RMTs/MTs must securely maintain, store, transfer, and dispose of client health records to protect confidentiality, whether acting as the Health Information Custodian (HIC) or as an Agent of an HIC.

• HIC Role: You are the HIC if you run your own practice or control how client health information is collected, used, shared, or disclosed. Responsibilities include establishing privacy policies, obtaining consent, protecting information, ensuring accuracy, limiting use, providing client access, and correcting records.
• Agent Role: You are an Agent if you work for/on behalf of another HIC in a practice (e.g., a clinic owner where the RMT/MT is an independent contractor). Responsibilities include protecting privacy, using information only as directed by the HIC, following HIC policies, and reporting breaches to the HIC.
• Privacy Breach: In the case there is a privacy breach, you must follow the procedures to notify those involved: who (HIC, individuals’ information that was lost/stolen, and report to IPC); when (at first reasonable opportunity); and what (information that was lost, stolen or accessed/disclosed).

More information about the roles of HIC and Agent is available in What You Need to Know About Privacy Law.

For more details, contact the Practice Specialist at practicespecialist@cmto.com or call 1-416-489-2626/1-800-465-1933 (press 5).