Health information custodian

A buyer of a clinic, pharmacy or lab may meet this term, because PHIPA places duties for patient records on the custodian. Section 3(1) of Ontario’s Personal Health Information Protection Act defines the term by paragraphs, subject to exceptions in subsections 3(3) to (11); under section 3(3), except as prescribed, a person such as a health care practitioner who is an agent of a custodian is not a custodian in respect of personal health information handled while performing that work. This entry covers Ontario and Newfoundland and Labrador; check the rules where you are.

Another province’s version

Newfoundland and Labrador’s Personal Health Information Act, in section 4(1), also defines “custodian” as a person in listed paragraphs who has custody or control of personal health information as a result of or in connection with their powers, duties or work. The list includes a health care professional when providing health care, and a person who operates a health care facility or a pharmacy; section 4(2) excludes some classes, such as an employee of a custodian acting in the course of employment. Back in Ontario, section 3(12) of PHIPA says that if a custodian dies, the estate trustee, or if there is none the person who has assumed responsibility for administering the estate, is deemed the custodian of the records until custody and control passes to another person legally authorized to hold them, as the Information and Privacy Commissioner of Ontario also explains.

What to ask

• Who is the custodian today: the practitioner, the operator or the business.
• Who will be the custodian after closing.
• Who has custody or control of the records during the transition.

See cybersecurity and privacy checks before buying a business and PHIPA.