Limiting Who Else Can See Your Health Information PDF Print E-mail

Sometimes it is possible to put limits on who can see your personal health information.  Your ability to do this will depend on what type of organization holds the information and whether their system has the technical means to block access.

Hospitals and Health Authorities

Hospitals and health authorities can sometimes put “flags” on your health record in the hospital to prevent a specific person from seeing it. If you want to do that, you must contact the privacy officer of the health authority that runs the hospital.

Information held by your health care provider

Sometimes you just don’t want your doctor including certain information in a file about you that is shared with another health care provider. If you DO NOT WANT someone to see your personal health information that is in your doctor’s file, you should tell the doctor. They may want you to give them the instructions in writing. Click here for a sample form.

You have a right to tell your health care provider that you do not want your personal health information shared with anyone else, including other health care providers or just specific people.   Your health care provider must follow your instruction except if there is a legal requirement to disclose your information (see When Consent Isn't Needed). 

If you are not legally competent because of your age or have an intellectual disability your representative can give instructions on your behalf (see Guardians, Powers of Attorney and Representation Agreements.  

Information in an Electronic Health Record (E-Health) - Disclosure Directives

The e-Health Act gives individuals a limited right to put a 'disclosure directive' on their health information to limit to whom the information may be disclosed. Once your information is in your electronic health record, some parts of it can flow through the system, and be accessible to others unless you use your right to put a disclosure directive on your personal health information.  

A 'disclosure directive' is an instruction by you about whether or not your information can be disclosed, or to whom, or for what purpose, that is attached to your EHR file in a particular health information bank.

There are a few steps involved in putting a disclosure directive on the information in a health information bank. You must download the form from the Ministry of Health website or call Health Insurance BC at  604-683-7151 in the Lower Mainland or elsewhere in BC: 1-800-663-7100. If you call, a representative on the helpline can answer any questions you may have. 

Mail the completed form to:  

Disclosure Directive Service
PO Box 9688 Stn Prov Govt
Victoria, BC V8W 9P8

Receive your secret code in the mail and call customer service

After you have sent in your form and required documentation and it has been processed, you will receive a receipt in the mail which contains a secret code.  You must call HIBC at the numbers listed above and give the code to the HIBC customer service representative over the phone to confirm your identity.

Confirm your identity with customer service and put the disclosure directive on your electronic health record

Once you have confirmed your identity using the secret code sent to you by mail, you can proceed with applying a disclosure directive and adding the keyword to your electronic health record.

The customer service representative will review the keyword rules with you. You will share your keyword with the representative and they will complete the process of adding a disclosure directive to your electronic health record.

When you want someone to see your electronic health record, you tell them the keyword

Once a disclosure directive has been applied to your electronic health record, you will need to share your keyword if you would like a health professional to see your personal health information.

If you can't give out the keyword - emergencies

In urgent and emergency care settings, a disclosure directive can be overridden – when a health professional determines that a patient’s personal health information is necessary for timely care and the patient is unable to provide it. However, no one outside an urgent or emergency care setting will be able to access personal health information unless you provide your keyword.