Record Keeping and Privacy Practice Topic

Please refer to the Releasing Personal Health Information Fact Sheet, which describes a few of the more common disclosures permitted by health information custodians, which pharmacists are, under the Personal Health Information Protection Act (PHIPA). You can also to refer to the legislation directly for complete details or contact the Information and Privacy Commissioner of Ontario. 

Regarding requests from health regulatory colleges in Ontario, all colleges – including the College – must follow the same Health Professions Procedural Code (set out in the Regulated Health Professions Act). Colleges also establish Rules of Procedure, as any hearings in Ontario must meet the standard for procedural fairness mandated by the Statutory Powers Procedure Act. You could reach out to the investigator directly regarding questions about their rules of procedure. 

Specific to fentanyl, please refer to the Patch-For-Patch Fentanyl Return Program Fact Sheet. Regulation 305/16 under the Safeguarding Our Communities Act (Patch for Patch Return Policy) has specific provisions for dispensers providing information to law enforcement. Please refer to section 4(3) under ‘Contingency Plan’ in the regulations. 

The College’s Releasing Personal Health Information Fact Sheet describes some of the most common disclosures permitted by pharmacists/pharmacies as health information custodians under Ontario’s Personal Health Information Protection Act (PHIPA). For example, information may be disclosed when a pharmacy professional is presented with a warrant, court order, production order, or under authority established in legislation, such as the Coroners Act and the Missing Persons Act. There may be other legislation—such as Canada’s Criminal Code or the province’s Child, Youth and Family Services Act — which may prevail over PHIPA. 

The Information and Privacy Commissioner of Ontario, who provides oversight of Ontario’s access and privacy laws including PHIPA, has additional resources to guide registrants in their decisions surrounding personal health information, including: 

• Fact Sheet – Disclosure of Personal Information to Law Enforcement 

• Fact Sheet – Disclosure of Information Permitted in Emergency or other Urgent Circumstances 

• Yes, You Can. Dispelling the Myths About Sharing Information with Children’s Aid Societies 

• Fact Sheet – Obtaining Personal Health Information About a Deceased Relative 

• Circle of Care: Sharing Personal Health Information for Health-Care Purposes 

As always, supporting documentation is essential as evidence of your decision-making process and rationale. If a registrant is uncertain about their obligations after reviewing the appropriate resources and legislation, they may wish to obtain independent legal advice or consult with their corporation’s privacy officer. 

Pharmacies and pharmacy professionals in Ontario have responsibilities to safeguard the personal health information of their patients as health information custodians under the Personal Health Information Protection Act (PHIPA). As PHIPA establishes the mandate of the Information and Privacy Commissioner of Ontario, please refer to Information and Privacy Commissioner (IPC) of Ontario Fact Sheet – Obtaining Personal Health Information About a Deceased Relative. Additional information can be found on the IPC website.

Please refer to the Record Retention, Disclosure, and Disposal Guideline and the Record Keeping and Scanning Requirements Fact Sheet. 

Regulations under the Drug and Pharmacies Regulation Act require pharmacies to make and retain a scanned copy of all original prescriptions. However, the decision to destroy paper-based records after they have been scanned is at the discretion of the Designated Manager who should evaluate the backup processes in place to safeguard records for the required timeframe.  

In terms of the timeframe, all prescription records in the pharmacy’s possession, scanned or in hardcopy form, are subject to the retention period of a minimum 10 years after the last date of service provided to the patient. Since records cannot be destroyed until at least 10 years after the patient has ceased to use a pharmacy’s services (notwithstanding the provision for children under 18 years of age), the date of when a record can be destroyed cannot be pre-determined.  

Also, the patient record must be maintained as a whole, therefore dispensing records (hard copies) and prescriptions (originals or scanned originals) cannot be singled out for destruction. If the patient continues to use the services of the pharmacy, the patient record would need to be retained on file for an indefinite period of time (i.e., forever). 

The “transfer of records” process is not the same as a prescription transfer (as permitted by the Drug and Pharmacies Regulation Act). When closing a pharmacy, all patient files and prescription records are “transferred” or relocated to the receiving Designated Manager (DM)/owner, and the prescriptions will then belong to the receiving pharmacy. Exactly “how” the records are entered or merged into the receiving pharmacy’s software system is sorted out by the DMs and the vendor(s). Ideally, it should be seamless to the patient as they must continue to be able to access their personal information. 

Pharmacies and pharmacy professionals participating in the closure of a pharmacy should review the College’s closing a pharmacy webpage. Additionally, the College’s Record Retention, Disclosure and Disposal Guideline can provide additional information on the management of patient records.