Doctor lost control of patient records
Tuesday, Aug 13, 2013 06:00 am
A local physician reported the loss of control over more than 1,500 patient records when she was unable to retrieve them upon leaving the Didsbury Medical Clinic to start a clinic of her own, according to officials.
Following an investigation by the Information and Privacy Commissioner (OIPC) of Alberta, Rachel Hayward, portfolio officer for the OIPC, wrote in her investigation report -- H2013-IR-01 – that Dr. Dianne Smith did not follow the Health Information Act (HIA), because she did not have a direct contract with the Electronic Medical Record (EMR) provider for the clinic, as outlined in the HIA.
“When custodians do not directly sign agreements with their EMR vendors, they may find themselves in the unfortunate position of not being able to exercise control over health information they need to provide health services,” stated Hayward.
“Custodians remain accountable for the health information they collect, use and disclose, and must ensure they are playing an active role in determining how that information is managed.”
The issue was reported by Smith when she requested that Telin Medical Systems Ltd. send her the required records so she could start up her own clinic and keep her patients’ records, according to Hayward’s report.
Telin officials told her they could not transfer the records to her because she was not the custodian listed on the contract, and that the owner of the clinic, Shariz Jaffer, was the custodian, and Jaffer initially refused to provide consent for the transfer.
“Given that Mr. Jaffer is not a custodian under the HIA and that the HIA only allows a custodian to sign the agreement, this agreement should have been signed by Dr. (Ashif) Jaffer (the other doctor working at the Didsbury Medical Clinic) and Dr. Smith.” Hayward wrote in the report.
A custodian in this regard is someone belonging to the College of Physicians and Surgeons of Alberta, Hayward noted.
“I find the agreement provided to me is not a valid information manager agreement as defined in the HIA.”
During her investigation, Hayward found that both doctors had contravened Section 31 of the HIA when they disclosed health information to Telin, because neither doctor had an agreement with the EMR themselves.
Jill Clayton, the information and privacy commissioner, said that generally, OIPC does not publicly release investigations, but that this one can provide some important lessons to custodians of medical records.
“Certainly we thought it was a significant investigation report, which is why we published it,” said Clayton.
“When we do, it’s usually because we think there’s either a systemic issue or we think it’s a good opportunity to relay a story that we think is something we need to share with others.”
In this case, Clayton thought this particular investigation had a good message, and since educating custodians of their responsibilities under the HIA is part of the OIPC’s mandate, she believes there is merit in bringing custodians’ obligations to their attention, she said.
She noted the OIPC is responsible for oversight of three statutes: the Freedom of Information and Protection of Privacy Act (FOIPP), the Personal Information Protection Act (PIPA) and the HIA.
“A major portion of the mandate is to resolve complaints and investigate, and for the most part we are able to resolve things informally, with recommendations being made,” she said.
The three recommendations made by Hayward following her investigation are that:
“…Dr. Jaffer revisit the agreement with Telin to ensure that it is signed by the custodian of the records (in this case himself)…that Dr. Smith review her agreement with her new EMR vendor to ensure (the same thing, and) generally, I recommend all custodians review their agreements with their EMR providers to ensure that they are signed by the custodian(s) responsible for the custody and control of the health information.”
In conclusion, the OIPC was able to resolve the issue, and Smith was eventually able to regain custody and control of her records.
“However, the process took several weeks,” wrote Hayward.
“This time delay could have been avoided if she had entered into an information manager agreement with Telin.”
This investigation highlights two important issues with respect to the relationships between custodians and information managers, she wrote.
First, that information manager agreements must be signed by custodians -- agreements signed by anybody other than a custodian is not a valid agreement under the HIA, and that without a proper agreement in place, problems like this may arise.
Smith declined to comment on the results of the investigation.