Memo: Important Changes to Consent Management in the Electronic Health Record

Ontario Health is updating its consent model for the provincial Electronic Health Record (EHR) – the rules governing how patients can block or allow access to their health information – to make it easier for patients and health care providers to manage consent preferences in the EHR. These changes will have an impact on how consent directives will be applied in the EHR and how health care providers perform consent overrides.

Please share with privacy officers and anyone in your organization who manages data in the EHR or views it through one of the provincial viewers.

What is the EHR?

The EHR contains a secure digital record of patients’ personal health information, which is made available electronically for health care providers to care for their patients.

What is Changing?

Applying consent directives

A consent directive gives patients – or their substitute decision makers – the option to restrict access to personal health information in the EHR. If a patient – or their substitute decision maker – does not want their health information shared with members of their health care team, they can restrict access by contacting Ontario Health to request a consent directive be applied to their health information. This means that when a health care provider tries to access this information, a notice will appear to indicate that the information is blocked.

As of February 13, 2026, patients will have the following two options to choose from when making a request to Ontario Health to apply consent directives to their personal health information in the EHR:

• Option 1 – Repository: Restrict access to all records within a clinical repository of the EHR.
• Option 2 – Global: Restrict access to all records in all existing clinical repositories of the EHR as well as any future repositories.

In accordance with the above options, Ontario Health will update consent directives implemented prior to the date of this letter in respect of the Acute and Community Clinical Data Repository (acCDR) and the Diagnostic Imaging Common Services (DI-CS) repositories. For each of these repositories, where a consent directive was previously applied to block or allow specified records or health care providers/organizations, this will now be applied to block all records within the applicable repositories (Option 1), affording an equal or greater protection of records. This change is anticipated to be completed by April 30, 2026. Please note: Consent directives applied in the Ontario Laboratories Information System (OLIS) and Digital Health Drug Repository (DHDR) will not be impacted by this change.

In accordance with this change, Ontario Health will no longer accept requests for consent directives from health care providers and will no longer leverage Service Ontario for the intake of consent directive requests.

Overriding consent directives

If a patient has applied a consent directive to their health records in the EHR, there are certain circumstances where a health care provider may still be permitted to access these records. In these circumstances, the health care provider can perform a consent override, which will result in the temporary display of the blocked information to the health care provider.

When a health care provider performs a consent override, they will be required to select the reason for the override:

• The health care provider has obtained express consent from the individual with whom the information relates.
• The health care provider believes, on reasonable grounds, that the collection is necessary for the purpose of eliminating or reducing a significant risk of serious bodily harm to the individual to whom the personal health information (PHI) relates and it is not reasonably possible for the provider to obtain the individual’s consent in a timely manner.
• The health care provider believes, on reasonable grounds, that the collection is necessary for the purpose of eliminating or reducing a significant risk of serious bodily harm to a person other than the individual to whom the PHI relates or a group of persons.

After the health care provider performs a consent override, records for which the consent directive was applied will be accessible to the health information custodian (and its agents) for a standardized 8-hour period.

These changes are anticipated to be completed by April 30, 2026.

Why Are We Making These Changes?

Ontario Health is committed to protecting patients’ privacy. This update to the consent model strengthens that commitment by making it easier for patients and health care providers to manage consent preferences in the EHR – creating a more consistent experience across the health system and reducing the risk that information is accessed in a way that goes against a patient’s wishes.

What Do You Need to Do?

• Advise patients that they need not do anything as any changes will afford an equivalent or greater protection for their records in the EHR, or direct them to complete and submit an EHR Consent Directive Request Form if they would like to make, modify or withdraw a consent directive for their records. Patients may also be referred to the eHealth website for further information on consent directives.
• Comply with the EHR Consent Directive and Consent Override Policy when accessing the EHR.
• If you have any questions about consent directives, consent overrides or how personal health information is managed in the EHR, please contact:
  
  Ontario Health Privacy Office
  Phone: 416-946-4767 or 1-888-411-7742
  Email: OH-DS_privacy@ontariohealth.ca