Regardless of the business structure through which a physician practices (e.g. as a sole practitioner, in a shared group practice, or as an employee of a clinic), all physicians have legal, ethical, and professional duties relating to medical records. While privacy laws impose obligations with respect to information contained in a medical record, medical-legal standards are in place to ensure that physicians retain medical records for the periods that are required by law, that regulators can access the records on request, and that the medical records and the systems holding are reliable. The College of Physicians and Surgeons of BC’s Professional Standards and Guidelines on Medical Records require physicians to ensure that “before they create a medical record, they comprehensively address the issues of ownership, custody, confidentiality, and enduring access for themselves and their patients.”
These professional, ethical, and legal duties are fundamental and can’t be overridden for any individual physician by a business arrangement. These duties can also endure long past the date upon which a business arrangement comes to an end. It is therefore important that all physicians take steps at the outset of any business relationship to address medical records issues and to mitigate risk and ensure legal compliance with respect to those issues.
In its Medical Records standard, the College prescribes that:
- “[i]n all situations where a physician is creating medical records in a group or shared medical record environment, a data-sharing agreement should be in place which addresses how issues of ownership, custody, and enduring access by individual physicians and patients will be addressed, including following relocation, retirement, or death of the physicians”;
- “[i]n all situations where a physician creating a medical record is not the owner of the clinic and/or of the EMR licence issues of custody, confidentiality, and enduring access by individual physicians and patients must be documented in a formal contract with the owners and/or EMR service providers”; and
- “[f]ailure to address issues of custody, confidentiality, and enduring access of medical records may be considered professional misconduct.”
These guidelines are meant to assist with some of these issues, both during and at the termination of the business relationship. However, these guidelines are not exhaustive and do not constitute legal advice. Every physician should carefully consider his or her own particular situation and seek appropriate legal advice.
