What Are My Privacy Obligations When Selling My Practice?
For a health practitioner contemplating selling their practice, there are many considerations that need to be addressed, such as finding a potential purchaser for your practice and ensuring continuity of care for your patients. But among the important obligations to keep in mind when selling your practice are your privacy obligations, as you remain accountable for safeguarding your patients’ privacy until the sale is complete, and you can be held to account for any gaps even after the sale.
Protecting patients’ personal health information (“PHI”) is not only a legal requirement but it is fundamental to providing high-quality patient care. A Health Information Custodian (“HIC”) is a person or organization who, as a result of their power, duties, or work, has custody or control of PHI. This includes health care organizations such as hospitals, pharmacies, and laboratories, as well as some individual health practitioners, such as the owners of a medical clinic or dental practice or a health practitioner working as a sole practitioner in their own practice.
If you are a health practitioner who is also a HIC, and you are planning to retire or sell your practice, you must ensure that you transfer patient records in accordance with all relevant legislation and the rules put in place by your applicable regulatory college.
Disclosing Information to Potential Purchasers
The Personal Health Information Protection Act, 2004 (“PHIPA”) allows a HIC to disclose personal health information to a potential purchaser for the purpose of assessing and evaluating the operations of the HIC’s practice. In order to do so, the HIC must first have the potential purchaser enter into a confidentiality agreement. This means that you are able to disclose, for example, the number of active patients, or the number and types of procedures performed by having the purchaser inspect some randomly selected patient files, as long as the potential purchaser agrees to keep the information confidential and secure and not to retain any of the information longer than is necessary for the purpose of the assessment or evaluation.
Transferring Health Records to a Successor
Under PHIPA, you, as the HIC, are responsible for health records until custody or control of the records passes to another legally authorized person. The new HIC must comply with all of the duties and obligations of HICs set out in the law.
If health records are being transferred to a successor, the successor becomes the new HIC. The IPC notes that the transfer of records to a successor can only be done to someone who is already a HIC, or who will become a HIC after the transfer. For example, when a physician retires, the records may be transferred to another physician. Using the services of a record storage company, on the other hand, is not a transfer of health records. The record storage company is not a HIC, so the original HIC will continue to be responsible for the health records retained by the storage company on the HIC’s behalf.
You have a duty to transfer records to your successor in a secure manner, and you also have a duty to notify individuals that their records are being transferred to a successor. This obligation must be carefully managed in connection with the sale of a practice, because you are required to make reasonable efforts to provide notification before the transfer or, if that is not reasonably possible, as soon as possible after the transfer.
Please note that your regulatory college may impose additional obligations on HICs who are transferring health records. For example, the Royal College of Dental Surgeons of Ontario requires that all patients provide consent if their records are stored on premises not controlled by the HIC.
Notifying Patients
As noted, HICs have a duty to notify individuals that their records are being transferred and that there is going to be a change in practice. When notifying individuals, the IPC notes that you should provide the notification yourself, and avoid the notification coming from an unknown agent. Notice should be given directly to individuals (for example, in person at an appointment, by letter, or by phone call). However, where direct notification is impractical or where contact information is out of date, indirect notification is appropriate (for example, posting a notice in your office or on your website or using a recorded message on your answering machine).
While PHIPA does not require that this notice be made in writing, your regulatory college may impose additional obligations regarding providing notice in writing about the change in ownership.
The IPC notes that at minimum, the notice should provide the following:
a description of the change in practice;
contact information for the HIC or their agent;
contact information for the person who has or will have the records as a result of the transfer;
the length of time that the HIC will retain the health records;
how individuals may request access to or correction of their health records; and
how individuals may request a transfer of their health records to another HIC.
As HICs should make patients aware of how and where they can obtain copies of their records, you may wish to send a notification letter to patients, post a notice in the office prior to practice closure and/or arrange with your landlord to post a notice at the practice location for a period of time after closure.
Conclusion
If you are selling or contemplating selling your practice and want to ensure that you have discharged all privacy obligations, please contact us. For more information, please see the IPC’s Guidance on avoiding abandoning health records for Health Information Custodians who are changing practice, and the IPC’s Checklist for Health Information Custodians in the event of a planned or unforeseen change in practice. And of course, get the advice of a lawyer experienced in this area before proceeding.
