This comes as a surprise to most lay people.

In Ontario, and in many jurisdictions around the world, children make their own health privacy decisions when they are “capable” of doing so and not when they reach a specific age.

What does that mean?

Capacity is presumed. Meaning, healthcare providers presume everyone is capable to make their own health privacy decisions UNLESS the presumption is unreasonable.

Babies do not make their own decisions. Little kids do not make their own decisions.  Many teenagers do make their own privacy decisions.

Health privacy decision-making capacity is a two-part test.  To be capable to consent to health information being collected, used or disclosed, a person must be (1) ABLE to understand the information relevant to the decision and (2) ABLE to appreciate the reasonably foreseeable consequences of giving, not giving, withholding or withdrawing that consent.

Depending on the child, that might mean starting to make health information privacy decisions at age 8 or 10 or 12 or 14 or 16 or older. Maturity, intellectual ability and the complexity of the health information all come into play.

Privacy decision making is very much tied to making healthcare treatment and counselling decisions.  Children who make their own treatment and counselling decisions, also make their own privacy decisions about the related health information.

Parents as Substitute Decision-Makers

Incapable children, those who are not able to make their own privacy decisions, must have a substitute decision-maker.  In most cases, parents make decisions for their children until their children become capable on their own.  If an incapable child is in the custody of a children’s aid society – the CAS makes privacy decisions on behalf of that child.

What happens if parents are split?

It depends.

In Ontario, if parents are separated, divorced or never co-habited, they share custody unless that right has been taken away from them. Custodial parents together have health privacy decision-making authority over their incapable children.  But, if one parent has custody and the other has a right of access only, the custodial parent makes health privacy decisions over the access-only parent.  Court orders may override this and healthcare organizations may need advice from time to time to sort out specifics of who can make decisions and who receives health updates.

Under the age of 16 – Capable Kids

There is a nuance to this discussion.  This nuance causes a lot of misunderstandings about the age of 16.

In the case of capable children under the age of 16, their parents can also consent to the collection, use and disclosure of health information relating to treatment and counselling the children did not consent to on their own (unless the capable child objects).

For example, parents of a 15-year old capable kid can give permission for a healthcare organization to release information about her vaccination records as a baby to her school – but cannot give permission for that same health organization to release information about her social worker’s counselling records, which counselling the kid consented to on her own.  15-year old did not consent to the vaccines when she was a baby. The 15-year old did consent to the social worker counselling sessions. That’s the difference.

Capable children’s decisions always trump their parents. So if the capable 15-year old objected to her parents sending in her baby vaccination information to her school, that decision would override her parents’ permission.  That does not happen very often. Mostly because children and parents are not often in dispute over sharing health records with others. It does happen though.

It happens, for example, that capable children do not want their parents to have a copy of their historic health information to use in custody battles.  If a capable child objects to a healthcare organization releasing their health information to a third party or to the parents, that capable child’s instruction prevails.

Safety Trumps Privacy

There are additional considerations when it comes to children and privacy.  There are mandatory reports to children’s aid societies that override privacy considerations if there is a child in need of protection from physical, emotional or sexual abuse.

There are also situations where sharing information with parents or police is required in order to reduce or eliminate a significant risk of serious bodily harm to a child or someone else.

Under the Mental Health Act and Child, Youth and Family Services Act and other laws, there are specific provisions that override the privacy rights of individuals rooted in protecting public and personal safety.

Tough Conversations

This topic is meaty. It is emotionally and ethically tricky for healthcare providers.  It is hard for parents to understand that in some cases their children have rights to exclude them from having information. It is challenging to give children information in a positive and proactive way without discouraging them from living in community with their parents and receiving the supports they need.

That’s why it is important to share privacy information with patients and their families early and often.

Most children do not know their rights.  It is important to explain privacy rights to children in a way that is easy for them to understand and exercise.  It is also important to take the time to have nuanced privacy conversations with children so they receive parental supports and so information is shared to avoid gaps in care.

To avoid surprises for parents, it is important to explain that over time, most children will become capable of making their own decisions.

Bottom Line

If your healthcare organization serves children, this is an important topic to canvass with your staff.  I can pretty much guarantee that some of your staff do not understand the nuance of this topic and rely on the wrong information that 16-year olds and older kids make their own health privacy decisions and under the age of 16, parents make privacy decisions.    Make sure you train your team on the issue.

Have easy to understand information available for parents and children on this topic too.  It’s hard for families to understand privacy.  Starting the conversation early helps ease the path forward for parents navigating the healthcare system and empowers children to understand their rights and receive supports from their parents.

Join me for my free Ask Me Anything about Health Privacy webinars on the first Wednesday of every month from 10-11am.  In May 2019 I talked about this topic of kids and privacy.  If you missed it, you can now purchase the replay where you can watch the video, download the transcript and the slides. Go to the Kate Dewhirst Shop for more information and to gain access.