Health Privacy Update: What happens if you lose a patient record?
The Information and Privacy Commissioner of Ontario has issued a new health privacy Decision 86.
A woman contacted a hospital to have access to her deceased son’s health records. The hospital provided part of the record but notified the requester that part of the paper record was missing.
The requester made a complaint to the IPC.
During mediation, the hospital issued an apology for losing the records and explained how in response to discovering the loss they had followed their breach management protocol. The files were believed to be permanently lost – but there was no reason to believe they were improperly accessed or disclosed. They were likely lost as part of the scanning process from their paper record system to their electronic health records.
The IPC decided not to review the complaint because the IPC found the hospital had adequately:
- Searched for the records
- Fulfilled its information management practices
- Followed its privacy breach protocol
- Notified the complainant and the IPC of the lost
records - Updated its practices to prevent future similar incidents
- Consulted with its third party vendor
responsible for scanning paper records to prevent future similar incidents
Bottom Line: Health information custodians, like hospitals, primary care teams, long-term care homes, pharmacies and community agencies, must protect your health records. You have to take reasonable steps to securely transfer, scan and retain your health records. And…mistakes happen. Your organization may lose records. If you do, you must take steps to address the possible privacy breach that arises. You must notify the affected people. The IPC’s safeguards standard is not a standard of perfection – but you do have to be privacy respectful and diligent in your scanning, storing and transferring records practices.
Next Steps: If you are a health Privacy Officer, and you are looking for a summary of all the IPC’s health privacy decisions, register here for a free download of all of them.
If you are ready to continue on your privacy journey, join me for Privacy Officer training starting April 30 or Advanced Privacy Officer training on June 18th.
