August 13, 2016

The College often receives inquiries from members of the public and health care professionals who have been unable to access patient records from registrants because they have moved to different practice locations or left practice without taking proper steps to transfer or dispose of their patient files.  This raises serious concerns with respect to the privacy and security of patient personal information and safety concerns in terms of continuity of care.  As such, these inquiries have led to Inquiry Committee investigations and action in every case. Registrants are therefore reminded to familiarize themselves with the requirements for collecting, using and disclosing personal information and for storage, disposal and transfer of patient records under .

Registrants are required to ensure that all records pertaining to their practice that contain “personal information” (which is defined as “recorded information about an identifiable individual” other than business contact information) are safely and securely stored.  Those records must only be accessible to the registrant, his or her staff, and persons who have signed a confidentiality agreement with the registrant. This issue often surfaces in the context of embedded practices where registrants provide optometric services in optical stores or other business settings. It is critical to ensure that any person who is not employed by the registrant has signed a confidentiality agreement before being permitted access to the patient’s personal information. Registrants must ensure that they comply with the bylaw requirements and the requirements of the Personal Information Protection Act before disclosing patient personal information to third parties – even those with whom they have a business association.

The bylaws also govern the disposal or transfer of records containing personal information.  If a registrant moves to a different practice location or ceases to practice, he or she must ensure that records are transferred to the patient or, with the consent of the patient, to another registrant or a BC optometric corporation.  The records cannot be transferred to any other third person, organization or business. If the patient records are not transferred, and the mandatory storage period of ten years (or ten years after a minor patient reaches the age of 19) has expired, the records may be destroyed by way of a shredder or burning.[1]  Personal information stored by electronic means must be erased in a manner that ensures that the information cannot be reconstructed.

A registrant who receives patient records from another registrant must notify the patient of the transfer.  A registrant who ceases to practice must not only dispose of records in accordance with the requirements of Part 7 but must also notify the College, and provide the College with a written summary of the steps taken to dispose or transfer patient records.  Registrants are also required to make appropriate arrangements to ensure that, in the event of death or incapacity, the patient records will be safely and securely transferred to another registrant or BC optometric corporation. In such circumstances, the registrant receiving patient records must also notify the patient concerned of the transfer. Finally, a registrant is required to provide immediate written notification to the College Registrar if records are moved from the registrant’s place of practice or other storage location to a new location.

The bottom line is that patient records must always be in the safe custody of a registrant or a BC optometric corporation. Patients must always be notified of and consent to transfer of their records to such third parties. That notification must be provided by the registrant seeking to transfer the records and by the registrant who receives the records. A registrant who intends to move his or her practice location or stop practising must provide written notification to the College of the steps taken to dispose or transfer patient records in accordance with the requirements of Part 7. When the College receives inquiries from members of the public or other health care professionals looking for the location of records, it must be in a position to advise the patient or health care professional where those records are located. If it cannot do so, the matter will be referred to the Inquiry Committee for investigation and regulatory action.

 [1] Registrants should be aware that the province amended the Limitations Act effective June 1, 2013 to increase the limitation period from six to 15 years for individuals to file civil claims. Under that Act, registrants should keep their records for 16 years from the date of the last entry or from the age of majority of the patient whichever is later. Registrants will want to ensure that they retain patient records for a sufficient period of time to be available in the event of a legal action.