Patient records do not move with the practice by default. Personal Health Information Protection Act, 2004 section 42 lets a custodian show them to a prospective buyer only under a confidentiality agreement, and transfer them to a successor only if the seller first makes reasonable efforts to notify every patient. Neither step needs a patient’s consent, and neither is optional.
Key takeaways
SECTION 01 OF 09
Marginal note Disclosure to successor. Subsection (1) lets a custodian disclose personal health information “to a potential successor of the custodian, for the purpose of allowing the potential successor to assess and evaluate the operations of the custodian, if the potential successor first enters into an agreement with the custodian to keep the information confidential and secure and not to retain any of the information longer than is necessary for the purpose of the assessment or evaluation” (PHIPA s.42(1)). The agreement is a condition of the disclosure, not closing paperwork.
It is an exception to section 29, which otherwise bars disclosure without consent, so it does consent’s work and only inside its own limits. A buyer not yet a custodian is separately bound by section 49(1) not to use the information “for any purpose other than” the one the custodian was authorised to disclose it for. None of it makes the buyer an owner: the Act speaks of custody and control, never title, and never defines “successor” — the word appears seven times, all inside section 42. Treadstone Law on transferring patient records runs the same order.
SECTION 02 OF 09
PHIPA defines the role by function, not by ownership. Paragraph 1 of the section 3(1) definition captures “A health care practitioner or a person who operates a group practice of health care practitioners”, and a health care practitioner is in the main a College member under the Regulated Health Professions Act, 1991 who provides health care.
Everyone else is an agent — someone who “acts for or on behalf of the custodian in respect of personal health information for the purposes of the custodian, and not the agent’s own purposes”. Associates, front desk, software vendor and storage company are agents, and section 17(3) leaves the custodian responsible for them: buying the agents does not buy the custodianship. In a shared practice the answer is often recorded nowhere, which is why the Information and Privacy Commissioner of Ontario — the regulator’s position, not the statute — tells group practices in Avoiding Abandoned Health Records to name the custodian in a formal agreement. The RCDSO is blunter about its own members: “Only a dentist can be a custodian of patients’ dental records.”
SECTION 03 OF 09
Subsection (2), marginal note Transfer to successor, operates at closing. A custodian “may transfer records of personal health information about an individual to the custodian’s successor if the custodian makes reasonable efforts to give notice to the individual before transferring the records or, if that is not reasonably possible, as soon as possible after transferring the records” (PHIPA s.42(2)). No consent, no opt-in: a duty to try to tell people, falling on the seller.
The IPC puts it to patients the same way: “doctors must notify their patients of the transfer at the first reasonable opportunity, either before they retire or soon after”. Its guidance says the notice should name who will hold the records, for how long, and how to seek access or a transfer elsewhere. What it does not license is marketing: section 33 bars use “for the purpose of marketing anything” without express consent, so the recall list is not an asset the buyer may mail — ordinary customer data, which runs on a different statute, is covered in a separate article. Treadstone Law on records when a practice changes hands adds the deal-side point: draft the agreement and the notice plan together.
SECTION 04 OF 09
PHIPA sets a floor; the College sets the timetable. The CPSO’s Closing a Medical Practice policy — a College expectation, not legislation — states that “Physicians must provide patients with at least 90 days’ notice of a planned closure.” A sale bends it without removing it: “In instances where a successor will be in place to take over the practice the notice period may be shortened”, subject to judgment about not stranding patients who decline the buyer.
Dentistry arrives by another route. The RCDSO states that “The selling dentist must notify the patients of the practice in writing about the change in ownership”, and that on incapacity or death the incoming dentist must write instead. Behind it sits O. Reg. 853/93, making “Failing to make arrangements with a patient for transfer of the patient record or a copy thereof” on retirement professional misconduct. See also college consent on a sale.
SECTION 05 OF 09
For physicians the period is regulated, not merely expected. O. Reg. 114/94 under the Medicine Act, 1991 requires a member to “retain the records required by regulation for at least ten years after the date of the last entry in the record, or until ten years after the day on which the patient reached or would have reached the age of eighteen years, or until the member ceases to practise medicine, whichever occurs first”. A chart closed at age four runs twenty-four years.
The RCDSO states the same ten years for dentistry: records, radiographs and prescriptions “must be maintained for at least ten years after the date of the last entry in the patient’s record”, and PHIPA s.13(1) requires them “retained, transferred and disposed of in a secure manner”. Storage and access requests for charts belonging to people who will never return is a cost sized by file count, not revenue — attached to goodwill rather than part of it.
SECTION 06 OF 09
The branch nobody prices. For family medicine and primary care, O. Reg. 114/94 requires a physician who ceases to practise to either “transfer them to a member with the same address and telephone number” or “notify each patient that the records will be destroyed two years after the notification and that the patient may obtain the records or have the member transfer the records to another physician within the two years”. Destruction outside those routes is prohibited.
Everywhere else the duty does not end. The IPC fact sheet Succession Planning to Help Prevent Abandoned Records says “These obligations do not end until a legally authorized successor has custody and control of the records”; on death the estate’s administrator holds them meanwhile, and the RCDSO agrees that “The estate trustees can act for the deceased dentist for an interim period during the sale of a practice.”
The costliest misconception is that warehousing the charts discharges the obligation. It does not: “Since a record storage company is not a custodian, you continue to be responsible for health records retained by a record storage company on your behalf”. Records may go only to a successor who is already a custodian or becomes one on the transfer.
SECTION 07 OF 09
Section 42(2) engages only when records move to a successor custodian, so a share purchase of the corporation holding custody triggers no notice at all — but the custodian’s identity must be established rather than assumed, because section 3(1) reaches both the practitioner and the person operating the group practice without saying which it is inside a one-practitioner corporation. The RCDSO reads it one way for dentistry: the dentist, usually the owner, “is deemed to be the custodian of their patients’ dental records”. Who may hold the shares is separate, covered in the share restrictions; Treadstone Law’s practice hub treats the certificate of authorisation as a closing condition and its answer on taking over the patients handles the roster. And O. Reg. 853/93 s.6 bars an associated member or partner, on a break-up, from soliciting “the principal member’s patients” except as otherwise agreed in writing.
SECTION 08 OF 09
PHIPA does not reach animal records, structurally rather than by oversight. Section 4(1) defines personal health information as “identifying information about an individual in oral or recorded form” relating to that individual’s health or care, and its custodians are defined by reference to the Regulated Health Professions Act, 1991, whose Schedule 1 lists dentistry, medicine, physiotherapy, nursing, optometry, pharmacy and twenty other professions. The string “veterinar” does not occur once in the 50,745-word consolidated RHPA.
Ontario veterinarians sit under the Veterinarians Act and R.R.O. 1990, Reg. 1093, where the regulated relationship is with “the owner of an animal that the member is treating”. The clock differs too: records are “retained for a period of at least five years after the date of the last entry in the record or until two years after the member ceases to practise veterinary medicine, whichever occurs first”, half the medical or dental period. Check the calendar too — the Veterinary Professionals Act, 2024 notes that “Sections 1-98 come into force on a day to be named by proclamation of the Lieutenant Governor”, so on the consolidation fetched 1 September 2026 the older Act still governs. Treadstone Law’s answer on veterinary records and clinic hub take the transaction side.
SECTION 09 OF 09
The RCDSO describes what the market does: “The purchase and sale agreement typically contains provisions that transfer the responsibility to retain the records to the purchaser and gives the vendor the right of access to the records if required for the defence of a complaint or a claim against the dentist.” The second half matters more than sellers expect: a complaint can arrive years after closing, by which time the file is behind the buyer’s door. See complaints after a sale.
What no clause can do is lock a patient out of their own chart. PHIPA s.72(2) makes wilful contravention an offence punishable, “if the person is a natural person, to a fine of not more than $200,000 or to a term of imprisonment of not more than 1 year, or to both”, and up to $1,000,000 for anyone who is not; O. Reg. 329/04 s.35(1) caps administrative penalties separately at $50,000 and $500,000. Two boundaries: this is Ontario law, and each College speaks only for its own members. Whoever holds the charts still owes s.54(2) an access response “as soon as possible in the circumstances but no later than 30 days after receiving the request”.
No. PHIPA s.42 lets a custodian disclose records to a prospective buyer for diligence only under a confidentiality agreement, and transfer them to a successor only after the seller first makes reasonable efforts to notify every patient — neither step needs patient consent, and neither is optional.
No. A record storage company is not a custodian, so the seller or buyer remains responsible for health records retained by a storage company on their behalf. Records may go only to someone who is already a custodian or who becomes one on the transfer, and the obligations do not end until a legally authorized successor has custody and control.
For physicians and dentists, at least ten years after the date of the last entry in the record, or until ten years after the patient turns eighteen, whichever occurs first — a chart closed at age four can run twenty-four years. Veterinary records in Ontario are different: only five years, since PHIPA does not cover animal records at all.
Sources
