This article was updated September 2024
Registrants (or the organization they work for) are free to choose whichever record-keeping system is best suited to their needs and access to technology. The same principles apply to both paper and electronic record-keeping. For example, modifications to any record need to be tracked. In other words, the originals must not be overridden or erased.
Security of paper records would include locking and storage, while for electronic records it would include encryption, virus prevention, backups, and physically restricting access to the computer and display. When using electronic record-keeping systems, an alternate process for record-keeping must be ready in case the electronic system is down or unavailable. Review CRPO’s Professional Practice Standard 5.6: Record Storage, Security, & Retrieval for more detail.
Question:
I have been using paper in the past and want to switch to electronic record-keeping. Can I scan and destroy the paper copies?
Answer:
There are options when it comes to transitioning from paper to electronic record-keeping. You may either convert all existing paper records into electronic form, or retain paper records and begin entering information into an electronic format on a subsequent basis. In either case, client care and appropriate record-keeping practices must continue without interruption.
When scanning paper records, registrants are responsible for ensuring their integrity upon conversion into electronic format. This includes verifying that documents have been properly scanned and that the entire record is intact, including any attached documents and notes. You should establish specific procedures for converting files and document these procedures in writing. It may be helpful to enlist a reputable commercial organization to assist in this process[1].
The Information and Privacy Commissioner of Ontario states that old paper records should not be destroyed unless the required retention period has expired or the entire paper-based record has been duplicated in electronic format[2].
Question:
How do I determine who is the “health information custodian”?
Answer:
CRPO often receives questions about who is responsible for health information recorded by a registrant. The answer to this question depends on identifying the “health information custodian.” The term “health information custodian” is defined in the Personal Health Information Protection Act, 2004 (PHIPA) [3,4]. In short, a custodian is an individual or organization that has custody or control of personal health information.
If practising alone, a registrant is the health information custodian of their clients’ information. If employed by another health information custodian such as a hospital, the employer is the health information custodian and the registrant is expected to follow the record management practices of their employer.
Where a registrant is employed by a non-health organization such a school, university, college or municipality, the registrant is considered to be the custodian. In these situations, the registrant cannot disclose personal health information to their employer without the client’s consent or another legal exception.
In other situations, the answer may not be clear, and registrants will need to speak with their employer. The Information and Privacy Commissioner of Ontario also has resources on this topic [5,6].
Question:
How do I properly destroy my client files?
Answer:
Records, including clinical records, appointment records, and financial records, need to be kept for 10 years from the last interaction with the client or from the client’s 18th birthday, whichever is later[7].
When the time period for keeping the record has expired, the records should be destroyed. If the therapist destroys any records, they should record the names of the destroyed files and the date they were destroyed.” For paper records, destruction means cross-cut shredding, not simply continuous (single strip) shredding, which can be reconstructed. You should consider pulverization or incineration of records that are highly sensitive. You might also hire a licensed service provider to destroy your files. In doing so, look for a provider accredited by an industrial trade association, such as the National Association for Information Destruction (NAID) [8].
The Information and Privacy Commissioner of Ontario (IPC) has a Technology Fact Sheet on the topic of disposing electronic media, linked in Related Resources below.
For questions about confidentiality and health records, contact the Information and Privacy Commissioner of Ontario.
Toronto Area: 416-326-3333
Toll Free: 1-800-387-0073
info@ipc.on.ca
[1] From “Ontario Policy Statement # 33-38, Electronic Records”, 2000, College of Physicians and Surgeons, p. 5.
[2]From “Personal Health Information: A Practical Tool for Physicians Transitioning from Paper-Based Records to Electronic Health Records”, 2009, Information and Privacy Commissioner of Ontario, p. 20.
[3]From “Frequently Asked Questions Personal Health Information Protection Act”, 2015, Information and Privacy Commissioner of Ontario, p.7-9.
[4]From “Personal Health Information Protection Act”, 2004, Information and Privacy Commissioner of Ontario, Section 3(1).
[5] From “A Guide to the Personal Health Information Protection Act”, 2004, Information and Privacy Commissioner of Ontario.
[6]From “ Frequently Asked Questions Personal Health Information Protection Act”, Information and Privacy Commissioner of Ontario, 2015.
[7]From “ The CRPO Professional Practice Standards for Registered Psychotherapists”.
[8]From “Personal Health Information: A Practical Tool for Physicians Transitioning from Paper-Based Records to Electronic Health Records”, 2009, Information and Privacy Commissioner of Ontario, p. 22.