This article appeared in issue 112 of the Eighth Line Newsletter, and has been edited for easier viewing on the web. Some of the information in this article may be out of date. Refer to our current static website pages for correct information.
What’s the Big Deal about File Custody?
Being an optician means juggling several roles and responsibilities; your roles as health care provider and sales associate often see you balancing frame and lens selection with the patients’ preferences and budget, and these parts of the job can easily take up all of your time and attention. But there are other aspects of being a health care provider that can’t be ignored, specifically an optician’s administrative obligations. While it’s certainly not the most glamorous part of the job, record retention is a vitally important for both you and your patients!
Keeping your patients’ files up-to-date and secure is not only a good idea, it’s mandated by law; legal jargon can be difficult to understand, but we want to help you navigate the Health Information Act legislation surrounding file custody to ensure that you know how to follow best practices. In this article we will break down and examine your record-keeping roles and responsibilities, as well as offer advice on how to ensure your patients have access to their files now and in the future. As thick and weedy as the waters are, we’re going to attempt to dive in and help you wade through the confusing world of custodianship in this two part article series.
What is a Custodian?
A custodian is a health professional who creates and maintains a patient file; this includes a “regulated member of the College of Opticians of Alberta” (now called the “Alberta College and Association of Opticians”)(HIR, Section 2(2)(h)). Simply put: opticians are responsible for collecting and caring for their patients’ health information.
Under the Health Information Act, “health information” is defined as “diagnostic, treatment and care information” and “registration information” (HIA, Section 1(1)(k)). “Diagnostic, treatment and care information” includes, among other things, devices and equipment (such as eyeglasses and contact lenses) provided to an individual based on a prescription, and “registration information” means identifying information about a patient, such as demographics, location, phone and email, home address, billing information, and more (HIA, Section 1(1)(i)).
Essentially, this means that all information entered into a patient’s file is considered the patient’s health information. Custodians have special permission to collect, use, and disclose that information for the purposes of providing health services. They may gather both identifying and non-identifying information about a patient. As stated above, identifying-information is any information that can be used to identify an individual, and includes but is not limited to: names, initials, birth dates, personal identification numbers, and contact information. Non-identifying information cannot be used to identify an individual by reasonable means, and may include general information such as aggregate data about gender, age range, ethnic background, etc.
Custodian Responsibilities to Patients
While custodians “may collect non-identifying health information for any purpose (HIA, Section 19),” a patient’s individually identifying health information is confidential, and custodians have specific responsibilities with regards to safeguarding that information, making sure it’s accurate, keeping it up to date, and making it accessible to patients.
Custodians have a duty to collect, use, or disclose health information with the highest degree of anonymity possible. This means that before collecting information, you must consider whether the information is necessary for delivering the services you provide (HIA, Section 57). If you don’t need to know something to provide the service, you should not ask for it. That being said, our Standards of Practice have certain requirements for what needs to be in a patient file; all of that information is considered necessary.
If you are disclosing health information you must likewise endeavor to only divulge the amount of health information necessary to carry out the intended purpose of the disclosure, while simultaneously considering the wishes of the patient whom the information is about (HIA, Section 58). In practical application, this means that if someone who is authorised to request information needs it to carry out a specific service or task, you as the custodian should give the minimum amount of information required to oblige. In this way, sensitive information continues to be protected.
An optician has a responsibility to ensure that measures are in place to safeguard all confidential information in a patient’s file. The HIA states that “a custodian must take reasonable steps in accordance with the regulations to maintain administrative, technical and physical safeguards that will protect the confidentiality of health information” and “protect against any reasonably anticipated threat or hazard to” the security and integrity of health information, as well as protect against loss of, unauthorized use of, or access to the health information (HIA, Section 60). This can mean locking the files in a cabinet, or ensuring they’re on a password encrypted database among other measures. The point is to make sure that access to patient files is controlled and limited to those who have a right to see them (HIA, Section 45).
Patient Rights to Access
Among those who have a right to access patient files are the custodian, the affiliates of the custodian, and the patient. We will talk more about affiliates versus custodians in Part 2 of this set of articles, but for now let’s focus on the patient: A patient has a right to examine the original record, and to access a copy of any information in their file; this includes any notes that you have put in the file. However, patients are not entitled to walk away with the original file, as it is the custodian’s responsibility to keep that file for a period of ten years.
Under Section 41 of the HIA, “a custodian that discloses a record containing individually identifying diagnostic, treatment and care information … must make a note of” the name of the person to whom they disclosed the information, the date and purpose of the disclosure, and a description of the information disclosed. “The information … must be retained by the custodian for a period of 10 years following the date of disclosure;” this means that the clock starts over once a file has been accessed, altered, or added to. Since a patient has a right to access everything in their file, if they request a copy of all or part of that file, there are few circumstances where it would be appropriate for a custodian to deny that request (HIA, Section 7).
Requests for Information
When a patient requests a copy of their file, or any information in their file, the custodian usually has a maximum of 30 days to respond to the request. There are instances where it may be difficult for a custodian to access the file due to off-site storage, and there may be scenarios where a custodian could ask for an extension from the Commissioner (HIA, Section 15), but for the most part it should be reasonable to respond to a patient request within 30 days (HIA, Section 12). If you find you need more time to respond to a request for information, Section 15 of the HIA outlines steps for a custodian to take to ask the Commissioner for an extension.
A custodian may require a patient to submit their request in writing, so that the custodian has documentation of the request to add to the file (HIA, Section 8(2)). A custodian may also charge a small fee (outlined in the Health Information Regulations) if necessary in order to comply with the request (HIA, Section 67).
For some health professionals, there may be instances when a custodian can refuse to comply with a request for information if it’s in the best interest of the patient to withhold it. Opticians are unlikely to encounter too many scenarios where this is the case, but you should still be aware of the legislation. “A custodian may refuse to disclose health information to an applicant if the disclosure could reasonably be expected to result in immediate and grave harm to the applicant’s mental or physical health or safety, to threaten the mental or physical health or safety of another individual, or to pose a threat to public safety (HIA, Section 11).” There are other circumstances under which a custodian can refuse to disclose health information, but the above stated is the most likely, although still rare, situation in which an optician might refuse to disclose.
For example, if a non-compliant contact lens patient is requesting information from their file that could be used to purchase contact lenses in an unsafe manner, and the optician is afraid that the patient is likely to become injured through disclosure of that information, the optician may wish to withhold the information to prevent harm. These are rare scenarios that should be addressed on a case-by-case basis, and you should keep in mind that a patient has the right to ask the Commissioner to review the decision (HIA, Section 12(2)(c)(iii)).
One of the best ways to ensure your files are thorough and complete is to get into the habit of meticulous documentation. If a complaint ever arises about an optician, a well-documented file can help provide evidence of what happened, the steps that were taken to attempt to resolve the problem, and any concerns the optician had at the time with regards to patient compliance, etc. In addition to the custodian, meticulous documentation benefits the patient and the successor custodian who may eventually take over your files. Always keep a file as if someone else will read it, making sure to document events, concerns, and resolutions, and keep comments and notes relevant and appropriate.
The Health Information Act empowers custodians to choose a successor for their files by legislating that “a custodian may disclose individually identifying diagnostic, treatment and care information without the consent of the individual who is the subject of the information to its successor where the custodian is transferring its records to the successor as a result of the custodian ceasing to be a custodian, or ceasing to provide health services within the geographic area in which the successor provides health services, and the successor is a custodian (HIA, Section 35(1)).”
It is a good idea for every custodian to have a back-up plan in case of emergency. Retirement, sudden illness, injury, or death, or any other situations that may arise can impede patient access to files, so it’s important to plan ahead. Having a plan for where your files will go if you are unable to take care of them, either temporarily or for the long term, will help your patients access their information quickly, and will help the College know where to send your patients if you can’t tell them yourself.
Closing an Office
Because patients have a right to access the information in the files, the custodian has a responsibility to make every reasonable effort to inform patients when something changes. For instance, if an optician is closing an office, they should notify their patients of the change. Best practice would be to notify each patient individually, but in a larger office this may not be a reasonable option. An alternative would be to post a notice on the door, or put up a notice on the business website. If you need guidance on how to inform your patients, refer to the Standards of Practice or contact the college for help.
Depending on where the optician has gone, they should either inform their patients that their files are located at the optician’s new place of business, or indicate where they can access the files if the optician is retiring or leaving the province.
Retiring or Transferring out of Province
When an optician retires, they let their license lapse. This means that they are no longer a regulated health professional, and must make arrangements for someone else to become the custodian of their files. The successor custodian becomes responsible for safeguarding and providing access to the patient’s files; they may also take on the other health provider responsibilities to the patients that the previous custodian had.
Similar to retiring, if an optician is transferring out of province they are usually not licensed in Alberta anymore. They must make alternate arrangements for their patients’ files, and make reasonable attempts to let their patients know where to find their files. These files should remain in Alberta under the care of a regulated health professional because the patients need to be able to access them and they are subject to provincial privacy laws.
Why Share Your Plan?
If the college receives a call from a patient who can’t track down their file and doesn’t know what happened to their optician, we do our best to help them. When we don’t know your succession plan, this can mean trying to get a hold of opticians who have retired or their families if the optician is deceased. Sharing your emergency succession plan and letting us know where your files have gone when you retire, close your business, or move out of province, will help us facilitate for you without inconveniencing you or your family.
Our “Successor Custodian” form is an excellent way to inform us of what your intent is in case of emergency. We also have an “Optical Business Closing” form, which allows you to inform the College that your business is closing, and where you are transferring your files. Sometimes patients don’t return for several years, and any notice you’ve put up to inform them will be long gone. In those cases especially, it’s best to have a paper trail.
Next time: Multiple Custodians
We’ve discussed what to do if you are the sole custodian of your patient files, but what if you are one of many health professionals in an optical? Who is the custodian in that case? What is the difference between custodians and affiliates? How can you make sure everyone is clear about what their roles are? We’ll answer these questions in the second part of this article series; keep your eyes out for “The Circle of Care: Who is Responsible for Patient Files?”