skip to content

Medical Records

Print page icon

Approved by Council: November 2000
Reviewed and Updated: September 2005, November 2006, May 2012

Downloadable Versions: Medical Records | Dossiers médicaux

Other References:



The medical record is a powerful tool that allows the treating physician to track the patient’s medical history and identify problems or patterns that may help determine the course of health care.

The primary purpose of the medical record is to enable physicians to provide quality health care to their patients. It is a living document that tells the story of the patient and facilitates each encounter they have with health professionals involved in their care.

In addition to telling the patient’s story, complete and accurate medical records will meet all legal, regulatory and auditing requirements. Most importantly, however, they will contribute to comprehensive and high quality care for patients by optimizing the use of resources, improving efficiency and coordination in team-based and interprofessional settings, and facilitating research. This is achieved in the following ways:

  • Quality of care: Medical records contribute to consistency and quality in patient care by providing a detailed description of patients’ health status and a rationale for treatment decisions.
  • Continuity of care: Medical records may be used by several health practitioners. The record is not just a personal memory aid for the individual physician who creates it. It allows other health care providers to access quickly and understand the patient’s past and current health status.
  • Assessment of care: Medical records are fundamental components of:
    • external reviews, such as those conducted for quality improvement purposes (e.g., the College’s Peer Assessment Program and Independent Health Facilities Program),
    • investigations (such as inquiries made by the Coroner’s Office, and College investigations),
    • billing reviews (records must be properly maintained in order for physicians to bill OHIP for services),1 and
    • physician self-assessments, whereby physicians reflect on and assess the care they have provided to patients (for instance, through patterns of care recorded in the EMR).
  • Evidence of care: Medical records are legal documents and may provide significant evidence in regulatory, civil, criminal, or administrative matters when the patient care provided by a physician is questioned. The legal requirements for medical records are set out in the Ontario Regulations made under the Medicine Act, 1991 (referred to in this policy as the “Regulation” and attached at Appendix A). Other legislation that has an impact on medical records is listed under “Legislative References” at the beginning of this policy.

This policy explains how medical records must be kept, outlining general requirements and considerations about the collection, use, storage, and disclosure of patients’ personal health information, with respect to both paper and electronic records. It outlines requirements with regard to access and retention periods to ensure continuity of care for patients. The policy concludes by listing requirements for the contents of medical records, explaining what must be included in records and how it must be documented.

Physicians are ultimately responsible for meeting the expectations set out in this policy and may assess their own medical record-keeping practices by answering the questions listed in Appendix C, which have been taken directly from a protocol used in the College’s peer assessment activities.



This policy establishes principles and requirements for all medical records and applies to all physicians. The policy indicates any additional requirements that exist based on the type of record (e.g., paper, electronic or hospital-based records) or the physician’s practice (e.g., primary care, procedural medicine, group practice).



The purpose of this policy is to set out physicians’ professional and legal obligations with regard to medical records and to provide all practising physicians with a tool that will assist them in implementing record-keeping practices that are practical and easy to maintain.



In accordance with The Practice Guide, the professional expectations in this policy are based on the following principles:

  • Good medical record-keeping is part of providing the best quality medical care.
  • Accurate and complete documentation in the medical record that is in keeping with the requirements of this policy is essential in facilitating and enhancing communication in collaborative patient care models.


The College expects all physicians to keep medical records that are consistent with their legal obligations and the expectations set out in this policy. While many of the elements of the guidance set out below are mandatory, other components of the policy are offered as recommendations as to the best means of providing patients with quality medical care. Those elements of the policy that are mandatory will be explicitly indicated through the use of terms such as “must”, “required”, or “expected”, whereas recommendations and advice will be indicated through terms such as “should”, “recommended”, or “advised”.


1. Overview and Organization of Medical Records


The Regulation requires that medical records be legible.2 This can be accomplished through legible handwriting, typed entries, voice dictation and transcription, electronic medical records, or handwriting recognition software.3

The College expects that information in a medical record can be understood by other health professionals. Using conventional medical short forms is permissible. However, to reduce error, the meaning should be clear to a health professional reading the record. Physicians should not use abbreviations that are known to have more than one meaning in a clinical setting.

While exceptions exist, patients may obtain access to the information in their medical records. Although the medical record is not written primarily for the patient, physicians must be prepared to provide explanations to patients of any term, code, or abbreviation used in the medical record.4

Documentation of the Patient Encounter

Every patient encounter and all patient-related information must be documented in either English or French and dated in the medical record. Where there will be more than one health professional making entries in a record, each professional’s entry must be identifiable, which may, in an EMR, be accomplished through an audit trail. Where a physician has limited control over the content of a shared record, he or she is only accountable for his or her own entries into the record.

The physician must ensure the accuracy of the entries made into the medical record on his or her behalf by a trainee or the recipient of delegation. This may be indicated by cosigning the entry.

The Health Insurance Act5 requires that physicians record the start and stop time for certain types of patient encounters, such as psychotherapy and counselling.6 In addition to these, physicians should ensure that the start and stop times are recorded for some other types of clinical encounters, such as resuscitation, administration of medications, and telephone conversations.

The College recommends that entries be recorded as soon as possible after the encounter. This is important to ensure safe delivery of care, especially in coordinated care environments.

Chronological and Systematic

In office based practices where there is a single patient chart, it is expected that all materials in each patient chart be ordered in a chronological and systematic manner. In settings such as walk-in clinics, single patient files must be created and all documentation for a single patient must be kept in that patient’s file. It is not appropriate to file by date.

Collection, Use, and Disclosure of Information

Physicians must always obtain the patient’s consent when collecting, using or disclosing personal health information (PHI), unless provided otherwise by law.7

Mandatory reporting requirements are an example of situations in which the disclosure of PHI is required by law.8 Circumstances in which physicians are permitted to collect, use, and/or disclose PHI are set out in the Personal Health Information Protection Act, 2004 (PHIPA).9

If the collection, use, or disclosure is neither permitted nor required by law and therefore patient consent must be obtained, physicians should note that as members of what is commonly referred to as the “circle of care,” PHIPA allows them to assume a patient’s implied consent under particular circumstances. A physician may only assume the implied consent of the patient to collect, use, or disclose the patient’s PHI if:

  • they have received the PHI from the patient, their substitute decision maker, or another health information custodian (HIC) for the purpose of providing or assisting in the provision of health care to the patient,
  • the physician is using, collecting, or disclosing10 the PHI for the purpose of providing or assisting in the provision of health care to the patient, and
  • the patient has not expressly withheld or withdrawn consent to the PHI being collected, used, or disclosed.

Commercial Services

Physicians may wish to engage commercial providers for services such as storage, maintenance, scanning, destruction, and other issues related to medical records. Physicians should use due diligence when selecting and engaging service providers. It is strongly recommended that any agreements with such providers be made in writing.11 These agreements must reflect the same legal and regulatory requirements that apply to physicians as health information custodians. Physicians are encouraged to seek legal counsel or contact the CMPA for advice in these circumstances.


2. Security and Storage

Physicians are ultimately responsible for ensuring that medical records are stored and maintained according to legal requirements and the principles set out in this policy.

Medical records must be stored in a safe and secure environment to ensure physical and logical integrity and confidentiality. Physicians must develop records management protocols to regulate who may gain access to records and what they may do according to their role, responsibilities, and the authority they have.12 At minimum, protocols must ensure that patient records, in electronic or paper form, are readily available and producible when legitimate use is required, and that reasonable steps have been taken to ensure they are protected from theft, loss and unauthorized use or disclosure, including copying, modification or disposal.13 This requirement applies regardless of whether the information is stored on premises within the physician’s control or otherwise. What is reasonable in terms of records management protocols will depend on the threats and risks to which the information is exposed, the sensitivity of the information, and the extent to which it can be linked to an identifiable individual. Physicians are encouraged to remain up-to-date about evolving industry standards and should remain aware of orders of the Information and Privacy Commissioner of Ontario.14


Data sharing agreements incorporating the requirements in this policy must be established among physicians and organizations who will be sharing patient health information with each other.15 This is especially important for physicians who share records (electronic or paper) with hospitals and other care facilities or that allow entries into the record by multiple health-care providers. Physicians must be aware of all others (including non-medical staff, such as administrative, maintenance, or technical staff) who can access their records or their EMR system and what functions they are able to perform. In such situations, the EMR system should be equipped with user identification and passwords for logging on, and where possible, controls that restrict access based on the user’s role and responsibilities. All those who have access to the records must be bound by appropriate confidentiality agreements. For electronic systems, there must be a functioning audit trail or record of who has accessed an EMR and what additions or edits they have made to the record over time.

All personal health information contained on an EMR, external storage media, or a mobile device16 must be strongly encrypted.17

Physicians using wireless Internet must be sensitive to the additional security issues and ensure that the network they are using is sufficiently secure to protect patient privacy.18

E-mails may not be secure. Therefore, physicians who wish to send personal health information by e-mail must obtain express consent to do so from the patient or their representative unless they have reasonable assurances that the information sent and received is secure. Physicians should use a secure e-mail system with strong encryption.

If a physician becomes aware that personal health information over which he or she has custody and control has been stolen, lost, or accessed by unauthorized persons, requirements under PHIPA state that the physician must notify the patient at the first reasonable opportunity.20 In such instances, the College recommends that physicians seek advice from the Information and Privacy Commissioner of Ontario and the CMPA about the steps required.


All patient records and data must be kept in restricted access areas or locked filing cabinets to protect against loss of information and damage. Electronic records must be backed-up on a routine basis and back-up copies stored in a physically secure environment separate from where the original data are normally stored.

Physicians who take records out of the office or access their electronic records from a location other than their own office must take appropriate measures to prevent loss, restrict access, and maintain the privacy of patients’ personal health information.21 All identifiable personal health information accessed and/or stored on mobile devices (even temporarily) must be de-identified or strongly encrypted. The significance of a loss or breach can be greater when multiple patient records are stored on a portable electronic device. Physicians must be particularly diligent in protecting records under these circumstances.


3. Electronic Records

All of the principles discussed in this policy apply equally to electronic records. Specific requirements for EMR systems are set out in section 20 of the Regulation and are listed at Appendix A. Physicians have ultimate responsibility for meeting all legal and regulatory requirements with respect to electronic records.

Good record-keeping practices are essential for physicians using paper or electronic records. An EMR is a tool that can help facilitate these practices. Physicians should therefore research the available products in order to choose an EMR that meets their needs.

An electronic format must be capable of capturing all the pertinent personal health information and allowing the user (whether the physician, another health professional involved in the patient’s care, or an authorized third party) to access patient information in an efficient manner.

Choosing an EMR vendor is a crucial step in the process of transitioning to electronic records. It is strongly recommended that physicians exercise due diligence and carry out research in advance of making this choice for themselves and their practice. Physicians are encouraged to consult Appendix G for further information and to seek advice from OntarioMD which manages Ontario’s EMR adoption program and provides funding and assistance to physicians for acquiring, implementing, and adopting EMRs and related resources.

Transitioning from Paper to Electronic Records

When making the transition from paper to electronic records, physicians must ensure that patient care and appropriate record-keeping practices continue without interruption and that patients’ personal health information is protected.

Physicians may choose to convert all existing paper charts into electronic form, or retain their paper charts and begin entering patient information into the EMR on a subsequent basis. Physicians are responsible for ensuring the integrity of the data that have been converted into electronic form. This includes verifying that documents have been properly scanned and that the entire patient record is intact upon conversion, including all attached notes and handwritten comments. Physicians should establish specific procedures for converting files and document these procedures in writing. It may be helpful to enlist a reputable commercial organization to assist in this process.22

Scanning Documents

When a physician converts paper records into an electronic format, the original paper records may be destroyed in accordance with the principles set out in this policy, provided that:

  • Written procedures for scanning are developed and consistently followed,
  • Appropriate safeguards are used to ensure reliability of digital copies,
  • A quality assurance process is established, followed, and documented (e.g., comparing scanned copies to originals to ensure that they have been accurately converted), and
  • Scanned copies are saved in “read-only” format.

Physicians who wish to use Optical Character Recognition (OCR) technology to convert records into searchable and editable files may do so, provided they retain either the original record or a scanned copy. Originals or scans of documents that have been converted using voice recognition software must also be retained until the retention periods set out in section 4 of this policy have been met.


Electronic systems can facilitate transmission of test results and other documents between health-care providers or facilities. This ability to share information presents significant benefits to physicians and patients. Physicians also have the ability to access and contribute to shared resources and health data.

As health information custodians, physicians have primary accountability for the security of patients’ personal health information. However, physicians have less control over what happens with data stored on external systems. Therefore, when information is shared over a network and is accessed remotely by a physician’s EMR, the physician must assess the risks involved, ensure that the network they use is sufficiently secure, and only exchange the minimum amount of health information necessary in order to provide care while limiting exposure and potential for breaches of privacy. Physicians must also enter into written agreements with service providers who are health information network providers.23


4. Retention, Access and Transfer of Medical Records

Physicians are obligated to retain the original medical record themselves and only transfer copies to others. In some instances, it may be feasible to rely on an external facility or organization to retain records, such as a commercial storage provider, hospital, diagnostic facility, or clinic. In such instances, physicians must ensure that access to records is possible for authorized parties when necessary. Physicians should establish data sharing agreements when relying upon third parties to retain their medical records and may wish to seek legal advice or consult the CMPA for this purpose.24

Retaining Medical Records

The Regulation requires that physicians keep medical records for the following time periods:

  • Adult patients: records must be kept for 10 years from the date of the last entry in the record.
  • Patients who are children: records must be kept until 10 years after the day on which the patient reached or would have reached the age of 18 years.
  • Physician ceases to practise medicine: records must be retained for the periods outlined above unless:
    • complete custody and control of the records has been transferred to another person who is legally authorized to hold them, or
    • each patient has been notified that records will be destroyed two years after the notification and that they may obtain the records or have them transferred to another physician within the two years.25

Notwithstanding the above requirements from the Regulation, the College recommends that records be maintained for a minimum of 15 years. This is because of a provision in the Limitations Act which states that some legal proceedings against physicians can be brought 15 years after the act or omission on which the claim is based took place.26 The College makes this recommendation to ensure that physicians will be able to provide evidence should it be required in any future legal proceedings brought against them.

Physicians may also be required to retain records longer than the above time periods when a request for access to personal health information under PHIPA is made before the retention period ends. Where such a request has been made, physicians must retain the personal health information for as long as necessary to allow for an individual to take any recourse that is available to them under PHIPA.27

Patient Access to Records

Patients have a right of access to their personal health information that is in the custody or under the control of a HIC, including any information that has been stamped or indicated as confidential, unless an exception applies.28 Physicians should consult section 52 of PHIPA for a comprehensive list of such exceptions and should seek the guidance of the CMPA or their legal counsel if unsure about how to respond to a request for access.

Physicians cannot refuse to grant a patient access to their records for the purpose of avoiding a legal proceeding.

If a physician has refused a patient access to his or her record, the patient is entitled to make a complaint to the IPC under subsection 54(8) of PHIPA.

Patient Requests Transfer

If a patient requests that a physician transfer his or her records, the transfer should take place in a timely fashion in order to facilitate continuity of care.

In some circumstances it will be more efficient for the transferring physician to prepare a summary of the records rather than to provide a copy of the entire record. This is acceptable to the College as long as it is acceptable to the receiving physician and the patient. The physician is still obligated to retain the original record, in its entirety, for the time period required by the Regulation.

Fees for Transfer

Physicians may charge patients a reasonable fee for making a record of personal health information, or part of it, available. Fees charged must reflect the cost of the materials used, the time required to prepare the material and the direct cost of sending the material to the requesting physician. Fees charged cannot exceed the amounts prescribed by regulation or the amount of “reasonable cost recovery.”29 This requirement applies regardless of whether access is provided directly by a physician or an agent of the physician, such as a record storage company.

While prepayment may be requested, physicians must ensure that their practices adhere to the applicable sections of PHIPA and orders of the IPC. A fee for a transfer of medical records may only be requested after a fee estimate has been provided to the patient30 and when, in the best judgment of the treating physician, the patient’s health and safety will not be put at risk if the records are not transferred until payment is received. Physicians are encouraged to consider the patient’s financial circumstances and ability to pay when determining the appropriate fee.

The obligation to pay the account rests with the patient or the party who has requested the records. Fulfilling such a request is an uninsured service and reasonable attempts may be made on the part of the physician to collect the fee.

Physician Relocates

When a physician relocates they are still responsible for meeting records retention requirements, whether or not they will be providing ongoing health care to their patients. Relocating physicians who wish to transfer custody of records for patients they will no longer be seeing clinically are encouraged to obtain legal advice to ensure that arrangements they make for record transfer and retention comply with their obligations under the Regulation and PHIPA.

Physicians are also encouraged to document records transfer arrangements in a written agreement. Such an agreement should address, among other things:

  • The location of the records;
  • The requirement of the receiving physician to notify the transferring physician if the records are moved to a different location or transferred to a different physician;
  • The transferring physician’s right of access to the records in the event of a civil claim or College complaint;
  • The patients’ right of access to the records;
  • The length of time for which the records must be retained;
  • The obligation to protect the confidentiality of the records; and
  • The destruction of the records.

Physician Ceases to Practise

When a physician ceases to practise medicine (either because they no longer maintain their certificate of registration31 or due to death) two options are available with respect to patient records to ensure continuity of care: 1) they may be transferred, or 2) they may be retained for the periods set out above. In all cases, the physician will continue to be the custodian of the records until complete custody and control passes to another person or entity that is legally authorized to hold them.

Section 42(1) of PHIPA permits a physician to disclose personal health information to a potential successor for the purpose of allowing the potential successor to assess and evaluate the operations of the custodian, if the potential successor first enters into an agreement with the physician to keep the information confidential and secure and not to retain any information longer than necessary for the purpose of the assessment and evaluation.

Before patient records are transferred to a physician’s successor, the physician must make reasonable efforts to give notice to patients, or where this is not reasonably possible, notify patients as soon as possible after the transfer has occurred.32

If a physician dies, the estate trustee of the physician is deemed to be the custodian of the records until custody and control of the records passes to another person who is legally authorized to hold them.33 Where uncertainty arises over responsibilities with regard to the medical records of a deceased physician, the College suggests seeking legal advice or contacting the CMPA or the College’s Physician Advisory Service.

Where a physician ceases to practise but is not transferring records to another physician, the physician or his or her representative must notify each patient that their medical records will only be held for two years, and should suggest that patients collect their records or request a transfer of their records to another physician before this two-year period expires. Notification of patients should take place by way of direct communication with each patient at a scheduled appointment or through a letter or phone call, or in some other way that ensures that patients will receive notice. In all other situations, the rule requiring record maintenance for a minimum of 10 years will apply.34

The College encourages physicians to think proactively about how they will continue to meet their obligations under PHIPA and ensure that patients have continued access to their records. This includes making every effort to ensure that all patient records are transferred or remain available to patients until they find another physician.35 Physicians are also encouraged to notify the College of arrangements made with respect to records after relocating or ceasing to practise in order to facilitate access and continuity of care.

Destroying Medical Records

Physicians must not dispose of a record of personal health information unless their obligation to retain the record has come to an end. Physicians are reminded that obligations to retain records may arise under PHIPA (because a patient has requested access, for example) and disposal of the record under such circumstances may be an offence under section 72(1) of PHIPA.

When the obligation to retain medical records comes to an end the records may be destroyed, provided that this occurs in a manner that is in keeping with the obligation of maintaining confidentiality and requirements of PHIPA.36 Records must be disposed of in a secure manner such that the reconstruction of the record is not reasonably foreseeable in the circumstances. As such the College requires that physicians cross-shred all paper medical records (confidential shredding services are available for large quantities of records). Electronic records must be permanently deleted from all hard drives,37 as well as other storage mechanisms. Hard drives must either be crushed or wiped clean with a commercial disk wiping utility. Similarly, any back-up copies of records must be destroyed when the original records are destroyed.38

Medical Records in a Group Practice or Employment Setting

Dissolution of a Group Practice

Physicians in a group practice setting must have an agreement that establishes responsibility for maintaining and transferring patient records upon dissolution. The method of dividing or deciding custody of records must comply with PHIPA. Where possible, agreements should be made upon the establishment of the group practice.

The agreement should address such items as:

  • The method for division of medical records upon termination of the practice arrangement. The agreement should specify a method of identifying who should have ongoing custody of the medical records.
  • Reasonable access to the content of the medical records to allow each physician to prepare medico-legal reports, defend legal actions, or respond to an investigation.39

Where no agreement is made upon the establishment of the group practice, an agreement should be implemented upon dissolution of the group practice to address issues such as custody of and access to the original records. For example, the physician who has created the greatest percentage of the entries in a particular patient record may be expected to continue to maintain it.40

Ask the Patient

If a group practice dissolves, the patient should be asked whether he or she wishes to continue seeing a physician from the dissolved practice. If the patient is following a physician to a different practice location, the records should be transferred and physicians should agree how the cost of copying and transferring records will be divided within the group. In the case of planned group practice dissolution, the cost must not be charged to the patient.

All former physician partners and associates must be given reasonable access to medical records for which they are the rightful custodian for the purpose of providing health care. If a physician is denied access to medical records for which they are the rightful custodian, he or she may wish to seek legal advice about further options for obtaining the records.

When the Physician is an Employee

Physicians who are employees must ensure that there is a written agreement with the employer about patient record retention, access and transfer. Such an agreement would be particularly useful in the event that a physician leaves practice with an employer. Where physicians are concerned that the facility’s record-keeping practices may not meet the requirements of this policy, they are encouraged to contact the College’s Physician Advisory Service for advice.


5. General Principles for Contents of Medical Records

As stated above, the record must tell the story of the patient’s health care condition and allow other health-care providers to read and understand the patient’s health concerns or problems. Each record of a patient encounter, regardless of where the patient is seen, must include a focused relevant history, documentation of an assessment and an appropriate focused physical exam (when indicated), including a provisional diagnosis (where indicated), and a management plan.

The Daily Diary of Appointments

Maintaining a daily diary of patient appointments is required by the Regulation41 and must include all professional encounters.

The Cumulative Patient Profile (CPP)

A Cumulative Patient Profile must be maintained in each patient’s family practice chart which contains a brief summary of essential information about the patient. This “snapshot” of the patient will generally include critical elements of the patient’s medical history, allowing the treating physician, or any other health professional using the chart, to quickly get the picture of the patient’s overall health. Appendix E contains sample CPP forms, which each physician is encouraged to customize to meet his or her needs.

The information in a CPP could include elements of the following:

  • Patient identification (name, address, phone number, OHIP number);
  • Personal and family data (occupation, life events, habits, family medical history);
  • Past medical history (past serious illnesses, operations, accidents, genetic history);
  • Risk factors;
  • Allergies and drug reactions;
  • Ongoing health conditions (problems, diagnoses, date of onset);
  • Health maintenance (annual exams, immunizations, disease surveillance, e.g., mammogram, colonoscopy, bone density);
  • Consultants’ names;
  • Long-term management (current medication, dosage,
  • Major investigations;
  • Date the CPP was last updated;
  • Contact person in case of emergencies.

The CPP should be completed during the first or second patient encounter, and should feature prominently in the patient’s record to allow for easy access and reference. However, physicians should commence keeping a CPP for all patients in an existing practice, even where this has not been done before. Most EMRs will automatically compile patient information into a CPP as it is entered into other sections of the record.

Physicians should review the information in the CPP at each visit and revise this information as it becomes outdated. This is equally important for physicians who use EMRs. Regular review and revision is particularly important where physicians are required to send the information to third parties such as medical consultants, the hospital emergency room, lawyers, and insurance companies. In these situations, physicians must ensure they are providing these parties with accurate and current information.

While a CPP is highly recommended for specialists’ patient charts, especially those specialists who see patients on an ongoing basis, there may be variations in format based on specialty.

Clinical Notes

Clinical notes are notes that are made contemporaneously with a physician-patient encounter. A good clinical note benefits patient care by encouraging accurate and comprehensive records, assisting in the organization of reports, and facilitating rapid and easy retrieval of information from the record.

Clinical notes must capture all relevant information from a patient encounter. This requires physicians to reflect on the care provided for a specific patient and document nuances of the encounter. Templates and checklists may be helpful tools for physicians, but may not, on their own, meet the requirements for a complete clinical note. Physicians must avoid over-reliance on pre-populated templates and refrain from using overly general templates when documenting patient encounters. Physicians should consider selecting an EMR that allows entry of free-text or that allows templates to be customized within the system to allow for greater descriptive detail. Also, where patient information is entered into templates in advance, physicians must verify that the entries accurately reflect the nature of the encounter and provide all pertinent details about the patient’s health status.

One of the most widely recommended methods for documenting a patient encounter is the Subjective Objective Assessment Plan (SOAP) format. It can also be easily adapted to gather and document information obtained during other specific types of encounters such as psychotherapy (see Appendix D for examples). While the College recommends that physicians use the SOAP format, other documentation methods are acceptable as long as they capture all of the elements of SOAP, which are described in further detail below.

Physicians should consider the following points when documenting their patient encounters:

Subjective Data

The subjective elements of the patient encounter (that which is expressed by the patient) should be documented in this section (e.g., patient reports of nausea, pain, tingling).

  • Presenting complaint and associated functional inquiry, including the severity and duration of symptoms;
  • Whether this is a new concern or an ongoing/recurring problem;
  • Changes in the patient’s progress or health status since the last visit;
  • Review of medications, if appropriate;
  • Review of allergies, if applicable;
  • Past medical history of the patient and his or her family, where relevant to the presenting problem;
  • Patient risk factors, if appropriate;
  • Salient negative responses.

Objective Data

The measurable elements of the patient encounter and any relevant physical findings from the patient exam or tests previously conducted are documented in this section.

  • Physical examination appropriate to the presenting complaint;
  • Positive physical findings;
  • Significant negative physical findings as they relate to the problem;
  • Relevant vital signs;
  • Review of consultation reports, if available;
  • Review of laboratory and procedure results, if available.


This section will contain the physician’s impression of the patient’s health issue.

  • Diagnosis or differential diagnosis.


The physician’s plan for managing the patient’s condition is described in this section.

  • Discussion of management options;
  • Tests or procedures ordered and explanation of significant complications, if relevant;
  • Consultation requests including the reason for the referral, if relevant;
  • New medications ordered and/or prescription repeats including dosage, frequency, duration and an explanation of potentially serious adverse effects;
  • Any other patient advice or patient education (e.g., diet or exercise instructions, contraceptive advice);
  • Follow-up and future considerations;
  • Specific concerns regarding the patient, including any decision by the patient not to follow the physician’s recommendations.

Consultation Requests

Consultation requests should include:

  • Reasons for referral;
  • Urgency of the consultation;
  • Relevant medical history;
  • Current medications;
  • All relevant test and procedure results.

It is recommended that the physician retain a copy of the referral note, both in order to maintain a record of the date and nature of the referral and as part of the ongoing record of the patient’s story.

Patient Declining Treatment or Missing Appointment

Where treatment or an investigation has been declined or deferred, the medical record should also indicate the reason, if any, given by the patient for declining the management recommendations of the physician.

The medical record should also note when a scheduled appointment is missed by a patient.

Telephone Conversations and E-Mails

Telephone conversations and e-mails where health information about the patient is collected and exchanged must be recorded in the medical record in the same way as any other physician-patient encounter.42 The documentation should include the date and time of the call or e-mail, significant information, and advice provided. Where possible, it is advisable to copy all e-mail correspondence for the chart, particularly those dealing with matters of significant clinical impact. Records should also indicate any prescriptions or repeats authorized over the telephone.

Removing Portions of the Record

Storage requirements may necessitate the removal of some materials from a patient’s active chart. If investigation results and consultation reports are no longer relevant to the patient’s current care, it is permissible to store them elsewhere (in accordance with section 14(2) of PHIPA and the retention requirements set out in the regulation and this policy). In such instances, the physician should make a notation indicating that documents have been removed from the chart and the location where they have been stored.

Modifying Records

Where it is necessary to modify medical records to ensure their accuracy, physicians should do so. Corrections must be made in such a manner as to ensure that the correct information is recorded (with the additions or changes dated and initialed) and the incorrect information is either severed from the record and stored separately, or maintained in the record but clearly labeled as being incorrect. Where the incorrect information is severed from the record, physicians must ensure that there is a notation in the record that allows for the incorrect information to be traced.43 Where incorrect information is maintained in the record, physicians must ensure that the information remains legible (for example, by striking through incorrect information with a single line).

PHIPA also stipulates that patients may request that corrections be made to their record if they show that it is incomplete or inaccurate.44 If the physician is not persuaded that a correction requested by a patient is warranted, the patient may require the physician to attach a statement of the patient’s disagreement to the medical record.45 The statement of disagreement would then become a part of the record.

Where physicians are uncertain as to how to properly correct information, the College’s Physician Advisory Service may be a helpful resource. In addition, they may wish to seek legal advice or consult the CMPA.


6. Procedural Medicine

In addition to following the above guidelines and requirements, records for procedural medicine must always indicate the patient’s most responsible physician for ongoing care, as well as the reason for the consultation referral.

Consultants’ Records46

While there are many different specialties within procedural medicine, a general principle is that documentation must always support the type of procedure that takes place. Below are some considerations for different types of consultants’ records.

For hospital inpatients, while it is recommended that daily progress notes be made for patients who have active and ongoing medical or surgical problems, progress notes are required when there has been any change in the patient’s status or management plan. Physicians must also ensure that records contain a documentation of patient consent outlining the risks, benefits, and alternatives (where appropriate). This would generally be documented in the consultation report or the procedural note.

Follow-up visit documentation should focus on response to therapy, changes in condition or symptoms, new health issues, changes in medications or allergies, documentation of review of investigations, and an ongoing management plan.

Many consultants perform diagnostic procedures or surgeries which also require specific documentation. In instances where physicians do not document the elements listed below themselves, they must ensure that they have been documented elsewhere (e.g., in the anaesthetist’s record).

The typical operative note should include:

  • the name of the patient and the appropriate identifiers such as birth date, OHIP number, address, and hospital identification number if applicable;
  • the name of the family physician (and referring health professional if different from the family physician);
  • the operative procedure performed;
  • the date on which the procedure took place;
  • the name of the primary surgeon and assistants;
  • the name of the anaesthetist (if applicable) and type of anaesthetic used (general, local, sedation);
  • pre-operative and post-operative diagnoses (if applicable); and
  • a detailed outline of the procedure performed, including
    • administration of any medications or antibiotics,
    • patient positioning,
    • intra-operative findings,
    • prostheses or drains left in at the close of the case,
    • complications including blood loss or need for blood transfusion,
    • review of sponge and instrument count (i.e., a statement of its correctness at the conclusion of the case), and
    • patient status at the conclusion of the case (stable and sent to recovery room vs. remained intubated and transferred to ICU).

The typical diagnostic or interventional procedural note should include:

  • the name of the patient and the appropriate identifiers such as birth date, OHIP number, address, and hospital identification number if applicable;
  • the name of the family physician (and referring health professional if different from the family physician);
  • the procedure performed;
  • the date on which the procedure took place;
  • the name of the physician performing the procedure and assistants if applicable;
  • the name of the anaesthetist if applicable and type of anaesthetic used (general, local, sedation); and
  • a detailed outline of the procedure performed (including administration of any medications, complications, findings and recommendations based on the findings if applicable).

These notes should be dictated or transcribed on the day on which the procedure took place. In instances where operative notes cannot be completed on the same day, physicians must ensure their completion as soon as possible after the procedure.

For quality assurance and condition management purposes, it is recommended that consultants include in the record any pertinent details that may be useful to future physicians who may see the patient in the event that the patient develops complications.

Requirements will also vary for specialists who do not keep their own records or dictate operative notes, but enter information into a hospital or health facility record (e.g., anaesthetists). Hospitals may adopt by-laws about documentation and chart completion that not only reflect existing legislation, but also supplement it with additional requirements. Physicians are bound by their hospital by-laws related to documentation and should therefore familiarize themselves with the specific record-keeping requirements at their institution.

Consultation Reports

The consulting physician must report to the referring health professional (or family physician, if he or she is not the referring health professional) after completion of the initial assessment (which may take more than one visit). In general, the following content should be included (as applicable) in the initial consultation report:

  • An opening statement outlining the reasons for the consultation;
  • An appropriate history related to the problem with documentation of the relevant positive and negative findings to assist in making a differential diagnosis, including any risk factors related to the disease under consideration;
  • A review of systems;
  • Family and social histories;
  • A review of medications and allergies;
  • A complete physical examination of the system of interest;
  • A review of available laboratory results, reports of relevant investigations, and any other pertinent patient data;
  • A summary of conclusions and recommendations including:
    • the investigations to be done,
    • the potential risks and benefits of each investigation (if applicable),
    • the treatment prescribed or administered, including any changes to existing medications or new medications prescribed, and a list of side effects that were discussed with the patient,
    • the professional advice provided to the patient, and
    • particulars of any referral made by the physician; and
  • The follow-up plan, i.e., whether the referring health professional or consulting physician will follow-up and when the patient is to return to the consulting physician and/or the family physician for follow-up.47

Subsequent follow-up reports should be sent to the referring health professional when there are new findings or changes are made to the management plan. Follow-up reports should include the following:

  • A detailed review of the problem originally consulted on and any response to therapy;
  • A detailed physical examination related to the system/problem;
  • A review of any laboratory reports, consultation reports, reports of investigations performed, and any other pertinent patient data received since the previous visit related to the system/problem; and
  • A summary of conclusions, recommendations, and follow-up plan as noted above.

Copies of reports must be kept in consultants’ records, except in the case of a consultation which occurs in a hospital, long-term care institution, or multi-specialty clinic where common medical records are maintained.

Electronic records allow reports to be sent automatically to referring health professionals. All consultation reports must be reviewed by the author (the treating physician) to ensure accuracy. In instances where reports are sent prior to review, the consulting physician must still review for accuracy as soon as possible and notify the referring health professional of any erroneous details. If a referring physician is notified of erroneous details in a consultation report, he or she must follow-up to ensure that any treatment decisions are consistent with the final version of the report.

Reports on imaging studies, pathology reviews, diagnostic tests, and other investigations must be completed and sent to the referring health professional in a timely manner. When faced with clinically significant results, physicians are expected to follow-up with appropriate urgency and are encouraged to document any efforts taken to follow-up with the referring health professional in the patient’s record. The more serious the result and possible consequences, the more urgent it is for the physician to take steps to inform the referring health professional. The means of communication of the report should reflect the urgency of the situation and ensure that the referring health professional receives the results in a timely fashion.48

Discharge Summaries

A discharge summary outlining the particulars of a patient’s stay in a health facility must be completed for all inpatients and dated and signed by the attending physician. If the physician anticipates a delay in the completion of the discharge summary, he or she should ensure that an immediate brief summary is available to those who will be responsible for follow-up care.

All discharge summaries must include:

  • identifying information (e.g., author’s name and status, name of the most responsible physician, patient’s name, health record number, admission date, and discharge date);
  • distribution of copies to the referring physician and/or family physician;
  • a brief summary of the management of each of the active medical problems during the admission, including major investigations, treatments, and outcomes;
  • details of discharge medications, including reasons for giving or altering medications, frequency, dosage, and proposed length of treatment; and
  • follow-up instructions and specific plans after discharge, including a list of follow-up appointments with consultants, further outpatient investigations, and outstanding tests and reports needing follow-up.


Appendix A:

Components of Medical Records Required By Law – Ontario Regulation 114/94, General, Sections 18, 19, 20 and 21, made under the Medicine Act, 1991, S.O. 1991, c.30.

18. (1) A member shall make records for each patient containing the following information:

  1. The name, address, and date of birth of the patient.
  2. If the patient has an Ontario health number, the health number.
  3. For a consultation, the name and address of the primary care physician and of any health professional who referred the patient.
  4. Every written report received respecting the patient from another member or health professional.
  5. The date of each professional encounter with the patient.
  6. A record of the assessment of the patient, including,
    1. the history obtained by the member,
    2. the particulars of each medical examination by the member, and
    3. a note of any investigations ordered by the member and the results of the investigations.
  7. A record of the disposition of the patient, including,
    1. an indication of each treatment prescribed or administered by the member,
    2. a record of professional advice given by the member, and
    3. particulars of any referral made by the member.
  8. A record of all fees charged which were not in respect of insured services under the Health Insurance Act, which may be kept separately from the clinical record.
  9. Any additional records required by regulation. O. Reg. 241/94, s. 2.

(2) A member shall keep a day book, daily diary or appointment record containing the name of each patient who is encountered professionally or treated or for whom a professional service is rendered by the member. O. Reg. 241/94, s. 2.

(3) The records required by regulation shall be,

  1. legibly written or typewritten or made and kept in accordance with section 20; and
  2. kept in a systematic manner. O. Reg. 241/94, s. 2.

19. (1) A member shall retain the records required by regulation for at least ten years after the date of the last entry in the record, or until ten years after the day on which the patient reached or would have reached the age of eighteen years, or until the member ceases to practise medicine, whichever occurs first, subject to subsection (2).

(2) For records of family medicine and primary care, a member who ceases to practise medicine shall,

  1. transfer them to a member with the same address and telephone number, or
  2. notify each patient that the records will be destroyed two years after the notification and that the patient may obtain the records or have the member transfer the records to another physician within the two years.

(3) No person shall destroy records of family medicine or primary care except in accordance with subsection (1) or at least two years after compliance with clause (2)(b).

20. The records required by regulation may be made and maintained in an electronic computer system only if it has the following characteristics:

  1. The system provides a visual display of the recorded information.
  2. The system provides a means of access to the record of each patient by the patient’s name and, if the patient has an Ontario health number, by the health number.
  3. The system is capable of printing the recorded information promptly.
  4. The system is capable of visually displaying and printing the recorded information for each patient in chronological order.
  5. The system maintains an audit trail that,
    1. records the date and time of each entry of information for each patient,
    2. indicates any changes in the recorded information,
    3. preserves the original content of the recorded information when changed or updated, and
    4. is capable of being printed separately from the recorded information for each patient.
  6. The system includes a password or otherwise provides reasonable protection against unauthorized access.
  7. The system automatically backs up files and allows the recovery of backed-up files or otherwise provides reasonable protection against loss of, damage to, and inaccessibility of, information.

21. A member shall make his or her equipment, books, accounts, reports and records relating to his or her medical practice available at reasonable hours for inspection by a person appointed for the purpose under a statute or regulation.

Appendix B:

Section 37.1 - Ontario Health Insurance Act, R.S.O. 1990, c.H.6

37.1.- (1) For the purposes of this Act, every physician, practitioner and health facility shall maintain such records as may be necessary to establish whether he, she or it has provided an insured service to a person.

(2) For purposes of this Act, every physician, practitioner and health facility shall maintain such records as may be necessary to demonstrate that a service for which he, she or it prepares or submits an account is the service that he, she or it provided.

(3) For the purposes of this Act, every physician and health facility shall maintain such records as may be necessary to establish whether a service he, she or it has provided is medically necessary.

(4) For the purposes of this Act, every practitioner and health facility shall maintain such records as may be necessary to establish whether a service he, she or it has provided is therapeutically necessary.

(5) The records described in subsections (1), (2), (3) and (4) must be prepared promptly when the service is provided.

(6) If there is a question about whether an insured service was provided, the physician, practitioner or health facility shall provide the following persons with all relevant information within his, her or its control:

  1. The General Manager.
  2. An inspector who requests the information.
  3. In the case of a physician or health facility, a member of the Medical Review Committee who requests the information.
  4. In the case of a practitioner or health facility, a member of the applicable practitioner review committee who requests the information.

(7) In the absence of a record described in subsection (1), (2), (3) or (4), it is presumed that an insured service was provided and that the basic fee payable is nil.

If you have any questions regarding the OHIP Schedule of Benefits, you should contact your local branch of OHIP or the Provider Services Branch of the Ministry of Health and Long-Term Care.

Appendix C:

Self–Evaluation: Assess Your Own Medical Records

Auditing your own medical records can help you identify the strengths and weaknesses of your current system.

A list is available from the protocol used in the College’s peer assessment activities. Use this list to review your own record-keeping practice, and to identify areas of strength and weakness in your documentation.

Appendix D:

Record-Keeping for Specific Types of Encounters

As stated in the policy, documentation in a medical record must always support the type of procedure that takes place. This section provides examples of instances where additional information should be included in records of particular types of encounters to ensure that they are comprehensive and fulfill legal and professional obligations.

The Periodic or Annual Health Examination

Primary health care providers conduct periodic (or annual) health examinations for health maintenance and disease screening. The difference between these examinations and the more frequent physician-patient encounter is that these examinations are more comprehensive. This must be reflected in the medical record.

This type of encounter should be recorded as a periodic health exam. It is advisable to use the CPP to review and update the patient’s medical history, family and social history, ongoing health concerns or problem list, immunizations, allergies and medications. The record should show evidence that appropriate screening and preventive care is taking place as the patient progresses through his or her life.

The physical examination should include all body parts and systems appropriate to the age and gender of the patient.

The treatment plan, if any, including tests or procedures ordered and any advice given should also be documented.

Discussion of treatment options, explanation of significant complications and potentially serious adverse effects of medications should also be included in the chart, along with referrals to other health professionals, where applicable.

General Assessments

The general assessment is a comprehensive examination conducted to establish a diagnosis, ascertain target organ involvement, and develop an investigative and treatment plan for a specific medical condition. The physical examination should include all body parts and systems relevant to the condition at issue (e.g., if the presenting problem is chest pain, the physician would examine the body parts that might be involved, but might not conduct a pelvic or rectal examination).49

This type of encounter should be recorded as a general assessment. Again, the CPP should be used to review and update the patient’s medical history, family and social history, ongoing health concerns or problem list, immunizations, allergies and medications. The record of the visit should reflect all of the elements of the physical examination.

Patients with Chronic Conditions

For patients with chronic conditions, such as diabetes mellitus, it is highly recommended to have flow sheets that allow the physician to record important clinical information about the patient’s management over long periods of time. Flow sheets permit the physician to see trends that enhance his or her ability to identify the appropriate treatment. Flow sheets will, of necessity, deal only with one disease. The CPP and the progress notes will be the principal information used to ensure comprehensive care.

Links to sample flow sheets are included in Appendix F.

Patient Encounters Where Focus is Psychotherapy

The Psychotherapy Act, 2007, defines the scope of practice of psychotherapy as “the assessment and treatment of cognitive, emotional or behavioural disturbances by psychotherapeutic means, delivered through a therapeutic relationship based on verbal or non-verbal communication.”50 The same legal requirements apply to records maintained for psychotherapy as to other sorts of records. However, some differences exist based on the scope of psychotherapeutic practice. For example, in psychotherapy, the physician would record observations about the patient’s emotional status, speech, cognitive pattern, etc., in place of recording a physical examination. Maintaining records that “tell the patient’s story” is particularly crucial in the psychotherapeutic context because there may be less objective physical data upon which to base management plans.

The following list of potential elements is applicable to the psychotherapy-focused progress notes of physicians who include psychotherapy as part of their general medical practice. The list is not meant to be comprehensive, but to serve as a guide only:51

  • The problem/story the patient presents;
  • Developments between visits;
  • Any progress made;
  • Responses to treatment;
  • Physical complaints;
  • Relationship/family issues;
  • Work/social problems;
  • Patterns and insights noted by the physician;
  • Interventions or therapeutic approaches by the physician;
  • Mental status – especially if changed;
  • Suicidality – risk, discussion, plan, if present;
  • Assessment, impression, formulation or diagnosis – A DSM-IV-TR (or subsequent DSM edition) or ICD diagnosis may be made whenever possible for medico-legal, consultation, and other purposes which are in the patient’s interest;
  • Specific therapy used (where applicable);
  • Patient homework, goals, plans;
  • Medication and any change in medication or dosage;
  • Community or education resources suggested;
  • Referrals;
  • Meeting or conversation with a supervisor and any additional insights (e.g., with regard to communication patterns that cause the patient difficulties, diagnoses, formulations or plans of action). Any notes regarding therapist learning or dealing with counter-transference are recommended to be kept in the therapist’s own notebook, and not in the patient’s chart;
  • On the patient’s last visit, when known, the physician can record the outcome of the work and the patient’s response to the end of therapy.


Individual counselling is a medical encounter that is an educational dialogue for the purpose of developing patient awareness of the problem or situation.

The following information should be included when documenting a counselling session:

  • Subject being discussed;
  • Scope of the discussion (educational components, management options, prognosis, etc.);
  • Patient’s response to the discussion;
  • Therapy prescribed (if any);
  • Action plan or goal including follow-up.

The physician will want to remember that for OHIP billing purposes psychotherapy and counselling appointments require documentation of the start and stop times and are limited to a certain number of blocks per year which must be scheduled in advance.

Record-Keeping for Couple, Family, and Group Therapy

Where individuals are treated together, either in couple, family, or group therapy, the personal health information of the individuals is shared and communicated in a group setting. Since these individuals choose to share their personal health information in this context, the physician does not have to make efforts to protect the privacy of these individuals in relation to the personal health information that they share. Physicians are required, however, to protect information they enter into the record about their assessment of individual patients as the disclosure of this information has not been consented to by the patients to whom it pertains.

Where the individuals receive a combination of individual and group therapy, physicians must protect personal health information that is disclosed during individual therapy, as this information is most likely disclosed only for the purpose of individual treatment. In these situations, the College suggests that physicians keep separate records for individual therapy and for group therapy.

Third parties, such as mediators, lawyers or courts may request records of couple, family, or group therapy. Consent will be required from all of the individuals involved in the therapy and the consent will need to be specific to the material requested and submitted. Requirements regarding disclosure of personal health information to third parties are discussed in the body of this policy. For further information, physicians should consult the College’s Confidentiality of Personal Health Information policy.

Appendix E:

Appendix F:

Appendix G:

Choosing an EMR Vendor

Given the variety of options that exists when choosing an EMR vendor, it is strongly recommended that physicians exercise due diligence and carry out research in advance of making this choice for themselves and their practice. When deciding on an EMR vendor, it is recommended that physicians and their teams consider the following:

  • objectives they hope to achieve with an EMR;
  • the functions they require within their EMR;
  • how the software meets the needs of the interprofessional team;
  • the support and training offered by the EMR vendor; and
  • vendor policies about software upgrades and data access provisions in case of a departure from a physician group.

Given that choosing an EMR vendor and making the transition is a lengthy process, physicians may also want to make enquiries into the stability of the EMR vendor to be confident that the particular company will be able to provide continued support into the foreseeable future.

In choosing an EMR, it is also helpful for physicians to consult colleagues or other experienced EMR users about the advantages and disadvantages of particular systems. It is strongly recommended that physicians seek legal review of contracts with EMR vendors prior to entering into an agreement.

Physicians have the option of choosing an EMR from an Application Service Provider (ASP) or purchasing or leasing a locally installed system. A principal difference between the two types of system is the way in which data is stored. With an ASP, the data is stored offsite and is accessed either through a private network or via the Internet, whereas a locally installed system resides on a physician’s own server that is located on-site. Systems vary in terms of capabilities, space requirements to accommodate hardware, data storage capacity, and degree of control over the data within the EMR and the functions it can perform. When making their choice, physicians should consider what type of system best meets their unique practice needs.

In addition to these considerations, physicians are encouraged to use the “Vendor Assessment Tool” offered on the OntarioMD website. Physicians may also wish to consider OntarioMD’s EMR Solution Selection Guide and Workbook.52



1. Physicians must understand their obligations under the Health Insurance Act, R.S.O. 1990, c.H.6 and the OHIP Schedule of Benefits. Section 37.1 of Ontario’s Health Insurance Act, which deals with record keeping, is attached at Appendix B. Any questions that physicians may have regarding the OHIP Schedule of Benefits should be directed to the appropriate local branch of OHIP or the Provider Services Branch of the MOHLTC.

2. O. Reg. 114/94, General, enacted under the Medicine Act, 1991; S.O. 1991, c. 30, s. 18(3).

3. Physicians who wish to make use of such software must have an appropriate quality assurance process in place, as described in section 3 of this policy under “Scanning Documents,” to ensure that transcription of information is accurate.

4. Personal Health Information Protection Act, 2004 , S.O. 2004, Chapter 3, Sched. A, s. 54.(1)(a).

5. Health Insurance Act, 1990 , R.S.O. 1990, c.H.6, s. 37.1(4.1)(b).

6. For a comprehensive list of such encounters, physicians are encouraged to consult the OHIP Schedule of Benefits which can be found at

7. This section of the policy covers general principles set out in the Personal Health Information Protection Act, 2004, S.O. 2004, c.3 Sched. A., regarding the collection, use, and disclosure of personal health information. Physicians can obtain further detail about PHIPA, and specifically about privacy obligations in relation to research from the Office of the Privacy Commissioner of Ontario. Physicians may also wish to consult the CPSO’s Confidentiality of Personal Health Information policy

8. See the CPSO’s Mandatory Reporting policy for more information.

9. See sections 36 to 50 of PHIPA, S.O. 2004, c.3, Sched. A.

10. A patient’s implied consent can only be assumed for disclosure of personal health information to another health information custodian.

11. Physicians should note that where they enter into agreements with service providers who are health information network providers, as defined in section 6(2) of O. Reg. 329/04 General, enacted under PHIPA (the “PHIPA Regulation”), these agreements must be made in writing, as required by section 6(3)7 of the PHIPA Regulation.

12. Records management protocols include both physical and logical access controls. Physical access controls are physical safeguards intended to limit persons from entering or observing areas of the physician’s office that contain confidential health information or elements of an EMR system. Logical access controls are system features that limit the information users can access, modifications they can make, and applications they can run. Examples of the latter include the use of “lock-boxes” and “masking” options to restrict access to personal health information at patient request.

13. PHIPA , s. 12(1)

14. Orders of the IPC can be found on the Commission’s website at

15. Physicians may wish to consult the CMPA’s “Data sharing principles for Electronic Medical Record/Electronic Health Record agreements”:

16. For the purposes of this policy, external storage media include any portable electronic device that allows the storage of data such as a laptop, tablet, USB flash drive/memory stick, or portable hard drive. Mobile devices include cell phones or personal digital assistants (including smart phones).

17. IPC Orders HO-004, HO-007, HO-008. For a working definition of “strong encryption” and guidance on the minimum technical and functional requirements for a health care environment, consult the IPC’s Fact Sheet 16: Health-Care Requirement for Strong Encryption, available at

18. Further information can be found in the IPC’s Fact Sheet #14 – Wireless Communication Technologies: Safeguarding Privacy and Security at and IPC Order HO-005.

20. PHIPA s. 12 (2). An exception to this requirement applies if the health information custodian is a researcher who has received the personal health information from another custodian (PHIPA s.12(3)).

21. This includes storing only the minimal amount of personal health information necessary and for the minimal amount of time necessary to complete the work. Physicians are encouraged to consult the IPC Fact Sheet 12 titled “Encrypting Personal Health Information on Mobile Devices”: Additional requirements exist under PHIPA s. 14(1)(2).

22. For further guidance, see IPC publication Personal Health Information: A Practical Tool for Physicians Transitioning from Paper-Based Records to Electronic Health Records at

23. O. Reg. 329/04 General, enacted under PHIPA, s.6(3)7.

24. Physicians may wish to consult the CMPA’s “Data sharing principles”:

25. O. Reg. 114/94, General, enacted under the Medicine Act, 1991; S.O. 1991, c. 30, s. 19(1).

26. The Limitations Act, 2002, S.O. 2002, c. 24, Sched. B provides that there is no limitation period in respect of a proceeding arising from a sexual assault if at the time of the alleged assault one of the parties to it had charge of the person assaulted, was in a position of trust or authority in relation to the person or was someone on whom he or she was dependent, whether financially or otherwise.”

27. PHIPA , s 13(2).

28. PHIPA , s 52.

29. PHIPA , s. 54(11). See OMA “Physician’s Guide to Uninsured Services” and IPC Order HO-009.

30. PHIPA , s. 54(10).

31. This would include physicians whose certificates of registration have been suspended or revoked.

32. PHIPA , s. 42(2). Physicians are also encouraged to consult the IPC’s publication “How to Avoid Abandoned Records: Guidelines on the Treatment of Personal Health Information in the Event of a Change in Practice” for more information:

33. PHIPA , s. 3(12). Where there is no estate trustee, the person who has assumed responsibility for administration of the deceased custodian’s estate is deemed to be the custodian of the records.

34. O. Reg. 114/94, General, enacted under the Medicine Act, 1991; S.O. 1991, c. 30, s. 19(2)(3).

35. For additional information, physicians are encouraged to consult the CPSO’s policy on Practice Management Considerations for Physicians Who Cease to Practise, Take an Extended Leave of Absence or Close Their Practice Due to Relocation.

36. PHIPA , s. 13(1).

37. It may not be possible to permanently delete records from a computer’s hard drive. In most cases it will be preferable to destroy the hard drive altogether.

38. For further information, consult the IPC’s Fact Sheet #10 – “Secure Destruction of Personal Information”:

39. Physicians are also encouraged to consult the CMPA’s “Data Sharing Principles” when establishing such agreements

40. Physicians involved in a Family Health Network or other primary care arrangement should consult their contracts to determine whether special rules apply. Generally speaking, the patient must be given notice that the departing physician is leaving the arrangement and provided with the opportunity to remain with the practice.

41. O. Reg. 114/94, General, enacted under the Medicine Act, 1991, s. 18(2).

42. The CMPA emphasizes the importance of documenting phone calls as evidenced by its development of a “Patient Telephone Call Record,” available free of charge to members. This note-sized sheet has a self-adhesive portion that allows the physician to affix the completed note into the patient’s medical record.

43. PHIPA , s. 55(10)

44. PHIPA , s. 55(8)

45. PHIPA , s. 55(11)(b)

46. Many of the components of records for procedural medicine described in this section are set out in the Public Hospitals Act, R.R.O. 1990, Reg. 965.

47. Consultants must ensure that primary care providers receive copies of consultation reports in a timely manner, in addition to the referring health professional, where these are not the same individual.

48. For more detailed information, see the CPSO policy Test Results Management.

49. There will be occasions when specialists are conducting condition-specific examinations that include all the components necessary to assess the patient’s condition but do not include all the aspects of a general assessment. In these circumstances, the specialist should seek the appropriate assessment code to bill for the encounter.

50. Psychotherapy Act, 2007 , S.O. 2007, c.10, Sched. R, s. 3.

51. Physicians may also wish to consult Cameron, et al., eds. Standards and Guidelines for the Psychotherapies, University of Toronto Press: Toronto, 1998, Chapter 19 for a description of the “narrative style” of documentation in psychotherapy.