- Download the guide
- Ontario’s access and privacy legislation
Collecting personal information
- Are school boards limited in the amount or kind of personal information they may collect?
- Does a school board need consent to collect personal information about a student?
- When can a school board collect personal information indirectly?
- Does a school board need to give notice that it is collecting personal information?
- What are the rules for collecting, using, disclosing and requiring the production of Ontario Education Numbers?
- Using and disclosing personal information
- Consent to collect, use and disclose personal information
- Safeguarding and retaining information
Access to information
- How do students and parents access personal information?
- Do individuals have a right to access general records from a school board?
- Do students need to reach a certain age before they can exercise their access rights?
- How does a child’s age affect the parent’s right of access to personal information?
- Do non-custodial parents have a right to access a child’s school records?
- Correction of personal information
- Special topics
Collection, use and disclosure of health information
Special rules apply to the collection, use and disclosure of students’ health information when they receive health care in school. Heath care includes any health-related examination, assessment, service or procedure provided to students to:
- diagnose, treat or maintain their physical or mental wellbeing
- prevent disease or injury, or
- promote health
Examples include providing care to a student who is not feeling well, examining a student’s injury, and assessing a student for a condition such as a speech disorder.
The rules governing the collection, use and disclosure of students’ personal health information are outlined in the Personal Health Information Protection Act (PHIPA) and apply to health information custodians and those working on their behalf. Custodians are only allowed to collect, use or disclose a student’s personal health information if:
- they have the student’s consent (or the consent of a substitute decision-maker such as a parent), and it is necessary for a lawful purpose, or
- it is permitted or required by PHIPA
Custodians must take reasonable steps to keep health information secure. If personal health information is stolen, lost, or used or disclosed without authority, the custodian must notify the student or their substitute decision-maker, and in some cases must also notify the IPC.
What is Personal Health Information?
A student’s personal health information includes any identifying information about the student that relates to:
- the student’s physical or mental health, including their family health history
- providing health care to the student, including the identification of a health care provider
- payments, or eligibility for health care, or eligibility for coverage for health care
- the student’s health number
- the identity of the student’s substitute decision-maker
Personal health information can be in either oral or written form and includes any other information about the student contained in a health record.111
Who is a Health Information Custodian?
A health information custodian is a certain person or organization that is involved in delivering health care and includes:
- health care practitioners such as physicians, nurses, psychologists, speech-language pathologists, dental hygienists and social workers providing health care
- a person who operates a group practice of health care practitioners
- a community health or mental health centre, program or service whose primary purpose is the provision of health care112
In some situations, a school board may be the custodian of students’ health records, such as where it is operating a group practice of practitioners. In other circumstances, a health care practitioner employed by the board may be the custodian. While different arrangements are possible, the school board must provide clarity about who is the custodian responsible for student health records.
For more information on custodians working for employers (including school boards) who are not custodians, please see the IPC’s fact sheet: Health Information Custodians Working for Non-Health Information Custodians at ipc.on.ca.
Who can consent to the collection, use and disclosure of health information?
Students can consent to the collection, use and disclosure of their personal health information if they can understand the information that is relevant to deciding whether to consent, and the possible consequences of that decision.
If a student is younger than 16, a parent113 or other authorized person can consent on their behalf. This does not apply if the student has received treatment or counselling under the CYFSA on their own.114 The decision of a capable student prevails over a conflicting decision of a parent or other authorized person.115
If a student is incapable of consenting to the collection, use or disclosure of their personal health information, a substitute decision-maker can consent on their behalf.116
Can students request access to their health information?
Students or their substitute decision-makers, if applicable, can access the student’s health records, with some exceptions. For example, students would not have the right to access a record if it is subject to a legal privilege or if a court order prohibits its disclosure.117
Custodians must respond to a request within 30 days. This time limit can be extended by up to 30 additional days if the custodian gives written notice and an explanation for the extension.
Where the health care provider is employed by the school or acting on its behalf, the request must be made to the school board under MFIPPA.
Can a school board collect, use and disclose student health numbers?
Where a school board is not a custodian, it cannot collect, use or disclose a student’s health number except for certain purposes, including providing health services funded by the Government of Ontario.118 A school board cannot require students to present a health card for other purposes, such as to identify students for registration. However, the school board can ask to keep a student’s health number on file, on a voluntary basis, in case of a medical emergency. School boards should consider the privacy risks associated with collecting health numbers when developing their policies on this subject.
What about student immunization information?
Public health units in Ontario must keep up-to-date immunization records for every student in relation to nine designated diseases.119 If a student’s record is incomplete, a health unit can send the school a written order to suspend the student. Physicians or nurses immunizing a child must provide the parent with a confirmation that the immunization was administered.