Who can access your health record

Patients own the information in their health records and are entitled to examine and/or receive a copy of their health records upon request, which includes any records created by other health care providers. Patients may request a “complete copy” of their records, which may include the cumulative patient profile, encounter notes, referrals, consultation reports, and laboratory results. Section 29 of PIPA provides that a holder of the health record must generally respond to a patient’s request for such information within 30 business days. 
 Under FIPPA (which is for public bodies), people have the right to request access to records held by public bodies. These records often include records that contain personal information and records such as reports, audits, and financial information of the public body. The public body has 30 business days to respond. Disputes about the time for a response or the scope of disclosure can be directed to the OIPC. 

Most health Colleges in British Columbia have standards, guidelines or Bylaws governing a registrant’s obligations with respect to medical records. For example, the College of Physicians and Surgeons of BC has a standard titled “Medical Records Management” which provides information regarding a physician’s professional obligations when dealing with medical records.  

Please visit the following page for more information on colleges, boards, and commissions. 

Please visit the following page for more information on professional regulation.  

The holder of health records may alter a record. However, when making alterations to a record, the holder must clearly identify what alterations were made to the record and when.  

If a patient requests a correction of their personal information in the health record, and the holder agrees, it must be made as soon as reasonably possible. If your information is corrected, said corrected information must be provided to any organization that had that information up until a year before the correction was made.   

If a patient requests a correction of their personal information, and the holder is not in agreement, the requested correction must be documented along with the reason for declining to make the correction (section 24 of PIPA). 
 Those holding health records may transfer the original records (for example, on the retirement of a physician) if the new holder agrees to hold the health records and provides the patient with enduring access. The former holder of the records must take reasonable steps to ensure patients are notified of the transfer of their records. 

There are some limitations to your accessing and altering rights depending on the circumstances. For example, opinions and diagnoses cannot be changed because the record must remain an accurate reflection of the time they were made. If opinions are changed later on, that changed opinion would be reflected in the record. 

Regarding rights to access private health records, section 23 of PIPA protects certain categories of information from disclosure (section 23(3) of PIPA). For example, an organization may choose to refuse to give you access to your personal information if it was collected for an investigation. Under section 23(4) of PIPA, an organization cannot disclose personal information in certain circumstances. 

Regarding public health records, an individual may be refused their records if the disclosure would threaten anyone’s safety or mental or physical health as noted under section 19 of FIPPA. The entire list of FIPPA exceptions can be found under division 2 of FIPPA.   

Both public and private bodies who either partially or fully refuse to disclose your personal health information must list several categories in their response. For private bodies, please see section 30 of PIPA. For public bodies, please see section 8 of FIPPA. 

Hospitals and health authorities can sometimes place “flags” on your health record in the hospital to prevent certain people from accessing it. If you would like that with your file, please contact the privacy officer of the health authority that holds your information.  

If you do not want your health care provider to share your personal health information with another health care provider such as a specialist, then please communicate this with your health care provider. It is best practice to communicate this both orally and in writing. Please visit the following page for our sample form. 

You have a right to tell your health care provider that you do not want your personal health information shared with anyone else, including other health care providers or just specific people. Your health care provider must follow your instruction except if there is a legal requirement to disclose your information. Please visit the following page for examples of when your consent may not be necessary.  

If you are not legally capable to limit your health information, then a representative can give said instructions on your behalf. Please visit the following page for more information about alternative and other legal representatives. 

In order to submit a disclosure directive, you may either download the adult disclosure directive form and mail it, or contact Health Insurance BC: 604-683-7151 (Lower Mainland) or 1-800-663-7100 (elsewhere in BC). If you call, a representative on the helpline can answer any questions you may have and may redirect you. Please see the following BC government form for adult disclosure directive.  

Mailing Address for the Completed Form 

Disclosure Directive Service 

PO Box 9688 

Stn Prov Govt 

Victoria BC V8W 9P8 

After you have sent in the required form and information and it has been processed, you will receive a confirmation code in the mail. You must call Health Insurance BC at either 604-683-7151 (Lower Mainland) or 1-800-663-7100 (elsewhere in BC), in order to confirm the code and in the process confirm your identity. 

Finally, you can now proceed with applying a disclosure directive and adding the keyword to your electronic health record. The customer service representative will review the keyword rules with you. You will share your keyword with the representative, and they will complete the process of adding a disclosure directive to your electronic health record. 

Once a disclosure directive has been applied to your electronic health record, you will need to share your keyword if you would like a health professional to see your personal health information. 

In urgent and emergency care settings, when a health professional determines that a patient’s personal health information is necessary for timely care and the patient is unable to provide it, a disclosure directive can be overridden. However, no one outside an urgent or emergency care setting will be able to access personal health information unless you provide your keyword. 

Guardians of a minor can exercise the minor’s rights only if the minor is incapable of exercising their rights on their own behalf. Every situation is different, but a minor can be legally capable in certain circumstances. For more information about a minor’s rights, especially privacy in their health records, please visit our page on confidentiality regarding minors. 

Here are some but not all of the parties who can exercise the rights of another individual, provided they have the documents which grant them the authority to do so:  

• Committee under the Patients Property Act 
• Attorney through an enduring power of attorney, under the Power of Attorney Act 
• Litigation guardian under the Representation Agreements Act 
• Representative under the Representation Agreements Act 

You should expect an organization or public body to require you to provide instructions that allow another individual to exercise your or their rights.  

For more information about these agreements, you can visit or contact the Nidus Personal Planning Resource Centre & Registry. 

The Public Guardian and Trustee of British Columbia has information on powers of attorney, representation agreements, and court orders that appoint a committee to look after the affairs of a person who is mentally incapable. 

Your health information privacy rights remain with you even when you are no longer living. Only the personal representative at the time of an individual’s death or the nearest relative may exercise the individual’s privacy rights. Depending on the circumstances, the personal representative or nearest relative may be asked to establish that they are seeking to exercise the deceased person’s rights on behalf of the deceased or in the interest of the deceased, and not on their own behalf or interest. 

If you are unsatisfied with the response of an organization or public body when you seek to exercise the privacy rights of someone on their behalf, first contact the privacy officer of the organization. If you are still unsatisfied, please contact the Office of the Information and Privacy Commissioner of BC.