Privacy and safety: Issues of dual compliance in high-secure and other forensic psychiatric hospitals

Health care organizations are obligated to provide safe and effective treatment to their patients and also protect the safety of their workers. This paper analyzes the tensions arising from legislative regimes that, respectively, protect privacy and workplace safety, using a large, tertiary high-secure forensic psychiatric hospital in Ontario, Canada, as an example. In Ontario, the Personal Health Information Protection Act (PHIPA) prohibits personal health information (PHI) from being disclosed to individuals who fall outside the "circle of care," including nonclinical employees who have direct involvement with patients and may be at risk of violence. PHIPA permits the disclosure of information where there is a risk of violence, but the statute's scheme for privacy protection was not designed to address, and may not be compatible with, the operations and requirements of high-secure forensic and other psychiatric hospitals. At the same time, the Occupational Health and Safety Act (OHSA) creates a regulatory framework that sets health and safety standards, including an employer's duty to disclose the risk of violence. OHSA prosecutions and proceedings demonstrate how these duties have been enforced against psychiatric hospitals. We examine this regulatory backdrop, explaining that PHIPA provides little guidance to psychiatric hospitals, where the risk of violence is elevated. We also discuss issues of dual compliance that arise from a hospital's legal obligations under PHIPA and OHSA. Finally, we turn to the ongoing clinical and operational challenges, suggesting strategies for increasing staff safety. These include strengthening the therapeutic alliance and providing patients with the option of consenting to disclosure of PHI to those outside the circle of care.