The Act respecting health and social services information aims to link health data to the patient, rather than to the place where care was provided.

Any person has the right to restrict access to their health and social services information, by determining that a specific intervener or intervener who belongs to a category of interveners cannot have access to one or more health and social services information that he or she has identified in his or her file during the provision of care and services.

A person also has the right to refuse that some people have access to certain health and social services information about him or her.

Health and social services information is defined as information that allows a person to be identified, even indirectly. This information must meet one of the following characteristics or be collected for registration purposes or with a view to taking charge of the user:

  • report on a person's physical or mental health;
  • report on material taken as part of an assessment or treatment;
  • report on health or social services provided;
  • have been obtained in the exercise of a function provided for in the Public Health Act.

These rights are granted by the Act respecting health and social services information (AHSSS). This law aims to protect people's rights to confidentiality and allows control over the sharing of information held by health and social services organizations. Individuals have the power to decide which stakeholders can access their information, in order to preserve confidentiality and protect their privacy.

Information may be disclosed or used only with the express consent of the person concerned, or as authorized by the AHSSS (LRSSS). The AHSSS provides for several cases where information may be used or communicated without the consent of the individual in order to make sure that the information is accessible in a timely manner to meet the needs of users.

The rules for obtaining consent to care remain unchanged.

Right to Restrict Access to Health and Social Services Information

To express their wish to restrict access to their health information held by an organization providing health and social services, a person aged 14 or over must specify the details of the restriction to the organization holding the information in question, including:

  • the name of the intervener for whom access is restricted;
  • the intervener category to which access is restricted, providing a precise description of this category;
  • the health and social services information to which access is prohibited.

The restriction has no time limit. It remains in place until the user modifies or withdraws it. It can only be lifted if the person's life or integrity is in danger, and if it is not possible to obtain the person's consent in time to lift it.

Example of restricted access

Someone doesn't want the dental hygienist at their clinic, who is their neighbor's daughter, to have access to health information about them. This person can restrict access to this information to the clinic's dental hygienist. It is also possible to restrict access to all dental clinic staff.

Requesting Restricted Access to Health and Social Services Information

To request the right to limit access to health and social services information, you can send your request in writing, by e-mail or by mail to the organization holding the data or to the intervener you met. This request must include:

  • your contact information or the contact information of the person with parental authority, tutor, guardian or mandatary, if applicable;
  • your signature;
  • the date of the restriction request.

A person appointed by the organization to deal with the restriction will contact you to inform you of the possible consequences that the restriction of information may have on your file.

The restriction of access can only be lifted in the following cases:

  • when there is a risk of endangering the life or integrity of the person concerned and it is impossible to obtain their consent in time;
  • when communication of the information is required by law.

Withdrawing or modifying an access restriction request

It is also possible to withdraw or modify a restriction. To do so, the person requesting the restriction must send a written request to the organization. This request must contain:

  • the name and contact details of the person concerned by the information;
  • in the case of a modification, the information to be modified;
  • in the case of a withdrawal of the restriction, this information must be recorded.

This restriction may not compromise the person's right to receive health and social services, except in the case of risk to life or integrity.

The organization is required to designate a person responsible for providing information on the potential consequences and risks associated with the exercise of this right, in order to ensure informed decision-making on the part of the person who has expressed his or her wish to restrict access to his or her information. It is important to emphasize that the designated person never attempts to influence or dissuade the individual from exercising his or her right to restrict access.

The legislation and regulations governing the right to restrict access to health and social services information are designed to protect the transparency and autonomy of individuals, while guaranteeing access to necessary services. 

Right to Refuse Access to Health and Social Services Information

Anyone may express their wish to refuse access to health and social services information about them, whether it is already held by an organization or is accessible to certain individuals. These persons include:

  • a spouse or close relative, if the proposed access is part of a bereavement process;
  • a spouse, parent or children, if the information relates to the cause of death;
  • a researcher, if the proposed access is for the purpose of soliciting his or her participation in a research project;
  • a researcher who is not affiliated with a public health and social services agency, a public institution or a private institution operating a hospital;
  • the categories of persons to whom access is to be refused.

Example of a case of refusal of access to health and social services information

Any person may refuse to allow their spouse to have access to their health information concerning their mental health if the proposed access is part of a bereavement process.

Unlike the right to restriction provided for in section 7 of the Act, which must apply to existing information identified by the person concerned, refusal may be expressed in advance with regard to information that does not yet exist or is not yet held by an organization.

Requesting Refusal of Access to Health and Social Services Information

To request the right to refuse access to health and social services information, send your request to the organization holding the information (e.g., a clinic). The request must include:

  • your contact information or the contact information of the person with parental authority, tutor, guardian or mandatary, if applicable;
  • your signature;
  • the date of the request for refusal.

Minors

In the case of a minor under the age of 14, the notice must be formulated by the person with parental authority or the guardian. In this case, in addition to information concerning the identity of the intervener or category of interveners affected by the restriction, the notice must include the name and contact details of the person issuing the notice. The same applies to the notice formulated by the representative of a person other than such a minor.

The person formulating the notice must sign it.

Refusal of access can only be lifted when disclosure of the information is required by law. This refusal cannot compromise the person's right to receive health and social services, except in the case of risk to life or integrity.

Information Gathering

An organization may only collect information that is necessary to fulfill its mission, perform its functions or manage a program.

For example, at the time of collection, the organization must inform the user about:

  • the name of the organization;
  • purposes of collection;
  • means of collection;
  • the right to access and rectify information;
  • the possibility of restricting or refusing access;
  • how long the information will be kept.

If the collection uses technologies to identify or profile the user, the user must be informed.

An organization may retain information only as long as is necessary for the fulfillment of the purposes for which it was collected, subject to legal exceptions.

Rights of Access and Modification of Information

Users have the right to be told what information is held about them and to have access to it. However, access may be temporarily denied if it poses a serious risk to their health.

  • Users have the right to know who has accessed their information, as well as the date and time of such access.
  • Users may request rectification of information if it is incorrect, incomplete or ambiguous.
  • Information provided by a third party is not accessible to the user if this would allow the third party to be identified, except with his or her written consent.
  • Minors under the age of 14 cannot access their information directly, except through their lawyer.
  • People who can consent to care for someone else can also access their information to exercise their authority.

Rights of Persons Related to a Minor

Parental authorities or guardians have the right to access the information of minors under the age of 14, unless there is a risk to the child's health or safety. Parental authorities or guardians may access the information of minors aged 14 and over after the holding organization has consulted with them and confirmed that there is no risk to their health or safety.

Rights of Persons Related to a Disabled Adult

A person planning to apply for the opening or review of a tutorship or mandate of protection for an incapable person of full age may access the necessary medical and psychosocial assessments, provided that a prior assessment concludes that the person is incapable. Guardians or mandataries of incapable adults may access their information and request corrections if necessary.

Rights of Persons Related to a Deceased Person

Heirs, successors, legatees, liquidators of an estate, beneficiaries of life insurance or of a death benefit of a deceased person, spouses and close relatives have rights of access to the deceased's information, particularly if this is necessary to exercise their rights and obligations or for the bereavement process.

Holders of parental authority or guardians have access to the non-psychosocial information of a deceased minor.