PHIPA and patient records for Ontario optical stores

Prescriptions, health card numbers, medical history from an intake form: an optical store holds more personal health information than most owners realise. In Ontario that information falls under PHIPA, the Personal Health Information Protection Act, 2004. This guide covers what it means at the counter and when choosing software, in plain terms.

Who is responsible

PHIPA places duties on health information custodians. Regulated health professionals who provide care are generally custodians, and the College of Opticians of Ontario's page on patient personal health information sets out the duties of "opticians who are health information custodians". Who exactly is the custodian in a store with several opticians, or one owned by a non-optician, depends on how the business is set up. If you're unsure, ask the College or a privacy lawyer.

Everyone else who handles the information on your behalf (staff, a bookkeeper, your software company) is your agent or service provider. They have duties too, but responsibility stays with you. "The software vendor lost it" is not a defence.

What PHIPA expects day to day

• Collect what you need, no more. A dispensary needs the prescription and contact details. It rarely needs a full medical history.
• Protect it with reasonable safeguards. Locked screens, individual logins rather than a shared password, staff who only see what their job needs, and paper charts that aren't left on the counter.
• Use it for the care you provide. Recall reminders for eye health are generally fine; sending patient lists to a marketing company is not, without consent.
• Be open about it. Have a short, plain written statement of what you collect and why, available to patients on request.

Breaches: what to do

A breach is any time information is stolen, lost, or seen or used by someone who shouldn't have it: a misdirected email, a stolen laptop, a staff member looking up a neighbour.

1. Contain it. Recover the email, change passwords, lock the account.
2. Tell the patient at the first reasonable opportunity. PHIPA requires this.
3. Report to the Information and Privacy Commissioner of Ontario at the first reasonable opportunity if the breach falls into one of the seven categories in the regulation. The IPC's report a privacy breach page summarizes them: use or disclosure without authority by someone who knew or should have known better (snooping counts, whatever the motive), stolen information (unless it was de-identified or encrypted), further misuse after a breach, a pattern of similar breaches, breaches that lead to discipline of a staff member or a report to their college, and any breach that is significant. A one-off accidental slip, such as an email to the wrong person, generally doesn't need reporting to the IPC unless another category applies. You still have to tell the patient.
4. Keep a record. By March 1 each year, custodians send the IPC statistics on the previous calendar year's breaches, including the ones that didn't need to be reported. Log every incident as it happens so the report is easy.

When a patient asks for their records

Patients have a right to see and get a copy of their own information. According to the IPC's guidance on access and correction, you must respond as soon as possible, and no later than 30 days after receiving the request. You can extend by up to 30 more days if meeting the deadline would unreasonably interfere with your operations or the consultations needed make it impractical, but you must tell the patient in writing how long the extension is and why. Not responding in time counts as a refusal. You may charge a fee, but it can't exceed reasonable cost recovery, and you must give the patient a fee estimate first.

In practice the most common request is "can I have my prescription?" Give it promptly; it's theirs.

How long to keep records

Retention periods for opticians are set by the College's standards, not by PHIPA directly. The College's Professional Practice FAQ says records must be kept for a minimum of seven years from the date of last entry, and a copy of the patient's prescription for a minimum of seven years. The FAQ doesn't set a separate rule for children, so if you see many young patients, ask the College whether a longer period applies. Whatever the period, plan for how records are destroyed securely at the end of it, including inside your software.

What to ask your software vendor

Your vendor holds the records on your behalf, so their safeguards are your safeguards. Ask, in writing:

• Where is the data stored? PHIPA doesn't strictly require storage in Ontario, but many custodians prefer Canadian storage, and patients increasingly ask. Know the answer.
• Who at the vendor can see my patients' records, and when? Look for access that you approve and that is logged.
• Is each staff member a separate login, with roles? Shared logins make it impossible to know who did what.
• Is there an audit trail of who viewed and changed each record?
• How are backups made and encrypted, and how fast can you restore?
• How would you tell me about a breach on your side, and how quickly?
• Can I export all my records if I leave, in a usable format?
• Does any feature send patient information to another company, such as an AI or messaging service, and where is that company?

A vendor that answers these clearly, and puts the answers in its agreement, is one you can defend to a patient and to the College.

The short version

You're responsible for your patients' information, even when someone else stores it. Keep logins individual, collect only what you need, know what to do in the first hour of a breach, answer access requests within the time limit, and pick software that keeps a record of who saw what.