Designing family updates under PHIPA

In an emergency department chat service, family members sent more than three times as many messages as patients, and wait time was their top question. The people who found it most useful were family members who weren't there.^[1] Families call the desk, walk up to triage and text the patient, often at the worst possible moment.

Automated updates can take most of that load. Real-time, EHR-triggered texts to emergency patients and family members have been run largely in the background, without adding work for nurses.^[2] The question is not whether to update families, but how to do it without disclosing more than the patient wants.

Under Ontario's Personal Health Information Protection Act, the hospital is the custodian and a family member is the recipient of a disclosure. That disclosure rests on the patient's consent, and it must be limited to what is reasonably necessary.^[3][4]

• Express, recorded consent. Each link records who created it, when, with which scope and through which channel.
• Minimum necessary. A fixed, versioned scope. Changing what family can see needs a new scope version and fresh consent for new links.
• Withdrawable. Consent can be withdrawn at any time by revoking the link, from the patient's phone.
• Logged. Every time a link is opened, it is written to the audit log the privacy office reviews.

The family stage labels deliberately collapse "tests", "results back" and "waiting for a specialist" into "Care in progress". A family member told that "results are back" will ask what they say, and that conversation belongs to the patient and the care team.

• Invites carry nothing personal. The preferred path is the phone's own share sheet, so the service never learns the recipient. The text-message fallback verifies the number with a code and sends a generic message with no names and no free text the patient typed.
• Tell the patient when a link is opened. The first open appears in the patient's own updates, so an unexpected viewer is noticed. Intimate partner violence is a real risk in emergency departments.
• Limit devices. Each link works on a small number of devices, and the patient can remove one.
• Honour privacy flags. Confidential or "no information" status, a custody concern or a restricted view revoke every link at once, with no departure message.
• Pause, don't end, when it matters. When updates are paused, family links pause too and show only that updates are paused.

Family links in EDFlow end with the patient's access to the visit, or earlier if the patient chooses a shorter time. Family notifications are opt-in and say only "There's a new update", with a link: no names on a lock screen, no hospital, no tests. Every one of these rules is covered by an automated test, because a privacy promise that isn't tested isn't a promise.