How to manage your medical records: Retention, access, security, storage, disposal, and transfer

Some of the most common questions asked by CMPA members relate to their clinical record, including how long should it be kept, who should have access to it, how it can be kept secure, how to properly store and dispose of it, and under what circumstances it should be shared or transferred.

Retention of records

Generally, provincial or territorial legislation and regulatory authority (College) policies specify the period of time that you, as a physician, are required to keep your clinical records. The chart below lists retention requirements or recommendations for each province and territory

The CMPA generally recommends that you retain medical records for at least 10 years (16 years in British Columbia) from the date of last entry or, in the case of minors, 10 years (16 years in British Columbia) from the time the patient would have reached the age of majority (either age 18 or 19 years). For obstetrical care, the CMPA recommends that maternal records (e.g. prenatal and labour and delivery records) also be maintained for at least 10 years from the time the infant reaches or would have reached the age of majority.

There are important reasons why the CMPA recommends these retention periods. A principal reason is that the records may be needed to assist in the defence of physicians, or their estates, if medical-legal difficulty should arise. For example, if your estate is sued in connection with professional work you performed, the records often contain the best evidence of your interaction with the patient. Similarly, obstetrical records are often relevant in subsequent medical malpractice actions brought related to the birth of an infant.

If you are defending yourself against allegations of professional fault or negligence, and the patient’s medical record has been disposed, you will be left to rely primarily on memory, which may be affected by the passage of time.

While legislation in each province or territory imposes limits as to when a legal action can be commenced, these limits can be quite flexible. In some circumstances, the courts may be reluctant to deprive an individual of the right to have an issue adjudicated despite the apparent expiry of the limitation period. Accordingly, although provincial and territorial differences in limitation periods vary, the CMPA generally advises that you retain your clinical records for at least 10 years (16 years in British Columbia) from the date of last entry or 10 years (16 years in British Columbia) from the age of majority in the case of minors. Again, the CMPA recommends that maternal records (e.g. prenatal and labour and delivery records) be maintained for at least 10 years from the time the infant reaches or would have reached the age of majority.

Access to records

The 1992 Supreme Court of Canada decision in McInerney v MacDonald 1 represented a significant departure from the previously-held view that the patient's right to information in the medical record was limited to a summary report of the care and management afforded the patient by the physician. In this decision, the Supreme Court stated the following:

• The physical medical records are the property of the physician.
• A patient is entitled to examine and receive a copy of the complete medical records compiled by the physician in administering advice or treatment to the patient, including records prepared by other doctors that the physician may have received.
• The patient is not entitled to examine or receive copies of any information or material received or compiled by the doctor outside of the physician-patient relationship.
• A patient's general right of access to medical records is not absolute. The court stated that patients should have access to the medical records in all but a few circumstances. The physician may use discretion not to disclose information the physician reasonably believes is likely to cause a substantial adverse effect on the physical, mental, or emotional health of the patient or harm to another person.
• A patient should have access to the medical record unless there are compelling reasons to not disclose. The onus is on the physician to justify denying access.

Since this decision, many jurisdictions have enacted privacy legislation that governs the collection, use, and disclosure of personal health information.

As a general rule, information about a patient should be disclosed only in one of the following scenarios:

• on the written authority of the patient
• on the written authority of the patient's authorized legal representative
• on receipt of a court order compelling disclosure
• when the request comes from an agency or individual expressly entitled by legislation to a copy of the records

Security of records

Clinical records must be properly secured and protected, either physically or electronically. For example, paper records should be kept in restricted access areas or in locked cabinets with limited access.

Patient information that is stored electronically is likely accessible to a greater number of people than a paper record, and the protection of the information is therefore more complex.

Security features and policies should ensure information maintained in an electronic records system is accessible only to those within the patient's circle of care (i.e. the healthcare providers treating a patient who need information to provide that care), or for other purposes authorized by law or with express patient consent. This can be achieved through the use of user identification and passwords for logging on.

Electronic records systems should also include controls that restrict access based on the user's role and responsibilities. Encryption technology on all computer systems and portable electronic devices (e.g. laptops, memory sticks, etc.) containing patient information is recommended.

Storage and disposal

You must ensure that records are stored in a safe and secure place. If you have hired a service provider to manage medical records, you continue to be responsible for maintaining the security of the records in accordance with applicable privacy legislation and College requirements. If the records are retained by a commercial storage provider, some jurisdictions that have enacted health-specific privacy legislation require that you enter into a written agreement with the storage provider. While this may not be a requirement in every jurisdiction, it is a recommended practice. Patients should also be notified about the location of their records and how they may be accessed. You must also confirm how you can access the records and make copies of any records for the purpose of preparing medical-legal reports, defending legal actions, or participating in a complaint investigation.

Once the retention period has expired, records should be destroyed in a way that maintains confidentiality.

Destruction should ensure that the record cannot be reconstructed in any way. For example, for paper records, it is recommended they be shredded, pulverized, or incinerated. Effective destruction of electronic records requires that the records be permanently deleted or irreversibly erased. When destroying information, you must consider whether it is necessary to destroy not only the original records, but also any copies, including back-up files.

As the CMPA does not set standards, including on record destruction, we cannot make any specific recommendations or endorse any particular record destruction practices. Rather, the CMPA’s advice is based on physicians’ obligations for destroying records, which is determined by the guidance and requirements of the Colleges, provincial or territorial privacy commissioners, and relevant privacy legislation. You should look to these organizations and legislation for detailed instructions.

Before destroying records, it is recommended that you make a list of the names of the patients whose records are to be destroyed, and that this list be kept permanently in a secure location. This is to be able to later determine at-a-glance that a medical record has been destroyed and not simply been lost or misplaced.

Transfer of records

It is not uncommon that a former physician is asked by a new physician to provide patient information or even to hand over the record. Occasionally, a patient will ask that the file be sent to the new physician or that it be given to the patient who can in turn take it to the new physician. However, an office clinical record made by you is your property and you may need it later if your professional work or care for the patient is called into question.

As a general practice, the CMPA advises that you not let the original files out of your control.

There are other reasonable means of providing information about a physician's role in a patient's case (with the patient's consent) without handing over the original file, including:

• a report or letter summarizing the relevant entries in the file
• a copy of the file may generally be provided if specifically requested

You must ensure that the medical records are transferred to another physician in a manner that protects the confidentiality of the information. When you are transferring patient information contained in an electronic record, you should use a secure means such as fax, email, or another electronic record. You should be aware of applicable College policies and guidelines and privacy legislation governing the transfer of personal health information via email or fax.

If you are working in partnership with others or in a clinic, you should have an agreement in place to deal with issues related to the transfer of and access to records in the event you leave the partnership or clinic.

The bottom line

• Despite different legislative requirements and College guidelines across the country setting out variable limitation periods, the CMPA generally advises that for medical-legal purposes you retain your medical records for at least 10 years (16 years in British Columbia) from the date of last entry or, in the case of minors, 10 years (16 years in British Columbia) from when the patient reaches the age of majority. For obstetrical care, the CMPA recommends that maternal records (e.g. prenatal and labour and delivery records) be maintained for at least 10 years from the time the born alive infant would have reached the age of majority.
• Patients have a general right to receive copies of their medical records arising out of the doctor-patient relationship, including consultant reports, and subject to some exceptions. You should ensure that appropriate written authorization is received from the patient or their legal representative before transfer occurs.
• Whether in paper or electronic format, you must properly secure and protect clinical records.
• Once the retention period has expired, you should destroy records in a manner that maintains confidentiality.
• When transferring records to another physician, you may charge patients a reasonable fee for copying and reviewing the record. Some privacy statutes address the issue of fees that are permitted to be charged to patients for access to their personal health information, and some Colleges and medical associations also have guidelines in this area, including what constitutes appropriate fees.

CMPA members may contact the CMPA for individual advice concerning the management of medical records.

Retention of clinical records by physicians in Canada

• Province
  or territory
• Minimum requirement
  / recommendation
• Age of
  majority

• British Columbia
• 16 years from the date of last entry or 16 years from when the patient reaches the age of majority, whichever is later 2
• 19

• Alberta
• 10 years from date of last entry or 2 years from when the patient reaches the age of majority, whichever is longer 3
• 18

• Saskatchewan
• 6 years from the date of last entry or 2 years from when the patient reaches the age of majority, whichever is later 4
• 18

• Manitoba
• 10 years from date of last entry or 10 years past the age of majority for minor patients 5
• 18

• Ontario
• 10 years from the date of last entry or 10 years from when the patient reaches the age of majority or until the physician ceases to practice if some conditions are met. 6 CPSO recommends retaining records for a minimum of 15 years. 78
• 18

• Québec
• 10 years from date of last entry 9
• 18

• New Brunswick
• 10 years after the patient was last seen or until age 21, whichever is longest 10
• 19

• Nova Scotia
• 10 years after date of last entry or 10 years after the patient reaches the age of majority 11
• 19

• Prince Edward Island
• 10 years after date of last entry or 10 years after the patient reaches the age of majority 12
• 18

• Newfoundland & Labrador
• 10 years after last provision of service or until age 21 for patients last seen when a minor, whichever is longer 13
• 19

• Yukon
• 6 years from date of last service or 2 years after the patient reaches the age of majority, whichever is longer 14, 15
• 19

• Northwest Territories
• 10 years from date of last entry or 2 years after the patient reaches the age of majority, whichever is longer (adopts CPSA Standard of Practice, Patient Record Retention) 4
• 19

• Nunavut
• 10 years from date of last entry or 2 years after the patient reaches the age of majority, whichever is longer (adopts CPSA Standard of Practice, Patient Record Retention) 4
• 19

References

1. McInerney v MacDonald, [1992] 2 SCR 138
2. College of Physicians and Surgeons of British Columbia [Internet]. Vancouver (CA):CPSBC; issued 2009 Jun 1; revised 2019 May 3. Bylaws, Part 3 – Records, s 3-6 [cited 2019 July 12]. Available from: https://www.cpsbc.ca/files/pdf/HPA-Bylaws.pdf
3. College of Physicians and Surgeons of Alberta [Internet]. Edmonton (CA):CPSA; reissued 2016 Jan. Patient Standard of Practice: Record Retention, s 6 [cited 2019 July 12]. Available from: http://www.cpsa.ca/standardspractice/patient-record-retent/
4. College of Physicians and Surgeons of Saskatchewan [Internet]. Saskatoon (CA):CPSS; issued 2019 Jun. Regulatory Bylaws for Medical Practice in Saskatchewan, s 23.1(f) [cited 2019 July 12]. Available from: https://www.cps.sk.ca/iMIS/Documents/Legislation/Legislation/Regulatory%20Bylaws.pdf
5. College of Physicians and Surgeons of Manitoba [Internet]. Winnipeg (CA):CPSM; revised 2019 Jun 21. Standards of Practice of Medicine, Part 5, s 24 [cited 2019 July 12]. Available from: https://cpsm.mb.ca/cjj39alckF30a/wp-content/uploads/Standards%20of%20Practice/Standards%20of%20Practice%20of%20Medicine.pdf#page=23
6. O Reg 114/94: General, s 19(1) under Medicine Act, 1991, SO 1991, c 30. Available from: https://www.ontario.ca/laws/regulation/940114
7. College of Physicians and Surgeons of Ontario [Internet]. Toronto (CA):CPSO; reviewed and updated 2020 March. Policies: Medical Records Management, Advice to the Profession on Medical Records Management [cited 2020 Nov 25]. Available from: https://www.cpso.on.ca/Physicians/Policies-Guidance/Policies/Medical-Records
8. College of Physicians and Surgeons of Ontario [Internet]. Toronto (CA):CPSO; reviewed and updated 2020 March. Policies: Medical Records Management, Advice to the Profession on Medical Records Management [cited 2020 Nov 25]. Available from: https://www.cpso.on.ca/Physicians/Policies-Guidance/Policies/Medical-Records-Management/Advice-to-the-Profession-Medical-Records-Managemen
9. Règlement sur les dossiers cliniques, les lieux d’exercice et la cessation d’exercice d’un médecin, Chapitre C-26, a. 91, s. 14 and 50.
10. College of Physicians and Surgeons of New Brunswick [Internet]. Rothesay (CA):CPSNB; affirmed 2017 June. Guidelines: Patient Medical Record [cited 2019 July 12]. Available from: http://cpsnb.org/en/medical-act-regulations-and-guidelines/guidelines/438-the-patient-medical-record
11. College of Physicians and Surgeons of Nova Scotia [Internet]. Halifax (CA): CPSNS; amended and approved 2016 April 1. Professional Standard Regarding Medical Records [cited 2019 July 12]. Available from: https://cpsns.ns.ca/wp-content/uploads/2017/10/Medical-Records.pdf
12. College of Physicians and Surgeons of Prince Edward Island [Internet]. Charlottetown (CA):CPSPEI; Policy: Retention, Access & Transfer of Records [cited 2019 July 12]. Available from: http://cpspei.ca/publications/policies/
13. College of Physicians and Surgeons of Newfoundland and Labrador [Internet]. St. John’s (CA):CPSNL; reviewed and updated 2017 Sept 9. By-Law No. 6: Medical Records, s 21 [cited 2019 July 12]. Available from: https://www.cpsnl.ca/web/files/By-Law%206%20-%20Medical%20Records%20-%20September%209%202017.pdf
14. Regulation O.I.C. 1980/206, s 3(3) under the Medical Professions Act, RSY 2002, c 149. Available from: http://www.gov.yk.ca/legislation/regs/oic1980_206.pdf
15. Yukon Medical Council [Internet]. Whitehorse (CA):YMC; amended 2017 Jun. Standards of Practice: Records Management, s 4 [cited 2019 July 12]. Available from: http://www.yukonmedicalcouncil.ca/pdfs/Records_Management.pdf

DISCLAIMER: The information contained in this learning material is for general educational purposes only and is not intended to provide specific professional medical or legal advice, nor to constitute a "standard of care" for Canadian healthcare professionals. The use of CMPA learning resources is subject to the foregoing as well as the CMPA's Terms of Use.