When it comes to patient confidentiality, privacy is not a privilege but a legal and ethical right. Medical records contain vast amounts of sensitive information, which health professionals must securely destroy at the end of the lifecycle to protect patient privacy.
In Ontario, the Personal Health Information Protection Act (PHIPA) is the province’s health-specific privacy legislation, which governs how medical information may be collected, used and disclosed within hospitals, psychiatric facilities, laboratories, ambulance services and nursing homes. PHIPA also requires healthcare providers, such as doctors, nurses and allied health professionals, to ensure that records are retained, transferred and properly destroyed in a secure manner, so that sensitive information may not be reconstructed.
What Types of Medical Records Must Be Shred?
PHIPA defines protected health information (PHI) as any identifiable information relating to a person’s health and medical history. This includes:
- Diagnostic, treatment and care information
- Ontario Health Insurance Plan (OHIP) information
- Genetic information
- Payments or eligibility for healthcare
- Donations, testing or examination of body parts or bodily substances
- Identifying information of a substitute decision-maker
- Other medical record details
It is important to note that PHIPA only governs the collection, use and disclosure of medical records and not other types of patient information, which fall under the jurisdiction of the Freedom of Information and Protection of Privacy Act (FIPPA). This act regulates the collection, use and disclosure of personal information in Ontario, as well as the proper retention, destruction, security and accuracy of the data, such as a patient’s:
- Name
- Address
- Phone number
- Social security numbers
- Medical record numbers
- Driver’s licence number
- Student number
- Race
- National or ethnic origin
- Colour
- Religion
- Age
- Sex
- Sexual orientation
- Marital or family status
- Education
- Fingerprints or blood type
- Medical, psychiatric, psychological, criminal or employment history
- Financial data
- Opinions or views
All PHIPA- and FIPPA-defined personal information must be properly stored and destroyed following a secure document destruction process. This is to ensure ongoing compliance and that information cannot be reconstructed.
PHIPA also requires that a certificate of destruction be issued upon completion of every shred. It must include the date, time, location and method of destruction, as well as the signature of the operator.
The Importance of Using a Medical Record Shredding Service
There are six main reasons why working with a medical record shredding service is essential for all healthcare providers:
1. Shredding medical records safeguards patient confidentiality
Healthcare providers have a legal and ethical obligation to protect private patient information – and patients expect that medical professionals treat their PHI with the utmost care and confidentiality. In-house office shredding not only goes against the PHIPA, but it puts highly private medical information at risk of falling into the wrong hands and being used in unlawful ways.
2. Shredding medical records ensures healthcare providers remain compliant
Healthcare providers have a much higher standard of compliance when it comes to data management due to the sensitive nature of medical records and the privacy laws imposed by PHIPA and FIPPA. When confidential documents end up in the trash or recycling bin or proper steps are not taken to ensure compliant destruction processes, healthcare professionals could face hefty fines for breaking privacy laws.
3. Shredding health records reduces storage space
Providers within the healthcare industry are required to provide medical records storage for a specified retention period. Implementing proper record retention and destruction processes not only ensures privacy law obedience and patient confidentiality, but it is an effective solution that saves practices costly storage space by shredding paper and electronic medical records on a strict schedule.
4. Shredding medical documents improves care
When medical records shredding is managed in-house, it takes administrative staff away from other responsibilities, such as appointment bookings and follow-up, in-patient processing, billing and more. By working with a certified document destruction service that provides medical records shredding, healthcare employees can focus on more important tasks and provide better customer service to the individuals they care for.
5. Shredding medical records protects patients from identity theft
Medical identity theft is a growing form of fraud, yet its protection often falls low on the priority list. Identity thieves steal PHI to gain unlawful access to medical care, prescription medicine or medical benefits. This form of fraud not only damages patients whose identities have been stolen, but it costs healthcare and insurance providers and taxpayers too. Working with a certified medical record shredding service with a secure chain of custody is the best way of safeguarding access to protected health information from identity thieves.
6. Shredding medical records protects against security breaches
Within the healthcare industry, there are many causes of security breaches, but lack of training and awareness of proper document disposal methods are two main causes. When employees are unaware of secure disposal processes, confidential documents containing PHI have a greater risk of being thrown in the trash or recycling bin. When this occurs, unauthorized individuals can gain access to private information, which can lead to a devastating data breach or a destroyed reputation.
Protect Confidential Documents With Blue-Pencil’s Medical Records Shredding Services
The only way to ensure your medical records are properly destroyed is to use a professional document shredding service that is NAID AAA Certified.
At Blue-Pencil, we provide compliant medical records shredding services to healthcare providers to keep protected health information secure. We offer one-time and reoccurring mobile destruction at your practice for paper records, computer hard drive devices and electronic medical records on non-paper media, including backup tapes, optical media, mobile data devices and more.
We also provide a Certificate of Destruction upon completion of every shredding service for all paper and media types to prove proper disposal practices are followed as per PHIPA. This also ensures a secure chain of custody for your peace of mind.
To learn more about our industry-leading medical record shredding services or to discuss your clinic’s document destruction needs, contact our customer service team at Blue-Pencil for a free quote.