I’m Kate Dewhirst.

I’m a lawyer who writes about legal issues affecting healthcare in Canada

Kate Dewhirst Health Law - bringing the law to life. Meet Kate (in 13 seconds)

There is no magic age when children make their own health privacy decisions

Posted by

This comes as a surprise to most lay people.

In Ontario, and in many jurisdictions around the world, children make their own health privacy decisions when they are “capable” of doing so and not when they reach a specific age.

What does that mean?

Capacity is presumed. Meaning, healthcare providers presume everyone is capable to make their own health privacy decisions UNLESS the presumption is unreasonable.

Babies do not make their own decisions. Little kids do not make their own decisions.  Many teenagers do make their own privacy decisions.

Health privacy decision-making capacity is a two-part test.  To be capable to consent to health information being collected, used or disclosed, a person must be (1) ABLE to understand the information relevant to the decision and (2) ABLE to appreciate the reasonably foreseeable consequences of giving, not giving, withholding or withdrawing that consent.

Depending on the child, that might mean starting to make health information privacy decisions at age 8 or 10 or 12 or 14 or 16 or older. Maturity, intellectual ability and the complexity of the health information all come into play.

Privacy decision making is very much tied to making healthcare treatment and counselling decisions.  Children who make their own treatment and counselling decisions, also make their own privacy decisions about the related health information.

Parents as Substitute Decision-Makers

Incapable children, those who are not able to make their own privacy decisions, must have a substitute decision-maker.  In most cases, parents make decisions for their children until their children become capable on their own.  If an incapable child is in the custody of a children’s aid society – the CAS makes privacy decisions on behalf of that child.

What happens if parents are split?

It depends.

In Ontario, if parents are separated, divorced or never co-habited, they share custody unless that right has been taken away from them. Custodial parents together have health privacy decision-making authority over their incapable children.  But, if one parent has custody and the other has a right of access only, the custodial parent makes health privacy decisions over the access-only parent.  Court orders may override this and healthcare organizations may need advice from time to time to sort out specifics of who can make decisions and who receives health updates.

Under the age of 16 – Capable Kids

There is a nuance to this discussion.  This nuance causes a lot of misunderstandings about the age of 16.

In the case of capable children under the age of 16, their parents can also consent to the collection, use and disclosure of health information relating to treatment and counselling the children did not consent to on their own (unless the capable child objects).

For example, parents of a 15-year old capable kid can give permission for a healthcare organization to release information about her vaccination records as a baby to her school – but cannot give permission for that same health organization to release information about her social worker’s counselling records, which counselling the kid consented to on her own.  15-year old did not consent to the vaccines when she was a baby. The 15-year old did consent to the social worker counselling sessions. That’s the difference.

Capable children’s decisions always trump their parents. So if the capable 15-year old objected to her parents sending in her baby vaccination information to her school, that decision would override her parents’ permission.  That does not happen very often. Mostly because children and parents are not often in dispute over sharing health records with others. It does happen though.

It happens, for example, that capable children do not want their parents to have a copy of their historic health information to use in custody battles.  If a capable child objects to a healthcare organization releasing their health information to a third party or to the parents, that capable child’s instruction prevails.

Safety Trumps Privacy

There are additional considerations when it comes to children and privacy.  There are mandatory reports to children’s aid societies that override privacy considerations if there is a child in need of protection from physical, emotional or sexual abuse.

There are also situations where sharing information with parents or police is required in order to reduce or eliminate a significant risk of serious bodily harm to a child or someone else.

Under the Mental Health Act and Child, Youth and Family Services Act and other laws, there are specific provisions that override the privacy rights of individuals rooted in protecting public and personal safety.

Tough Conversations

This topic is meaty. It is emotionally and ethically tricky for healthcare providers.  It is hard for parents to understand that in some cases their children have rights to exclude them from having information. It is challenging to give children information in a positive and proactive way without discouraging them from living in community with their parents and receiving the supports they need.

That’s why it is important to share privacy information with patients and their families early and often.

Most children do not know their rights.  It is important to explain privacy rights to children in a way that is easy for them to understand and exercise.  It is also important to take the time to have nuanced privacy conversations with children so they receive parental supports and so information is shared to avoid gaps in care.

To avoid surprises for parents, it is important to explain that over time, most children will become capable of making their own decisions.

Bottom Line

If your healthcare organization serves children, this is an important topic to canvass with your staff.  I can pretty much guarantee that some of your staff do not understand the nuance of this topic and rely on the wrong information that 16-year olds and older kids make their own health privacy decisions and under the age of 16, parents make privacy decisions.    Make sure you train your team on the issue.

Have easy to understand information available for parents and children on this topic too.  It’s hard for families to understand privacy.  Starting the conversation early helps ease the path forward for parents navigating the healthcare system and empowers children to understand their rights and receive supports from their parents.

Join me for my free Ask Me Anything about Health Privacy webinars on the first Wednesday of every month from 10-11am.  In May 2019 I talked about this topic of kids and privacy.  If you missed it, you can now purchase the replay where you can watch the video, download the transcript and the slides. Go to the Kate Dewhirst Shop for more information and to gain access.  


If you enjoyed this article please share it:


Previous and next posts from Kate:

Some of Kate’s recent and upcoming events

Primary care webinars: Employment Law Update & Legal Issues for EDs and Board members

Part of Kate’s monthly webinar series.

Our December program will address harassment in the workplace.
Full details of the 2021 webinar series and registration here.

Free healthcare privacy webinar - ask me anything!
the first Wednesday of every month

Free webinars - advance registration needed

Whether you're an experienced privacy officer or new in the field, pick Kate’s brain for free for an hour, in this live webinar. No charge, but you’ll need to register in advance.

Team Privacy Training Events
November 11, 12, 13, 18, 24, 25, 26, December 4 7

For Primary Care clinics, Hospitals, Community Agencies and Children’s Aid

Kate trains health professionals from many more health care organizations how being privacy-respectful can improve therapeutic relationships. More details...

Free Part X CYFSA privacy webinar - ask me anything!
the second Wednesday of every month

Free webinars - advance registration needed

Whether you're an experienced privacy designate or new in the field, pick Kate’s brain for free for an hour, in this live webinar. No charge, but you’ll need to register in advance.

Part X CYFSA Privacy Designate training
November 10 and 17

For Privacy Designates in the child welfare sector including children's aid societies and indigenous children's well-being centres

This course focuses on how to implement Part X of the Child Youth and Family Services Act in your organization.
Full details and registration here.

Health Privacy Officer training
April 2021

For Privacy Officers within healthcare organizations - now totally online.

This course focuses on how to become a more confident privacy officer and gives you the tools to document your privacy program. Full details and registration here...

Advanced Health Privacy Officer training
June 2021

For Privacy Officers within healthcare organizations - now totally online

This course focuses on taking theory into practice and we do real life scenarios to build your Privacy Officer skills.
Full details and registration here.

Kate Dewhirst Health Law

Kate says:

My mission is bringing the law to life. I make legal theory understandable, accessible and fun! I’m available and love to work for all organizations in the healthcare sector across Ontario and beyond.

Subscribe to my mailing list and keep up to date with news:

Latest Tweets


RT @choirchoirchoir: We sang the 🇨🇦 anthem at the Grey Cup 3 yrs ago + trended because we upped the BPM’s + actually had a good time with…

05:35 PM Nov 26th


contact details

P.O. Box 97010 Roncesvalles
Toronto Ontario M6R 3B3

(416) 855 9557

.