When preparing and maintaining records, Registered Psychotherapists are subject to the Personal Health Information Protection Act, 2004. PHIPA governs therapists’ use of personal health information, including its collection, use, disclosure and access.
PHIPA allows health information custodians to engage the services of agents. For example, administrative staff or technical support providers could be considered an agent of the health information custodian. When working with an agent, there should be a confidentiality agreement in place. The custodian is still responsible for the records, even if they have an agent. The custodian must take reasonable steps (such as training, oversight and having policies in place) to ensure the agent maintains privacy of the information to which they have access.
The following definitions are found in the Information and Privacy Commissioner of Ontario’s Frequently Asked Questions: Personal Health Information Protection Act:
WHAT IS A CUSTODIAN?
A custodian is a person or organization listed in PHIPA that, as a result of [their] power or duties or work set out in PHIPA, has custody or control of personal health information.
WHAT IS AN AGENT?
PHIPA defines an agent to include any person who is authorized by a custodian to perform services or activities in respect of personal health information on the custodian’s behalf and for the purposes of that custodian.
An agent may include a person or company that contracts with, is employed by or volunteers for a custodian and, as a result, may have access to personal health information. PHIPA permits custodians to provide personal health information to their agents only if the custodian is permitted to collect, use, disclose, retain or dispose of the information.
For more information, please see the following resources: