The Information and Privacy Commissioner has released Decision 176, which speaks to the use of electronic medical record (EMR) credentials by individuals other than the authorized user.

The decision arose after the father of a patient asked for an audit of his son’s hospital records, following his son’s death by suicide. The records were located on an EMR that is shared between two hospitals, both of which provided care to the patient.

The audit showed that the records had been accessed in accordance with PHIPA for quality of care purposes, risk management and patient relations purposes. However, they had also been accessed by a treating physician for the purposes of responding to a College of Physicians and Surgeons of Ontario (CPSO) proceeding, and by another agent at the same hospital, using that physician’s credentials after the physician failed to log out of their EMR account at the shared EMR terminal in the emergency department. The IPC commented on these last two accesses, but declined to review them in full because they were already the subject of a complaint to the College of Physicians and Surgeons of Ontario (CPSO).

The IPC stated that regardless of the agent’s purpose in accessing the records, use of the physician’s EMR credentials was in contravention of hospital policy and of PHIPA. The physician was cautioned by the hospital and a note put into their Medical Affairs file. Privacy refresher training was done for staff and (for reasons unrelated to this complaint) the EMR was eventually replaced with one that had an automatic sign-out feature.

Key Takeaway Messages for Health Privacy Officers:

• Use of another individual’s EMR credentials to access patient information is a contravention of PHIPA, even if the person accessing the records is an agent of the same HIC;
• Health providers should never have “team EMR” or “departmental EMR” credentials that are used by more than one person;
• The same factual scenario can be the a basis of a complaint to regulatory colleges and other authorities, in addition to the IPC; and

The IPC can elect to defer review of a complaint or certain elements of a complaint to another authority.