Data Retention and Destruction Standard

Policy

All paper and electronic records that include personal and health information pertaining to patients will be retained, protected and destroyed in a manner appropriate to the nature of the contents and as prescribed by applicable legislative requirements.

All patient information is considered confidential and must be secured to prevent access by unauthorized personnel, and shredded when there is no further obligation to retain the information.

Purpose

As prescribed by existing Canadian law and current Privacy legislation, all records must be maintained according to appropriate retention schedules based on purpose, use, and disclosure requirements. Once the retention period has expired, health and personal information will be destroyed through methods deemed  consistent with governing legislation and under secure conditions. Retention, protection and destruction of records is governed by this corporate policy and implemented at the operations level.

Procedure

Enforcement: 

Compliance to this standard is a mandatory requirement as this document forms an integral part of the Information Technology Policies. All changes and new technology solutions and processes (where applicable) must comply with the standard in its entirety. This standard outlines the minimum level of controls to be implemented and as such, more stringent levels of controls may be adopted based on individual business unit requirements. Staff members found in policy violation may be subject to disciplinary action, up to and including termination.

Document Review Lifecycle

Standard Review

This Security Standard is an evolving document and is reviewed, at minimum annually, updates are made to respond or reflect changes to business, information processing, and regulatory environments, or introduction of new threats, exposures and vulnerabilities.