Before collecting information from shared systems, nurses should ensure there is a current care-related purpose for viewing the information and should respect any lockbox or consent directives that may limit access. A nurse may collect personal health information from a shared system when the information is needed to provide or assist in providing care and when consent requirements are met. Access should be limited to information that is relevant to the client’s care and used only for the purpose for which it was collected. Nurses should follow employer policies for shared systems and avoid accessing records before there is a clear care-related need.

Sending identifiable client information to a personal email account is not an appropriate strategy to complete documentation. Nurses are accountable for maintaining confidentiality during collection, storage and transmission of personal health information and for using only employer-approved devices, systems and communication methods. If documentation cannot be completed within the approved system, the nurse should speak with the employer or privacy officer about secure options and follow any process for reporting a potential privacy breach if information has already been sent or stored insecurely.

PHIPA requires nurses to collect only the personal health information reasonably necessary for the purpose of the collection. Nurses should consider whether each question is connected to the client’s care or another authorized purpose. If a form appears to request more information than necessary, the nurse should consult their employer, manager or privacy officer. The organization may also need to review and update its intake form, policy or procedure to provide clear direction on what information is required.

When electronic systems are unavailable, nurses should follow employer or organizational downtime procedures and collect only the personal health information needed to provide care. Information must remain secure and confidential in any format, including paper records. Once systems are restored, nurses should follow organizational policies for entering information into the approved system, securely storing or destroying paper records, and reporting any suspected or known privacy breach.

For more information:

• Virtual Care practice guideline

Depending on the practice setting, a nurse may be acting as an agent of a health information custodian (HIC) or may themselves be considered the HIC. Nurses who practice independently or provide health services in non-traditional settings should clarify who has custody and control of personal health information, who is responsible for privacy policies, and how clients may access or correct their records. In either case, the nurse is accountable for collecting only the personal health information needed to plan and provide care and follow applicable legislation and organizational policies.

A nurse should not copy or remove client information from an employer’s electronic record system for a future independent practice. Personal health information belongs to the client, while the health information custodian has custody and control of the record. The nurse should follow employer policies for retention, transfer and disclosure of records, clarify whether the clinic is the health information custodian, and ensure any transition of care or record transfer is authorized, secure and limited to what is necessary.

You provide care in a community clinic and also operate your own nursing business. Some clients are seen in both settings. For efficiency, you begin collecting additional personal health information during clinic visits for use in your own independent practice. What considerations apply when collecting personal health information for more than one role or practice setting?