How long are patient records (with PHI) kept in Ocean?

Ocean is not an EMR/EHR and not a long term repository of health information for a patient. All patient records are eventually deleted from Ocean. Ocean only holds patient records in an encrypted format for a limited time to support the various ways clinics use the system.  After this time has passed, the patient record is permanently deleted from the Ocean database, although it will be available in database backups for a year.

For example, when a patient is scheduled for an appointment, the patient record is encrypted and uploaded into Ocean a day or two before the appointment time. It is deleted after the EMR downloads the generated note. The total time in Ocean may be 3-4 days.

For a contrasting example, if a newly pregnant patient registers for a new baby pediatric appointment, the patient might be sent an Ocean Online web questionnaire months prior to the birth and be asked to complete the form upon delivery. In this case, the patient record might be stored in Ocean for 5 months.

Ocean's behaviour is guided by the PIPEDA privacy principle of "Limiting Use, Disclosure and Retention". Privacy guidelines recommend that PHI be kept in as few places as possible for as short a time as possible. The principal record of personal health information for clinics is the EMR/EHR. Furthermore, the patients in Ocean are "snapshots" of a patient at a point in time (when the patient was uploaded). Although the patients can be updated by the EMR/EHR easily, having multiple copies of patient records is generally problematic due to the potential for stale data.

Caveats:

• You can "lock" a patient in Ocean to request that Ocean leave the record alone and stored within Ocean, although this should be reserved for special situations only.
• Ocean Study data captured for a patient is kept indefinitely (until it is deleted by the owning Ocean site).
• The audit trail maintained by Ocean lives indefinitely, which allows you to map the EMR ID of the patient to an Ocean reference number to tablet access, web questionnaire access, form completion audit records, etc for audit purposes.
• Encrypted PHI will be maintained in Ocean database backups for up to one year. Ocean backups are maintained at a secure facility with all access logged.  Access is limited to OceanMD operations staff.

Detailed time frames in patients are kept within Ocean:

• For patients with forms pending: 30 days or until the secure hyperlink to access the form expires
  • The patient will be kept in Ocean for the longer of the two durations.
• For patients with notes that haven't been downloaded: 90 days (if you have patients in this situation, the following will occur: "What do I do if I see 'Warning from Ocean: Notes Require Download?'")
• For patients that have all notes downloaded and no forms pending: 14 days
• For patients that have unopened secure messages and no forms pending: 14 days or until the secure hyperlink to access the message expires
  • The patient will be kept in Ocean for the longer of the two durations.
• For patients with an appointment scheduled in an integrated EMR with no forms or updates pending: 14 days after their scheduled appointment date
• For patients with associated eReferral, eConsult, Website Forms, Patient Authenticated Website Form, or Online Booking submissions: until all associated submissions are purged from the Ocean Site
  • Submissions are associated with existing patients via a matching health number/alternate ID. In the case of new patient creation (e.g., accepting a submission, creating a new submission), the patient is explicitly tied to the submission using a unique patient reference value.

eConsults/eReferrals

By default, eConsults/eReferrals that are sent through Ocean or transcribed into Ocean are stored for a minimum of 1 year before they are purged. However, certain actions in Ocean can extend the purge deadline beyond the default. Detailed information about eReferral storage can be found in: How long are eConsults/eReferrals stored after they are sent through Ocean?

eConsult/eReferral analytic data captured by Ocean is kept indefinitely. For additional information, please see Supporting Analytics in eConsults and/or eReferral eForms.

When an eConsult/eReferral is approaching it's purge deadline, it will automatically move into the 'Deletion Warnings' status folder 14 days before being purged from Ocean. A Deletion Warning email notification will also be automatically sent to all Ocean Sites with access to the eConsult/eReferral.

Website Form/Patient Authenticated Website Form Submissions

• Website Form Submissions in the 'New', 'Accepted', or 'Completed' status folder are kept for 180 days from the date of submission.
• If appointment information is added into the website form submission, it is retained until the appointment date + 30 days.
• If an 'Anticipated Time to Appointment' is entered in the website form submission, it is retained until the end of the estimated date range + 60 days.
• If review is requested by another user at the site, the submission will be stored for 12 months after the date the review was requested.
• When a Website Form Submission is scheduled for deletion, it moves to the "Deletion Warnings" status folder, which appears in red. A user can "extend" the retention time for additional blocks of 60 days.
• As above, Ocean will notify you with an alert if you have deletion warnings.

Online Booking Submissions

• If the appointment date is within 180 days of the date that the booking occurred, the submission will be retained in Ocean for 180 days after the date that the booking occurred.
• If the appointment date is beyond 180 days of the date that the booking occurred, the submission will be retained in Ocean for 30 days after the booked appointment date.
• If review of the submission is requested by another user at the site using the 'Needs Review' feature, the submission will be stored for 12 months after the date the review was requested.
• When an Online Booking submission is scheduled for deletion, it moves to the "Deletion Warnings" status folder 14 days before being deleted. A user can "extend" the retention time for additional blocks of 60 days.