The Solo Practitioner
In part one of this article series, “The Solo Practitioner: How to Handle Patient Files,” we discussed the legislated responsibilities of a custodian. We talked about the meaning of health information, how long it should be kept, and who has a right to access it. We also discussed how to prepare for a successor to take over if the custodian is no longer able to manage the patient files.
Most of the first article considers that the optician is working in a practice alone, but often an optician works alongside other registered health professionals such as other opticians or optometrists. What are the rules about files when more than one person is involved?
When two or more opticians work in a practice together, they will often share responsibility for patients. It’s easier and more convenient for their customers to walk into the optical and be able to get help from anyone working there, rather than trying to coordinate their schedules with a single practitioner’s hours. When multiple opticians work together with the same patients, adding to and updating patient files, they all bear some responsibility for the files. Each optician should clearly indicate which changes and additions they made.
Another health professional often working in the same location as opticians is an optometrist. Optometrists keep their own patient files that have to do with their examinations and eye health. Opticians sometimes have access to those files, either in full or in part, but the optician’s files are usually separate from the optometrist’s files. Both opticians and optometrists are considered custodians of their individual patient files.
Custodians vs Affiliates
As we discussed in the previous article, a custodian is a health care provider who is responsible for maintaining patient files. A custodian is the primary health practitioner associated with the patient file, and custodians are ultimately responsible for ensuring that their patient files are kept accurate and secure. Custodians who share health information about a patient between themselves for the purposes of improving that patient’s health are all considered to be in the patient’s circle of care. Custodians can disclose individually identifying information without the permission of the patient to other custodians for the uses outlined in section 27 of the HIA, including “providing health services” and determining or verifying the eligibility of an individual to receive a health service (HIA, Section 27(1)(a)and(b)). A custodian may disclose information from the file to another custodian or grant access to an affiliate as necessary and as outlined in the HIA.
So what is an affiliate? An affiliate is anyone who has been granted access to a custodian’s patient files for the purposes of helping the custodian. An affiliate may be “an individual employed by the custodian (HIA, Section 1(1)(a)(i))” or “a person who performs a service for the custodian as a student (HIA, Section 1(1)(a)(ii)” among other things. The affiliate may also be an information manager as defined in section 66(1) of the HIA. Regardless of the affiliate’s duties and the level of file access, the custodian remains the primary person in charge of the file.
Under Sections 24, 28, and 43 of the HIA, the Act asserts that “an affiliate of a custodian must not [collect, use, or disclose] health information in any manner that is not in accordance with the affiliate’s duties to the custodian.” This means that although the affiliate has access to the file, they are only allowed to manage the information in the way stipulated by the custodian. However, the affiliate is still responsible for following the rules as laid out in the HIA. Some affiliates are health care practitioners, but some may be unlicensed staff, depending on the type of facility, and these people must also follow the applicable privacy legislation. It is important for an affiliate to have a clear understanding of what is expected of them. One way to ensure that they understand their duties is to have them read and sign an affiliate agreement that clearly outlines their responsibilities.
When are YOU the Custodian?
In a practice run by an optometrist, opticians are often affiliates to the optometrists’ files. Where an optician keeps their own files, they are still the custodian to those files. If the optician runs the practice and employs an optometrist, the optometrist is the custodian of the eye exam and health records, and the optician is custodian to their own patient files. A copy of part of the optometric records may become part of the optician’s files, but the optometrist has an obligation to remain custodian to their own patient records.
“Follow the Money”
One way to think of it that may be slightly less confusing is that if the record pertains to a service for which you as the health care provider bill, you are likely also the custodian of that file. So, if an optometrist performs an eye exam and bills for it, the information surrounding that exam is part of the optometric record, and the optometrist is the custodian. If the optician makes glasses and bills for them, everything that was required to make those glasses are part of the file that the optician is custodian of, including a copy of the prescription issued by the optometrist. When someone adds to or accesses parts of a patient’s file, but they are not the ones billing for the service, they are likely affiliates to the custodian.
“Following the money” can be a helpful way to think about who the custodian of the file is but remember that it’s not the true measure for custodianship. If a health practitioner collects health information but does not end up billing for their service, or the transaction is not completed, the health practitioner is still responsible for maintaining that patient’s health record. So, for example, if you are fitting a patient for contact lenses and they do not complete their fitting, or they decide to go somewhere else, any health information you have collected is still your responsibility and you are the custodian of that patient’s file.
Sharing Information without Patient Consent
One more thing to note: a health professional is a custodian or affiliate to files under specific terms in the Health Information Act. Just because someone is a health professional, does not automatically make sharing the information in a patient’s file appropriate. Remember to consider that the information needs to be relevant to the service provided. So, for instance, if you were to share health information with a doctor who is outside of the patient’s circle of care, it is possible that even though that person is also a health practitioner, you may be breaching the HIA with regards to disclosing identifying health information without the consent of the patient.
Leaving a Practice
In a multi-provider optical, some confusion can arise when a custodian leaves the practice. Who owns the files in that case? Who is responsible for the patients? When a practitioner leaves to start their own practice, they may want to take their patient files with them; but if they are moving away from the area, it is likely more convenient for the patients to stay at the same location. If the arrangement ends on difficult terms, it may cause some disagreement when it’s time to separate. In such settings it’s a very good idea to have an information manager agreement and/or an information sharing agreement in place ahead of time.
Section 66 of the HIA defines an information manager as “a person or body that processes, stores, retrieves or disposes of health information in accordance with the regulations, strips, encodes or otherwise transforms individually identifying health information, or provides information management or information technology services” (Section 66 (1)). The information manager gathers the custodians’ patient files and keeps them secure in the same place, sometimes through use of a database.
When you work in a busy practice with multiple custodians, an information manager can improve efficiency and organisation. Sometimes the information manager will be another custodian, but when this is the case they are considered an affiliate to the other custodians’ files in this capacity (Section 66 (7)). The information manager does not have to be a custodian, and sometimes it is the unlicensed employer, or even someone hired specifically for the purpose of being the information manager; in any case, they still have to follow the privacy legislation as laid out in the HIA, and they are considered an affiliate under the Act (HIA, Section 1(1)(a)).
Information Manager Agreement
If the practice plans to use an information manager to handle their files, the custodians “must enter into a written agreement with an information manager in accordance with the regulations for the provision of any or all of the services described in subsection (1)” (Section 66 (2)). A custodian can “provide health information to the information manager without the consent of the individuals who are subjects of the information for the purposes authorized by the agreement” (Section 66 (3)), and the information manager in turn “may use or disclose that information only for the purposes authorized by the agreement” (Section 66 (4)). Just as with any affiliate, the information manager “must comply with the Health Information Act and Regulations and the agreement they have with the custodian” (Section 66 (5)). Additionally, “a custodian continues to be responsible for compliance with [the HIA] and the regulations in respect of the information provided” (Section 66 (6)). The written agreement ensures that the rules are very clear and the custodians and the information manager understand their roles and responsibilities under the Act.
Information Sharing Agreements
Information sharing agreements can help bring clarity to the sometimes confusing question of who owns the files, and what happens when a health practitioner leaves the practice. The information sharing agreement should outline an exit protocol as well as a custodian’s rights and responsibilities while in the practice. Having a written agreement to document this plan ahead of time will help make transitioning out of a practice go smoothly, and help quell any disagreements that may arise during the course of business with regards to managing the patient files.
If you work in a practice alongside an optometrist, you are likely already aware of the benefits of using an information manager and information sharing agreement; the optometrists’ standards of practice currently require them to enter into these agreements when they work with other health practitioners. If you are opening a new practice and planning on employing an optometrist, it’s important to cooperate and ensure that these measures are in place so that they are able to meet their standards; the added benefit is that these measures are a good way to keep everyone in the practice on the same page. They can’t hurt, and they certainly may help!