Guideline – Confidentiality of Patient Information

Introduction. 3

Purpose of this Guideline. 3

Code of Ethics. 4

Saskatchewan Privacy Legislation. 4

   Patient consent to disclosure of their health information and exceptions where consent is not required   6   6

   Mandatory reporting. 7. 7

      Who, other than the patient, can access patient health information?. 7

      Disclosure to a child’s parents or guardian. 7. 7

      Disclosure to police. 8

      Conversations with, or about, patients in the health care setting. 9. 9

      Technology. 9

      Voice messaging. 9. 9

Unprofessional Conduct. 10

   Mandatory Reporting. 10. 10

The College’s Expectation. 11

   Mandatory Reporting. 11
      
Communicable Diseases

      Child Abuse or Neglect

      Child Sexual Abuse

      Patient Deaths – the Coroner

      Stillbirths and Deaths

      Fitness to Drive

      Automobile Accidents

      Workers’ Compensation Claims

      Gunshot and Stab Wounds

      Patients who are pilots or members of flight crews

      Railway Workers

      Loss or theft of narcotics or other controlled drugs

      Reporting Colleagues

. 11

FREQUENTLY ASKED QUESTIONS.. 18

   Patient Confidentiality and the Health Information Protection Act. 18


Introduction

 

Physicians have an ethical and a legal obligation to maintain confidentiality over their patients’ information.

It is not possible to provide appropriate medical care to patients if patients withhold relevant information out of concern that the confidentiality will not be maintained. Any breach in confidentiality reduces the faith and trust of members of the public in the medical profession and in the confidentiality of health information.

Generally a physician cannot provide a patient’s health information to someone other than the patient without the patient’s consent. There are some circumstances in which physicians are permitted or required to disclose their patient’s health information to others without patient consent.

 

Purpose of this Guideline

This guideline is intended to help physicians understand their legal and professional obligations to maintain patient confidentiality and to identify situations where patient confidentiality is not required.

This guideline cannot address every situation in which physicians will be required to determine their ethical and legal responsibilities relating to patient confidentiality.

Physicians who are uncertain about their obligations in a specific situation are encouraged to contact the College, Canadian Medical Protective Association or their legal counsel for advice. The Privacy Commissioner for Saskatchewan may also be able to assist in some circumstances.


Code of Ethics

 

The Canadian Medical Association Code of Ethics, with one modification unrelated to confidentiality of patient information, is part of the College’s bylaws. It sets out ethical expectations for physicians. The Code of Ethics states:

31. Protect the personal health information of your patients.

32. Provide information reasonable in the circumstances to patients about the reasons for the collection, use and disclosure of their personal health information.

33. Be aware of your patient’s rights with respect to the collection, use, disclosure and access to their personal health information; ensure that such information is recorded accurately.

34. Avoid public discussions or comments about patients that could reasonably be seen as revealing confidential or identifying information.

35. Disclose your patients’ personal health information to third parties only with their consent, or as provided for by law, such as when the maintenance of confidentiality would result in a significant risk of substantial harm to others or, in the case of incompetent patients, to the patients themselves. In such cases take all reasonable steps to inform the patients that the usual requirements for confidentiality will be breached.

36. When acting on behalf of a third party, take reasonable steps to ensure that the patient understands the nature and extent of your responsibility to the third party.

37. Upon a patient’s request, provide the patient or a third party with a copy of his or her medical record, unless there is a compelling reason to believe that information contained in the record will result in substantial harm to the patient or others.

Saskatchewan Privacy Legislation

The Health Information Protection Act and The Health Information Protection Regulations establish legal requirements in Saskatchewan for “trustees”. Physicians who are in “custody or control” of patient health information are trustees under the legislation with duties and obligations to protect patient health information.

The obligations are set out in The Health Information Protection Act and include:
  1. An obligation to inform patients about the anticipated use and disclosure of the information which the physician gathers (section 9)
  2. An obligation to have policies and procedures to assist patients to understand their rights, including the right to request access to their information (section 9)
  3. An obligation to take reasonable steps to be able to advise patients if their personal health information was disclosed to a third party without their consent. That does apply if the disclosure was made to another health care provider or a family member under the authority of section 27(2) of the Act (section 10)
  4. An obligation to give patients access to their personal health information if the patient requests, subject only to very limited exceptions (section 12, 31 to 38)
  5. An obligation to respond to a patient’s request to amend the information in their record (section 13, 40)f)     
  6. An obligation to have policies and procedures in place to protect the integrity, accuracy and confidentiality of patient’s health information against reasonably anticipated threats (section 16)
  7. An obligation to take reasonable steps to confirm the identity of non-trustees to whom patient health information is sent (section 21)
  8. If patient information is provided to a non-trustee without the consent of the patient, an obligation to notify that person that the information can only be used for the purpose for which the information was provided (section 21)
  9. An obligation to only collect, use and disclose patient health information that is reasonably necessary for the purpose (section 23)
  10. An obligation to have policies and procedures in place to limit employee access to only the patient health information that is necessary to carry out the employee’s responsibilities (section 23)
  11. An obligation to only disclose patient health information with the patient’s consent or as permitted in the legislation (section 27)

The Health Information Protection Regulations describe some situations in which physicians are permitted to provide patient health information to police without patient consent.

Patient consent to disclosure of their health information and exceptions where consent is not required

Patient information cannot usually be disclosed to third parties without the consent of the patient. However, there are exceptions to that principle. If a third party seeks to obtain patient health information without the consent of the patient, that third party should be able to identify the exception which applies. Unless the situation is one in which legislation has mandated the physician to report their patient’s health condition (e.g. child abuse or neglect, a patient’s inability to drive safely, etc.), a physician is not required to provide the requested information, even if permitted to do so. The most common exceptions where patient consent is not required are:

a)    To another health care provider to assist that person to provide care to the patient (section 27(2) of The Health Information Protection Act). The disclosure must be consistent with the physician’s ethical responsibilities. 
b)    To an immediate family member or another person with whom the patient has a “close personal relationship” subject to three requirements – the information must relate only to services currently being provided, the patients must not have refused permission to disclose the information and the disclosure must be consistent with the physician’s ethical obligations (section 27(2)). 
c)    To a person who is authorized to make a health care decision on behalf of a patient not competent to make the health care decision. The disclosed information must be limited to the information required to make an informed decision (section 27(4)). 
d)    To an immediate family member of a deceased patient, or someone else with whom the person had a close personal relationship. The information must be limited to circumstances surrounding the death of the patient or services the patient recently received (section 27(4)).
e)    To the College of Physicians and Surgeons if the College requires the information to carry out its responsibilities (section 27(4)). 
f)     Where the physician believes, on reasonable grounds, that the disclosure will avoid or minimize a danger to the health or safety of any person (section 27(4)).
g)    Where the opinion believes that disclosure is necessary for monitoring, preventing or revealing fraudulent, abusive or dangerous use of publicly funded health services (section 27(4)).
h)    Where other legislation requires or permits the information to be disclosed without patient consent (section 27(4)).

Mandatory reporting

Certain statutes have reporting provisions that require physicians to provide information about patients. Examples of legislation requiring mandatory reports include reports of child abuse or neglect under The Child and Family Services Act and medical conditions that may make it unsafe for a patient to operate a motor vehicle under The Traffic Safety Act. (See the section of this document - Mandatory Reporting)



Who, other than the patient, can access patient health information?

Section 56 of The Health Information Protection Act describes situations in which individuals other than the patient can access the patient’s health information.

a)    If a personal guardian has been appointed for the patient (the patient is not competent to manage her or his affairs) a physician can provide patient health information to the guardian if the information disclosed relates to the guardian’s powers and duties;
b)    If a patient is not competent to provide consent to health care, a physician can provide information to the person with authority to make health care decisions on the patient’s behalf;
c)    If the patient is deceased, the physician can provide information to the executor or administrator of the estate to allow that person to administer the deceased patient’s estate; 
d)    If the patient has signed a document authorizing another person to access their health information, the physician can disclose the patient’s health information to that person. 


Disclosure to a child’s parents or guardian

Disclosure of patient information to parents is complex and the interrelationship between different pieces of legislation is not clear.

The College’s interpretation of the effect of different laws is that:

a)    If the child has sufficient understanding to be able to make informed decisions about the confidentiality of their patient information, the child will determine whether the physician can provide their health information to a parent. If the child has sufficient understanding to be able to make informed decisions about the confidentiality of their patient information, disclosing their health information to their parent without their consent will generally be “an unreasonable invasion of their privacy”. 
b)    If the child does not have sufficient understanding to be able to make informed decisions about the confidentiality of their patient information, the custodial parent can access the child’s health information. 
c)    If the child does not have sufficient understanding to be able to make informed decisions about the confidentiality of their patient information, the law is very unclear what right a non-custodial parent has to access the child’s health information. 


There is a more complete discussion in the Frequently Asked Questions section below relating to accessing a child’s health information.

Disclosure to police

The Health Information Protection Regulations sets out some circumstances in which physicians can release patient health information to police without patient consent. 

1)    A physician can release registration information (address, name, health services number, etc.) requested by a police officer in connection with a criminal investigation;

2)    A physician can release information about the nature and severity of a patient’s injury requested by a police officer in connection with a criminal investigation;

3)    A physician can release current health information to a police officer about that physician’s patient if the treatment relates to a criminal investigation.

There is a more complete discussion in the Frequently Asked Questions section below relating to providing patient health information to the police.


Conversations with, or about, patients in the health care setting

It is easy to inadvertently breach patient confidentiality in a health care setting. The Code of Ethics establishes an expectation that physicians will take precautions to reduce the risk that patient health information will inadvertently be disclosed to others in such a setting.

34. Avoid public discussions or comments about patients that could reasonably be seen as revealing confidential or identifying information.

It is essential that physicians and all staff take every precaution to ensure that conversations regarding patient information are not inadvertently overheard by others. Extra sensitivity is required by physicians and staff when discussing patient matters, either on the telephone or in person within hearing distance of others. For example, physicians should be cautious if discussing matters of personal health with patients in emergency room areas, or if a conversation is taking place with staff close to a reception area.

Technology

The College has developed a guidance document Guideline - Patient-Physician Communication Guidelines Using Electronic Communications which addresses the use of email, FAX, social media and other electronic methods of communications in relation to patient care.

Voice messaging

On certain occasions, it may be necessary to leave a voice message on a machine or with a third party. Physicians should be aware that when leaving voice messages for patients that more than one person in a home or an office may access messages. For this reason, physicians are advised to exercise caution regarding the content of any messages left for patients. While it is acceptable for messages to contain the name and contact information of the physician or the physician’s office, the College advises that messages should not contain any personal health information of the patient, such as details about the patient’s medical condition, test results or other personal matters.


Unprofessional Conduct

College bylaw 8.1 defines unprofessional conduct to include:

(x)  Giving information concerning a patient’s condition or any professional services performed for a patient to any person other than the patient without the patient’s consent unless required or authorized by law to do so.

Mandatory Reporting

Introduction

There are circumstances where physicians are either required or permitted to report particular events or clinical conditions to the appropriate government or regulatory agency. This section identifies some of the circumstances in which physicians are required to provide reports and patient consent is not required.

Legislation requires reporting in the circumstances describe below. When the law requires physicians to provide a report, that requirement overcomes confidentiality concerns in privacy legislation. The Health Information Protection Act states that patient consent to release health information is not required “where the disclosure is permitted pursuant to any Act or regulation.” Some physicians may have ethical concerns pertaining to reporting of confidential patient information. However, by making reports which the law requires them to make, they are complying with their legal obligations.

This guideline may not describe all of the circumstances in which physicians are required to provide reports, nor is it a substitute for legal advice regarding reporting obligations. The College encourages physicians to stay informed of their duties, and to seek guidance from the College, the Canadian Medical Protective Association (CMPA) or their legal counsel where necessary.

Notifying patients that a report has or will be made

The Code of Ethics of the Canadian Medical Association is part of College bylaws. Paragraph 35 states:

35. Disclose your patients' personal health information to third parties only with their consent, or as provided for by law, such as when the maintenance of confidentiality would result in a significant risk of substantial harm to others or, in the case of incompetent patients, to the patients themselves. In such cases take all reasonable steps to inform the patients that the usual requirements for confidentiality will be breached.

Physicians generally have an ethical obligation to notify their patient if a report will be made which will breach the patient’s confidentiality. There may be occasional exceptions to that principle, such as where the physician is concerned about the safety of the patient or another person.

The College’s Expectations

The College expects all physicians to be aware of and comply with their legal, professional and ethical reporting obligations. This guideline describes the most common mandatory reporting obligations of physicians. In order to support a trusting physician-patient relationship, physicians are expected to communicate with patients about their reporting duties unless the circumstances make it inappropriate to do so.

Mandatory Reporting

To access specific reporting obligations please use the links below:

 

Communicable Diseases

Child Abuse or Neglect

Child Sexual Abuse

Patient Deaths – the Coroner

Stillbirths and Deaths

Fitness to Drive

Automobile Accidents

Workers’ Compensation Claims

Gunshot and Stab Wounds

Patients who are pilots or members of flight crews

Railway Workers

Loss or theft of narcotics or other controlled drugs

Reporting Colleagues

 

a)         Communicable Diseases

Physicians are generally aware of their responsibility to make a report to a medical health officer if they reach an opinion that their patient is infected with, or is a carrier of, a category 2 communicable disease. Sexually transmitted infections and tuberculosis are examples of category 2 diseases. That opinion may be formed based upon a clinical assessment or a positive test result.

Physicians should consider advising patients whom they test for a category communicable 2 disease that the testing laboratory will notify Public Health if the test is positive and that they may be contacted by Public Health if the test is positive. 

If a physician forms the opinion that their patient has a Category 2 communicable disease, that physician is required to make a report to the public health officer as soon as possible, but in any event, within no later than 72 hours. Forms are generally available to facilitate such reporting. In addition, the physician is required to provide counseling to assist the patient to avoid spreading the disease and to be aware of treatments available.

Communicable diseases other than sexually transmitted infections and tuberculosis are Category 1 diseases.  Pertussis, measles and tetanus are examples of Category 1 diseases. If a physician forms the opinion that a patient is infected with or is a carrier of a category I communicable disease, that opinion is to be reported to a medical health officer within 48 hours.

Sections 32 to 34 of The Public Health Act, 1994 are available online from the Saskatchewan Queen’s Printer.

The regulations under that legislation are also available at the Queen’s Printer. The schedule at the end of the regulations contains a list of Category 1 and Category 2 diseases.

b)         Child Abuse or Neglect

Sections 11 and 12 of the Child and Family Services Act require anyone who has reasonable grounds to believe that a child is in need of protection to notify the Department of Social Services or the police. For the purpose of this legislation a child means someone under the age of sixteen years. A physician has an obligation to report a child in need of protection whether the child is, or is not, the physician’s patient.

In general, a child under the age of 16 is in need of protection if:

  • The child has suffered or is likely to suffer physical harm;
  • The child has suffered or is likely to suffer a serious impairment of mental or emotional functioning;
  • The child requires medical treatment what is not likely to be provided; or,
  • There is no adult person who is able and willing to provide for the child’s needs, and physical or emotional harm to the child has occurred or is likely to occur.

There are other circumstances in which a child may be in need of protection, so a physician who thinks that a child may require assistance that the child’s parent or guardian can’t or won’t provide should consider whether to report that matter to the Department of Social Services.

Sections 11 and 12 of The Child and Family Services Act are available online from the Saskatchewan Queen’s Printer.

c)         Child Sexual Abuse

The Emergency Protection for Victims of Child Sexual Abuse and Exploitation Act requires anyone who has reasonable grounds to believe that a child has been or is likely to be sexually abused to notify a child protection worker or the police. For the purpose of this legislation a child is someone under the age of 18. This can be contrasted with the definition of “child” described under the previous heading, where “child” is someone under the age of 16.

A physician has an obligation to report suspected child sexual abuse whether the person is, or is not, the physician’s patient.

Sexual abuse is defined as a harmful interaction for a sexual purpose, including involvement in prostitution and involvement in conduct that may amount to an offence pursuant to the Criminal Code.

The age of consent to sexual activity in the Criminal Code means that a person who engages in sexual conduct with a person under the age of 18 may be criminal. It is a criminal offence for:

  • A person to engage in sexual activity with a child under the age of 12;
  • A person to engage in sexual activity with a child who is 12 or 13, unless that person is less than 2 years older than the child (that means it is not a criminal offence for a 14 year old to engage in sexual activity with a 13 year old);
  • A person to engage in sexual activity with someone who is 14 of 15, unless that person is less than 5 years older than the child (that means it is not a criminal offence for a 19 year old to engage in sexual activity with a 15 year old);
  • A person to engage in sexual activity with someone who is under the age of 18, if they are in a position of trust or responsibility with respect to that young person (this would generally, for example, include teachers, religious leaders, coaches, relatives, etc.).

A physician who has reasonable grounds to believe that this has occurred is required to report to a child protection worker or the police.

That may be difficult for physicians in some circumstances, as a 13 year old patient in a relationship with a 16 year old, or a 15 year old patient in a relationship with a 21 year old may regard it as a breach of confidentiality if a physician makes such a report. However, the law requires the physician to make that report.

d)         Patient Deaths – the Coroner

Section 7 of The Coroners Act, 1999 requires everyone in Saskatchewan, including physicians, to notify a coroner or the police in the circumstances set out below. A physician has that obligation whether the deceased person was, or was not, the physician’s patient. The most common situations in which a death must be reported are where:

  • The death occurred as a result of an accident or violence or was self-inflicted;
  • The death occurred from a cause other than disease or sickness;
  • The death occurred as a result of negligence, misconduct or malpractice on the part of others;
  • The death occurred suddenly and unexpectedly when the deceased appeared to be in good health;
  • The death occurred as a direct or immediate consequence of the deceased being engaged in employment, an occupation or a business; or
  • The death occurred under circumstances that require investigation.

e)         Stillbirths and Deaths

Section 35 of The Vital Statistics Act, 2009 imposes obligations on physicians to complete a certificate of death “as soon as practicable” and deliver it to the funeral director. In some situations it will be the attending physician who has that obligation. Section 35 states that a certificate of death shall be completed:

(a) by a physician who was in attendance at the time of death or attended the deceased during the last illness of the deceased if the physician is able to make a reasonable determination of the medical cause of death; or

If there is no attending physician, any other physician who is able to make a reasonable determination of the cause of death is required to complete the certificate. Section 35 of the Act states:

(b) if there is no attending physician who is able to make a reasonable determination of the medical cause of death, by any other physician who is able to make a reasonable determination of the medical cause of death.

Section 47 of The Vital Statistics Act, 2009 requires physicians who were in attendance at a stillbirth that occurs outside a hospital to complete a certificate in the prescribed form and deliver it to the Registrar of Vital Statistics. In addition, the physician is required to either provide the required form to the parents or advise them of their obligation to submit a statement to the funeral director or the Registrar of Vital Statistics..

Section 49 of The Vital Statistics Act, 2009 requires physicians who were in attendance at a stillbirth that occurs in a hospital to complete a certificate in the prescribed form, showing the cause of the stillbirth, and deliver it to the funeral director.

f)          Fitness to Drive

Section 283 of The Traffic Safety Act requires physician to report the name, address and clinical condition of every patient who is 15 years of age or over and suffering from a condition that will make it dangerous for that person to operate a vehicle.

The reporting requirement is not dependent upon whether the patient has a driver’s licence or is actually driving.

Determining Medical Fitness to Operate Motor Vehicles is available from the Canadian Medical Association free of charge to CMA members. It is also available online at http://www.cma.ca/determining-fitness-to-drive. It is a useful resource to a physician when deciding whether a patient’s medical condition should result in a report to SGI.

g)         Automobile Accidents

Section 168 of The Automobile Accident Insurance Act applies to physicians who have treated a patient involved in an automobile accident, and who receive a request from Saskatchewan Government Insurance for a report. The physician is required to provide a written report within six days respecting the consultation or the treatment and any finding or recommendation relating to the consultation or treatment.

h)         Workers’ Compensation Claims

Sections 55 and 56 of The Workers’ Compensation Act, 2013 apply to physicians who have treated an injured worker and who receive a request from the Workers’ Compensation Board for a report. The physician is required to provide a report to the Workers’ Compensation Board respecting the examination or treatment provided by the physician that is relevant to the injury for which compensation is claimed.

The legislation does not require or authorize the physician to provide reports to the employer without the patient’s consent.

i)          Gunshot and Stab Wounds

The Gunshot and Stab Wounds Mandatory Reporting Act and the regulations under that Act require the chief executive officer of a regional health authority responsible for a hospital or facility that has treated a patient for a gunshot or stab wound to report that to the police. The report should state that the patient was treated for a gunshot or stab wound and provide the patient’s name, if known.

For purposes of the legislation, a stab wound is defined as a wound caused by a knife or other sharp or pointed instrument that is indicative of an act of violence inflicted by another individual.

Physicians are not required to make such reports, unless the CEO of the regional health authority designates them as the person responsible to make such a report.

j)          Patients who are pilots or members of flight crews

If a patient is a pilot, an air traffic controller or a member of a flight crew, that person is required to advise a physician, prior to examination, of that fact.

Section 6.5 of the Aeronautics Act requires physicians who believe on reasonable grounds that a patient who is a pilot, an air traffic controller or a member of a flight crew has a medical or optometric condition that is likely to constitute a hazard to aviation safety to inform a medical adviser designated by the Minister of Transport of Canada of that opinion and the reasons for the opinion.

k)         Railway Workers

If a patient holds a position with a railway that has been designated as critical to safe railway operations, that person is required to advise a physician, prior to examination, that the patient holds such a position.

If a physician believes, on reasonable grounds, that a patient who holds a position that is critical to safe railway operations has a condition that is likely to pose a threat to safe railway operations, the physician is required to notify a physician designated by the railway company to receive such reports. The physician is also required to provide a copy of the report to the patient. 

Section 35 of the Railway Safety Act is available from CanLii at http://www.canlii.org/en/ca/laws/stat/rsc-1985-c-32-4th-supp/latest/rsc-1985-c-32-4th-supp.html.

A handbook is available from Transport Canada indicating their perspective on the medical conditions which are reportable http://www.railcan.ca/publications/rule_handbook.

 

l)          Loss or theft of narcotics or other controlled drugs

When a physician discovers or is informed that a controlled substance (including a targeted substance, a narcotic, or a controlled drug) has been lost or stolen from their office, the physician must report the loss or theft to the Office of Controlled Substances, Federal Minister of Health, within 10 days.

Sections 7(1) and 61(2) of the Benzodiazepines and Other Targeted Substances Regulations are available from CanLii at http://www.canlii.org/en/ca/laws/regu/sor-2000-217/latest/sor-2000-217.html

Section 55(g) of the Narcotic Control Regulations is available from CanLii at http://www.canlii.org/en/ca/laws/regu/crc-c-1041/latest/crc-c-1041.html

m)        Reporting Colleagues

The bylaws of the College of Physicians and Surgeons contain an expectation that physicians will report colleagues who they believe may not be practicing medicine appropriately.

The Code of Ethics of the Canadian Medical Association is part of College bylaws. Paragraph 48 was modified from the paragraph developed by the CMA. College bylaws contain the following requirement as part of the Code of Ethics:

48. Avoid impugning the reputation of colleagues for personal motives; however, report to the appropriate authority any unprofessional conduct by a colleague or concerns, based upon reasonable grounds, that a colleague is practicing medicine at a level below an acceptable medical standard, or that a colleague’s ability to practice medicine competently is affected by a chemical dependency or medical disability

Physicians have an obligation to report concerns that another physician’s ability to practise medicine competently is affected by a chemical dependency or a medical disability. That obligation applies to the person’s treating physician as well as to colleagues not involved in the person’s treatment.

As with other mandatory reporting requirements, the obligation to report supersedes the obligation to protect confidentiality of patient information.

The Health Information Protection Act states that patient consent is not required to disclose information “to a health professional body or a prescribed professional body that requires the information for the purposes of carrying out its duties pursuant to an Act with respect to regulating the profession”

Physicians also have an obligation to report what they believe to be another physician’s failure to practise medicine to an appropriate standard or another physician’s unprofessional conduct.

FREQUENTLY ASKED QUESTIONS

Patient Confidentiality and the Health Information Protection Act

  1. Can physicians destroy paper records if the information from those records is scanned into an electronic health record?
  2. How long are Saskatchewan physicians required to maintain their patient’s information?
  3. What are a physician’s obligations to restrict staff access to patient records?
  4. What options does a physician have to deal with patient records when the physician ceases practice?
  5. Can a physician provide a child’s health information to the child’s parent?
  6. What patient information can physicians provide to police without a court order?
  7. What patient information can physicians provide to family members of a deceased patient?

 

a.    QUESTION:  Can physicians destroy paper records if the information from those records is scanned into an electronic health record?

Answer:

Neither The Health Information Protection Act nor College bylaws require a physician to keep more than one source of information. If all of the information in the paper record is contained in the electronic health record the paper record can be destroyed using a method which protects the confidentiality of that information.

b.    QUESTION: How long are Saskatchewan physicians required to maintain their patient’s information?

Answer:

There are three aspects to this issue:

How long does the College require patient records be maintained?

What are CMPA’s recommendations?

What is the limitation period to bring an action against a physician based upon a claim that the physician has been negligent?

One thing which causes confusion for some physicians is that there is a difference between the College’s requirements to retain records and CMPA’s recommendations to retain records.

College bylaws require medical records to be kept for six years after the date of the last entry in the record.  If the patient is under the age of 18, the records must be kept for 6 years or until the patient’s 20th birthday, whichever is longer.

The College’s requirements are based on a patient’s reasonable expectation to be able to access their records for a period of time after they last see their physician. If a patient has not seen a physician for six years, and has not asked for a copy of their chart within six years, the College’s perspective is that the physician should be able to destroy the chart (except for patients under the age of 18).

College bylaws require the entire record to be maintained. College bylaws do not permit a physician to destroy part of a patient record. It is not acceptable to “cull” the portion of the patient chart that is more than six years old and destroy that portion.

What are CMPA’s recommendations?

CMPA’s recommendation, contained in the article Retaining Medical Records, is the following:

The CMPA's advice has been and remains that physicians should retain records for at least 10 years from the date of the last entry or, in the case of minors, for at least 10 years from when the age of majority is reached. This advice is therefore aimed at the minimum period during which a physician should retain records. Physicians are encouraged to retain records for a longer period, if at all possible. 

CMPA’s recommendations are based upon their perspective that a patient chart should be retained for a sufficient period of time that the patient chart will be available to assist a physician if that a patient sues their physician.

What is the limitation period to bring an action in Saskatchewan against a physician based upon a claim that the physician has been negligent?

In Saskatchewan an adult patient must bring an action within 2 years from the date that the patient knew, or ought to have known, they had a claim against a physician. A patient is presumed to have known the facts on the date that the alleged negligence occurred unless the patient establishes that they did not know the facts until a later date. The limitation period does not apply to a person under the age of 18 until they reach their 18th birthday.

There are some exceptions to this, as a patient who is under a mental disability may not be subject to the limitation period, and there is no limitation period for a claim based upon misconduct of a sexual nature.

While an action must be brought by an adult patient within two years of the date that they knew or ought to have known that they had a claim against the physician, there is an absolute limit of 15 years within which the patient must bring the action. Thus, if a patient is unaware of the facts that gave rise to an action until 15 years and one day after the events occurred, it is too late for the patient to sue the physician.

CMPA has, in the past, advised me that it is extremely rare for an adult patient to try to sue a physician more than six years after the date that the events occurred, so the 15 year ultimate limitation period will very seldom arise.

Summary

The College’s requirement that physicians retain their patient records for 6 years after the last entry in the patient chart is based upon different considerations than CMPA’s recommendations.

Some physicians may choose to keep patient records for longer than the College requires. That is the physician’s choice.

With more physicians using electronic medical records, the issue of destruction of patient information is likely to become much less of an issue. There will be little cost or inconvenience in keeping electronic patient information that a physician could destroy.

c.    QUESTION:  What are a physician’s obligations to restrict staff access to patient records? 

Answer:

One of the fundamental principles of health information protection is that health providers will only access health information about patients to the extent that the information is necessary for them to perform their duties. Usually that is limited to the information that is necessary for that person to provide patient care (the need to know principle).

A physician who is a trustee of medical records (has custody or control of those records) is responsible to have policies and procedures in place to discourage employees from accessing health information which is not needed for them to perform their duties. Failure to have such policies and procedures in place may be a breach of HIPA and College’s regulatory bylaw 23.2.

One of the requirements of the College bylaw is that a clinic’s policies and procedures must include measures to obtain signed confidentiality agreements from individuals who have access to patient health information.

A sample confidentiality agreement is available on the SMA website.

Protecting the confidentiality of patient information is an important ethical and legal principle. Physicians can protect themselves and their employees by ensuring that everyone where they work is aware that they cannot access patient information unless it is needed to provide patient care or to otherwise perform their employment duties. 

d.    QUESTION: What options does a physician have to deal with patient records when the physician ceases practice?

Answer:

A physician who is a trustee of medical records (has custody or control of those records) remains responsible for those records unless the records are transferred to another trustee. That means that the physician remains responsible for the security of the records, responsible to arrange patient access to records, etc.

The options for a physician are:

  • To transfer to another trustee – usually another physician or a Regional Health Authority. The records then become the responsibility of the person or organization that accepted the records.
  • To place the records in a secure storage facility. The physician retains responsibility for those records until they are destroyed in accordance with the College’s retention requirements.
  • To retain the records. Some physicians have stored their records in a secure location under their control.

The College has been working with government for several years to identify better options for physicians, as some physicians find that they have considerable difficulty in making appropriate arrangements for their patient records.

The College expects that this will become less of an issue as more physicians transition to electronic records.

e.    QUESTION: Can a physician provide a child’s health information to the child’s parent?

Answer:

The College is frequently asked for advice in dealing with non-custodial parents. Two questions are most frequently asked:

  • What medical information should be given to the non-custodial parent of a child patient?
  • What right does a non-custodial parent have to arrange for medical care for their child?

Unfortunately, the answers to these questions are not easy ones, unless the child is sufficiently mature to make their own medical decisions. If a child is sufficiently mature to make their own medical decisions, neither parent has a right to that child’s medical information unless the child consents.

The law is unclear respecting the obligations of physicians and the proper legal principles to apply in situations where the custodial and non-custodial parents are unable to agree. What follows is the College’s perspective respecting the situation.

How is custody established?

Custody can be determined by court order or by agreement between the parties. It is not uncommon for there to be no court order or agreement that determines which of the parents has custody of their children.

The problem

Consent is one concern. Generally speaking, a physician cannot provide medical care to a child of tender years unless the parent of that child consents to the medical procedure. A non-custodial parent may not be able to legally consent on their child’s behalf.

A physician can very easily become embroiled in a dispute between the parents. If a physician refuses to provide information to a non-custodial parent, that parent may be very upset. If a physician provides information to a non-custodial parent, the custodial parent may be very upset. The law has not clearly defined the right of a non-custodial parent to medical information about their child. Parents may not be entirely truthful if asked about the legal arrangements for custody and access of their children. Even if a parent presents a copy of a court order to a physician, a physician cannot be certain that there has not been a later court order that has changed the situation.

Where there are court proceedings between the parents, one or both parents may seek medical information about their child to add support to their position in court. It can be very difficult to know whether to discuss medical care with a parent’s lawyer for use in court proceedings.

It appears to be more common that parents will enter into agreements that refer to each of the parents having “joint custody” of their children. This can be a somewhat meaningless term as there are some orders or agreements that use the term “joint custody” but only one of the parents is given the right to make decisions respecting medical care to the exclusion of the other parent.

The provisions of The Children’s Law Act, 1991

There is a conflict between two pieces of legislation relating to access to a child’s medical information. If the parents are not married, or if the parents are married but have not brought divorce proceedings The Children’s’ Law Act, 1997 applies. This states that:

Unless otherwise ordered by the court and subject to subsection (2) and any agreement pursuant to subsection (3), the parents of a child are joint legal custodians of the child with equal rights, powers and duties. (s. 3(1))

Unless otherwise ordered by the court, a parent who is granted access to a child has the same right as the custodial parent to make inquiries and be given information concerning the health, education and welfare of the child. (s. 9(2))

If it was not for The Health Information Protection Act, that would mean that a physician should provide information to both parents, in the absence of a court order.

The effect of The Health Information Protection Act is discussed below.

The Divorce Act

Section 16(5) of the Divorce Act states:

Unless the court otherwise orders, a spouse who is granted access to a child of the marriage has the right to make inquiries, and to be given information, as to the health, education and welfare of the child.

The section does not state to whom the inquiries should be directed. Is it to the physician? To the other spouse? To either? Courts have consistently ruled that a non-custodial spouse has the right to make inquiries of the other spouse. There are no court decisions of which the College is aware that make it clear whether, in Saskatchewan, the non-custodial spouse can make inquiries of the child’s physician.

The effect of The Health Information Protection Act

The Health Information Protection Act provides a number of guarantees to patients, including the right of confidentiality of health information. It is more specific legislation than The Children’s Law Act, 1991as it pertains to confidentiality of patient information and a physician’s obligations as trustee under The Health Information Protection Act.

The College’s interpretation of the relevant provisions of The Health Information Protection Act is that if a child is sufficiently mature to make health care decisions, the child has a right to confidentiality of their health information.

If a child is not sufficiently mature to exercise his or her right to decide who should be provided health information, the legislation states that it is the custodial parent who makes the decision.

The relevant provisions of The Health Information Protection Act state:

Disclosure

27(1) A trustee shall not disclose personal health information in the custody or control of the trustee except with the consent of the subject individual or in accordance with this section, section 28 or section 29.

(2) A subject individual is deemed to consent to the disclosure of personal health information:

(a) for the purpose for which the information was collected by the trustee or for a purpose that is consistent with that purpose;

(b) for the purpose of arranging, assessing the need for, providing, continuing, or supporting the provision of, a service requested or required by the subject individual; or

(c) to the subject individual's next of kin or someone with whom the subject individual has a close personal relationship if­:

(i) the disclosure relates to health services currently being provided to the subject individual; and

(ii) the subject individual has not expressed a contrary intention to a disclosure of that type.

(3) A trustee shall not disclose personal health information on the basis of a consent pursuant to subsection (2) unless:

(a) in the case of a trustee other than a health professional, the trustee has established policies and procedures to restrict the disclosure of personal health information to those persons who require the information to carry out a purpose for which the information was collected or to carry out a purpose authorized pursuant to this Act; or

(b) in the case of a trustee who is a health professional, the trustee makes the disclosure in accordance with the ethical practices of the trustee's profession.

Exercise of rights by other persons

56 Any right or power conferred on an individual by this Act may be exercised:

(c) by an individual who is less than 18 years of age in situations where, in the opinion of the trustee, the individual understands the nature of the right or power and the consequences of exercising the right or power;

(d) where the individual is less than 18 years of age, by the individual's legal custodian in situations where, in the opinion of the trustee, the exercise of the right or power would not constitute an unreasonable invasion of the privacy of the individual;

While there is uncertainty about the combined effect of these provisions, and while the College is aware that some individuals interpret the law differently, it is the College’s suggestion that the following principles apply where the child is not sufficiently mature to make their own decisions pertaining to access to their health information:

If there is a court order directing the medical care of the child, it prevails;

A physician is permitted, but not required, to provide information to a non-custodial parent about the current treatment being provided to a child, but not information pertaining to the child’s history. The College’s perspective is that section 27(4)(2) of The Health Information Protection Act would not, for example, authorize a physician to provide the entirety of the child’s chart to the non-custodial parent.

The physician is required to provide health information to the custodial parent at that person’s request.

The College’s recommendations – where the child is not sufficiently mature to control their own health information:

Physicians need not inquire whether a parent who attends at a physician’s office with a child is a custodial parent unless the physician is aware that there has been a breakdown in the relationship between the parents;

If a physician is aware that there has been a breakdown in the relationship between the parents, prudence would suggest that the physician ask about custody arrangements. If there is an agreement or a court order that gives custody to the other parent, a physician should be cautious about providing the non-custodial parent information about the child’s medical history;

It is preferable to have the consent of the custodial parent to provide health information to the non-custodial parent. If the physician has the consent from both parents to provide a child’s health information to the non-custodial parent, there should not be any future difficulties.

If a physician is unclear about their responsibilities in a specific situation, obtain advice from CMPA, the College, or their own lawyer.

f.     QUESTION: What patient information can physicians provide to police without a court order?

Answer:

Physicians should consider four things in deciding whether they will release such information:

  1. Physicians are not required to disclose any information to the police.  Disclosure is permissive, not mandatory (the issue of mandatory reporting of child abuse or child sexual abuse to the Department of Social Services or the police is discussed above in this guideline);

  2. Physicians should consider ethical principles in deciding whether information should be released to the police;

  3. Physicians are only permitted to release current health information. The person’s past health history should not be disclosed;

  4. If possible, obtain advice from someone who is knowledgeable about health privacy before making a decision. We suggest that, if possible, physicians contact the privacy officer in your regional health authority or Bryan Salte at the College of Physicians and Surgeons (244-7355).

Physicians can only release health information for three purposes:

  1. A physician can release registration information (address, name, health services number, etc.) requested by a police officer in connection with a criminal investigation;

  2. A physician can release information about the nature and severity of a patient’s injury requested by a police officer in connection with a criminal investigation;

  3. A physician can release current health information to a police officer about that physician’s patient if the treatment relates to a criminal investigation.

Some situations will have to be dealt with on a case-by-case basis. However, the most common situations that physicians are likely to be required to respond to a police request for patient health information are described in the four case scenarios below:

 Case Scenario Number 1

The physician has treated a patient in hospital. The police have stated that the patient is a suspect in a criminal investigation, and have asked me to disclose the patient’s identity.

Can the physician do so?

Answer: Yes. Physicians are permitted, but not required, to provide the patient’s registration information to the police (name, address, Health Services Number).

Case Scenario Number 2

The patient was the driver, injured in an automobile accident. The police suspect that the patient was impaired and have asked whether the patient’s injuries affect the patient’s ability to be tested by breathalyzer, or affect the patient’s ability to respond to questions.

Can the physician give this information?

Answer: Yes. A physician is permitted, but not required, to provide information about the patient’s injuries to assist the police in their investigation.

Case Scenario Number 3

The patient was the victim of a criminal act (injured in an assault or in a motor vehicle accident). The police want to know the extent of the patient’s injuries to assist them with their investigation.

Can the physician give this information?

Answer: Yes. Physicians are permitted, but not required, to provide information about the patient’s injuries to assist the police in their investigation.

Case Scenario Number 4

The patient was the driver, injured in an automobile accident. The police suspect that the patient was impaired. They have asked the physician to describe the physician’s observations of the patient to assist in deciding whether the patient may have been impaired. (Was an odour of alcohol detected on the patient’s breath? Did the patient state that he had been drinking? etc.).

Can the physician give this information?

Answer: Yes. The physician is permitted, but not required, to provide the patient’s current information to assist the police in their investigation. The physician is not, however, permitted to provide any information about the patient’s history.

g.    QUESTION: After a patient’s death, what right does a member of the patient’s family have to obtain medical information or a copy of the deceased person’s patient chart?

Answer:

A physician has the same obligation of confidentiality to deceased patients as to living patients, with two exceptions:

The only time that a physician is required by HIPA to provide information or copies of documents to family members is if the executor or administrator of the estate needs the information or documents to administer the estate. One example of this would be where an executor or administrator of an estate requires the medical information in order to make a claim on a life insurance policy held by the deceased. The physician can require the executor or administrator of the estate to demonstrate how the information requested relates to the administration of the estate.

A physician is permitted but not required by HIPA to release information or copies of documents to an “immediate family member” or another person with whom the deceased had “a close personal relationship”. There are two restrictions on this:

·        The information must relate to the circumstances surrounding the death of the person or services that the person recently received; and,

  • The release of the information must be consistent with the ethics of the medical profession.

It can be reasonable to release such information to family members to assist them to understand the circumstances surrounding the death of their loved one.

This does not authorize a physician to release the entire patient chart for a deceased person, if that chart contains information other than information relating to the person’s death or services recently received by the deceased person.



Approved by Council, November, 2014

To be Reviewed November, 2019