Officials are recommending that physicians ensure the proper agreements are in place with their Electronic Medical Record (EMR) service provider, following an incident that recently took place in Didsbury.
Dr. Dianne Smith lost control of over 1,500 medical records when she left the Didsbury Medical Clinic to start her own practice, according to an investigation report written by Rachel Hayward, portfolio officer for the Information and Privacy Commissioner (OIPC) of Alberta.
Smith had not personally entered into a contract with the EMR of the clinic she was working at, and the records were actually under the care of Shariz Jaffer, owner of the Didsbury Medical Clinic, who is not a custodian under the Health Information Act (HIR).
“When custodians do not directly sign agreements with their EMR vendors, they may find themselves in the unfortunate position of not being able to exercise control over health information they need to provide health services,” stated Hayward in the report, noting that a custodian is someone belonging to the College of Physicians and Surgeons of Alberta.
“Custodians remain accountable for the health information they collect, use and disclose, and must ensure they are playing an active role in determining how that information is managed.”
When Smith left the clinic, she contacted the clinic's EMR, Telin Medical Systems Ltd., requesting that her patients' records be sent to her new EMR so she would have the information she needed.
Telin representatives declined the request because she was not the custodian listed on the agreement with the EMR, and Shariz Jaffer also initially declined to give consent to send the files.
Smith was eventually able to regain control of her patients' records.
“However, the process took several weeks,” wrote Hayward. “This time delay could have been avoided if she had entered into an information manager agreement with Telin.”
Generally, the OIPC does not publicly release its investigations or their findings, but Jill Clayton, the information and privacy commissioner of Alberta, said that this incident can provide an important lesson to custodians of medical records.
“When we do (publish), it's usually because we think there's either a systemic issue or we think it's a good opportunity to relay a story that we think is something we need to share with others,” said Clayton.
This particular investigation has a good message, especially since educating custodians of their responsibilities under the (HIA) is part of the OIPC's mandate, she said.
“A major portion of the mandate is to resolve complaints and investigate, and for the most part we are able to resolve things informally with recommendations being made,” she said.
The recommendation made by the OIPC in this case is that custodians ensure they personally hold agreements with whichever EMR they choose, and to make sure that if this is not the case, the issue is dealt with as soon as possible to avoid lapses in patient care, she added.
“The key thing this particular case brings to light is by law, a custodian has to enter into an agreement with the information manager,” she said.
“Custodians who have these kinds of arrangements with an (EMR) vendor need to make sure that they have an information manager agreement in place, and need to make sure that they, as the custodians under the (HIR) have signed the agreement and that it's not signed by somebody else who is not a custodian.”
