Skip navigation
Login

Good Practice: Safeguarding your Client's Personal Information

Key Takeaways

  1. Physiotherapists must protect their client’s privacy. Administrative, physical, and technical safeguards are required to protect client privacy.
  2. Physiotherapists must ensure that safeguards are in place at the practice site.
  3. Physiotherapists are custodians of health information and retain full responsibility as custodian.*
  4. Physiotherapists who work in private settings owned by non-custodians must inform the employer of the physiotherapist’s legislated and regulatory obligations as a custodian, have formal agreements in place that identify the physiotherapist as the custodian of the health information pertaining to their physiotherapy clients, and address issues of record custody, maintenance and retention.

*Physiotherapists must default to the understanding that they are custodians of health information unless they fit the description of ‘affiliate' articulated in the Health Information Act.

93% of privacy breaches are a result of human error.1

Although privacy safeguards are admittedly not the most exciting topic, they are essential to secure your client’s health and financial information. Security is a multi-layered approach where each layer adds a barrier to unauthorized access, use, disclosure, alteration, or destruction. It is important for physiotherapists to understand and learn how to implement these safeguards to ensure that client health information remains secure.

Privacy Impact Assessments help you identify and address potential privacy risks related to your practice. Privacy Impact Assessments are mandatory for custodians designated under the Health Information Act. Physiotherapists who are serving in the role of custodian are required to prepare and submit Privacy Impact Assessments for every information system or administrative practice employed in the collection, use, disclosure, storage, or disposition of health information. Click here for more information about Privacy Impact Assessments and other privacy resources.

All custodians are required to designate an individual who is responsible for the overall security and protection of health information in the custody or under the control of the custodian (often called a Privacy Officer). If you are a custodian and have not designated a Privacy Officer, these responsibilities would fall onto you by default. Privacy officers are responsible for ensuring compliance with the Health Information Act, including monitoring privacy risks, identifying appropriate safeguards to mitigate those risks, and conducting training regarding privacy policies and procedures .

Consistently educating yourself and your affiliates about privacy risks and the use of safeguards to address those risks should be a priority. This article will take you through examples of safeguards you can implement and resources that provide more information.

The information contained in this article is not an exhaustive list. The intent of this article is not to turn physiotherapists into privacy or IT professionals, but rather to raise general awareness of privacy safeguards so that physiotherapists know what to look for in the information systems they use and know what to ask their information technology service providers about.

Administrative Safeguards

Administrative safeguards are organizational policies and procedures that act to protect the privacy of clients. They can come in many forms. How they are used is specific to the practice site.

  • Policies and procedures that address the custodian’s responsibilities under the Health Information Act are a requirement. Policies preventing sharing of passwords and login credentials between co-workers and creating audit logs of access to health information are two examples of standard policies that custodians must have in place.

Perform regular risk assessments to identify vulnerabilities and emerging risks. Regular risk assessments are part of a privacy officer’s duties to review policies and reports of privacy near misses, talk to staff, etc., to identify any potential issues or threats and the measures to mitigate those threats.  

  • Educate yourself and your affiliates regarding safeguards and privacy policies. This is a must as most privacy breaches are a result of human error. It is also a requirement to qualify for most cyber security insurance policies. There are many free online courses offered through provincial and national institutions to educate you and your affiliates. See the resource list for some options.
  • Confidentiality agreements protect health information by stating the actions the physiotherapist and their affiliates are required to take to keep that health information confidential and secure. Confidentiality agreements may be included in employment contracts. Confidentiality agreements may also be required from third parties that have access to the practice site or the health information collected at the practice site.
  • Role-based access limits access to health information to those who have a need to know specific categories of health information to perform their work duties. Examples might be reception or administrative staff having access to booking and billing information, but no access to a client’s health information.
  • Access controls and user management processes are similar to role-based access. There should be policies in place that would restrict access to certain areas of information storage as well as off-boarding policies and procedures that ensure terminated employees can no longer access any part of the practice site’s data.
  • Policies requiring that computers are closed or screen locked when physiotherapists are not present prevent prying eyes from accessing a client’s personal health information.
  • Mobile/portable device policies are standard in most practice settings to limit any risk to having information stored or accessed on personal devices. You should have policies which control how your affiliates access and use their devices in the practice setting. For more information: https://oipc.ab.ca/resource/bring-your-own-device-byod-programs/
  • Monitor and manage third party vendors or others that may access your site, computer hardware, or information systems, such as external IT companies, contractors, students, and cleaners. Custodians are required to have Information Manager Agreements with information system and information technology providers that address the requirements of the Health Information Act. You may want to have confidentiality agreements in place with students, cleaners, or others who have access to your site to create an added level of security around health information.

Physical Safeguards

Physical safeguards are physical and structural measures put in place to prevent access to or removal of electronic devices or paper records.

  • Locked offices, cabinets for computers, device locks, and secure storage of hard drives all create a physical barrier to unauthorized access. You can control access to equipment and private areas by using standard locks. Or you can use other high-tech mechanisms like individualized passcodes or fobs to track who is accessing specific areas of the practice site.
  • Secure transport of records is standard practice. Letters, documents, etc. that contain health information should be transported securely. Locked briefcase or file box, locked in the trunk of a vehicle are measures that you can take to limit the risk of privacy breach while files are in transit, especially when paired with policies that prohibit staff from leaving records unattended in a vehicle, for example while stopping at a store while in transit.

Technical Safeguards

The College of Physiotherapists of Alberta strongly encourages all registrants to follow IT industry best practices and work with IT organizations to understand how to best secure their systems and health information using technical safeguards. Most of these would be put in place by software companies or IT companies to ensure they are applied properly. 

  • Password protection is the simplest form of a technical safeguard. Passwords should be complex in nature and not written down in a place someone else can access. Most registrants/employees will have several passwords in use on a range of devices and systems. An important consideration, particularly with increasing use of cloud-based services from multiple vendors, is the risk posed by password reuse, which could result in multiple systems being compromised from a single password breach. The difficulty remembering multiple passwords is often cited as a barrier to using unique passwords for different systems. Password managers can help to keep track of all those passwords and avoid password reuse. For more information about password best practices (including password length and complexity and use of passphrases) look to organizations like the National Institute of Standards and Technology and the Canadian Centre for Cyber Security.
  • Unique logins (as opposed to shared or generic logins) allow tracking of individual users when performing an audit or investigating a privacy breach. Password and unique login policies are administrative safeguards that work with the passwords and logins themselves to establish requirements for the level of complexity of passwords and the minimum frequency of password updates.
  • Two-factor or multiple factor authentication takes passwords to the next level and should be implemented when available in a system.2 Passwords can be hacked but having multi-factor authentication in use creates an additional barrier that increases your overall cyber security.
  • Most software/hardware programs come with encryption already installed to protect from outside interference. While passwords make it difficult for hackers to access the information stored in the software/hardware, encryption scrambles the information so that even if the information is accessed, it is unusable to anyone who does not have the encryption “key.” Although encryption and other safeguards may already be installed on devices and programs, it is important to confirm that the settings are enabled and actively in use. Not all systems are enabled by default.
  • Secure offsite back up of data protects your practice from losing valuable information if there is an issue at the practice site such as a fire or flood that damages the data housed there. Also, if you are targeted by a ransomware attack, you still have access to your client and practice data.
  • Network security involves the use of firewalls, anti-malware, email/content filtering to protect against cyber-attack. Network security should be reviewed with an IT organization and with the companies you use to house data and information to confirm alignment with IT best practices and the requirements of the HIA.

A Physiotherapist’s Responsibility

Physiotherapists are custodians under the Health Information Act. All Alberta physiotherapists should default to the understanding that they have the role and responsibilities of a custodian unless they fit the definition of affiliate found in the Act, in relation to a custodian under the Health Information Act.

There are two key components to the definition of affiliate:

  • The type of employment relationship (e.g., employee, student, volunteer, contracted service provider, information manager).
  • The other party’s status under the Act. One can only be an affiliate to a custodian designated under the Act. If your employer is not a custodian, you cannot be an affiliate as that term is defined in the Act, you are the custodian. 

Physiotherapists who work in practice settings owned by non-custodians must inform the employer of the physiotherapist’s legislated and regulatory obligations as a custodian . The physiotherapist is responsible for record maintenance and retention in accordance with regulatory requirements and the HIA.

Many physiotherapists work in non-traditional settings and for multidisciplinary practices that are not owned and operated by a physiotherapist. Some practice settings may not be owned by a regulated health professional but by an investor, entrepreneur, or unregulated health-care provider. There are concerns that in these settings the owner/operator may not fully understand a physiotherapist’s professional responsibilities and legislated duties. Remember that unless the practice owner is a custodian under the HIA, the physiotherapist will need to fulfill all the responsibilities of being a custodian under the HIA. The practice owner could become the physiotherapist’s affiliate through a contractual agreement and could be contracted to perform health record management duties as the physiotherapist’s information manager. In this situation, all parties need to understand that the practice owner is the physiotherapist’s affiliate. The physiotherapist establishes the policies and procedures related to health information management, retains custody and control over the records, and retains responsibility for the actions of their affiliate. The affiliate is required to follow the physiotherapist custodian’s privacy policies and may face penalties if they fail to do so. 

When physiotherapists work in these environments, they are responsible for ensuring that contracts and daily operations meet the privacy requirements of the HIA and the College of Physiotherapists of Alberta. A physiotherapist must make sure that appropriate agreements are in place before they start and these agreements must be in a legally binding contract.

In practice settings owned by non-physiotherapists, the Most Responsible Physiotherapist is responsible for ensuring the practice setting is established in a way the enables the physiotherapist to meet their professional responsibilities as part of their agreement with the employer and the College. However, responsibility for health information falls to each individual physiotherapist custodian. 

You are responsible for ensuring the privacy of your client’s health information and for ensuring compliance with the requirements of the Health Information Act.

Resources

Sources

  1. https://www.priv.gc.ca/en/for-federal-institutions/privacy-act-bulletins/pab_20221005/ Referenced on February 10, 2025.
  2. https://www.cyber.gc.ca/en/guidance/best-practices-passphrases-and-passwords-itsap30032

Page updated: 16/10/2026