A “lock-box” is not a thing but rather a concept or term used to describe the right of patients to withhold or withdraw their consent to the collection, use or disclosure of their personal health information. Individuals may expressly instruct you to not use or disclose their personal health information for health care purposes.
They could tell you to:
- not collect, use or disclose a particular item of personal health information, such as a specific diagnosis, for health care purposes,
- not to collect, use or disclose the contents of their entire record of personal health information, or
- not to use or disclose their personal health information to a particular individual or group.
A patient cannot stop you from recording personal health information that is required by law or by College Standards. But once a patient locks personal health information, you cannot use or disclose the information, unless the individual provides express consent, or unless the law allows you to disclose the locked personal health information (for example, in an emergency).
If you later need to share information about the patient with another health care provider, and you don't have the patient's consent to disclose all the personal health information you feel is necessary, you must notify the receiving health care provider of that fact (i.e., that there is information being withheld at the patient's request - but not the information itself). The receiving provider would then be able to explore the matter of the locked personal health information with the patient and seek their express consent to access the locked information.
Here is a link to a Fact Sheet put out by the Office of the Information and Privacy Commissioner of Ontario