-
Review your organization's policies, procedures, or restrictions related to:
-
confidentiality
-
the collection, use, and disclosure of personal information and relevant consent
-
access to client records
-
storage, retention, transportation, and disposal of client records
-
how to contact the privacy officer
Collect only information that is necessary and appropriate for your client and recognize that confidentiality does not cease once the client is discharged or dies, but is indefinite.
-
Inform clients, preferably at the beginning of their care, about the limits of confidentiality, and to whom they can speak if they have questions.
-
Ensure that you have consent from the client (or substitute decision-maker) before sharing information about the client with another health care professional, when there is any uncertainty about whether they are a part of the client’s health care team. Follow your organizational policies, procedures, or restrictions on documenting consent and when determining with whom information can be shared.
Be aware that information gained about a client in one setting is not always transferable to a different setting without the client’s consent, unless there is specific legal authority to do so.
-
Know when, how, and what client information to share with health care professionals inside and outside your organization to enable continuity of care. Consider what information will be required for the delivery of safe and ethical care to the client.
-
When making decisions about disclosing confidential information without the client’s consent, consider the following:
-
Does a law require me to disclose this information?
-
Is disclosure without the client’s consent authorized by the BCCNM Bylaws (see section 354)?
-
Should I encourage and support the client to disclose the information before I do? What reason do I have for not doing so?
-
If I am concerned about the risk of harm to clients or others, can I justify the weight I have attached to both the magnitude and the probability of harm?
-
With whom am I permitted to discuss this issue?
-
If I believe compelling circumstances exist that affect anyone’s health or safety, who is the most appropriate person to receive this information? Do I have the authority to disclose this information or do I need to involve the designated individual in my organization?
-
Do I have enough information and the appropriate skills to act on my decision or do I need further advice or consultation?
-
Know who your client is and who has authority to consent on the client’s behalf (e.g., if they are a minor, or if there is a substitute decision-maker).
When a child who is deemed capable of making health care decisions has consented to health care, do not release health care information to others (including the parents) without the child’s consent, unless there is a legal obligation or compelling circumstances that affect the child’s health or safety. These issues can be complex and may require consultation with knowledgeable colleagues and, if applicable, your employer or privacy officer.
-
If you are concerned that a client poses a risk of harm to themselves or others, report it immediately to an appropriate person and follow any relevant organizational policies, procedures, or restrictions.
-
Know what to do if clients ask to look at their records or request a correction to their records. Organizational policies, procedures, or restrictions should provide clear direction. If they do not, speak to the privacy officer or health records manager in your organization.
-
If you are required by law to disclose a client’s personal health information, you must follow that law. Inform your employer, and seek advice from your insurer or legal counsel as appropriate.
-
Know and follow your organization’s policies and procedures for assessing and reporting situations in which you suspect abuse or neglect of children or adults. Decisions to report may not be straightforward. Consult with knowledgeable colleagues when possible. These situations may include:
-
When a child is in need of protection under the
Child, Family and Community Service Act.
-
When a vulnerable adult is in need of support and assistance under the
Adult Guardianship Act.
-
If you are engaged in research, understand and follow legislated requirements and use guidelines that address the ethical conduct of research to inform your practice.
-
In the event of a security breach, take appropriate measures to address the issue as soon as possible after the breach is discovered. Know what your organization’s policies, procedures, or restrictions state.
Intervene if others fail to maintain client confidentiality. Consider if the most appropriate action is for you to discuss your concerns directly with the person or to report it to someone senior in your organization. If your concerns are not addressed or if you decide it is not prudent to discuss your observations and concerns directly, use the reporting mechanisms in your workplace so others can take action.
-
Be aware of where you are and who is around when discussing confidential client information. Withholding the client’s name is often not enough to maintain confidentiality. Do not discuss client information in public areas.
Do not discuss clients or care-related events in online forums (e.g., social networking websites). Talking about care situations online may breach client confidentiality, even if the client’s name is not mentioned.
Be aware of your organization’s policies, procedures, or restrictions on the use of digital devices to collect or access personal information about a client. Doing so without consent or other legal authority may be a serious breach of privacy.
If you are documenting on a computer, always log off or lock the computer when you are finished to ensure that account access and confidential information remain secure.
For more information on this or any other practice issue, contact BCCNM’s Practice Support Services by e-mail at
practice@bccnm.ca or call 604.742.6200 or toll-free (Canada only) 1.866.880.7101.