PHIPA rights and consent
Sources reviewed: August 29, 2026
PHIPA gives individuals meaningful control over personal health information while recognizing defined situations in which the law permits or requires handling without consent.
Key information
Individual health privacy rights
The IPC summarizes a set of rights that help individuals understand and exercise control over their personal health information.
Be informed about the purposes for collecting, using, and disclosing personal health information.
Subject to the Act’s exceptions and additional requirements, be notified at the first reasonable opportunity of theft, loss, or unauthorized use or disclosure of personal health information and be told about the right to complain to the IPC.
Give, withhold, or withdraw consent, and expressly restrict certain uses or disclosures for health care, subject to statutory exceptions.
Request access to a record of personal health information and, when access is granted, request a copy and correction of qualifying inaccuracies, subject to the Act.
Complain to the IPC about access or correction refusals and actual or potential privacy contraventions.
Elements of valid consent
When PHIPA requires consent, every element of the statutory consent test must be satisfied.
Consent must come from the individual or an authorized substitute decision-maker.
The person must understand the purpose of the collection, use, or disclosure and know that consent may be given or withheld.
Consent must relate to the personal health information that will be collected, used, or disclosed.
Consent must not be obtained through deception or coercion.
Express, implied, and assumed implied consent
The required form of consent depends on the purpose, recipients, and statutory conditions surrounding the information handling.
Express consent is required for certain disclosures, including a disclosure to a non-custodian or a disclosure between custodians for a purpose other than providing or assisting in providing health care, unless another legal authority applies.
Consent may otherwise be implied when the circumstances support that conclusion and all elements of valid consent are satisfied.
Specified custodians may assume implied consent when they receive personal health information from the individual, a substitute decision-maker, or another custodian to provide or assist in providing health care, unless they know consent was expressly withheld or withdrawn.
PHIPA also identifies circumstances in which collection, use, or disclosure is permitted or required without consent. Consent is not the only possible legal authority.
Consent directives, capacity, and decision-making
Consent choices and decision-making authority must be evaluated for the particular information-handling decision.
An individual may expressly withhold consent for specified uses or disclosures. A condition cannot restrict recording required by law or established professional or institutional practice, and statutory exceptions continue to apply.
Consent may be withdrawn by notice, but withdrawal does not operate retroactively and does not prevent a collection, use, or disclosure that PHIPA permits or requires without consent.
Capacity is decision-specific and can change. A person is presumed capable unless there are reasonable grounds to believe otherwise, and is capable when able to understand relevant information and appreciate the reasonably foreseeable consequences of the decision.
When an individual is incapable, an authorized substitute decision-maker may make the consent decision in accordance with PHIPA’s priority and decision-making rules.
Authoritative sources
These summaries are based only on current Ontario legislation and official guidance from Ontario’s health privacy regulator. Check the linked sources for amendments, exceptions, forms, and current procedural instructions.