I’m Kate Dewhirst.

I’m a lawyer who writes about legal issues affecting healthcare in Canada

Kate Dewhirst Health Law - bringing the law to life. Meet Kate (in 13 seconds)

There is no magic age when children make their own health privacy decisions

Posted by

This comes as a surprise to most lay people.

In Ontario, and in many jurisdictions around the world, children make their own health privacy decisions when they are “capable” of doing so and not when they reach a specific age.

What does that mean?

Capacity is presumed. Meaning, healthcare providers presume everyone is capable to make their own health privacy decisions UNLESS the presumption is unreasonable.

Babies do not make their own decisions. Little kids do not make their own decisions.  Many teenagers do make their own privacy decisions.

Health privacy decision-making capacity is a two-part test.  To be capable to consent to health information being collected, used or disclosed, a person must be (1) ABLE to understand the information relevant to the decision and (2) ABLE to appreciate the reasonably foreseeable consequences of giving, not giving, withholding or withdrawing that consent.

Depending on the child, that might mean starting to make health information privacy decisions at age 8 or 10 or 12 or 14 or 16 or older. Maturity, intellectual ability and the complexity of the health information all come into play.

Privacy decision making is very much tied to making healthcare treatment and counselling decisions.  Children who make their own treatment and counselling decisions, also make their own privacy decisions about the related health information.

Parents as Substitute Decision-Makers

Incapable children, those who are not able to make their own privacy decisions, must have a substitute decision-maker.  In most cases, parents make decisions for their children until their children become capable on their own.  If an incapable child is in the custody of a children’s aid society – the CAS makes privacy decisions on behalf of that child.

What happens if parents are split?

It depends.

In Ontario, if parents are separated, divorced or never co-habited, they share custody unless that right has been taken away from them. Custodial parents together have health privacy decision-making authority over their incapable children.  But, if one parent has custody and the other has a right of access only, the custodial parent makes health privacy decisions over the access-only parent.  Court orders may override this and healthcare organizations may need advice from time to time to sort out specifics of who can make decisions and who receives health updates.

Under the age of 16 – Capable Kids

There is a nuance to this discussion.  This nuance causes a lot of misunderstandings about the age of 16.

In the case of capable children under the age of 16, their parents can also consent to the collection, use and disclosure of health information relating to treatment and counselling the children did not consent to on their own (unless the capable child objects).

For example, parents of a 15-year old capable kid can give permission for a healthcare organization to release information about her vaccination records as a baby to her school – but cannot give permission for that same health organization to release information about her social worker’s counselling records, which counselling the kid consented to on her own.  15-year old did not consent to the vaccines when she was a baby. The 15-year old did consent to the social worker counselling sessions. That’s the difference.

Capable children’s decisions always trump their parents. So if the capable 15-year old objected to her parents sending in her baby vaccination information to her school, that decision would override her parents’ permission.  That does not happen very often. Mostly because children and parents are not often in dispute over sharing health records with others. It does happen though.

It happens, for example, that capable children do not want their parents to have a copy of their historic health information to use in custody battles.  If a capable child objects to a healthcare organization releasing their health information to a third party or to the parents, that capable child’s instruction prevails.

Safety Trumps Privacy

There are additional considerations when it comes to children and privacy.  There are mandatory reports to children’s aid societies that override privacy considerations if there is a child in need of protection from physical, emotional or sexual abuse.

There are also situations where sharing information with parents or police is required in order to reduce or eliminate a significant risk of serious bodily harm to a child or someone else.

Under the Mental Health Act and Child, Youth and Family Services Act and other laws, there are specific provisions that override the privacy rights of individuals rooted in protecting public and personal safety.

Tough Conversations

This topic is meaty. It is emotionally and ethically tricky for healthcare providers.  It is hard for parents to understand that in some cases their children have rights to exclude them from having information. It is challenging to give children information in a positive and proactive way without discouraging them from living in community with their parents and receiving the supports they need.

That’s why it is important to share privacy information with patients and their families early and often.

Most children do not know their rights.  It is important to explain privacy rights to children in a way that is easy for them to understand and exercise.  It is also important to take the time to have nuanced privacy conversations with children so they receive parental supports and so information is shared to avoid gaps in care.

To avoid surprises for parents, it is important to explain that over time, most children will become capable of making their own decisions.

Bottom Line

If your healthcare organization serves children, this is an important topic to canvass with your staff.  I can pretty much guarantee that some of your staff do not understand the nuance of this topic and rely on the wrong information that 16-year olds and older kids make their own health privacy decisions and under the age of 16, parents make privacy decisions.    Make sure you train your team on the issue.

Have easy to understand information available for parents and children on this topic too.  It’s hard for families to understand privacy.  Starting the conversation early helps ease the path forward for parents navigating the healthcare system and empowers children to understand their rights and receive supports from their parents.

Join me for my free Ask Me Anything about Health Privacy webinars on the first Wednesday of every month from 10-11am.  In May 2019 I talked about this topic of kids and privacy.  If you missed it, you can now purchase the replay where you can watch the video, download the transcript and the slides. Go to the Kate Dewhirst Shop for more information and to gain access.  

If you enjoyed this article please share it:

Previous and next posts from Kate:

Some of Kate’s recent and upcoming events

Team Privacy Training Events
October 16, October 24 and November 21

For Primary Care clinics, Children’s Aid and FHTs

Kate trains health professionals from many more primary care organizations how being privacy-respectful can improve therapeutic relationships. More details...

Speaking event October 23, 2019

Osgoode Professional Development – Mental health Certificate

Kate joins the faculty for this training event. More details...

Primary care webinars: Managing Incapacity & Consent to Treatment

Part of Kate’s monthly webinar series.

Our October webinar is about managing incapacity, and the November title is Consent to Treatment.
Full details of the 2020 webinar series and registration here.

Advanced Privacy Officer training
December 10, 2019

For experienced Privacy Officers within healthcare organisations.

This one day training course focuses on how to handle difficult privacy situations using real-life (but anonymized) case studies and role-play. Full details and registration here...

Privacy Officer training
January 20 & 27 and February 3,10 & 18, 2020

Kate is the program chair for the Osgoode Certificate in Privacy in Healthcare.

This program explores the range of privacy interests that must be protected in the day-to-day treatment of patients, the development of information systems and the creation of institutional policies. More details...

Free healthcare privacy webinar - ask me anything!
October 2, November 6 and December 4

Free webinars - advance registration needed

Whether you're an experienced privacy officer or new in the field, pick Kate’s brain for free for an hour, in this live webinar. No charge, but you’ll need to register in advance.

Kate Dewhirst Health Law

Kate says:

My mission is bringing the law to life. I make legal theory understandable, accessible and fun! I’m available and love to work for all organizations in the healthcare sector across Ontario and beyond.

Subscribe to my mailing list and keep up to date with news:

Latest Tweets

The main message: A doctor (or any other health information custodian) should never ignore a patient’s access reque… https://t.co/HW8mrFymnC

about 22 hours ago

What happens when someone asks for access to recordings? It depends. Here’s a story about what might happen.… https://t.co/kRnDh5IOo2

12:01 PM Oct 12th

When you have an early warning system you don't hold all those reports until the end of the year. You look for proa… https://t.co/mz22nGp89F

12:01 PM Oct 11th

contact details

901 King Street West Suite 400 East Tower
Toronto Ontario M5V 3H5

(416) 855 9557