Duties and responsibilities

Expectations of physicians in practice

Sharing records, improving care, staying safe

Originally published December 2014

Providing patients with access to their online medical records and doctors' visit notes is advocated by some care providers and commentators as another step toward quality healthcare. Physicians who do share their records online should keep in mind their professional and legal obligations to protect patient information and document appropriately. In addition, making patients aware of what they can expect from online access maintains the trust in the doctor-patient relationship.

Technology makes it easier

Electronic health records and web-based patient portals have made it easier to share records online with patients. Physicians in solo and group practices, and institutions such as clinics and hospitals are embarking on this new front.

The benefits

Those in favour of providing patients with online access to their medical records see substantial benefits. One often-referenced study called OpenNotes allowed patients in ambulatory care settings to enter an online patient portal to read what their primary care providers wrote about them. Among its results, the study found: "The vast majority [of patients] reported an increased sense of control, greater understanding of their medical issues, improved recall of their plans for care, and better preparation for future visits. Perhaps most important clinically, a remarkable number reported becoming more likely to take medications as prescribed."1

The obligations

Giving patients access to their medical records online holds promise for improved healthcare. If venturing into this area, physicians should reflect on how they will continue to protect patient health information, document appropriately, and manage patients' expectations.

Security and privacy of information

Physicians have both professional and legal obligations to keep confidential patient information private and secure. When providing patients with online access to medical records, they should follow their medical regulatory authorities' (Colleges') policies or guidelines for protecting confidential patient information, as well as the applicable privacy legislation.

Physicians' electronic record systems and patient portals must have security features that adequately guard patient information. Robust features, such as encryption, along with rules on who can access data can help minimize risks. In some provinces and territories, these features are required by law. Physicians will want to work with their vendor and staff to create a secure electronic record system and portal.

The privacy and security issues should be part of the discussions with patients when introducing shared records. In fact, Colleges in some jurisdictions expect physicians to explain to patients the risks of using a web-based portal. Patients should be made aware that security measures have been put in place, but it is always a possibility that these safeguards can fail.

Clarifying expectations

Clarifying what patients can expect when accessing their records online allows physicians to maintain the trust in their relationships with patients.

Doctors should speak with their patients about the purpose of viewing the record and visit notes, what information they will have access to, and how the portal is intended to be used. The discussion should also include what the portal is not to be used for, such as providing a diagnosis or follow-up care, exchanging time-sensitive information, obtaining professional advice, or communicating medical emergencies. Patients who want to discuss notes they've seen online should be instructed to contact the physician in the appropriate manner.

The CMPA recommends that physicians include terms of use on their web-based patient portals. These can clarify what patients can expect from online access to their records by outlining the terms and conditions under which patients may use and access the portal. To help guide physicians in creating their own terms of use, the Association has developed a template agreement [PDF] which includes a provision for websites with patient portals.

Documenting appropriately

Physicians' notes and medical records serve a number of purposes: providing an ongoing account of patients' health and treatment, communicating with other healthcare professionals, and acting as legal documents giving evidence of the care provided. Colleges and the courts have expectations for records including that they will be contemporaneous, accurate, and adequately maintained.

When speaking with patients about viewing their records online, doctors should aid patients' understanding by discussing the professional and legal requirements for documenting in and maintaining medical records. Physicians should clarify that while patients are being given access to view their records, they will not have the ability to make changes to the record.

Patients who do want to amend their record can make a request to the physician. The physician ultimately must agree that the request is reasonable and appropriate, for example to correct an incomplete or inaccurate record. In cases where physicians decline the request, they can document the events in the record, including the discussion with the patient. In some jurisdictions, privacy legislation requires the patient's objection to the entry to be included as part of the record. When mistakes or missing information is discovered, it may be appropriate to make an additional entry in the record, provided it is clearly marked as a correction. Physicians should be aware of the legal and College requirements in their jurisdiction for making corrections or addendums (late entries) in the record.

At times, physicians may have concerns that patients' accessing their records online will view certain information that could be harmful or upsetting. Although patients have a general legal right of access to their personal health information, including consultants' reports, there may be exceptions that physician may rely on to deny patients' access to information. An example of such an exception is when it could be reasonably expected that seeing the information would result in imminent harm to patients or others. Physicians will also want to ensure that there is a mechanism in place to hold back any potentially upsetting or sensitive information that has not yet been discussed with the patient in a face-to-face appointment. For example, a physician may wish to withhold access to a poor test result until they've spoken to the patient in person. The terms of use agreement may serve as a mechanism or tool to explain in detail the intent of the portal and describe exactly what information patients will see and will not see. The agreement may even be adapted and modified for particular patients.

Patients can also request copies of some or all of the information in their medical record, which is in accordance with their general right of access to their personal health information. Some electronic record systems make it difficult practically to give patients printouts of their record. Whether physicians provide patients with a paper copy or electronic copy will depend on a patient's specific request and the ease of printing directly from the electronic record system.

Making the most of the benefits

Sharing physicians' notes and electronic records online with patients may mean significant improvements in patients' engagement in their own healthcare. The OpenNotes pilot study demonstrated that patients who saw their physicians' notes had a better understanding of their medical condition and were better at taking their medications. These convincing results motivated the three institutions participating in the study to continue with the project, which has spread to numerous other physicians' offices, clinics, and institutions in North America and the United Kingdom.

To optimize those potential benefits, doctors should keep in mind their obligations to keep patient information private and secure, document so they meet professional and legal requirements, and manage patients' expectations so they maintain trust in the doctor-patient relationship.




  1. Delbanco, T., Walker, J., S.K. Bell, Darer, J.D., Elmore, J.G., Farag, N., Feldman, H.J., Mejila, R., Ngo, L., Falston, J., Ross, S.E., Trivedi, N., Vodicka, E., Leveille, S.G., "Inviting patients to read their doctors' notes: A quasi-experimental study and a look ahead," Annals of Internal Medicine, (October 2, 2012), Vol. 157, No.7 p.461

DISCLAIMER: The information contained in this learning material is for general educational purposes only and is not intended to provide specific professional medical or legal advice, nor to constitute a "standard of care" for Canadian healthcare professionals. The use of CMPA learning resources is subject to the foregoing as well as the CMPA's Terms of Use.