Practice Matters

What do I need to consider when hiring administrative staff/technical support providers who might have access to client information?

Consent & Confidentiality

This article was first published in the February 2022 Communiqué

 

When preparing and maintaining records, Registered Psychotherapists are subject to the Personal Health Information Protection Act, 2004 (PHIPA). PHIPA governs therapists’ use of personal health information, including its collection, use, disclosure and access.

 

PHIPA allows health information custodians to engage the services of agents. For example, administrative staff or technical support providers could be considered an agent of the health information custodian. When working with an agent, there should be a confidentiality agreement in place. The custodian is still responsible for the records, even if they have an agent. The custodian must take reasonable steps (such as training, oversight and having policies in place) to ensure the agent maintains privacy of the information to which they have access.

 

The following definitions are found in the Information and Privacy Commissioner of Ontario’s Frequently Asked Questions: Personal Health Information Protection Act, linked in Related Resources below:

 

What is a Custodian? 

A custodian is a person or organization listed in PHIPA that, as a result of [their] power or duties or work set out in PHIPA, has custody or control of personal health information.

 

What is an agent? 

PHIPA defines an agent to include any person who is authorized by a custodian to perform services or activities in respect of personal health information on the custodian’s behalf and for the purposes of that custodian.

 

An agent may include a person or company that contracts with, is employed by or volunteers for a custodian and, as a result, may have access to personal health information. PHIPA permits custodians to provide personal health information to their agents only if the custodian is permitted to collect, use, disclose, retain or dispose of the information.

 

For more information, please see the resources linked below.

Related Resources

For additional information, see the resources below.

  • Ontario Government

    Personal Health Information Protection Act, 2004

    PHIPA allows health information custodians to engage the services of agents. For example, administrative staff or technical support providers could be considered an agent of the health information custodian.

    Read more here
  • Information & Privacy Commissioner of Ontario

    IPC Resources

    The Commissioner is an officer of the Legislature who is appointed by, and reports to the Legislative Assembly of Ontario, and is independent of the government of the day.

    Read more here
  • Information & Privacy Commissioner of Ontario

    PHIPA Frequently Asked Questions

    This FAQ provides a general overview of the Personal Health Information Protection Act and Regulation 329/04.

    Read more here
  • Standard 3.1

    Confidentiality

    The Professional Practice Standards regarding confidentiality.

    Read more here
  • Standard 5.1

    Clinical Records

    The Professional Practice Standards regarding record keeping and documentation.

    Read more here

Join our mailing list and stay up to date with the latest news

Sign up to receive news and information from us.

Sign Up Today