Improper disposition of medical records appears to be an international problem. The Saskatchewan Information and Privacy Officer recently issued regulatory guidance to health care providers on complying with the province’s health data protection law. The guidance is being sent to all health regulatory bodies and health care organization privacy boards in Saskatchewan to remind them of their obligations under the Health Information Protection Act (HIPAA), which was enacted in 1999 and took effect Sept. 1, 2003. The guidance was prompted in part by an incident where thousands of patient records were dumped in a recycling bin in the provincial capital of Regina.
The guidance noted that “[e]lectronic medical records may largely eliminate the prospect of patient files blowing in the wind around dumpsters but pose other significant privacy risks. These include snooping, viewing of personal health information without any appropriate need to know, gossip, and carelessness.”
Among the recommendations in the guidance are the following:
- Designate a Privacy Officer with specific responsibility for compliance with privacy laws and the safe retention and disposition of personal health information.
- Adopt written policies and procedures, “including physical, administrative and technical measures reasonable for the protection of personal health information.”
- Adopt and follow a record retention and disposition schedule.
- Ensure that all personal health information is properly and safely stored at all times.
- Ensure that when disposing of personal health information all materials are shredded or otherwise completely destroyed.
- Enter into an appropriate agreement with any entity to which the storage or destruction of patient files is outsourced.
Sound advice for those maintaining personal health information, no matter where they are located.