Practice Matters

Health information custodian and health information custodian successor

Record-Keeping

This article was first published in the January 2023 Communiqué and updated in September 2024 

 

Registrants who are health information custodians are advised to designate a successor in writing (with the successor’s consent). A “successor” is someone who agrees to become the custodian of your records in the event of your inability to fulfill this role.

 

At registration renewal, registrants are asked to review their health information custodian (HIC) successor page to ensure the information is up to date. Registrants can also update their health information custodian successor information at any time in their CRPO account.

 

What is a health information custodian (HIC)? 

A health information custodian is the person or organization responsible for maintaining health records.

 

When practising alone, the registrant is the health information custodian of their clients’ records.

 

When an RP is working as an employee of an agency or hospital, they are expected to follow the record management policies of their employer. This assumes that the employer’s record management practices comply with the Personal Health Information Protection Act, 2004 (PHIPA). If this is not the case, the registrant must ensure that their clinical records comply with PHIPA and CRPO Professional Practice Standards. The organization may have an information or privacy officer to monitor compliance with PHIPA.

 

When the registrant is practising in a shared or group practice arrangement, it is important to clarify in writing at the outset who owns the records (the registrant, clinical supervisor, or group practice). In general, the health information custodian keeps the original record and provides copies when disclosing the record to others with authorization.

 

See the list of resources at the bottom of this article for more information about these obligations.

 

What is a health information custodian (HIC) successor? 

Registrants who are health information custodians are advised to designate a successor in writing (with the successor’s consent). A “successor” is someone who agrees to become the custodian of your records in the event of your inability to fulfill this role.

 

The successor’s name can be provided on the annual renewal form and is retained in CRPO’s records and used only to facilitate a client’s access to their clinical records.

 

Can I have more than one HIC successor? 

Yes. You can name two or more HIC successors. Registrants can update (i.e., edit, add, or remove) their successor custodian information at any time in their CRPO account.

 

Does my successor need to be registered/located in Ontario? 

The successor does not need to be registered or reside in Ontario, but you might wish to consider the role of the successor and their proximity to your clients. For example, if you have a paper-based record-keeping system, would it be possible for a client to easily access their records from someone located outside Ontario?

 

Does my successor need to be a Registered Psychotherapist? / Can a family member be a health information custodian (HIC)? 

When considering who might be an appropriate successor, it would be important to ensure they have the competence necessary to fulfill the role of a health information custodian. Standard 6.4, Closing, Selling or Relocating a Practice, encourages registrants to select qualified successors, who have knowledge of healthcare privacy law. In order to best ensure compliance with CRPO standards, the College suggests selecting another registrant when possible. If this is not possible, it would be helpful for the successor to at least be a registrant of a regulated health profession in Ontario; a registrant of the Ontario College of Social Workers and Social Service Workers;, or a healthcare institution, as these individuals and organizations are likely to be familiar with the framework of health care law and regulation.

 

Registrants are advised to make appropriate arrangements in advance for the transfer of records to a successor. If a specific HIC successor is not named, PHIPA, section 3(12) indicates an estate trustee or administrator would become responsible for a deceased registrant’s records, until custody of the records passes to another legally authorized person. This might place someone who is unfamiliar with PHIPA requirements and the importance of maintaining client confidentiality in the role of a health information custodian.

 

Can I provide my HIC successor with access to my records? Does my HIC successor need to sign a confidentiality agreement?

“PHIPA provides for the disclosure of personal health information without consent, including disclosure in the following circumstances:… to potential and actual successors of the custodian (although potential successors must provide a written confidentiality assurance and affected individuals must be notified of any actual transfer of records to a successor);” (See page 9 in the Guide to PHIPA 2020.)

 

I am an independent contractor within a private practice, and I use the clinic owner’s software to maintain my records. Am I the health information custodian (HIC)? 

CRPO is unable to determine who is the health information custodian. When working with others, it is important to establish who is the health information custodian at the outset of the relationship. You can read more about this in our Practice Matters article on Professionalism in business relationships, linked in Related Resources below. How a client’s personal health information (PHI) will be handled, and who may access it, is something that needs planning.

 

I work in private practice, but I do not know anyone who is willing to be my successor. What should I do? 

RPs in solo private practice are strongly encouraged to have contact with other RPs, for example a supervisor, mentor, colleague, consultant, peer group, etc. Over time the RP could explore whether any of these colleagues would serve as a successor custodian.

 

If it is not immediately possible to identify a successor, you may enter the name of the person who would become your estate trustee in the event of your death. Please seek legal advice if you are unsure who this would be. If you are still unable to name a successor custodian, enter “N/A” or other similar entries in the annual renewal form. You can update this information if it changes at any time in your CRPO account.

 

Do I need to include the name of my health information custodian successor in my will? 

It is not a CRPO requirement to include the name of your HIC successor in your will. In any case, it would be prudent for you to ensure that you have a contingency plan in place. If no one specifically is named, PHIPA, section 3(12) indicates an estate trustee or administrator would become responsible for the deceased registrant’s records, until custody of the records passes to another legally authorized person.

Related Resources

For additional information, see the resources below.

  • Professional Practice Standards

    Standards Section 5: Record-Keeping & Documentation

    The Professional Practice Standards regarding record keeping and documentation.

    Read more here
  • Standard 6.4

    Closing, Selling, or Relocating a Practice

    The Professional Practice Standards regarding closing, selling, or relocating a practice.

     

    Read more here
  • Practice Matters

    Contingency Planning

    What happens to my clients and clinical records if I’m suddenly no longer able to practise?

     

    Read more here
  • Practice Matters

    Professionalism in Business Relationships

    When an RP enters into a private practice business arrangement with another person, it is essential that they address key details of their business relationship at the outset.

    Read more here
  • The Personal Health Information Protection Act, 2004

    A Guide for Regulated Health Professionals 

    This is intended as a general guide for regulated health professionals in Ontario about the basic concepts of the Personal Health Information Protection Act, 2004 and how to begin the process of developing a plan for complying with it.

    Download PDF
  • The Personal Health Information Protection Act, 2004

    What You Need to Know About Privacy Law

    If you engage in commercial activities involving the collection, use or disclosure of personal information outside of Ontario, then you will also need to comply with the federal Personal Information Protection and Electronic Documents Act.

     

    Download PDF
  • Standard Section 5: Record Keeping & Documentation

    Jurisprudence e-Learning Manual

    This manual describes the professional and legal obligations of registered psychotherapists. Part 1: Professional Regulation, Part 2: Professional Practice Standards, and Part 3: Laws.

    Read more here
  • Information & Privacy Commissioner of Ontario

    PHIPA Frequently Asked Questions

    This FAQ provides a general overview of the Personal Health Information Protection Act and Regulation 329/04.

    Read more here
  • Information & Privacy Commissioner of Ontario

    Succession Planning to Help Prevent Abandoned Records

    Custodians have obligations under PHIPA to take reasonable steps to ensure personal health information in their custody or control is protected against privacy breaches.

    Read more here
  • Information & Privacy Commissioner of Ontario

    Avoiding Abandoned Health Records

    You are responsible for safeguarding health records before, during, and after a change in practice. This duty does not end until the custody or control of the records passes to another legally authorized person.

    Read more here

Join our mailing list and stay up to date with the latest news

Sign up to receive news and information from us.

Sign Up Today