Medical Records Management
This policy has been developed to set out CPSPEI’s requirements regarding the management of paper-based and electronic medical records, collectively referred to as “medical records”.
Preamble
Whether in paper or electronic form, from the moment a patient record is created, the registrant has a responsibility to ensure that it is appropriately stored, secured, and maintained.
Registrants are not always the custodians of their patient medical records. Registrants will either be the “custodian” of their medical records or an “agent” of the custodian. These roles and their corresponding responsibilities are set out in the Health Information Act.
While the custodian owns the medical records, patients have a right to access their medical records. This right endures after the registrant-patient relationship ends, regardless of whether the ending is planned or unexpected. For the purposes of this Policy, a patient’s enduring right to access their own medical record is limited to the length of time when records are required to be retained by the registrant.
In addition to the provisions of this Policy, registrants must also comply with all legislative, ethical and regulatory requirements related to medical record-keeping, including the Health Information Act. Registrants are encouraged to seek advice from the Canadian Medical Protective Association (CMPA) regarding questions of patient record management.
Policy
Access to Medical Records
Registrants must provide patients and authorized parties with access to, or copies of, all the medical records in their custody or control upon request, unless an exception under the Health Information Act applies.
All registrants, irrespective of practice setting, must take reasonable steps to ensure there is a process in place establishing reasonable and enduring access for patients to their charts.
Transfer of Medical Records
Registrants must retain original medical records for the required time periods (see Retention and Destruction below) and only transfer copies to others.
Registrants must only transfer copies of medical records where they have consent or are permitted or required by law to do so.
Registrants must transfer copies of medical records in a secure manner and document the date and method of transfer in the medical record.
Fulfilling a request for copying and transferring medical records is an uninsured service. Registrants are entitled to charge patients or third parties a fee for obtaining a copy or summary of their medical records. Patients should be made aware in advance of fees. The charge must be reasonable, taking into account the cost of the materials used, the time required to prepare the materials, the direct cost of sending the materials, and the patient’s ability to pay. Please refer to the Medical Society’s Physicians’ Guide to Uninsured Services.
Retention and Destruction of Medical Records
For minor patients, registrants must retain medical records for at least ten (10) years from the time the patient reaches 18 years of age, or the completion of any known proceedings where the records may be relevant, whichever is later.
For adult patients, registrants must retain medical records for at least ten (10) years from the date of the last entry, or the completion of any known proceedings where the records may be relevant, whichever is later.
Registrants must only destroy medical records once their obligation to retain the record has come to an end.
Registrants must destroy medical records in a secure and confidential manner and in such a way that they cannot be reconstructed or retrieved.
Storage and Security of Medical Records
Registrants must ensure medical records in their custody and control are stored in a safe and secure environment, and in a way that ensures their integrity and confidentiality. This includes:
- taking reasonable steps to protect records from theft, loss and unauthorized access, use or disclosure, including copying, modification or disposal;
- keeping all medical records in restricted access areas or in locked filing cabinets to protect against unauthorized access, loss of information and damage; and,
- backing-up electronic records on a routine basis and storing back-up copies in a secure environment separate from where the original data is stored.
When a registrant chooses to store medical records content that is no longer relevant to a patient’s current care separately from the rest of the medical record, they must include a notation in the record indicating that documents have been removed from the chart and the location where they have been stored.
Registrants must ensure medical records are readily available and producible when access is required.
Electronic Records System Requirements
Registrants who use an Electronic Medical Record (EMR) system, different from the Prince Edward Island Electronic Health Record system, must use due diligence when selecting an EMR system and/or engaging EMR service providers.
Registrants must only use systems that:
- ensure appropriate security provisions are in place; and
- maintain an audit trail (a record of who has accessed the electronic record) that:
- records the date and time of each entry of information for each patient,
- indicates any changes in the recorded information,
- preserves the original content of the recorded information when changed or updated, and
- is capable of being printed separately from the recorded information for each patient.
Registrants must automatically back up files and allow the recovery of backed-up files or otherwise provide reasonable protection against loss of, damage to, and inaccessibility of, information.
Document History
Approval Date: October 9, 2025