To ensure the privacy and confidentiality of our clients’ personal health information, and in accordance with The Personal Health Information Act (PHIA), staff should not maintain physical or manual ledgers that contain information for multiple individuals. This record type will be removed from the Retention Schedule for Personal Health Information.

We encourage you to review your current practices within your program or department, keeping the following considerations in mind as part of our commitment to PHIA compliance and protecting client privacy.

Why This Is Necessary

PHIA sets clear expectations for how personal health information should be collected, used, and retained. When multiple patients’ details are stored together in a single document, these principles can be compromised-particularly the requirement to collect and retain only the minimum amount necessary.

Retaining these logs brings considerable risks because they:

• Allow unauthorized access to and use of personal health information.
• Increase the likelihood of privacy breaches.
• Make it challenging to track who accessed the data.
• Lead to documentation inconsistencies.

For quality assurance, auditing, and program development, the use of Electronic Health System (EHS) reports provides a PHIA-compliant alternative without these risks.

If you have questions or need guidance on retention or destruction, please reach out to: Anastasia Byrne, Records and Privacy Analyst

Submitted by: Privacy and Access