I’m Kate Dewhirst.

My team and I write about legal issues affecting healthcare in Canada.

Kate Dewhirst Health Law - bringing the law to life. Meet Kate (in 13 seconds)

Sharing EMR Credentials — A Cautionary Tale

Posted by

The Information and Privacy Commissioner has released Decision 176, which speaks to the use of electronic medical record (EMR) credentials by individuals other than the authorized user.

The decision arose after the father of a patient asked for an audit of his son’s hospital records, following his son’s death by suicide. The records were located on an EMR that is shared between two hospitals, both of which provided care to the patient.

The audit showed that the records had been accessed in accordance with PHIPA for quality of care purposes, risk management and patient relations purposes. However, they had also been accessed by a treating physician for the purposes of responding to a College of Physicians and Surgeons of Ontario (CPSO) proceeding, and by another agent at the same hospital, using that physician’s credentials after the physician failed to log out of their EMR account at the shared EMR terminal in the emergency department. The IPC commented on these last two accesses, but declined to review them in full because they were already the subject of a complaint to the College of Physicians and Surgeons of Ontario (CPSO).

The IPC stated that regardless of the agent’s purpose in accessing the records, use of the physician’s EMR credentials was in contravention of hospital policy and of PHIPA. The physician was cautioned by the hospital and a note put into their Medical Affairs file. Privacy refresher training was done for staff and (for reasons unrelated to this complaint) the EMR was eventually replaced with one that had an automatic sign-out feature.

Key Takeaway Messages for Health Privacy Officers:

  • Use of another individual’s EMR credentials to access patient information is a contravention of PHIPA, even if the person accessing the records is an agent of the same HIC;
  • Health providers should never have “team EMR” or “departmental EMR” credentials that are used by more than one person;
  • The same factual scenario can be the a basis of a complaint to regulatory colleges and other authorities, in addition to the IPC; and

The IPC can elect to defer review of a complaint or certain elements of a complaint to another authority.


If you enjoyed this article please share it:


Previous and next posts from Kate:

Some of Kate’s recent and upcoming events

Free healthcare privacy webinar - ask me anything!
the first Wednesday of every month

Free webinars - advance registration needed

Whether you're an experienced privacy officer or new in the field, pick Kate’s brain for free for an hour, in this live webinar. No charge, but you’ll need to register in advance.

Health Privacy Officer Foundations training
October 24, 31, November 7, 14, 21, 28 2022 Coming Soon: Spring 2023 Next Program

For Privacy Officers within healthcare organizations.

This course focuses on how to become a more confident privacy officer and gives you the tools to document your privacy program. Full details and registration here...

Join the Shush: a collective of health privacy officers
Annual membership 2022

For Privacy Officers within healthcare organizations

This is an annual membership program that takes theory into practice and tackles real life scenarios to build Privacy Officer skills.
Full details and registration here.

Primary care webinars: Employment Law Update & Legal Issues for EDs and Board members

Part of Kate’s monthly webinar series.

Our May program will address progressive discipline and in September we discuss mandatory training for new employees and October we discuss ethical decision making in primary care.
Full details of the 2022 webinar series and registration here.

Team Privacy Training Events
August 3, September 7, 23

For Primary Care clinics, Hospitals, Community Agencies, Mental Health Teams, Public Health Units, School Boards, Police departments

Kate trains health professionals from many more health care organizations how being privacy-respectful can improve therapeutic relationships. More details...

Ontario Hospital Association Professional Staff Credentialing Toolkit

2nd Edition is now available for managing physicians, dentists, midwives and nurse practitioners in hospitals Read here...

Free summary of all PHIPA IPC decisions

Want to read privacy breach stories to learn how to improve your work? We have summarized all the Information and Privacy Commissioner's health privacy decisions for you Download here...

Kate Dewhirst Health Law

Kate says:

My mission is bringing the law to life. I make legal theory understandable, accessible and fun! I’m available and love to work for all organizations in the healthcare sector across Ontario and beyond.

Subscribe to my mailing list and keep up to date with news:

Latest Tweets

[OCT 6 – WEBINAR SERIES] Register now at link for "Right or Wrong — Ethical decision-making"… https://t.co/mPCiMBsJN3

08:00 AM Sep 26th

Register now for this FREE upcoming Ask Me Anything. We cover topics like: - video surveillance - snooping - infor… https://t.co/yCc7Cl4TWj

08:00 AM Sep 24th


contact details

P.O. Box 97010 Roncesvalles
Toronto Ontario M6R 3B3

(416) 855 9557

.