Model Guidelines for Pharmacists to Comply with Provincial Privacy Legislation

Pharmacists have an ethical obligation to protect the patient's right of confidentiality and provincial pharmacy regulatory authorities have developed policies or legislative instruments to guide the pharmacist in meeting this obligation. Because of public concerns that individuals' privacy may be violated when technologies such as computer networks, are used to collect, store, use or transmit personal information, provincial governments are implementing privacy legislation to protect personal information. During the course of practice, pharmacists acquire medication and other medical and personal information about their patients. When legislation is directed towards individual health information, pharmacists then have both ethical and legal obligations to respect the confidential nature of their patients' personal health information and protect the privacy of the individual.

The twelve "Guiding Principles" listed below were developed by the Pharmacy Registrars to form the basis of Pharmacists' Operational Guidelines. The Guidelines were endorsed by NAPRA on April 21, 2001 to provide member regulatory bodies with assistance in helping pharmacists meet these legal and ethical obligations.

Guiding Principles to Protect the Patient's Right to Confidentiality

1. Health related information about an individual (personal health information) belongs to the patient, but the electronic and paper records that carry this information are the property of the pharmacy. Such records include but are not limited to, prescriptions, patient profiles and reports, which contain information that identifies an individual with a pharmacy service.
2. The pharmacist has a duty to inform the patient of the anticipated use (other than internal) or disclosure of personal health information collected.
3. The pharmacist can only use or disclose personal health information with the consent of the patient. Consent can either be explicit, or inferred if the pharmacist has fulfilled the duty to inform and has sufficient reason to believe that the patient would consent under the circumstances. Exceptions include preventing harm to the patient or if it is in the patient's best interests (where lawful authority exists) or for any other purpose such as research or education when the identity of the patient is concealed.
4. The pharmacist may collect and use personal health information only for the purposes of providing pharmacy services.
5. The pharmacist may disclose personal health information only to those who have a legitimate need for that information.
6. The patient can revoke consent at any time, but such revocation is not retroactive.
7. Consent or revocation can be given verbally or in writing. When consent is given verbally, the pharmacist must document the direction especially when it relates to sensitive or potentially controversial information.
8. Upon request of the patient, the pharmacist is obliged to allow the patient to inspect records carrying personal health information and provide a copy. Where the patient requests an amendment, the pharmacist shall document the amendment in the person's record.
9. Where others such as pharmacy employees or information managers have access to personal health information collected and stored by the pharmacist, the pharmacist shall ensure that policies or formal agreements (where needed), exist to protect the information.
10. The pharmacist shall establish policies governing the retention, security and destruction of personal health information to maintain patient confidentiality and privacy.
11. Before using or disclosing personal health information, the pharmacist must take reasonable steps to ensure that the information is accurate, complete and not misleading.
12. Lawful agents (such as guardians or executors of estates) can exercise the rights of individuals.

Operational Guidelines for Pharmacists - Disclosure

Due to ethical and legal obligations, it is recognized that confidential personal health information must or in fact should, be disclosed in certain circumstances. Circumstances when confidential information may be disclosed to third parties include:

1. The patient consents to release of the information. Written consent from the patient should be obtained. At a minimum, the pharmacist should be satisfied that the patient has expressly permitted the release of the information sought. Otherwise, inferred consent as described in the guiding principles is sufficient.

2. Release of the information is necessary to comply with the law. For example:

• a police officer presents a warrant
• a pharmacist is served with a subpoena which requires delivery of documents containing the patient records
• release of the information is required by Rules of Court that relate to production of information in a lawsuit
• an inspector or investigator authorized under provincial pharmacy legislation to have access to the records makes a request to access the records
• an inspector authorized under The Controlled Drugs and Substances Act and/or The Food and Drugs Act to have access to the records makes a request to access the records pertaining to controlled drugs and substances or narcotic and controlled drugs

3. Police, other law enforcement agencies or officials, or provincial professional regulatory authorities request the information and the pharmacist deems it to be in the best interest of the public to provide such information.

4. Pharmacists and other health care professionals request the information for bona fide medical and/or pharmaceutical reasons where, in the judgement of the pharmacist it is prudent to provide this information in the interests of the patient:

• to protect the mental or physical health or safety of the patient, or
• for pharmacy information sharing networks (i.e. telephone fan-outs) to prevent the illegal or non-medical use of drugs

5. Release of the information to legal counsel is required for use in providing legal services to the provincial pharmacy regulatory authority and/or one or more of its members.

6. Pharmacists may disclose to a third party such as a commercial data compiler, prescription information including the identity of the prescriber, pharmacist and pharmacy, which does not and may not reasonably be expected to, identify the patient. This information is provided on the understanding that the third party will not disclose this information with respect to the prescriber, pharmacist and pharmacy except in an aggregate format (i.e., which does not disclose specific individual prescribing or dispensing information), without signed consent from the prescriber, pharmacist and pharmacy. The onus to obtain this consent is on the third party requesting such information.