Access requests and retention
Answer PHIPA access requests with a EDFlow visit-record export, place and lift legal holds, and understand the retention schedule, care records and de-identification after the operational window.
Access requests
When a patient asks for their information under PHIPA:
- Find the visit: from the visit's Activity tab, or Legal holds → Care records by the EHR visit number (hashed in memory, never stored as typed).
- Export the visit record: timeline, care-team names, tests and their steps, requests, tasks, the going-home summary, family-link activity, the access log and care records.
- A second privacy officer approves the export. It's audited.
EDFlow holds far less than the EHR: never results, diagnoses or notes. The EHR remains the official record.
Legal holds
A hold stops retention from deleting a visit.
- Manual: from the visit's Activity tab or Legal holds (reason required).
- Automatic: visits with an urgent request, a death, a return within 72 hours, a patient-relations complaint recorded by staff, and incident subjects.
- Lift needs
privacy.legal_holdand a fresh sign-in check. Every hold and lift is audited.
Retention schedule
| Setting | Default | Allowed values | What it does |
|---|---|---|---|
retention.operationalWindowDays | 30 | 7–90 days | Days PHI is kept before de-identification (F-21.2). (Reduces privacy) |
retention.auditDays | 730 | 730–3650 days | Audit log retention. (Reduces privacy) |
retention.analyticsDays | 730 | 365–2555 days | De-identified analytics retention. (Reduces privacy) |
retention.safetyRecordYears | 10 | 2–30 years | Retention of care records (D-36). (Reduces privacy) |
| Data | Kept | Then |
|---|---|---|
| Printable card code | 15 min | Deleted |
| Staff-assist codes | 5 min | Deleted |
| Push tokens, patient and family phone numbers | Until the session, access or link ends | Deleted |
| Card, visit-code, family and summary token hashes | Until access ends | Deleted |
| Patient and family sessions | Access end + 7 days | Deleted (the audit log keeps the history) |
| Identifiable visit data (display name, match key, locations, care-team links, orders, low and normal requests, inbox, estimates, stages, family links) | The operational window after departure (default 30 days) | De-identified |
| Care records: urgent and high requests with their lifecycle, check-ins that raised a request, published summaries, task instructions shown, delay notices, call-backs, updates pauses | The safety-record period (default 10 years) | Deleted unless on hold |
| EHR event ledger, idempotency keys, dead letters | 30 days | Deleted |
| Outbox | Bodies 30 days, rows 90 days | Cleared, then deleted |
| Audit log | 2 years (range 2 to 10) | Deleted with its digests |
| De-identified analytics | 2 years (range 1 to 7) | Deleted |
| AI conversations | Session end + retention days (default 7) | Deleted |
De-identification
At the end of the operational window, the nightly job:
- confirms the visit's de-identified analytics row exists;
- copies care records;
- converts remaining requests to de-identified request facts;
- unlinks feedback;
- deletes orders, tasks, inbox, estimates, family links, stages, care-team links and locations;
- keeps a stub with the visit-number hashes only while care records exist.
Visits on legal hold are skipped. Each run is audited with counts.
Related
Last updated on