Who has access to your medical records

Under BC law, the information included in your medical records belongs to you. You have the right to see these records, except in a few specific circumstances. (We explain these here.) 

However, even though the information belongs to you, the physical records don’t. They belong to whoever created them — a doctor or hospital, usually. You may have to pay a (minimal) fee to see your records. Learn the steps involved in accessing your medical records.

“I have a disability that requires me to use a wheelchair. When I started my new job, my boss asked me about any restrictions or limitations I had. He told me he needed the information to accommodate me in the workplace. My doctor provided my boss with the information he needed, and my office is now entirely wheelchair-friendly.”

– Brady, Surrey, BC

Health care providers have a duty of confidentiality to you. This means they can’t share information about you with others without your permission — except in a few specific situations, explained below. Otherwise, your providers have to ensure your personal health information is kept private and secure.

There are situations in which someone may ask for your permission to see your medical records. For example:

• An insurance company may ask to see medical information when you apply for life or health insurance.

• An employer may ask to see medical information if you apply for a job that’s safety-sensitive.

• An employer may ask to see medical information if you have a disability the employer needs to accommodate.

You’re free to say no to these requests. But there may be consequences. The insurance company can decline your insurance application. The employer can choose not to hire you or may be limited in its ability to accommodate your disability. 

Health care providers who treat you can access your medical records. These providers are said to be in your circle of care. They’re allowed to share whatever records are relevant to your care and treatment. Your consent to this is assumed.

For example, if your family doctor refers you to an eye specialist, the doctor will send along whatever medical records the specialist needs to give you care and treatment.

Health care providers aren’t allowed to share a patient’s medical records with anyone outside their circle of care except in very limited situations.

Providers must disclose information in certain situations

The law requires health care providers to disclose information about a patient in these situations:

• A provider who believes a child is being abused or neglected has a duty to report their concern to a child welfare worker. (See this BC law.)

• A health care facility that treats a person for a gunshot or stab wound must report certain information to the local police. (See this law.)

• A doctor who believes a patient poses an imminent risk of serious harm to someone has a duty to tell the police. (See this case.)

• A doctor who has a patient who continues to drive, despite a medical condition that makes it dangerous to do so, must report the patient to the provincial authorities. (See this law.)

• For billing and administrative purposes, a health care provider must send certain information to the Medical Services Plan (MSP).

As well, health care providers may disclose information about a patient in these situations:

• A court orders that medical records be shown to other parties and lawyers in a lawsuit.

• The police obtain a search warrant to seize a person’s medical records.

• Disclosure is necessary for a person’s medical treatment but they themselves aren’t able to consent (for example, an emergency situation).

• The health care provider thinks a vulnerable adult has been abused or neglected.

Public bodies can disclose information in additional situations

Finally, when medical records are held by a hospital or other public body such as a health authority, information may be disclosed in these situations: 

• To address threats to public health.

• To make sure the hospital is delivering quality care or to figure out what happened if something went wrong.

• For research into health issues (specific conditions are usually needed to support disclosure in this context).

You can restrict access to certain health information about you that’s stored in province-wide health information databases. For example, a provincial database holds lab results. If you have lab results in this database, you can make a disclosure directive to block access to your lab results for anything other than clinical purposes.  

This privacy feature is known as masking. Your doctor should inform you about the option to mask personal information in your records, as well as advise you on how masking might affect the delivery of care.  

There are steps you can take if you think your medical records have been released to someone who shouldn’t have access. The first step is to reach out to your health care provider to tell them of your concern. 

Put your concern in writing. Address your letter to your health care provider, or to the health records office of the medical facility you’re dealing with. Be specific about the details to help them understand your concern. Ask them to explain their legal authority to release your medical records. 

You can use the forms provided by the information commissioner for BC.

• If your medical records are held by a health care provider in private practice, you can use this form.

• If your medical records are held by a public body such as a hospital or health authority, you can use this form.

Deliver your request directly to the provider or facility. 

Keep a copy of the letter for yourself. Make a note of when it was received. Under the law, the provider or facility must answer a request within 30 days. (In some cases, a time extension may be permitted.) 

Give your health care provider or the medical facility at least 30 business days to respond. Your next step (explained below) is to complain to the information commissioner, who may not accept your complaint if you don’t wait at least 30 days.

If you don’t hear back from your health care provider or medical facility, or you aren’t satisfied with their response, you can file a complaint with the Information & Privacy Commissioner of BC.

You must make your complaint in writing. You can send a letter or email or you can use the forms on the information commissioner’s website: 

• If you’re dealing with a health care provider in private practice, use this form.

• If you’re dealing with a hospital or other public body, use this form.

Clearly describe what happened. Explain your concerns. Attach a copy of your letter to the health care provider or facility, as well as any response you received. 

There is no fee for filing a complaint with the information commissioner.

The information commissioner will review your complaint according to the commission’s policies and criteria and decide whether to open a complaint file. If the commissioner declines to investigate your complaint, you will receive a letter explaining why. If your complaint is accepted, the commissioner will investigate your complaint and make a finding.

When more than one doctor is caring for a patient, treatment information can be shared between them. The patient’s consent is implied. The treating doctors can exchange relevant medical information, including lab results and consultations with other health care professionals providing rehabilitation, mental health, social work, nursing, and dietary services.

No, not unless you consent. However, your employer may need some medical information to meet their legal obligations. For example, you may have a disability and need to be accommodated.

If you refuse to release the medical information your employer needs to accommodate you (for example, the nature of your disability and your limitations and restrictions in the workplace), there may be consequences. For example, your employer may be limited in its ability to accommodate your disability. Or you may be put on unpaid leave, or have your work duties changed. See our guidance on your privacy rights at work.