Principle V: Confidentiality

College registrants shall hold all client information in strict confidence and comply with any applicable privacy and other legislation. College registrants shall disclose such information only with client consent or when required or allowed by law. 

INTERPRETATION

5.1 Policy and Processes

5.1.1 College registrants shall comply with any applicable privacy and other legislation.

5.1.2 College registrants shall obtain consent to the collection, use or disclosure of client information including personal information, unless otherwise permitted or required by law. ‘Personal information’ means information about an identifiable individual and includes (but is not limited to) personal health information.

5.1.3 College registrants shall inform clients early in their relationship of the limits of confidentiality of information. Limits to confidentiality may include registrants being required to share information with: 

• supervisors; 
• interprofessional teams; 
• administrative staff; 
• students and volunteers; 
• appropriate accreditation bodies; and 
• Children’s Aid Societies, the College, law enforcement organizations and/or other organizations, as required by law. 

College registrants shall respect their clients’ right to withhold or withdraw consent to, or place conditions on, the disclosure of their information (subject to when such disclosure is required by law). 

5.1.4 College registrants shall anticipate circumstances in which there may be limits to confidentiality, and discuss these limits with the team, group or community. 

5.1.5 College registrants shall be aware of the distinction between consultation and supervision as it pertains to sharing client information. In consultation, clients are not identified.

5.1.6 College registrants employed by an organization shall acquire and maintain a thorough understanding of the organization’s policies and practices relating to the management of client information, including:

(i) when, how and the purposes for which the organization routinely collects, uses, modifies, discloses, retains or disposes of information; 

(ii) the administrative, technical and physical safeguards and practices that the organization maintains with respect to the information; 

(iii) how an individual may obtain access to or request correction of a record of information about the individual; and 

(iv) how to make a complaint about the organization’s compliance with its policies and practices. 

5.1.7 Self-employed College registrants and College registrants who are responsible for complying with privacy legislation shall establish clear policies and practices relating to the management of client information, including the matters identified in 5.1.6 (i), (ii), (iii) and (iv) above, and make information about these policies and practices readily available in accordance with any applicable privacy and other legislation.

5.1.8 College registrants who are responsible for complying with privacy legislation shall include those who are considered to be “health care practitioners” (within the meaning of the Personal Health Information Protection Act, 2004) and employed or retained by persons who are not “health information custodians” (within the meaning of the Personal Health Information Protection Act, 2004). Examples include social workers or social service workers who provide healthcare as part of their duties and are employed by: 

• Children’s Aid Societies: 
• providers of supportive housing; and 
• government bodies that provide services in correctional facilities or youth justice facilities.

5.1.9 When College registrants are employed by an agency or organization whose policies and practices conflict with College standards of confidentiality, College standards shall take precedence and registrants shall comply with the College standards.

5.1.10 College registrants shall obtain clients’ consent before photographing, audio or video recording or permitting third-party observation of clients’ activities. Exceptions (which may include activities undertaken during child abuse investigations, for example) may be allowed under the law or by order of the court. 

5.1.11 College registrants shall comply with the requirements regarding the use or disclosure of information for research or educational purposes set out in any applicable privacy and other legislation. Where case scenarios are presented for research, educational or publication purposes, client confidentiality shall be ensured through the alteration and/or disguise of identifying information. (See also Interpretation 4.4.7.)

5.1.12 College registrants in indirect, non-clinical practice shall distinguish between public and private information related to their clients. Public information is any information about clients and/or their activities that is readily available to the general public and the disclosure of which would not harm the client and does not include personal information about an individual. Public information related to clients may be disclosed where it is appropriate to do so, provided that such disclosure is permitted by law and compliant with College standards. 

5.1.13 When working with community groups, government agencies and other organizations that are clients, College registrants shall keep confidential any sensitive information about the client group, agency or organization, including human resources, financial, managerial, strategic and/or politically sensitive material, the disclosure of which could harm the client.

5.2 Disclosure of client information

5.2.1 College registrants shall obtain client consent prior to each disclosure of information, where consent is required. Clients may sign consent forms or provide verbal consent; College registrants shall document that consent was obtained. 

5.2.2 When consent to the disclosure of information is required, College registrants shall make reasonable efforts to inform clients of the parameters of information to be disclosed, advise clients of the possible consequences of such disclosure, and inform clients of the following: 

• who is requesting the information (name, title, employer and address); 
• why the information is desired; 
• how the receiving party plans to use the information; 
• if the receiving party may pass the information on to a third party without the client’s consent; 
• exactly what information is to be disclosed; 
• the repercussions of giving or refusing to give consent; 
• the expiration date of the consent if applicable; and 
• how to revoke their consent.

5.2.3 College registrants shall make reasonable efforts to ensure that the information disclosed is pertinent and relevant to the professional service for which clients have contracted. College registrants shall take reasonable steps to ensure that the information disclosed is as accurate, complete and up-to-date as is necessary for the purposes of the disclosure, and shall clearly set out the limitations, if any, on the accuracy, completeness or up-to-date character of the information.

5.2.4 When disclosure is required or allowed by law or by order of a court, College registrants shall not divulge more information than is required or allowed.

5.2.5 A College registrant, or the professional corporation through which they are practising, may disclose information to the College without client consent when required in relation to a review, investigation or proceeding under the Social Work and Social Service Work Act, 1998. College registrants and/or professional corporations shall not divulge more information than is reasonably required.

5.2.6 College registrants wishing to use collection agencies or legal proceedings to collect unpaid fees shall disclose, in the context of legal proceedings, only the client’s name, the contract for service, statements of accounts and any records related to billing. In these circumstances, College registrants shall not divulge more information than is reasonably required. (See also Interpretation 6.1)

5.2.7 College registrants in indirect, non-clinical practice shall obtain the client’s consent before: 

• publishing reports about their work with the client; 
• referring to their work with the client in their advertising; 
• speaking with media, funders, potential funders and/or other individuals/groups about the organization, agency or community; and 
• bringing guests, observers, or media to meetings involving the client.

5.3 Electronic Practice

5.3.1 College registrants using online platforms and providing virtual services shall: 

• explain to clients the limits of confidentiality (including any particular limits associated with online platforms and/or virtual practice) prior to or during the first online meeting and document this conversation; 
• ensure that the collection, use and storage of client information complies with applicable privacy legislation; and 
• ensure that client information is stored in a jurisdiction where the privacy laws are consistent with Ontario laws or, where applicable, Canadian federal laws. 

5.3.2 When communicating virtually, College registrants shall maintain client confidentiality and ensure client safety by: 

• verifying the client’s identity when it would be possible for another person to pose as the client; 
• establishing a plan (such as a discrete phrase or sign) so that clients can convey that they are not alone and/or are not safe; and 
• developing a safety plan with the client, which includes asking them for the contact information for, and permission to contact, another person in the event of an emergency or service interruption. 

5.3.3 When using electronic communication to send client information, College registrants shall mark it confidential when possible, and shall ensure that it has been received by the intended recipients. 

Electronic communication refers to texting, email, video chat platforms, social media platforms, websites, faxes or other types of online communication.