Private Practice RDs: Do you have plans in place to manage client health records?

Updated: March 2026.

What do I need to know about protecting client personal health and financial information as a private practice dietitian?

Dietitians in private practice play an important role in protecting client information. If you operate a solo or independent practice, you are likely considered a (HIC) under Ontario’s Personal Health Information Protection Act, 2004 (PHIPA). This means you are responsible for ensuring that client personal health information is collected, used, stored, and retained in a way that protects privacy and confidentiality.

Each year during registration renewal, dietitians must confirm that they have plans and policies in place to securely store and retain client health and financial records in accordance with the College’s record keeping requirements.

But what does this involve in practice?

Are you a Health Information Custodian?

In most cases, dietitians in solo private practice are the Health Information Custodian for their clients’ records. This means you are responsible for protecting personal health information and ensuring it is:

• Kept private and confidential.
• Securely stored, whether electronic or paper.
• Accessible to clients upon request.
• Retained for the required period as per the Record Keeping Standard.
• Safely disposed of when the retention period ends.

These responsibilities apply not only to health records (for example, assessments, or nutrition care plans), but also to financial records such as invoices and billing documentation.

Still not sure not sure if you are an HIC? Read Are you a Health Information Custodian? in the Learning Hub.

Preparation is key

Part of protecting personal health information involves planning for unexpected changes in your practice. These may include incapacity, death, bankruptcy, or retirement. Without a plan, client records may be left unattended or inaccessible.

Guidance from the Information and Privacy Commissioner of Ontario emphasizes that health information custodians should take steps to prevent abandoned health records when a practice closes or changes.

Dietitians should develop a business or continuity plan that identifies who will take responsibility for client records if they are unable to do so.

Developing policies and agreements

Secure systems for storing and retaining client health and financial records are required under the Professional Practice Standards for Record Keeping (Standards 4 and 5).

Dietitians should also establish formal agreements and procedures that clarify who is responsible for records, particularly when:

• Working with other health professionals.
• Using electronic health record systems.
• Contracting with record storage companies.

Even when an external provider or agent stores records, the health information custodian remains responsible for ensuring that personal health information is managed securely and in compliance with PHIPA. 

Designating someone to manage records 

Dietitians should identify a designated individual who can manage client records if the dietitian becomes unable to do so.

This person might be:

• Another dietitian
• A colleague
• A spouse or family member
• A trusted friend

The designated individual does not need to be a dietitian. They may be a spouse, family member, friend or colleague. It is important to ensure that whoever is designated understands the responsibilities involved and is prepared to carry them out. This includes protecting confidential information and managing records appropriately.

If a dietitian dies, their estate trustee or administrator temporarily becomes the custodian of the records until they are transferred to someone legally authorized to take custody. If another person, such as a trustee in bankruptcy — assumes full control of the records due to insolvency, that individual becomes the custodian.

If a practice is transferred to another dietitian

When a practice is transferred to a successor dietitian, the original custodian must make reasonable efforts to notify clients before the transfer. If advance notice is not feasible, clients should be informed as soon as possible afterwards.

Once the records are transferred, the successor dietitian becomes the HIC and assumes responsibility for protecting and managing the records.

Record retention requirements

Client records must be retained according to the Professional Practice Standards for Record Keeping established by the College of Dietitians of Ontario:

• Adults: Records must be kept for 10 years after the client’s last visit.
• Children: Records must be kept for 10 years after the client turns 18.

During the retention period, records must remain private, secure, and accessible if requested by the client or required by the College or law enforcement during an investigation.

Providing clear instructions

Because designated individuals may not be familiar with professional record keeping requirements, it is important to include clear instructions in your business plan or will. These instructions may include:

• Notifying the College by email of the dietitian’s incapacity or death.
• Contacting clients to inform them of how their records will be stored and accessed
• Explaining the applicable retention period
• Providing resources to support clients who require ongoing dietetic care, whether through a successor dietitian or by helping them locate services through the College Register, Dietitians of Canada’s Find a Dietitian, Ontario Health811, or other sources.

Providing a template letter or phone script can help the designated individual communicate clearly with clients during a difficult or unexpected situation.

This information may be provided in a letter for the designated HIC to send to clients. A sample letter is included below. Alternatively, a telephone script may be created to contact clients directly.

Sample Letter

Dear <Client’s Name>, I regret to inform you that your Registered Dietitian <insert name> has <been in an unforeseen situation/experienced an accident or passed away suddenly>. The purpose of this letter is to inform you that your client health record will be kept at <insert>. If you would like a copy of your records, you may contact <insert>. Please note that copies of records will incur a fee of <insert>. Records will be kept private and confidential according to the record retention requirements of the College of Dietitians of Ontario (Professional Practice Standards for Record Keeping): For adults: Records will be kept for 10 years after the date of the client’s last visit. For children: Records will be kept for 10 years after the client turns 18 years old. If you wish to seek dietetic services elsewhere, you may do so by searching online and verifying a dietitian’s status through the College of Dietitians Public Register. The Register allows you to confirm registration status and view important information such as any restrictions on practice or disciplinary history. If you have any questions or concerns, please do not hesitate to contact me. Kind regards, <insert designated custodian contact information>

 

Key Takeaways 

Planning protects both clients and dietitians

Having clear policies and contingency plans helps ensure that client information remains secure and accessible, even if a practice changes unexpectedly. Taking time to prepare these plans protects clients’ privacy and supports compliance with professional and legal obligations.

Registered Dietitians who have questions about developing policies for managing client health and financial records are encouraged to contact the College of Dietitians of Ontario for guidance.

References

College Standards, Guidelines, and other articles
College of Dietitians of Ontario (2026). Are you a Health Information Custodian?
College of Dietitians of Ontario. (2019). Professional Practice Standard: Record Keeping.
College of Dietitians of Ontario. (2020). Privacy of Personal Information Dietetic Practice Tool kit for Registered Dietitians in Ontario.

Information and Privacy Commissioner of Ontario
Information and Privacy Commissioner of Ontario. (2019). Avoiding Abandoned Health Records: Guidance for Health Information Custodians Changing Practice.

Legislation
Personal Health Information Protection Act, 2004, S.O. 2004, c. 3, Sched. A.