Privacy and confidentiality

Protecting patient information


Tree diagram with different examples of eCommunication: apps, big data, telemedicine, email, EMR/EHR, online forums, patient portals, social media, texting

What does eCommunication mean to you?

More than you might think:

  • apps
  • big data
  • telemedicine
  • email
  • online forums
  • patient portals
  • social media
  • texting

Communicating with patients electronically

Older woman reviewing electronic record with health professional
  • Many patients want it
  • Can improve efficiency of care
    • scheduling, reminders
  • May save time and unnecessary visits
  • Can foster patient engagement

Case: A misdirected email
Middle-aged woman coughing


A 55-year-old woman with cough and dyspnea sees her family physician before travelling for business to a remote part of Canada. The physician orders chest X-rays, and it is agreed that the results will be communicated to the patient by email.
Young physician reading computer screen

Clinical events

The X-rays reveal a moderately-sized pneumothorax of the right lung and suggest the possibility of an underlying neoplasm. The radiologist dictates an urgent report, which is flagged in the family physician's electronic medical record. The family physician sends an email describing the X-ray findings and advising the patient to go to the emergency department.


The email is mistakenly sent to the patient's ex-husband, who sees the message only the following day. He then informs the patient of her diagnosis and the need for urgent follow-up. Fortunately, the patient is seen prior to her planned trip and does not experience any harm as a result of the delay.

Think about it

  • What are the risks of communicating with patients via email?
  • Is it appropriate to deliver bad news or a serious diagnosis by email?

Lessons learned

Establish and document a plan with patients regarding electronic communication. Clarify expectations and discuss the risks of using emails or text messages with patients, taking into consideration whether the means of communication to be used is secure. Even if the patient's consent is obtained, the physician is still obligated to protect the patient's privacy. Physicians should ensure that their office staff are trained on privacy requirements, and that contact information for patients, including email addresses, is confirmed on a regular basis.

Finally, keep in mind that sensitive or urgent information may be more appropriately communicated in person or by telephone.


Communicating with colleagues electronically

Smartphone lying on top of laptop computer
  • Many colleagues want it
  • Perceived to be a more efficient means of communication
    • compared to paging or telephone calls
  • Sharing forum for medical education
  • Facilitates remote consultations

Case: Think before sharing clinical photos
Hockey player with black eye and missing tooth


A 32-year-old recreational hockey player is diagnosed with a comminuted tibial fracture. He is assessed by a medical student doing a rotation in the emergency department. She sends a photo of the initial X-ray via text messaging to her fellow classmates for its teaching value. She fails to notice that the patient's demographic information is visible on the photo.
X-ray of comminuted fractures of tibia and fibula


The patient is seen again one week later in the orthopaedics clinic by a different medical student. He incidentally mentions to the patient that he had already seen his impressive X-ray by text message the previous week.


The patient is very upset that his medical information was shared without his consent and files a complaint against the first medical student to her school.

The medical student is required to write an essay about the importance of patient privacy and a reprimand is officially documented in her academic record.

Think about it

  • How might sharing a photo of a patient's X-ray, rash, or other clinical findings constitute a breach of confidentiality?
  • What strategies could the medical student have used to prevent this complaint?

Lessons learned

Prior to sharing, consider whether the recipient of the shared information is in the circle of care. When sharing identifiable information outside the circle of care or for purposes other than providing care, it is generally necessary to obtain patient consent. Not doing so could result in a privacy breach with serious consequences.

When sharing using social media, be mindful that even de-identified medical stories or photos might be identifiable by others through metadata. If you have any doubts, consider obtaining express consent from the patient.


Case: Posting patient information
Young woman in front of laptop computer


Sasha is a second-year medical student who takes photographs during the resuscitation of a trauma patient. She plans to share the experience with her colleagues.

That night Sasha uploads the photos to Facebook. Concerned about protecting the patient's confidentiality, she limits showing her photos only to the "friends" in the Facebook group dedicated to her class.

The next day, she is called to speak with the Chief of Emergency.

Think about it

  • How could the photos be a concern given the care that Sasha took to ensure they were shared only with her classmates?
  • What other information should you be careful about posting on social media websites?

Lessons learned

Discussions on social networking or even professional websites may constitute a breach of privacy and violate a patient's expectation of confidentiality.

Social networking websites such as Facebook and Twitter, teaching sites run by medical schools (e.g. study groups), and professional sites run by associations and societies are all public spaces. Password protection on such sites may give users a false sense of security that they're in an exclusive environment.

Your online friends may find the case findings equally interesting and forward the information to their friends, who are not known to you. Once even a single online friend receives information, that information is no longer within your control, and you cannot prevent it from being circulated rapidly and indiscriminately.


eCommunication checklist

  • Is the communication within the circle of care?
  • Is explicit (written) consent of the patient required?
  • Is the information secure (encrypted)?
  • Is your device password-protected?
  • What are the relevant regulatory standards?
  • Is only essential information being shared?
  • Is person-to-person communication more appropriate?

Privacy considerations

Despite the convenience of email and text messaging, these methods of eCommunication are often the least secure and the least private. Physicians who communicate via email, text, social media, or web portals need to be mindful they are governed by the same legal and professional standards as would apply in other professional settings (e.g. a hospital setting, family practice, or clinic). Relevant regulatory standards include federal, provincial or territorial privacy legislation, or guidelines published by medical regulatory authorities (Colleges).

Encryption: protecting information

Physicians have an obligation to protect the confidentiality of their patients' personal health information and to comply with privacy requirements. Privacy regulators agree that the use of appropriate encryption software to protect electronic messages is a reasonable safeguard under the circumstances. Various enterprise solutions (e.g. patient portals) can provide encryption, and an increasing number of encryption applications are available for use on personal devices such as smartphones.

Obtaining patient consent

Physicians considering using unsecured or unencrypted email or text messaging should do so only for information that does not include identifiable personal health information (e.g. scheduling, reminders). When doing so with patients, patients should agree to:
  • how these messages will be used
  • the type of information that will be sent
  • how the emails or texts will be processed
  • the risks of using email or text messages

The discussion and patient's agreement should be documented in the medical record. Nevertheless, obtaining the patient's consent or using disclaimers in emails does not obviate a physician's legal and professional obligations to reasonably protect patient health information. Physicians should similarly ensure their office staff are trained on privacy requirements and have signed confidentiality agreements.

View the CMPA's template Consent to use electronic communications (PDF) Opens in new window.

When talking might be a better option

Finally, there are times when face-to-face (or at least person-to-person) communication may simply be more appropriate. Examples include conveying sensitive test results to patients or transferring patients requiring more complex care to a colleague, where interpreting nonverbal cues or giving feedback may be essential to the interaction.

To learn about professionalism issues with eCommunication, see the section on Social media.