In general, consent means agreement or permission. In the context of your health information, consenting refers to whether you agree to the collection, use, or disclosure of your personal health information.
The law in the health context generally distinguishes consent in two ways. The first is “express consent”, which is when you directly write or say that you agree before the information can be collected, used, or disclosed. The second is “implied consent”, which is when your consent is assumed due to the circumstances and context.
Both expressed and implied consent are legally legitimate types of consent, but only if you have been notified or if the purpose is obvious in the circumstances.
In some situations, your consent is not required at all. This can happen if there is a law that requires personal health information to be collected, used or disclosed. Please visit the following page for more information about when your consent may not be needed.
Your consent is needed for your health care provider to collect, use or disclose your personal health information for the purpose of giving you care or treatment. Aside from filling out a consent form on your first visit, your consent is normally obtained through “implicit consent”. Implicit or implied consent is when consent is not expressly granted, but rather obtained through the person’s actions as well as the circumstances and facts of the situation. However, implied consent must be informed and you must know that you can opt out.
Your health care provider is legally allowed to assume your implied consent when collecting personal health information as they will need it to give you care and treatment.
This means that your health care provider will not ask you for expressed consent at every instance they interact with your personal health information—for example, when sending your information to a specialist, receiving your information from elsewhere in the health care system, or at every single appointment.
If you would not like for your health care provider to assume your consent, then you must notify them. If you have notified your health care provider regarding your consent, they must follow those instructions until you expressly change them.
For more information, please see the “BC Physician Privacy Toolkit A guide for physicians in private practice”, as well as our page about limiting access to your health information.
Your health care provider will generally not talk to others about your health before receiving consent unless it is for the purpose of your health care and treatment. For example, your health care provider may speak with your family member. If you have any concerns about the disclosure of health information, please notify your health care provider.
Health care providers are not allowed to use your sensitive personal health information for fundraising purposes without your express consent. In addition, your health care provider or a business must get your consent to contact you about any products and services they offer. One possible way to get your consent for either of these purposes is to include a check box on the registration forms you fill out at your appointments.
There are several situations in which your consent may not be needed to collect, use or disclose your personal health information. This page is designed to provide general information and examples, but is not an exhaustive list of every situation where consent may not be needed.
Health care providers are allowed to collect, use, and disclose your personal health information if it is clearly in your interest to do so and consent cannot be obtained in a timely way, or if it is necessary for your medical treatment and you are unable to give consent. See section 12 of the Health Care (Consent) and Care Facility (Admission) Act. This allows health care providers to see your personal health information in an emergency, even if you have previously given instructions not to disclose certain records or information. For example, your prescribed medication information may be accessible through PharmaNet regardless of whether you have a keyword.
When your personal health information is collected by your health care provider, it is routine and necessary for some of it to be shared with your insurance provider for billing and payment purposes. See section 8(2) of the Personal Information Protection Act (“PIPA”) regarding implied consent.
Private health care bodies can sometimes disclose your personal information for research purposes. However, there are strict requirements that the private health care body must comply with:
Public health care bodies follow similar strict requirements aside from PIPA, in which division 3 of the E-Health (Personal Health Information Access and Protection of Privacy) Act is followed.
In general, researchers must get the approval of a research ethics board who will assess the confidentiality and impact of the disclosure, among many other ethical concerns. If the research ethics board does not give approval, the information cannot be gathered, included, or disclosed.
Public health bodies as well as other government agencies are allowed to collect, use, and disclose personal health information for a stewardship purpose if the Minister of Health has authorized them to do so. Public health bodies are generally allowed to share personal health information for any reason that meets the definition of a stewardship purpose. Please see division 3 of the E-Health (Personal Health Information Access and Protection of Privacy) Act as well as the definitions set out in section 9 of the Ministry of Health Act.
In BC, certain sexually transmitted infections are legally required to be reported by health care providers to their relevant health authorities. The current reportable sexually transmitted infections include:
Reported sexually transmitted infections are anonymous. Please see the schedule in the Reporting Information Affecting Public Health Regulation for the list of all reportable diseases.
Anonymous testing as well as disclosure to sexual partners is available for all sexually transmitted infections. In the case of a minor, a guardian will be notified unless the health care provider considers the minor capable for their own health. Please visit the following page for more information about clinics for testing.
Certain communicable diseases are legally required to be reported by health care providers to their relevant health authorities. See the schedule in the Reporting Information Affecting Public Health Regulation for the list of all reportable communicable diseases.
Health care providers are also legally required to report adverse events following an immunization and where there has been an infection or exposure. See section 5 or 10 of the Public Health Act, respectively.
A health care provider is legally required to report if they believe a minor is in danger of possible abuse, neglect, exploitation, deprivation of care, or refusal to consent to treatment. Specifically, under section 14 of the Child, Family and Community Service Act (“CFCSA”) a registrant must report their concerns about the welfare of a child to a child welfare worker. The duty to report overrides the confidentiality requirements of the patient-physician relationship and a failure to report is an offence under section 14 of the CFCSA.
Health care providers are legally required to report their patient if they believe their patient’s medical condition makes operating a motor vehicle dangerous for either the patient or the public, and that the patient continues to drive despite being warned. Please see section 230 of the Motor Vehicles Act.
A similar report must be made by optometrists and doctors about pilots and air traffic controllers under section 6.5 of the Aeronautics Act.
Health care providers are legally required under the Health Professions Act to report another registrant:
In rare cases, a patient’s health information may be disclosed or used for regulatory purposes if there is a complaint or an investigation involving your health care provider. For example, please see section 18(1) of the Personal Information Protection Act.
Health care providers are legally required to report all gunshot wounds. Stab wounds that are not self-inflicted or accidental must also be reported. Reports may include the patient’s name, their wound treatment, and the location of the place where the patient was treated. Please see the Gunshot and Stab Wound Disclosure Act.
Health care providers are legally required to report facts and circumstances to a death in certain situations. See section 2 of the Coroners Act.
In general, if your consent was initially needed, you will still be able to change or withdraw it at a later time. It is best practice to communicate this change with your health care provider orally and with clearly written instructions. If you need help with the written instructions, your health care provider is required to assist in that process.
Sometimes your consent is not needed, but if you would like to change access to your information then please communicate with your health care provider and health authorities.
Please visit the following page for our sample form that you can use to give your health care provider instructions about how you want him or her to collect, use, or disclose your personal health information.
Please visit the following page for a list of situations in which your health care provider is required by law to disclose personal health information.
These pages were last updated and reviewed in August of 2022.
The information on these pages only contains general information and guidance; none of the information constitutes legal advice. If you have a specific issue that you believe is a legal problem, the best practice is to consult a lawyer.
The information is non-partisan, dynamic and ever changing. It is the result of FIPA’s research and public education programs.
If you note something that needs to be added, corrected, or removed, please contact us by email: fipa AT fipa.bc.ca.