There are many different types of activities that may be used to address priority risks in each of the four planning areas. Collaborative, multi-sectoral risk intervention models, such as Situation Tables, are one example of initiatives that are widely used across the province in risk intervention. They involve multi-sector service providers assisting individuals, families, groups and places facing acutely elevated risk of harm by connecting them to resources in the community within 24 to 48 hours. As information sharing has been identified by many communities as a barrier to the success of these models, this section was developed to provide guidance. In addition to the information sharing guidance below, the Risk-driven Tracking Database is another tool available to support communities implementing their multi-sectoral risk intervention models (see Tool 5 – Analyzing Community Risks).

While the following speaks specifically to multi-sectoral risk intervention models, the importance of sharing information in each of the four planning areas cannot be understated. In order for planning to be effective, multi-sector agencies and organizations must work together, including sharing information in social development on long-term planning and performance data between sectors, in prevention on aggregate data and trends to inform priority risks, in risk intervention on risks facing individuals, families, groups and places and in incident response on a situation at hand.

Guidance on information sharing in multi-sectoral risk intervention models

Please note that not all aspects of the information sharing principles and Four Filter Approach outlined below are prescribed in legislation and many may not be mandatory for your specific agency or organization. Together, they form a framework intended to guide professionals (for example, police officers, educators from the school boards, mental health service providers, etc.) that are engaged in multi-sectoral risk intervention models (for example, Situation tables) that involve sharing information.

The sharing of personal information and personal health information (personal information) requires compliance with the Freedom of Information and Protection of Privacy Act (FIPPA), Municipal Freedom of Information and Protection of Privacy Act (MFIPPA), the Personal Health Information Protection Act (PHIPA), and/or other pieces of legislation by which professionals are bound (for example, the Youth Criminal Justice Act). With that, before engaging in a multi-sectoral risk intervention model, all professionals should familiarize themselves with the applicable legislation, non-disclosure and information sharing agreements and professional codes of conduct or policies that apply to their respective agency or organization.

Considerations should also be made for undergoing a Privacy Impact Assessment (PIA) and entering into a confidentiality agreement. Conducting a PHIPA and entering into information sharing agreements is recommended to ensure that adequate standards for the protection of personal information are followed.

For information on Personal Health Information Protection Act (PHIPA), refer to the Planning for Success: Privacy Impact Assessment Guide, (PDF, 517 Kb) and Privacy Impact Assessment Guidelines (PDF, 267 Kb) for the Ontario Personal Health Information Protection Act”.

Once the decision has been made to participate in a multi-sectoral risk intervention model, such as a Situation table, agencies/organizations should also ensure transparency by making information about their participation publicly available, including the contact information of an individual who can provide further information or receive a complaint about the agency/organization’s involvement.

Note: Information contained below should not be construed as legal advice.

Information sharing principles for multi-sectoral risk intervention models

Information sharing is critical to the success of collaborative, multi-sectoral risk intervention models and partnerships that aim to mitigate risk and enhance the safety and well-being of Ontario communities. Professionals from a wide range of sectors, agencies and organizations are involved in the delivery of services that address risks faced by vulnerable individuals and groups. These professionals are well-placed to notice when an individual(s) is at an acutely elevated risk of harm, and collaboration among these professionals is vital to harm reduction.

Recognizing that a holistic, client-centered approach to service delivery is likely to have the most effective and sustainable impact on improving and saving lives, professionals involved in this approach, who are from different sectors and governed by different privacy legislation and policy, should consider the following common set of principles. It is important to note that definitive rules for the collection, use and disclosure of information are identified in legislation, and the following principles highlight the need for professional judgment and situational responses to apply relevant legislation and policy for the greatest benefit of individual(s) at risk.

Consent

Whenever possible, the ideal way to share personal information about an individual is by first obtaining that individual’s consent. While this consent may be conveyed by the individual verbally or in writing, professionals should document the consent, including with respect to the date of the consent, what information will be shared, with which organizations, for what purpose(s), and whether the consent comes with any restrictions or exceptions.

When a professional is engaged with an individual(s) that they believe is at an acutely elevated risk of harm, and would benefit from the services of other agencies/ organizations, they may have the opportunity to ask that individual(s) for consent to share their personal information. However, in some serious, time-sensitive situations, there may not be an opportunity to obtain consent. In these instances, professionals should refer to pieces of legislation, including privacy legislation, which may allow for the sharing of personal information absent consent.

With or without consent, professionals may only collect, use or disclose information in a manner that is consistent with legislation (i.e., Freedom of Information and Protection of Privacy Act, Municipal Freedom of Information and Protection of Privacy Act, Personal Health Information Protection Act and/or other applicable legislation to which the agency/organization is bound), and they must always respect applicable legal and policy provisions.

Professional codes of conduct

It is the responsibility of all professionals to consider and adhere to their relevant professional codes of conduct and standards of practice. As in all aspects of professional work, any decision to share information must be executed under appropriate professional discipline. This presumes the highest standards of care, ethics, and professional practice (for example, adherence to the policies and procedures upheld by the profession) will be applied if and when personal information is shared. Decisions about disclosing personal information must also consider the professional, ethical and moral integrity of the individuals and agencies/organizations that will receive the information. The decision to share information must only be made if the professional is first satisfied that the recipient of the information will also protect and act upon that information in accordance with established professional and community standards and legal requirements. As this relates to collaborative community safety and well-being practices, this principle reinforces the need to establish solid planning frameworks and carefully structured processes.

Do no harm

First and foremost, this principle requires that professionals operate to the best of their ability in ways that will more positively than negatively impact those who may be at an acutely elevated risk of harm. Decisions to share information in support of an intervention must always be made by weighing out the benefits that can be achieved for the well-being of the individual(s) in question against any reasonably foreseeable negative impact associated with the disclosure of personal information. This principle highlights what professionals contemplate about the disclosure of information about an individual(s) in order to mitigate an evident, imminent risk of harm or victimization. This principle ensures that the interests of the individual(s) will remain a priority consideration at all times for all involved.

Duty of care

Public officials across the spectrum of human services assume within their roles a high degree of professional responsibility – a duty of care – to protect individuals, families and communities from harm. For example, the first principle behind legislated child protection provisions across Canada is the duty to report, collaborate, and share information as necessary to ensure the protection of children. Professionals who assume a duty of care are encouraged to be mindful of this responsibility when considering whether or not to share information.

Due diligence and evolving responsible practice

The Office of the Information and Privacy Commissioner of Ontario (IPC) is available and willing to provide general privacy guidance to assist institutions and health information custodians in understanding their obligations under FIPPA, MFIPPA and PHIPA. These professionals are encouraged to first seek any clarifications they may require from within their respective organizations, as well as to document, evaluate and share their information sharing-related decisions in a de-identified manner, with a view to building a stronger and broader base of privacy compliant practices, as well as evidence of the impact and effectiveness of information sharing.

Note that FIPPA, MFIPPA and PHIPA provide civil immunity for any decision to disclose or not to disclose made reasonably in the circumstances and in good faith.

Acutely elevated risk

For the purposes of the following Four filter approach, “acutely elevated risk” refers to any situation negatively affecting the health or safety of an individual, family, or specific group of people, where professionals are permitted in legislation to share personal information in order to eliminate or reduce imminent harm to an individual or others.

For example, under section 42(1)(h) of Freedom of Information and Protection of Privacy Act (FIPPA), section 32(h) of Municipal Freedom of Information and Protection of Privacy Act and section 40(1) of Personal Health Information Protection Act (PHIPA), the following permissions are available.

Significant risk of serious bodily harm” includes a significant risk of both serious physical as well as serious psychological harm. Like other provisions of PHIPA, section 40(1) is subject to the mandatory data minimization requirements set out in section 30 of PHIPA

Four filter approach to information sharing

In many multi-sectoral risk intervention models, such as Situation Tables, the discussions may include sharing limited personal information about an individual(s) such that their identity is revealed. For that reason, the Ministry encourages professionals to obtain express consent of the individual(s) before the collection, use and disclosure of personal information. If express consent is obtained to disclose personal information to specific agencies/organizations involved in a multi-sectoral risk intervention model for the purpose of harm reduction, the disclosing professional may only rely on consent to disclose personal information and collaborate with the specific agencies/organizations and only for that purpose.

If it is not possible to obtain express consent and it is still believed that disclosure is required, professionals in collaborative, multi-sectoral risk intervention models are encouraged to comply with the Four Filter Approach outlined below.

Under the Four Filter Approach, the disclosing agency/organization must have the authority to disclose and each recipient agency/organization must have the authority to collect the information. The question of whether an agency/organization “needs-to-know” depends on the circumstances of each individual case.

Filter one: initial agency/organization screening

The first filter is the screening process by the professional that is considering engaging partners in a multi-sectoral intervention. Professionals must only bring forward situations where they believe that the subject individual(s) is at an acutely elevated risk of harm as defined above. The professional must be unable to eliminate or reduce the risk without bringing the situation forward to the group. This means that each situation must involve risk factors beyond the agency/organization’s own scope or usual practice, and thus represents a situation that could only be effectively addressed in a multi-sectoral manner. Professionals must therefore examine each situation carefully and determine whether the risks posed require the involvement of multi-sectoral partners. Criteria that should be taken into account at this stage include:

  • The intensity of the presenting risk factors, as in: Is the presenting risk of such concern that the individual’s privacy intrusion may be justified by bringing the situation forward for multi-sectoral discussion?
  • Is there a significant and imminent risk of serious bodily harm if nothing is done?
  • Would that harm constitute substantial interference with the health or well-being of a person and not mere inconvenience to the individual or a service provider?
  • Did the agency/organization do all it could to mitigate the risks before bringing forward the situation?
  • Do the risks presented in this situation apply to the mandates of multiple agencies/organizations?
  • Do multiple agencies/organizations have the mandate to intervene or assist in this situation?
  • Is it reasonable to believe that disclosure to multi-sectoral partners will help eliminate or reduce the anticipated harm?

Before bringing a case forward, professionals should identify in advance the relevant agencies or organizations that are reasonably likely to have a role to play in the development and implementation of the harm reduction strategy.

Filter two: de-identified discussion with partner agencies/organizations

At this stage, it must be reasonable for the professional to believe that disclosing information to other agencies/organizations will eliminate or reduce the risk posed to, or by, the individual(s). The professional then presents the situation to the group in a de-identified format, disclosing only descriptive information that is reasonably necessary. Caution should be exercised even when disclosing de-identified information about the risks facing an individual(s), to ensure that later identification of the individual(s) will not inadvertently result in disclosure beyond that which is necessary at filter three. This disclosure should focus on the information necessary to determine whether the situation as presented appears to meet, by consensus of the table, both the threshold of acutely elevated risk, outlined above, and the need for or benefit from a multi-agency intervention, before any identifying personal information is disclosed.

The wide range of sectors included in the discussion is the ideal setting for making a decision as to whether acutely elevated risk factors across a range of professionals are indeed present. If the circumstances do not meet this threshold, no personal information may be disclosed and no further discussion of the situation should occur. However, if at this point the presenting agency/organization decides that, based on the input and consensus of the table, disclosing limited personal information (for example, the individual’s name and address) to the group is necessary to help eliminate or reduce an acutely elevated risk of harm to an individual(s), the parties may agree to limited disclosure of such information to those agencies/organizations at filter three.

Filter three: limited identifiable information shared

If the group concludes that the threshold of acutely elevated risk is met, they should determine which agencies/organizations are reasonably necessary to plan and implement the intervention. Additionally, the presenting agency should inform the table of whether the individual has consented to the disclosure of his or her personal information to any specific agencies/organizations. All those agencies/organizations that have not been identified as reasonably necessary to planning and implementing the intervention must then leave the discussion until dialogue about the situation is complete. The only agencies/organizations that should remain are those to whom the individual has expressly consented to the disclosure of his or her personal information, as well as those that the presenting agency reasonably believes require the information in order to eliminate or reduce the acutely elevated risk(s) of harm at issue.

Identifying information may then be shared with the agencies/organizations that have been identified as reasonably necessary to plan and implement the intervention at filter four.

Any notes captured by any professionals that will not be involved in filter four must be deleted. Consistency with respect to this “need-to-know” approach should be supported in advance by way of an information sharing agreement that binds all the involved agencies/organizations.

Note: It is important that the agencies/organizations involved in multi-sectoral risk intervention models be reviewed on a regular basis. Agencies/organizations that are rarely involved in interventions should be removed from the table and contacted only when it is determined that their services are required.

Filter four: full discussion among intervening agencies/organizations only

At this final filter, only agencies/organizations that have been identified as having a direct role to play in an intervention will meet separately to discuss limited personal information required in order to inform planning for the intervention. Disclosure of personal information in such discussions shall remain limited to the personal information that is deemed necessary to assess the situation and to determine appropriate actions. Sharing of information at this level should only happen to enhance care.

After that group is assembled, if it becomes clear that a further agency/organization should be involved, then professionals could involve that party bearing in mind the necessary authorities for the collection, use and disclosure of the relevant personal information.

If at any point in the above sequence it becomes evident that resources are already being provided as required in the circumstances, and the professionals involved are confident that elevated risk is already being mitigated, there shall be no further discussion by the professionals other than among those already engaged in mitigating the risk.

The intervention

Following the completion of filter four, an intervention should take place to address the needs of the individual, family, or specific group of people and to eliminate or mitigate their risk of harm. In many multi-sectoral risk intervention models, the intervention may involve a “door knock” where the individual is informed about or directly connected to a service(s) in their community. In all cases, if consent was not already provided prior to the case being brought forward (for example, to a Situation Table), obtaining consent to permit any further sharing of personal information in support of providing services must be a priority of the combined agencies/organizations responding to the situation. If upon mounting the intervention, the individual(s) being offered the services declines, no further action (including further information sharing) will be taken.

It is important to note that institutions such as school boards, municipalities, hospitals, and police services are required to provide written notice to individuals following the disclosure of their personal information under section 42(1)(h) of Freedom of Information and Protection of Privacy Act (FIPPA) and section 32(h) of Municipal Freedom of Information and Protection of Privacy Act (MFIPPA). Even where this practice is not required, we recommend that all individuals be provided with written notice of the disclosure of their personal information. This should generally be done when the intervention is being conducted. In the context of multi-sectoral risk intervention models, such written notices should indicate the names and contact information of all agencies to whom the personal information was disclosed at filters three and four, whether verbally or in writing.

Report back

This “report back” phase involves professionals receiving express consent from the individual(s) to provide an update regarding their intervention to the group, including to those who did not participate in the intervention. This may involve reporting back, in a de-identified manner, on pertinent information about the risk factors, protective factors and agency/organization roles that transpired through the intervention. In the absence of express consent of the individual(s), the report back must be limited to the date of closure and an indication that the file can be closed or whether the intervening agencies need to discuss further action. If the file is being closed, limited information may be shared regarding the reason for closure (for example, connected to service).

Contact us

Information and Privacy Commissioner