Storage of pharmacy records

Pharmacy records

All required records that exist in physical form must be maintained in the dispensary of the licensed pharmacy unless the licensee has applied for and received permission from the registrar to store the physical records at another location. Physical records include paper-based records and physical electronic media such as hard drives, USB flash drives, and optical storage media.

A licensee does not require permission from the registrar to store pharmacy records electronically if they are stored

• offsite using a secure physical data centre or cloud-based service provider within Canada, and
• the means of storage is documented in a privacy impact assessment that has been submitted to the Office of the Information and Privacy Commissioner of Alberta.

A licensee must ensure all data required under the legislative framework is backed up at least once daily and store a copy of the backup data

• using a secure cloud-based service provider that stores data within Canada,
• in a fire- and theft-resistant safe, or
• at an approved off-site location.

Record storage outside of the dispensary

An application is required if pharmacy records are to be stored outside the dispensary of a licensed pharmacy. When storing records outside of the dispensary, the location must maintain the security and confidentiality of the pharmacy records and limit access to only authorized individuals. The storage location must have a sufficient physical barrier system to prevent unauthorized access. ACP recommends using a secure storage facility. The following are examples of locations that would not be considered appropriate:

• A publicly accessible area (e.g., patient consultation room or the patient services area).
• A private dwelling or a location on private property.
• An area that is accessible by non-pharmacy staff.
• A location that has high traffic or is accessible by a number of individuals.

Licensee responsibility

Regarding the management of pharmacy records, the licensee is designated as the custodian of patient health information under the Health Information Regulation and is responsible for protecting the confidentiality and security of the health information in their custody. With regards to pharmacy records stored outside of the dispensary, it is the additional responsibility of the licensee to

• apply for approval by ACP;
• ensure all legislative requirements including accessibility, storage, backup, privacy, retention, and destruction are met;
• maintain the care and control of the records;
• restrict and control access to the records;
• review approved locations for storage of pharmacy records outside of the dispensary in the pharmacy profile in myACP;
• notify ACP if there is a change to the off-site storage information; and
• ensure an incoming licensee or TPIC is aware of and has access to any records stored outside of the dispensary if you cease in your role as licensee of the pharmacy. 

Process to apply to store records outside of the dispensary

A request for off-site record storage must be submitted by a licensee when records are to be stored in a location outside of their licenced dispensary. The licensee must

• submit a separate request for each off-site records storage location they wish to utilize, and
• submit a request for off-site record storage when there is a change to off-site storage information previously approved by ACP.

1. Complete and submit your application to store pharmacy records outside of the dispensary. This must be completed by the licensee.
   • Access the application to store pharmacy records outside of the dispensary (in myACP). All applications can be found in new applications.
   • Complete applications are reviewed in the order in which they are submitted and may take up to 15 business days to assess and process. Incomplete applications will result in further delays.
2. ACP will notify you via email if your application has been approved or if we have any questions regarding your application.