Standards for Canadian organizations

2020 Edition

Client Rights (CA-CR) 2: Confidentiality and Privacy Protections

The organization protects the confidentiality of information about clients and assumes a protective role regarding the disclosure of confidential information.
2020 Edition

Currently viewing: CLIENT RIGHTS (CA-CR)

VIEW THE STANDARDS

Purpose

The rights and dignity of clients are respected throughout the organization.
1
The organization's practices fully meet the standard as indicated by full implementation of the practices outlined in the CA-CR 2 Practice standards.
2
Practices are basically sound but there is room for improvement as noted in the ratings for the CA-CR 2 Practice standards.
3
Practice requires significant improvement as noted in the ratings for the CA-CR 2 Practice standards.
4
Implementation of the standard is minimal or there is no evidence of implementation at all, as noted in the ratings for the CA--CR 2 Practice standards.
Self-Study EvidenceOn-Site EvidenceOn-Site Activities
  • Confidentiality policy
  • Confidentiality procedures
  • Sample release form for disclosure of confidential information
No On-Site Evidence
  • Interviews may include:
    1. Program director
    2. Relevant personnel
    3. Persons served
  • Review case records

Fundamental Practice

CA-CR 2.01

When the organization receives a request for confidential information about a client, or when the release of confidential information is necessary for the provision of services, prior to releasing such information, the organization:
  1. determines if the reason to release information is valid;
  2. obtains informed, written authorization to release the information from the client and/or parent or legal guardian, as appropriate; and
  3. maintains each authorization of consent in the case record and provides a copy to the client and/or parent or legal guardian.
Note: Please see the Case Record Checklist for additional guidance on this standard.
1
The organization's practices reflect full implementation of the standard.
2
Practices are basically sound but there is room for improvement; e.g.,
  • Written, informed consent is always obtained prior to releasing information, and there have been no instances where confidential information was inappropriately released, but procedures could be strengthened or clarified.
3
Practice requires significant improvement; e.g.,
  • In a few rare instances information was inappropriately released or informed consent not obtained; or
  • In a significant number of cases the information was not provided or there is no documentation that clients were offered a copy.
4
Implementation of the standard is minimal or there is no evidence of implementation at all.

Fundamental Practice

CA-CR 2.02

Prior to the disclosure of confidential or private information, the organization informs the client about circumstances when it may be legally or ethically permitted or required to release such information without his or her consent, and notifies the client of such a release when it occurs.
Examples: When permitted or required by law, regulation, or court order, confidential information may be released without the authorization of the client and legal guardian. The organization may wish to seek legal counsel, as necessary, when others seek identifying information about an individual or family, or when the release of confidential information is necessary for the provision of services.
1
The organization's practices reflect full implementation of the standard.
2
Practices are basically sound but there is room for improvement; e.g.,
  • There are a few instances where clients were not fully informed of the legal or ethical circumstances when confidential or private information may be released without consent, but corrective action was immediately implemented prior to the actual release of the private information.
3
Practice requires significant improvement; e.g.,
  • Written procedures do not provide sufficient guidance to personnel to reconcile when the organization may be legally or ethically permitted or required to release confidential or private information without prior notification of client.
  • There are instances where staff have released confidential or private information inappropriately.
4
Implementation of the standard is minimal or there is no evidence of implementation at all or the organization is facing legal action because of inappropriate release of information.

CA-CR 2.03

The organization obtains informed, written consent from the client or a legal guardian prior to recording, photographing, or filming.

Interpretation

For programs providing Early Childhood Education (CA-ECE) or Out-of-School Time Services (CA-OST) it is not necessary to obtain consent each time children or youth may be recorded, photographed, or filmed; consent may be provided at enrollment and maintained in program records or files. Consents should be reviewed and updated annually.

Youth Justice

Interpretation

In youth justice programs, when recording, photographing, or filming is required by law, consent may not be necessary. However, it is still expected that the organization inform clients prior to recording, photographing, or filming. 
Note: Please see the Case Record Checklist for additional guidance on this standard.
1
The organization's practices reflect full implementation of the standard.
2
Practices are basically sound but there is room for improvement; e.g.,
  • Written, informed consent is always obtained prior to recording, photographing, or filming and there have been no instances where clients were recorded, photographed, or filmed without proper consent, but procedures could be strengthened or clarified.
3
Practice requires significant improvement; e.g.,
  • In a few rare instances, informed consent was not obtained prior to recording, photographing, or filming.
4
Implementation of the standard is minimal or there is no evidence of implementation at all.

Fundamental Practice

CA-CR 2.04

The release form for disclosure of confidential information includes the following elements:
  1. the name of the person whose information will be released;
  2. the signature of the person whose information will be released, or the parent or legal guardian of a person who is unable to provide authorization;
  3. the specific information to be released;
  4. the purpose for which the information is to be used;
  5. the date the release takes effect;
  6. the date, event, or condition upon which the consent expires in relation to the individual purpose for disclosure, not to exceed one year from when the release takes effect;
  7. the name of the person(s) or organization(s) that will receive the disclosed information;
  8. the name of the person or organization that is disclosing the confidential information; and
  9. a statement that the person or family may withdraw their authorization at any time except to the extent that action has already been taken.

Interpretation

Blanket release forms signed by clients when service is initiated do not meet the requirements of this standard.

Interpretation

When a release form is used to authorize the exchange of information between multiple parties, the form must comply with all elements of the standard. All relevant parties must be authorized to disclose and receive the information specified, for the purpose indicated, in the consent.

Interpretation

Elements (b) and (i) will not apply when law, regulation, or court order permits confidential information to be released without the authorization of the person or legal guardian.

FEC

Interpretation

 
In credit counselling organizations this standard applies in situations where a client specifically requests release of information to a third party, such as a letter of reference regarding payment history, or in instances when a program-specific release does not exist. Debt management agreements or releases signed at the initiation of a debt management program allow for information sharing with all creditors included in the program or added to the program for the duration of service, unless territorial/provincial laws indicate otherwise.
Examples: Examples of information that may also be included on release forms  include a statement regarding the impact, if any, of refusing to sign the authorization, and rules regarding re-disclosure of information.
1
The organization's practices reflect full implementation of the standard.
2
Practices are basically sound but there is room for improvement; e.g.,
  • Consent forms are always completed and signed, but in a few instances information related to elements (c) or (d) is vague.
3
Practice requires significant improvement; e.g.,
  • Consent is always obtained and forms are signed, but a significant number of consent forms
    • Have missing or inadequately addressed components; or
    • Are overly broad or non-specific.
4
Implementation of the standard is minimal or there is no evidence of implementation at all.