Electronic Information Management

Why This Matters for MTs

• PHIPA applies equally to paper and electronic records. Digital records create additional security considerations (hacking, data breaches, cloud storage vulnerabilities) that paper records do not.
• Practice management software is now standard in multi-therapist clinics and increasingly expected in solo practices. Competence with these systems is a practical necessity.
• A data breach involving client health information can result in regulatory complaints, Information and Privacy Commissioner (IPC) investigations, and loss of client trust.
• FOMTRAC identifies electronic information management as a professionalism competency, yet it is rarely covered in MT curricula.

Key Principles

Electronic Health Records (EHR) Systems

What EHR Systems Do

• Store client demographics, health histories, SOAP notes, assessment findings, and treatment plans electronically.
• Manage scheduling, appointment reminders, and waitlists.
• Generate receipts and process insurance billing (including direct billing).
• Track outcome measures over time (some systems generate progress graphs).
• Facilitate communication (secure messaging with clients, referral letters).

Common EHR Platforms for MT

• Jane App: Cloud-based, widely used in Canadian MT and allied health. Scheduling, charting, billing, online booking, telehealth. PHIPA-compliant hosting in Canada.
• Cliniko: Cloud-based practice management. Scheduling, documentation, billing. Data hosted outside Canada (check PHIPA implications).
• SOAP Vault: Specifically designed for massage therapists. SOAP documentation, treatment tracking.
• Universal Office (UO): Desktop-based. Common in multidisciplinary clinics. Scheduling, billing, documentation.
• Custom solutions: Some clinics use general-purpose tools (Google Workspace, Microsoft 365) for scheduling and documentation. These require careful configuration to meet PHIPA standards.

Selecting an EHR System Key questions to evaluate:

Digital Document Management

Creating and Organizing Digital Records

• Use consistent file naming conventions: `LastName-FirstName-YYYY-MM-DD-DocumentType` (e.g., `Smith-John-2026-04-23-SOAP.pdf`).
• Organize files in a logical folder structure (by client, by date, or as the EHR system dictates).
• Scan paper documents (intake forms, consent forms, referral letters) and store digital copies alongside electronic records.
• Use PDF format for documents that need to be preserved in their original format (signed consent forms, third-party reports).

Digital Signatures

• Electronic signatures on consent forms are legally valid in Ontario under the Electronic Commerce Act, 2000.
• Ensure the signature method provides verification of identity and intent (not just a typed name).
• Some EHR systems include built-in digital signature capture on tablets or phones.

Document Retention (Digital)

• The same retention rules apply to digital records as paper: 10 years from last entry, or until a minor client turns 28.
• At the end of the retention period, digital records must be permanently deleted — not just moved to a recycle bin. Use secure deletion methods or engage a certified data destruction service.
• Ensure backup copies are also deleted when the primary records are destroyed.

Cloud Storage Security

Benefits of Cloud Storage

• Automatic backups and redundancy (data survives hardware failure).
• Access from multiple devices and locations (useful for mobile practitioners or multi-location clinics).
• Vendor-managed security updates and infrastructure maintenance.
• Scalability (storage grows with your practice).

PHIPA Requirements for Cloud Storage

• Data residency: PHIPA does not explicitly prohibit storing data outside Canada, but the IPC strongly recommends Canadian hosting. If data is stored in another jurisdiction (e.g., US servers), it may be subject to that country's laws (e.g., US PATRIOT Act).
• Encryption: Data must be encrypted both in transit (during upload/download — HTTPS/TLS) and at rest (stored on the server).
• Access controls: Only authorized personnel should have access. Use role-based permissions.
• Vendor agreements: Review the cloud provider's privacy policy and data processing agreement. Ensure they will not access, use, or disclose your clients' health information for their own purposes.
• Business associate / data processing agreement: Have a written agreement with any cloud vendor that handles PHI, specifying their privacy and security obligations.

Cloud Storage Risks

• Vendor bankruptcy or service discontinuation (ensure data export capability).
• Security breaches at the vendor level (you are still responsible for your clients' data).
• Internet outage preventing access to records during clinic hours (maintain a contingency plan).

Backup Protocols

The 3-2-1 Rule

• 3 copies of your data (the original + 2 backups).
• 2 different media types (e.g., cloud storage + external hard drive).
• 1 copy offsite (not in the same physical location as the original — protects against fire, flood, theft).

Backup Schedule

• Daily: Automatic cloud backup of the EHR system (most cloud-based EHRs do this automatically).
• Weekly: Backup of any locally stored files (scanned documents, financial records, templates) to an external drive and/or a secondary cloud location.
• Monthly: Verify backup integrity. Test the restoration process by recovering a sample file.
• Annually: Review and update the backup strategy. Ensure it accounts for practice growth (more clients = more data).

Backup Security

• Encrypt all backup media (external drives, USB drives).
• Store physical backup media in a locked, fireproof location.
• Do not leave unencrypted USB drives or external hard drives in unlocked drawers or vehicle trunks.

PHIPA Compliance for Digital Records

Core Obligations

• Collection: Collect only the personal health information necessary for the purpose (principle of data minimization).
• Use: Use PHI only for the purpose for which it was collected (treatment, billing, quality assurance) unless the client consents to another use or an exception applies (e.g., mandatory reporting).
• Disclosure: Disclose PHI only with the client's consent or as required by law. Use the principle of minimum necessary disclosure.
• Security: Implement administrative (policies, training), technical (encryption, access controls, audit logging), and physical (locked rooms, secured devices) safeguards.
• Breach notification: If a privacy breach occurs involving electronic records, notify affected individuals and report to the IPC if the breach poses a risk of significant harm.

Practical Security Measures

• Passwords: Use strong, unique passwords for every system. Implement multi-factor authentication (MFA) wherever possible.
• Device security: Lock computers and tablets when stepping away (even briefly). Enable automatic screen lock after 2-5 minutes of inactivity.
• Wi-Fi security: Use WPA3 (or minimum WPA2) encryption on clinic Wi-Fi. Do not use public Wi-Fi for accessing client records. If working remotely, use a VPN.
• Email: Do not send PHI via unencrypted email. Use the EHR's secure messaging system, or use an encrypted email service if sending clinical information to other providers.
• Mobile devices: If you access client information on a phone or tablet, ensure the device is password-protected, encrypted, and has remote wipe capability in case of loss or theft.
• Staff training: Train all staff (including front desk) on digital privacy and security protocols. Document the training.
• Audit logging: Use systems that track who accessed which records and when. Review audit logs periodically for unauthorized access.

Practice Management Software Overview

Clinical Application

• Before selecting an EHR system, create a requirements list based on your practice model (solo vs. multi-therapist, single vs. multiple locations, insurance billing needs).
• Implement MFA on all systems that support it — this single step prevents the majority of unauthorized access incidents.
• Test your backup restoration process at least once before you actually need it.
• Create a written privacy and security policy for your practice and review it annually.
• If you are transitioning from paper to electronic records, do not discard paper records until the digital copies are verified and backed up. Maintain the original paper records for the full retention period.