Agent or Custodian? Who Holds Your Patient Records

When a medical practice closes, the charts have to go somewhere, and physicians often ask a fair question: once the records are with a records management company, who is legally responsible for them? The answer depends on the arrangement. Most commonly, the physician remains the custodian and the company acts as the physician’s agent. In some situations, a company is asked to hold the records as custodian. This post explains the difference, why the first arrangement is far more common, and where the law is less settled than anyone would like.

Two terms that matter: custodian and agent

The custodian is the person or organization the privacy law holds responsible for personal health information. In Ontario, the Personal Health Information Protection Act (PHIPA) lists who counts as a custodian, and health care practitioners are among them (s. 3(1)). The custodian’s duties to keep records secure, respond to access and correction requests, and retain records for the required period don’t end when a practice closes. According to the Information and Privacy Commissioner of Ontario (IPC), they continue until a legally authorized successor has custody and control of the records.

An agent is someone who, with the custodian’s authorization, acts for or on behalf of the custodian in respect of personal health information. PHIPA defines an agent this way (s. 2) and says it doesn’t matter whether the agent is employed or paid. The custodian stays responsible for the information and may permit its agents to handle it on the custodian’s behalf, within limits (s. 17). A records company that stores charts and answers record requests at a physician’s direction is a typical example, and the IPC’s guidance on planning for a change in practice gives “a record storage company” as an example of an agent whose duties the custodian should set out in a written agreement.

Other provinces use similar ideas with different labels. In Alberta, the Health Information Act uses the term “information manager” for a person who stores, processes or disposes of health information for a custodian under a written agreement, and the custodian stays responsible for compliance. In Nova Scotia, the CPSNS describes the custodian as responsible for the management and storage of patient records, and it accepts a secure record storage company as one way to meet that responsibility. Nova Scotia’s Personal Health Information Act likewise says a custodian is responsible for information in its custody or control and may permit its agent to handle it on the custodian’s behalf (s. 28(1)).

The usual arrangement: you remain the custodian, we act on your behalf

In most practice closures, the physician remains the custodian, and Records Management acts on the physician’s behalf as an agent: storing the charts securely, answering patient and third-party record requests, and keeping the physician informed. This is the arrangement most firms in our field recommend, for a few reasons:

It matches how the regulators describe it. The CPSO says physicians who close or relocate remain responsible for meeting retention requirements. The OMA puts it plainly: even after retirement, you are responsible for your practice’s records.
It is the clearest legally. The responsible party is the same person before and after the move.
It keeps you in control. You keep the ability to access records if you ever need them for a College matter or a civil claim, which the CPSO lists as something a written agreement should address.

The OMA strongly recommends a written contract with the storage company. The CPSO likewise calls a written agreement good practice, covering the records’ location, patient access, retention periods, confidentiality and destruction.

Why some arrangements ask for something different

Sometimes a physician can’t, or would rather not, remain responsible for years after closing. The physician may have moved out of the country, no longer holds a licence, can’t be reached, or has died. The law has a default answer for death: PHIPA treats the estate trustee (or the person administering the estate) as the custodian until custody passes to someone legally authorized to hold the records (s. 3(12)). The CRPO has pointed out that this person may know very little about PHIPA or about handling health records.

In situations like these, a physician, an estate or a successor may ask a records company to take on a larger role than a standard agent. Some firms agree to this; most prefer to remain an agent. Neither choice is wrong, but they are different commitments, and each deserves a careful written agreement.

Why this isn’t a simple question

Here is the honest answer: the law doesn’t address every case cleanly. In Ontario, PHIPA defines custodians by category (s. 3(1)), and a records company doesn’t obviously fit any of them. The Act does contemplate custody changing hands: it lets a custodian transfer records to its “successor”, with notice to patients (s. 42), and it deems the estate trustee to be the custodian after a death (s. 3(12)). We didn’t find the term “successor” defined in the Act. The one situation where the regulation names a non-custodian as the custodian is bankruptcy or insolvency: a person who obtains complete custody or control of a custodian’s records because of it is prescribed as the custodian for those records (O. Reg. 329/04, s. 3(7)).

In Alberta, custodians are the bodies and providers listed in the Health Information Act or designated in its regulations, and a storage company is an “information manager” bound by a written agreement, with the custodian remaining responsible (s. 66). The CPSA describes a designated successor custodian as the person who can take over a physician’s duties if the physician can no longer meet them. Across provinces, the IPC has recommended that custodians plan for a change in practice so records are never abandoned, and has recommended amendments that would require notice to patients when a custodian dies or stops practising.

We haven’t found a clear, direct answer, in the statute or in the regulator guidance we reviewed, on whether and when a records company can itself become a custodian. We think it is better to say that plainly than to pretend the answer is settled.

What this means for your practice

Decide who will be responsible, and write it down. A written agreement should say who the custodian is, where the records are held, who responds to requests, how long records are kept, and how they are destroyed.
Name a successor. The CRPO and the IPC both recommend naming a successor in writing, with their consent, so there is no gap if you die or become unable to act.
Talk to your advisers. The CPSO suggests contacting the CMPA about the transfer arrangements, and a health-privacy lawyer can advise on your specific situation.
Call us before any charts move. The arrangement you choose affects how the transition is set up, how patient requests are handled, and what it costs. A short call first lets us tailor the process and keep it simple for you and your patients. We also notify your College of the new location of your records and can notify your referral network.

Talk to us about your closure.

Request a Quote Call Us: +1 (800) 775-0093

Sources and further reading

This article is general information, not legal advice. Check the current CPSO policies “Closing a Medical Practice” and “Medical Records Management” for the exact requirements that apply to you.

Agent or Custodian? Who Holds Your Patient Records After You Close Your Practice