her personal health information to another individual within the circle of care or to a specific health care provider.
Despite this generality, however, a client may indicate that s/he does not want certain information (or any information) shared, even within that circle. In this circumstance, the practitioner must not share the information. This is called placing information in a “lock box”
Despite PHIPA provisions the College of Registered Psychotherapists of Ontario (CRPO) requires members to obtain explicit informed consent from clients for the disclosure of any client information as well as requires higher standards of confidentiality than PHIPA requires. See Section 3.1 Confidentiality and Section 3.2 Consent for CRPO Standards.
Click here to view a sample interdepartmental release of information/consent form — word doc at
Under heading, Georgian College Release of info form