Some of the most common questions asked by CMPA members relate to their clinical record, including how long should it be kept, who should have access to it, how it can be kept secure, how to properly store and dispose of it, and under what circumstances it should be shared or transferred.
Retention of records
Generally, provincial or territorial legislation and regulatory authority (College) policies specify the period of time that you, as a physician, are required to keep your clinical records. The chart below lists retention requirements or recommendations for each province and territory.
CMPA generally recommends that you retain the entirety of your medical records for at least 10 years (16 years in British Columbia) from the date of last entry or, in the case of minors, 10 years (16 years in British Columbia) from the time the patient would have reached the age of majority (either age 18 or 19 years). For obstetrical care, CMPA recommends that maternal records (e.g. prenatal and labour and delivery records) also be maintained for at least 10 years from the time the infant reaches or would have reached the age of majority.
Maintaining the entirety of a record
In most jurisdictions, physicians must keep all records from the time they were created (i.e. from the first time the physician saw the patient) until the prescribed number of years after the last entry. For example, if you are located in a jurisdiction that prescribes a 10-year requirement, and you first see a patient in 1996 and last see the patient in 2026, you would need to maintain the entire record (i.e. from 1996 to 2026) until 2036.
There are important reasons why CMPA recommends these retention periods. A principal reason is that the records may be needed to assist in the defence of physicians, or their estates, if medico-legal difficulty should arise. For example, if your estate is sued in connection with professional work you performed, the records often contain the best evidence of your interaction with the patient. Similarly, obstetrical records are often relevant in subsequent medical malpractice actions brought related to the birth of an infant.
If you are defending yourself against allegations of professional fault or negligence, and the patient’s medical record has been disposed, you will be left to rely primarily on memory, which may be affected by the passage of time.
While legislation in each province or territory imposes limits as to when a legal action can be commenced, these limits can be quite flexible. In some circumstances, the courts may be reluctant to deprive an individual of the right to have an issue adjudicated despite the apparent expiry of the limitation period. Accordingly, although provincial and territorial differences in limitation periods vary, CMPA generally advises that you retain your clinical records for at least 10 years (16 years in British Columbia) from the date of last entry or 10 years (16 years in British Columbia) from the age of majority in the case of minors. Again, the CMPA recommends that maternal records (e.g. prenatal and labour and delivery records) be maintained for at least 10 years from the time the infant reaches or would have reached the age of majority.
Access to records
In the 1992 decision in McInerney v MacDonald 1, the Supreme Court of Canada made it clear that the information in the medical record belongs to the patient, but that the person or organization responsible for the creation, assembly and management of a paper or electronic record is the custodian of the information. Privacy legislation has now reinforced patients’ common law right of access to personal health information contained in their medical records.
A patient’s right of access, however, is not absolute. When a physician reasonably believes there is a significant likelihood of a substantial adverse effect on the patient's physical, mental, or emotional health, or harm to a third party, that information or part of the medical record does not need to be disclosed.
As a general rule, information about a patient should be disclosed only in one of the following scenarios:
- on the written authority of the patient;
- on the written authority of the patient's authorized substitute decision-maker;
- on receipt of a court order compelling disclosure; or
- when the request comes from an agency or individual expressly entitled by legislation to a copy of the records.
Security of records
Clinical records must be properly secured and protected, either physically or electronically. For example, paper records should be kept in restricted access areas or in locked cabinets with limited access.
Patient information that is stored electronically is likely accessible to a greater number of people than a paper record, and the protection of the information is therefore more complex.
Security features and policies should ensure information maintained in an electronic records system is accessible only to those within the patient's circle of care (i.e. the healthcare providers treating a patient who need information to provide that care), or for other purposes authorized by law or with express patient consent. This can be achieved through the use of user identification and passwords for logging on.
Electronic records systems should also include controls that restrict access based on the user's role and responsibilities. Most Colleges and privacy commissioners generally recommend or require that electronic records systems have an "audit trail" that records the date, time, and identity of the user when records are accessed; records the date and time of each information entry and the identity of the user making the entry; and indicates any changes in the recorded information and the identity of the user making the change.
Encryption technology on all computer systems and portable electronic devices (e.g. laptops, memory sticks, etc.) containing patient information is recommended.
Storage and disposal
You must ensure that records are stored in a safe and secure place. If you have hired a service provider to manage medical records, you continue to be responsible for maintaining the security of the records in accordance with applicable privacy legislation and College requirements. If the records are retained by a commercial storage provider, some jurisdictions that have enacted health-specific privacy legislation require that you enter into a written agreement with the storage provider. While this may not be a requirement in every jurisdiction, it is a recommended practice. Patients should also be notified about the location of their records and how they may be accessed. In Québec, the College requires that the storage company be located in the province. You must also confirm how you can access the records and make copies of any records for the purpose of preparing medical-legal reports, defending legal actions, or participating in a complaint investigation.
Once the retention period has expired, records should be destroyed in a way that maintains confidentiality.
Privacy legislation, Colleges and Privacy Commissioners generally require that record destruction practices ensure that the record cannot be reconstructed in any way. For example, paper records should be shredded, pulverized, or incinerated. Effective destruction of electronic records requires that the records be permanently deleted or irreversibly erased. When destroying information, you must consider whether it is necessary to destroy not only the original records, but also any copies, including back-up files.
Before destroying records, it is recommended that you make a list of the names of the patients whose records are to be destroyed, and that this list be kept permanently in a secure location. This is to be able to later determine at-a-glance that a medical record has been destroyed and not simply been lost or misplaced. In some jurisdictions, maintaining such a list is a requirement (e.g. Quebec).
Transfer of records
It is not uncommon that a former physician is asked by a new physician to provide patient information or the entire record. Occasionally, a patient will ask that the file be sent to the new physician or that it be given to the patient who can in turn take it to the new physician. However, an office clinical record made by you is your property and you may need it later if your professional work or care for the patient is called into question.
As a general practice, the CMPA advises that you not let the original files out of your control.
There are other reasonable means of providing information about a physician's role in a patient's case (with the patient's consent) without handing over the original file, e.g. a report or letter summarizing the relevant entries in the file. A copy of the file may generally be provided if specifically requested.
You must ensure that the medical records are transferred to another physician in a manner that protects the confidentiality of the information. When you are transferring patient information contained in an electronic record, you should use a secure means. You should be aware of applicable College policies and guidelines and privacy legislation governing the electronic transfer of personal health information.
If you are working in partnership with others or in a clinic, you should have an agreement in place to deal with issues related to the transfer of and access to records in the event you leave the partnership or clinic.
The bottom line
- Despite different legislative requirements and College guidelines across the country setting out variable limitation periods, CMPA generally advises that for medical-legal purposes you retain your medical records for at least 10 years (16 years in British Columbia) from the date of last entry or, in the case of minors, 10 years (16 years in British Columbia) from when the patient reaches the age of majority. For obstetrical care, CMPA recommends that maternal records (e.g. prenatal and labour and delivery records) be maintained for at least 10 years from the time the born alive infant would have reached the age of majority.
- Patients have a general right to receive copies of their medical records arising out of the doctor-patient relationship, including consultant reports, subject to some exceptions. You should ensure that appropriate written authorization is received from the patient or their legal representative before transfer occurs.
- Whether in paper or electronic format, you must properly secure and protect clinical records.
- Once the retention period has expired, you should destroy records in a manner that maintains confidentiality.
- In some jurisdictions, you may charge patients a reasonable fee for copying and reviewing the record when transferring records to another physician. Some privacy statutes address the issue of fees that are permitted to be charged to patients for access to their personal health information, and some Colleges and medical associations also have guidelines in this area, including what constitutes appropriate fees.
CMPA members may contact CMPA for individual advice concerning the management of medical records.
Retention of clinical records by physicians in Canada
- Province
or territory
- Minimum requirement/recommendation
- Age of
majority
- Alberta
- 10 years from date of last entry or 2 years from when the patient reaches the age of majority, whichever is longer 3
- 18
- British Columbia
- 16 years from the date of last entry or 16 years from when the patient reaches the age of majority, whichever is later 2
- 19
- Manitoba
- 10 years from date of last entry or 10 years past the age of majority for minor patients 5
- 18
- Newfoundland & Labrador
- 10 years after last provision of service or until age 21 for patients last seen when a minor, whichever is longer 13
- 19
- New Brunswick
- 10 years after the patient was last seen or until age 21, whichever is longest 10
- 19
- Northwest Territories
- 10 years from date of last entry or 2 years after the patient reaches the age of majority, whichever is longer (adopts CPSA Standard of Practice, Patient Record Retention) 4
- 19
- Nova Scotia
- 10 years after date of last entry or 10 years after the patient reaches the age of majority 11
- 19
- Nunavut
- 10 years from date of last entry or 2 years after the patient reaches the age of majority, whichever is longer (adopts CPSA Standard of Practice, Patient Record Retention) 4
- 19
- Ontario
- 10 years from the date of last entry or 10 years from when the patient reaches the age of majority or until the physician ceases to practice if some conditions are met. 6 CPSO recommends retaining records for a minimum of 15 years. 7, 8
- 18
- Prince Edward Island
- 10 years after date of last entry or 10 years after the patient reaches the age of majority 12
- 18
- Québec
- 10 years from date of last entry 9
- 18
- Saskatchewan
- 6 years from the date of last entry or 2 years from when the patient reaches the age of majority, whichever is later 4
- 18
- Yukon
- 10 years from date of last entry or 10 years after the patient reaches the age of majority, whichever is longer 14
- 19
Specific guidance for your region
Read what the regulatory authority (College) in your province or territory says about this topic.
Don't see your province or territory listed? Guidance from your College may not be currently available on this topic.
References
-
McInerney v MacDonald, [1992] 2 SCR 138
-
-
-
-
-
-
-
-
Règlement sur les dossiers cliniques, les lieux d’exercice et la cessation d’exercice d’un médecin, Chapitre C-26, a. 91, s. 14 and 50.
-
-
-
-
-
