Medical records when a corporate contract ends

Overview

In the pre-employment examination arrangement considered, the clinic was a personal information controller for its clinical processing. Employer payment did not make it the owner of the records. Each controller needed to assess retention against its own lawful purposes and applicable requirements.

Practice implications

Parao Law practice guidance

For physicians

Before returning or deleting records at a client’s request, check the clinic’s retention schedule, continuing clinical purpose and applicable recordkeeping duties. Tell patients how long their information will be kept and arrange secure disposal when retention is no longer justified.

For lawyers

Draft termination clauses around the parties’ actual control of processing, patient rights and justified retention. Address legal claims and applicable healthcare requirements rather than prescribing automatic deletion at contract end. This opinion does not establish one retention period for every kind of medical record.