I’m Kate Dewhirst.

My team and I write about legal issues affecting healthcare in Canada.

Kate Dewhirst Health Law - bringing the law to life. Meet Kate (in 13 seconds)

Health Privacy Update: What happens if you lose a patient record?

Posted by

The Information and Privacy Commissioner of Ontario has issued a new health privacy Decision 86.

A woman contacted a hospital to have access to her deceased son’s health records.   The hospital provided part of the record but notified the requester that part of the paper record was missing.

The requester made a complaint to the IPC.

During mediation, the hospital issued an apology for losing the records and explained how in response to discovering the loss they had followed their breach management protocol. The files were believed to be permanently lost – but there was no reason to believe they were improperly accessed or disclosed. They were likely lost as part of the scanning process from their paper record system to their electronic health records.

The IPC decided not to review the complaint because the IPC found the hospital had adequately:

  • Searched for the records
  • Fulfilled its information management practices
  • Followed its privacy breach protocol
  • Notified the complainant and the IPC of the lost
    records
  • Updated its practices to prevent future similar incidents
  • Consulted with its third party vendor
    responsible for scanning paper records to prevent future similar incidents

Bottom Line: Health information custodians, like hospitals, primary care teams, long-term care homes, pharmacies and community agencies, must protect your health records. You have to take reasonable steps to securely transfer, scan and retain your health records. And…mistakes happen. Your organization may lose records. If you do, you must take steps to address the possible privacy breach that arises. You must notify the affected people. The IPC’s safeguards standard is not a standard of perfection – but you do have to be privacy respectful and diligent in your scanning, storing and transferring records practices.

Next Steps: If you are a health Privacy Officer, and you are looking for a summary of all the IPC’s health privacy decisions, register here for a free download of all of them.

If you are ready to continue on your privacy journey, join me for Privacy Officer training starting April 30 or Advanced Privacy Officer training on June 18th.


If you enjoyed this article please share it:


Previous and next posts from Kate:

Some of Kate’s recent and upcoming events

Free healthcare privacy webinar - ask me anything!
the first Wednesday of every month

Free webinars - advance registration needed

Whether you're an experienced privacy officer or new in the field, pick Kate’s brain for free for an hour, in this live webinar. No charge, but you’ll need to register in advance.

Health Privacy Officer Foundations training
April 13, 20, 27, May 4, 11, 18, 25 2022

For Privacy Officers within healthcare organizations.

This course focuses on how to become a more confident privacy officer and gives you the tools to document your privacy program. Full details and registration here...

Join the Shush: a collective of health privacy officers
Annual membership 2022

For Privacy Officers within healthcare organizations

This is an annual membership program that takes theory into practice and tackles real life scenarios to build Privacy Officer skills.
Full details and registration here.

Primary care webinars: Employment Law Update & Legal Issues for EDs and Board members

Part of Kate’s monthly webinar series.

Our February program will NEW TOPIC address mental health supports for leaders (with Christine Burych) and in March we discuss employment contracts.
Full details of the 2022 webinar series and registration here.

Team Privacy Training Events
January 13, 26, February 2

For Primary Care clinics, Hospitals, Community Agencies, Mental Health Teams, Public Health Units, School Boards, Police departments

Kate trains health professionals from many more health care organizations how being privacy-respectful can improve therapeutic relationships. More details...

Ontario Hospital Association Professional Staff Credentialing Toolkit

2nd Edition is now available for managing physicians, dentists, midwives and nurse practitioners in hospitals Read here...

Free summary of all PHIPA IPC decisions

Want to read privacy breach stories to learn how to improve your work? We have summarized all the Information and Privacy Commissioner's health privacy decisions for you Download here...

Kate Dewhirst Health Law

Kate says:

My mission is bringing the law to life. I make legal theory understandable, accessible and fun! I’m available and love to work for all organizations in the healthcare sector across Ontario and beyond.

Subscribe to my mailing list and keep up to date with news:

Latest Tweets

New decision of the Information and Privacy Commissioner of Ontario for health privacy. And it is a doozy!… https://t.co/HUrtQgoosq

about 6 hours ago

Join The Shush, my community for Privacy Officers in the healthcare sector. Develop knowledge, skills and judgment,… https://t.co/UUnuBt5TXt

about 10 hours ago

Years ago, I sat in coroner’s inquests and listened to testimony of health care workers after the tragic deaths of… https://t.co/Kt37qOAVcp

04:30 PM Jan 19th

contact details

P.O. Box 97010 Roncesvalles
Toronto Ontario M6R 3B3

(416) 855 9557

.