I’m Kate Dewhirst.

My team and I write about legal issues affecting healthcare in Canada.

Kate Dewhirst Health Law - bringing the law to life. Meet Kate (in 13 seconds)

Health Privacy Update: Parents do not have a right of access to the information about them in their children’s health records

Posted by

Stay with me folks – it’s going to get bumpy. There are some important nuances to understand my headline and this case.

Here’s the new health privacy decision of the Information and Privacy Commissioner of Ontario #83.

This case echoes questions I am asked every week in my practice. It is important reading for any team that provides services to children and especially in cases where there are custody issues.

Background: A parent asked for access to his son’s records held by Algoma Family Services. His request was denied.

Algoma Family Services provides health treatment and counseling to children and young people. The son was capable of making his own treatment and privacy decisions and instructed Algoma Family Services not to share his health record with his biological father. The father appealed Algoma’s decision to the Information and Privacy Commissioner of Ontario (IPC).

The father claimed that his son’s health record included information about him and that he had a right of access to that information as a service recipient of Algoma Family Services. He wanted a copy of any record that had information observed about him, collected during clinical sessions about him, collected in professional meetings, collected collaterally, gathered from clinical tools and information shared to and by the Office of the Children’s Lawyer and the Children’s Aid Society about him. He specifically wanted a copy of the social worker’s notes including her personal views and opinions regarding her interactions with him or correspondence sent to her about him.

The IPC upheld Algoma Family Services’ decision not to provide access.

Reasons: Here are the important facts and decisions of the case:

  1. The father was not receiving services from Algoma Family Services. He was not himself a service recipient. Only the son was receiving services. The father was not involved in family counseling – where family members can be service recipients.
  2. The only record Algoma Family Services had was the son’s record. Any information about the father in the son’s record was the son’s personal health information – not the father’s. In this case, the record did not include information about the father’s physical or mental health. The father’s involvement was ancillary to providing care to the son.
  3. The son was capable of making his own information decisions as well as treatment and counseling decisions and he had expressly instructed Algoma Family Services not to share his information with his biological father.
  4. Algoma Family Services is not subject to freedom of information legislation – and the father had no right to access general records held by Algoma.

Lessons Learned: The facts of this case were important. Different facts might have resulted in an alternative outcome. This case explains a few key privacy principles that can be hard to digest – especially for family members:

  1. If they are capable, children can make their own privacy decisions. Almost no parent knows that. There is no magic age when children become capable of making their own privacy decisions. Instead, there is a capacity test. If a child is capable – the child decides how much information is shared with parents. If a capable child does not want a parent to have information – that instruction prevails.
  2. There is a nuance to point #1 above. If a capable child is under the age of 16, a custodial parent may also have access to and disclose information about treatment or counseling the child did not decide on their own (such as treatment or counseling as a baby or young child). That was not the case here. The father was not a custodial parent to the son. Also, the capable son did not want his father to have access in any event, so that permission would have been overridden in this case.
  3. Family history is a patient’s personal health information. Other people’s thoughts and opinions and observations about a patient – is the patient’s personal health information. Although not relevant to this case, it is possible that a child’s health record has parents’ personal health information in it. This can require a nuanced analysis. You may sometimes need legal advice to sort this through.
  4. It is possible for families to be patients or clients as a group. In this case, the father was not a client or service recipient. But in other cases of family therapy, the records may belong to all the family members as recipients of group family counseling. Be very careful to explain who is the client in any therapeutic relationship.

Bottom Line: Parents are not automatically entitled to view or have a copy of their children’s health information. If they are substitute decision makers for an incapable child – they have rights. If their child is capable – the child has rights. This can be difficult to navigate and can result in difficult conversations. It is helpful to have a brochure to explain privacy rights and children’s information to assist parents and other caregivers understand their rights and limits to those rights.

Want to read a summary of all the IPC’s health privacy decisions? I have summarized them all here.


If you enjoyed this article please share it:


Previous and next posts from Kate:

Some of Kate’s recent and upcoming events

Free healthcare privacy webinar - ask me anything!
the first Wednesday of every month

Free webinars - advance registration needed

Whether you're an experienced privacy officer or new in the field, pick Kate’s brain for free for an hour, in this live webinar. No charge, but you’ll need to register in advance.

Health Privacy Officer Foundations training
starts March 2024

For Privacy Officers within healthcare organizations.

This course focuses on how to become a more confident privacy officer and gives you the tools to document your privacy program. Full details and registration here...

Join the Shush: a collective of health privacy officers
Annual membership 2024

For Privacy Officers within healthcare organizations

This is an annual membership program that takes theory into practice and tackles real life scenarios to build Privacy Officer skills.
Full details and registration here.

Primary care webinars: Employment Law Update & Legal Issues for EDs and Board members

Part of Kate’s monthly webinar series.

Our 2024 program is now live.
Full details of the 2024 webinar series and registration here.

Mental Health webinars: Legal issues for mental health and addictions agencies and teams
Annual membership 2024

For managers and other leaders from mental health and addictions agencies, hospitals, CMHAs, CHCs, school boards, FHTs and Indigenous health services

This is an annual membership program with monthly webinars.
Full details and registration here.

Team Privacy Training Events

For Primary Care clinics, Hospitals, Community Agencies, Mental Health Teams, Public Health Units, School Boards, Police departments

Scheduled to your team's needs for comprehensive or refresher training More details...

Free summary of all PHIPA IPC decisions

Want to read privacy breach stories to learn how to improve your work? We have summarized all the Information and Privacy Commissioner's health privacy decisions for you Download here...

Kate Dewhirst Health Law

Kate says:

My mission is bringing the law to life. I make legal theory understandable, accessible and fun! I’m available and love to work for all organizations in the healthcare sector across Ontario and beyond.

Subscribe to my mailing list and keep up to date with news:

Latest Tweets

  • Our twitter feed is unavailable right now. Follow us on Twitter
  • contact details

    P.O. Box 13024, RPO Bradford Centre
    Bradford, ON, L3Z 2Y5

    (416) 855 9557

    .