I’m Kate Dewhirst.

My team and I write about legal issues affecting healthcare in Canada.

Kate Dewhirst Health Law - bringing the law to life. Meet Kate (in 13 seconds)

Sharing EMR Credentials — A Cautionary Tale

Posted by

The Information and Privacy Commissioner has released Decision 176, which speaks to the use of electronic medical record (EMR) credentials by individuals other than the authorized user.

The decision arose after the father of a patient asked for an audit of his son’s hospital records, following his son’s death by suicide. The records were located on an EMR that is shared between two hospitals, both of which provided care to the patient.

The audit showed that the records had been accessed in accordance with PHIPA for quality of care purposes, risk management and patient relations purposes. However, they had also been accessed by a treating physician for the purposes of responding to a College of Physicians and Surgeons of Ontario (CPSO) proceeding, and by another agent at the same hospital, using that physician’s credentials after the physician failed to log out of their EMR account at the shared EMR terminal in the emergency department. The IPC commented on these last two accesses, but declined to review them in full because they were already the subject of a complaint to the College of Physicians and Surgeons of Ontario (CPSO).

The IPC stated that regardless of the agent’s purpose in accessing the records, use of the physician’s EMR credentials was in contravention of hospital policy and of PHIPA. The physician was cautioned by the hospital and a note put into their Medical Affairs file. Privacy refresher training was done for staff and (for reasons unrelated to this complaint) the EMR was eventually replaced with one that had an automatic sign-out feature.

Key Takeaway Messages for Health Privacy Officers:

  • Use of another individual’s EMR credentials to access patient information is a contravention of PHIPA, even if the person accessing the records is an agent of the same HIC;
  • Health providers should never have “team EMR” or “departmental EMR” credentials that are used by more than one person;
  • The same factual scenario can be the a basis of a complaint to regulatory colleges and other authorities, in addition to the IPC; and

The IPC can elect to defer review of a complaint or certain elements of a complaint to another authority.


If you enjoyed this article please share it:


Previous and next posts from Kate:

Some of Kate’s recent and upcoming events

Free healthcare privacy webinar - ask me anything!
the first Wednesday of every month

Free webinars - advance registration needed

Whether you're an experienced privacy officer or new in the field, pick Kate’s brain for free for an hour, in this live webinar. No charge, but you’ll need to register in advance.

Primary care webinars: Employment Law Update & Legal Issues for EDs and Board members

Part of Kate’s monthly webinar series.

Our 2025 program is now live.
Full details of the 2024 webinar series and registration here.

Mental Health webinars: Legal issues for mental health and addictions agencies and teams
Annual membership 2025

For managers and other leaders from mental health and addictions agencies, hospitals, CMHAs, CHCs, school boards, FHTs and Indigenous health services

This is an annual membership program with monthly webinars.
Full details and registration here.

Health Privacy Officer Foundations training
starts Spring 2025

For Privacy Officers within healthcare organizations.

This course focuses on how to become a more confident privacy officer and gives you the tools to document your privacy program. Full details and registration here...

Join the Shush: a collective of health privacy officers
Annual membership 2024

For Privacy Officers within healthcare organizations

This is an annual membership program that takes theory into practice and tackles real life scenarios to build Privacy Officer skills.
Full details and registration here.

Team Privacy Training Events

For Primary Care clinics, Hospitals, Community Agencies, Mental Health Teams, Public Health Units, School Boards, Police departments

Scheduled to your team's needs for comprehensive or refresher training More details...

Free summary of all PHIPA IPC decisions

Want to read privacy breach stories to learn how to improve your work? We have summarized all the Information and Privacy Commissioner's health privacy decisions for you Download here...

Kate Dewhirst Health Law

Kate says:

My mission is bringing the law to life. I make legal theory understandable, accessible and fun! I’m available and love to work for all organizations in the healthcare sector across Ontario and beyond.

Subscribe to my mailing list and keep up to date with news:

Latest Tweets

  • Our twitter feed is unavailable right now. Follow us on Twitter
  • contact details

    P.O. Box 13024, RPO Bradford Centre
    Bradford, ON, L3Z 2Y5

    (416) 855 9557

    .