CMA CODE OF ETHICS AND PROFESSIONALISM
A compassionate physician recognizes suffering and vulnerability, seeks to understand the unique circumstances
of each patient and to alleviate the patient’s suffering, and accompanies the suffering and vulnerable patient.
An honest physician is forthright, respects the truth, and does their best to seek, preserve, and communicate
that truth sensitively and respectfully.
A humble physician acknowledges and is cautious not to overstep the limits of their knowledge and skills or the
limits of medicine, seeks advice and support from colleagues in challenging circumstances, and recognizes the
patient’s knowledge of their own circumstances.
A physician who acts with integrity demonstrates consistency in their intentions and actions and acts in a
truthful manner in accordance with professional expectations, even in the face of adversity.
A prudent physician uses clinical and moral reasoning and judgement, considers all relevant knowledge
and circumstances, and makes decisions carefully, in good conscience, and with due regard for principles of
exemplary medical care.
The CMA Code of Ethics and Professionalism articulates the ethical and professional commitments and responsibilities of the
medical profession. The Code provides standards of ethical practice to guide physicians in fulfilling their obligation to provide
the highest standard of care and to foster patient and public trust in physicians and the profession. The Code is founded on
and affirms the core values and commitments of the profession and outlines responsibilities related to contemporary medical
In this Code, ethical practice is understood as a process of active inquiry, reflection, and decision-making concerning what
a physician’s actions should be and the reasons for these actions. The Code informs ethical decision-making, especially in
situations where existing guidelines are insufficient or where values and principles are in tension. The Code is not exhaustive;
it is intended to provide standards of ethical practice that can be interpreted and applied in particular situations. The Code and
other CMA policies constitute guidelines that provide a common ethical framework for physicians in Canada.
In this Code, medical ethics concerns the virtues, values, and principles that should guide the medical profession, while
professionalism is the embodiment or enactment of responsibilities arising from those norms through standards,
competencies, and behaviours. Together, the virtues and commitments outlined in the Code are fundamental to the ethical
practice of medicine.
Physicians should aspire to uphold the virtues and commitments in the Code, and they are expected to enact the professional
responsibilities outlined in it.
Physicians should be aware of the legal and regulatory requirements that govern medical practice in their jurisdictions.
Trust is the cornerstone of the patient–physician relationship and of medical professionalism. Trust is therefore
central to providing the highest standard of care and to the ethical practice of medicine. Physicians enhance
trustworthiness in the profession by striving to uphold the following interdependent virtues:
A. VIRTUES EXEMPLIFIED BY THE ETHICAL PHYSICIAN
B. FUNDAMENTAL COMMITMENTS OF THE MEDICAL PROFESSION
Consider first the well-being of the patient; always act to benefit the patient and promote the good of the patient.
Provide appropriate care and management across the care continuum.
Take all reasonable steps to prevent or minimize harm to the patient; disclose to the patient if there is a
risk of harm or if harm has occurred.
Recognize the balance of potential benefits and harms associated with any medical act; act to bring about
a positive balance of benefits over harms.
Commitment to the well-being of the patient
Promote the well-being of communities and populations by striving to improve health outcomes and
access to care, reduce health inequities and disparities in care, and promote social accountability.
Commitment to justice
Practise medicine competently, safely, and with integrity; avoid any influence that could undermine
your professional integrity.
Develop and advance your professional knowledge, skills, and competencies through lifelong learning.
Commitment to professional integrity and competence
Always treat the patient with dignity and respect the equal and intrinsic worth of all persons.
Always respect the autonomy of the patient.
Never exploit the patient for personal advantage.
Never participate in or support practices that violate basic human rights.
Commitment to respect for persons
Contribute to the development and innovation in medicine through clinical practice, research, teaching,
mentorship, leadership, quality improvement, administration, or advocacy on behalf of the profession or
Participate in establishing and maintaining professional standards and engage in processes that support
the institutions involved in the regulation of the profession.
Cultivate collaborative and respectful relationships with physicians and learners in all areas of medicine
and with other colleagues and partners in health care.
Commitment to professional excellence
Value personal health and wellness and strive to model self-care; take steps to optimize meaningful
co-existence of professional and personal life.
Value and promote a training and practice culture that supports and responds effectively to colleagues in
need and empowers them to seek help to improve their physical, mental, and social well-being.
Recognize and act on the understanding that physician health and wellness needs to be addressed at
individual and systemic levels, in a model of shared responsibility.
Commitment to self-care and peer support
Value and foster individual and collective inquiry and reflection to further medical science and to
facilitate ethical decision-making.
Foster curiosity and exploration to further your personal and professional development and insight; be
open to new knowledge, technologies, ways of practising, and learning from others.
Commitment to inquiry and reflection
C. PROFESSIONAL RESPONSIBILITIES
The patient–physician relationship is at the heart of the practice of medicine. It is a relationship of trust that recognizes the
inherent vulnerability of the patient even as the patient is an active participant in their own care. The physician owes a duty of
loyalty to protect and further the patient’s best interests and goals of care by using the physician’s expertise, knowledge, and
prudent clinical judgment.
In the context of the patient–physician relationship:
1. Accept the patient without discrimination (such as on the basis of age, disability, gender identity or expression, genetic
characteristics, language, marital and family status, medical condition, national or ethnic origin, political affiliation, race,
religion, sex, sexual orientation, or socioeconomic status). This does not abrogate the right of the physician to refuse to
accept a patient for legitimate reasons.
2. Having accepted professional responsibility for the patient, continue to provide services until these services are no longer
required or wanted, or until another suitable physician has assumed responsibility for the patient, or until after the
patient has been given reasonable notice that you intend to terminate the relationship.
3. Act according to your conscience and respect differences of conscience among your colleagues; however, meet your
duty of non-abandonment to the patient by always acknowledging and responding to the patient’s medical concerns and
requests whatever your moral commitments may be.
4. Inform the patient when your moral commitments may influence your recommendation concerning provision of, or
practice of any medical procedure or intervention as it pertains to the patient’s needs or requests.
5. Communicate information accurately and honestly with the patient in a manner that the patient understands and can
apply, and confirm the patient’s understanding.
6. Recommend evidence-informed treatment options; recognize that inappropriate use or overuse of treatments or
resources can lead to ineffective, and at times harmful, patient care and seek to avoid or mitigate this.
7. Limit treatment of yourself, your immediate family, or anyone with whom you have a similarly close relationship to
minor or emergency interventions and only when another physician is not readily available; there should be no fee for
8. Provide whatever appropriate assistance you can to any person who needs emergency medical care.
9. Ensure that any research to which you contribute is evaluated both scientifically and ethically and is approved by a
research ethics board that adheres to current standards of practice. When involved in research, obtain the informed
consent of the research participant and advise prospective participants that they have the right to decline to participate
or withdraw from the study at any time, without negatively affecting their ongoing care.
10. Never participate in or condone the practice of torture or any form of cruel, inhuman, or degrading procedure.
Physicians and patients
11. Empower the patient to make informed decisions regarding their health by communicating with and helping the patient
(or, where appropriate, their substitute decision-maker) navigate reasonable therapeutic options to determine the best
course of action consistent with their goals of care; communicate with and help the patient assess material risks and
benefits before consenting to any treatment or intervention.
12. Respect the decisions of the competent patient to accept or reject any recommended assessment, treatment, or plan of
13. Recognize the need to balance the developing competency of minors and the role of families and caregivers in medical
decision-making for minors, while respecting a mature minor’s right to consent to treatment and manage their personal
14. Accommodate a patient with cognitive impairments to participate, as much as possible, in decisions that affect them;
in such cases, acknowledge and support the positive roles of families and caregivers in medical decision-making and
collaborate with them, where authorized by the patient’s substitute decision-maker, in discerning and making decisions
about the patient’s goals of care and best interests.
15. Respect the values and intentions of a patient deemed incompetent as they were expressed previously through advance
care planning discussions when competent, or via a substitute decision-maker.
16. When the specific intentions of an incompetent patient are unknown and in the absence of a formal mechanism for
making treatment decisions, act consistently with the patient’s discernable values and goals of care or, if these are
unknown, act in the patient’s best interests.
17. Respect the patient’s reasonable request for a second opinion from a recognized medical expert.
Physicians and the practice of medicine
Patient privacy and the duty of confidentiality
18. Fulfill your duty of confidentiality to the patient by keeping identifiable patient information confidential; collecting,
using, and disclosing only as much health information as necessary to benefit the patient; and sharing information only
to benefit the patient and within the patient’s circle of care. Exceptions include situations where the informed consent of
the patient has been obtained for disclosure or as provided for by law.
19. Provide the patient or a third party with a copy of their medical record upon the patient’s request, unless there is a
compelling reason to believe that information contained in the record will result in substantial harm to the patient or
20. Recognize and manage privacy requirements within training and practice environments and quality improvement
initiatives, in the context of secondary uses of data for health system management, and when using new technologies in
21. Avoid health care discussions, including in personal, public, or virtual conversations, that could reasonably be seen as
revealing confidential or identifying information or as being disrespectful to patients, their families, or caregivers.
Medical decision-making is ideally a deliberative process that engages the patient in shared decision-making and is informed
by the patient’s experience and values and the physician’s clinical judgment. This deliberation involves discussion with the
patient and, with consent, others central to the patient’s care (families, caregivers, other health professionals) to support
In the process of shared decision-making:
22. Recognize that conflicts of interest may arise as a result of competing roles (such as financial, clinical, research,
organizational, administrative, or leadership).
23. Enter into associations, contracts, and agreements that maintain your professional integrity, consistent with evidenceinformed
decision-making, and safeguard the interests of the patient or public.
24. Avoid, minimize, or manage and always disclose conflicts of interest that arise, or are perceived to arise, as a result of
any professional relationships or transactions in practice, education, and research; avoid using your role as a physician to
promote services (except your own) or products to the patient or public for commercial gain outside of your treatment role.
25. Take reasonable steps to ensure that the patient understands the nature and extent of your responsibility to a third party
when acting on behalf of a third party.
26. Discuss professional fees for non-insured services with the patient and consider their ability to pay in determining fees.
27. When conducting research, inform potential research participants about anything that may give rise to a conflict of
interest, especially the source of funding and any compensation or benefits.
28. Be aware of and promote health and wellness services, and other resources, available to you and colleagues in need.
29. Seek help from colleagues and appropriate medical care from qualified professionals for personal and professional
problems that might adversely affect your health and your services to patients.
30. Cultivate training and practice environments that provide physical and psychological safety and encourage help-seeking
31. Treat your colleagues with dignity and as persons worthy of respect. Colleagues include all learners, health care partners,
and members of the health care team.
32. Engage in respectful communications in all media.
33. Take responsibility for promoting civility, and confronting incivility, within and beyond the profession. Avoid impugning
the reputation of colleagues for personal motives; however, report to the appropriate authority any unprofessional
conduct by colleagues.
34. Assume responsibility for your personal actions and behaviours and espouse behaviours that contribute to a positive
training and practice culture.
35. Promote and enable formal and informal mentorship and leadership opportunities across all levels of training, practice,
and health system delivery.
36. Support interdisciplinary team-based practices; foster team collaboration and a shared accountability for patient care.
Physicians and self
Physicians and colleagues
Managing and minimizing conflicts of interest
38. Recognize that social determinants of health, the environment, and other fundamental considerations that extend
beyond medical practice and health systems are important factors that affect the health of the patient and of
39. Support the profession’s responsibility to act in matters relating to public and population health, health education,
environmental determinants of health, legislation affecting public and population health, and judicial testimony.
40. Support the profession’s responsibility to promote equitable access to health care resources and to promote resource
41. Provide opinions consistent with the current and widely accepted views of the profession when interpreting scientific
knowledge to the public; clearly indicate when you present an opinion that is contrary to the accepted views of the
42. Contribute, where appropriate, to the development of a more cohesive and integrated health system through interprofessional
collaboration and, when possible, collaborative models of care.
43. Commit to collaborative and respectful relationships with Indigenous patients and communities through efforts
to understand and implement the recommendations relevant to health care made in the report of the Truth and
Reconciliation Commission of Canada.
44. Contribute, individually and in collaboration with others, to improving health care services and delivery to address
systemic issues that affect the health of the patient and of populations, with particular attention to disadvantaged,
vulnerable, or underserved communities.
Approved by the CMA Board of Directors Dec 2018
37. Commit to ensuring the quality of medical services offered to patients and society through the establishment and
maintenance of professional standards.
Physicians and society
The CMA’s stance on intervention and judicial advocacy is to bring an evidence-based perspective to assist in relation to the decision-making of issues at hand.
CMA’s strategic plan and guiding principles opens the possibility that there may be circumstances when legal advocacy, and in particular judicial advocacy, may be leveraged strategically and proactively as a further tool in CMA’s advocacy toolbox to bring a non-partisan, evidence-based perspective to the courtroom that would further the organization’s vision for “a vibrant professional and a healthy population”.
Purpose and Scope of Policy
Given CMA 2020, and informed by knowledge of past experiences, the purpose of this policy is to provide guidelines to assist with decision making as to whether CMA should use legal action, as part of its advocacy toolbox, to move CMA’s work forward on a cause or issue.
Cases Deemed Appropriate for CMA Judicial Advocacy – General Principles
1. Stage and Venue of Proceedings
a) Generally, CMA will only engage in a proposed case at an appellate level or in the highest forum in which a matter is likely to be finally decided.
b) Exceptionally, the CMA may engage in a proposed case at a lower court or a court of first instance where:
i) circumstances justify engagement, such as an invitation from the court or where physicians’ expertise is necessary to create a trial record that supports the CMA’s policy position(s) or provides added relevant information that is not otherwise being provided or would highlight a critical issue that requires attention or would attract the attention of relevant parties.
c) Exceptionally, CMA may leverage international fora (e.g., United Nations treaty bodies) where involvement could help advance a specific cause or issue being championed by the CMA.
2. CMA’s Role in Proceedings
With some rare exceptions , , the CMA will only assume the role of intervener in a proposed case. The CMA will intervene where the CMA may bring a non-partisan, evidence-based analysis to an issue and where there are compelling reasons for doing so, considering the evaluation criteria contained in the Reference Guide in Appendix 1 of this policy.
3. Relevance to Existing CMA Policy
a) The CMA may engage in a proposed case where engagement would constitute a significant contribution to the consideration of the issue or issues involved and only when the position sought to be advanced is:
i. supported by and consistent with previously adopted policy of CMA; or
ii. a matter of compelling public or professional interest which the Board of Directors then adopts as CMA policy following appropriate consultation.
b) Where there is CMA policy that is clear, relevant to the proposed case and a matter of record, the policy should be cited and explained (e.g., in factum or affidavit).
c) If the CMA’s proposed stance in a case proceeding supports a position which the CMA has not previously adopted as policy, the CMA Board of Directors must adopt the position as policy before authorizing the activity.
4. Issue of National, Special and/or Unifying Significance to Profession
a) The CMA will generally only engage in a proposed case of special and unifying significance to the medical profession.
b) The CMA will not engage in a proposed case where the matter is only of local or regional concern or of a private nature with no public interest or compelling professional or public policy component.
5. Potential Case Outcome(s) and Effect(s)
Prior to engagement, the CMA must consider the potential impact(s) (both favourable and unfavourable) of the legal precedent that may set by the proposed case on members of the medical profession and patients.
6. Collaboration with Provincial/Territorial Associations, Affiliates and other Organizations
a) In the spirit of community building and collaborating with those who share our vision, the CMA welcomes opportunities to collaborate with provincial or territorial associations, affiliates and other organizations provided that these Guidelines are followed and that the other organizations
i. share positions on the issues at stake in the case that are consistent with CMA policy.
ii. can follow through on tasks, deadlines and communication needs related to collaboration.
b) While not mandatory, CMA would expect mutual assistance in funds and in kind when it collaborates with another organization (in relation to a judicial proceeding) or is asked to intervene.
7. Reputational Risk and Stakeholder Relations Implications
The CMA will consider as a general principle whether involvement in a proposed case:
a) may present the CMA with reputational risk(s) (e.g., inconsistent with mission and values, controversial, too political).
b) may impact relations with other stakeholders, including provincial/territorial medical associations, associates, affiliates and other organizations.
8. Financial and Resource Implications
The CMA will consider as a general principle the financial and resource implications of involvement in a proposed case such as the affordability of the proceeding, or competing demands for limited resources and staff availability. To the extent possible, the CMA will seek pro bono external legal assistance.
Authorization to Engage in Judicial Advocacy
CMA’s Senior Management Team will generally perform a preliminary analysis of the proposal to engage in a proposed case and may use the Reference Guide appended to these guidelines as a decision-making tool (see Appendix 1). The decision to engage in a proposed case must be ultimately authorized by the CMA Board of Directors. Once the Board has authorized the application, CMA staff will follow established internal protocol and procedures in the preparation of the required documentation according to the appended Working Draft Protocol (see Appendix 3). CMA staff will regularly provide the CMA Board with updates of the Court proceeding.
Appendix 1: Reference guide for determining if appropriate for CMA to engage in judicial advocacy on a matter, in accordance with CMA Guidelines on Judicial Advocacy
Degree to which criterion favours proposed judicial advocacy initiative
(please provide reasons for choice)
Somewhat favours Mildly favours Does not favour
Stage and venue of proceedings
Court of highest level?
If yes, mark as “strongly favours”
If yes, mark as “somewhat favours”
If not court of highest level or other appellate court, indicate jurisdiction
Relevance of matter to existing CMA policy
Is matter consistent with previously adopted policy?
Is matter of compelling public interest that may be adopted as policy?
Is matter of compelling professional interest that may be adopted as policy?
Issue of National, Special or Unifying Significance to the Profession
Does matter have impact beyond local/regional level?
Does matter have special or unifying significance for medical profession?
Collaboration or Request for Involvement
Other request for involvement?
Stakeholder relations implications
Appendix 2: Contents of Request for CMA to Intervene
1. Requests for CMA to intervene in court proceedings can arrive from multiple sources (internally – CMA Board, CMA provincial or territorial associations, affiliates, another organization, an individual member, etc.). CMA’s Legal Services Department may also monitor judicial developments and identify cases of special interest to CMA.
2. Unless there are exceptional circumstances, the request for CMA to intervene in a court proceeding shall contain the following:
(i) The style or caption of the case, identification of the last court to render a decision in the case and the court in which it is proposed to intervene. A copy of the decision or order appealed from, any accompanying reasons and other relevant documentation must be attached to (or linked from) the proposal;
(ii) The date by which the proposed application for leave to intervene and factum must be filed;
(iii) The issues before the Court and potential outcomes, dissenting views and likelihood of success, including policy implications for CMA depending on the various outcomes;
(iv) The position sought to be advanced on CMA’s behalf and how this position is consistent with existing CMA policy. If there is no existing CMA policy, the request should state why CMA should adopt the policy prior to intervention;
(v) If the request relates to a local or regional matter, an explanation of how the position to be taken is not inconsistent with CMA policy and the broader interests and concerns of CMA;
(vi) Consultations undertaken, if any, on why the matter warrants CMA intervention as a compelling issue of public policy and special interest to the medical profession;
(vii) A list of other organizations that might have an interest in the intervention or co-intervening with CMA;
(viii) Disclosure of any personal or professional interest, in the matter on the part of any individual or organization participating in the decision to seek the Board of Directors’ authorization to intervene; and
(ix) Budget development.
3. Where the request to intervene arises in a case where there is no existing CMA policy on the issue, the party making the request should demonstrate the urgency and importance of adopting the policy position to be advanced.
Appendix 3: Working Draft Protocol and Procedures for Court Intervention Document
CMA staff will prepare the application documents for leave to intervene in concert with expert litigation legal counsel.
Depending on the issues before the Court, the President or Chair or the CMA Board may review the contents of the application documents for leave to intervene and the actual factum prior to filing with the Court. Alternatively, the application documents and factum will be shared as information items with the CMA President and Board after filing. The decision to obtain the President and/or Chair and/or Board approval or not prior to filing lies with the CMA CEO.
CMA staff may also consult with the President and Chair on the choice of individual filing the affidavit (called the “affiant”) on CMA’s behalf. The affiant will in most circumstances be a physician, usually at the elected level, with experience and expertise on the issues before the Court.
All CMA Departments will consult with and co-ordinate with the CMA Legal Department. For example, the content of any Communication Strategy documents (e.g. press releases, media alerts, news articles, etc.) as part of the court proceeding must be consistent with the contents of CMA’s application for leave to intervene documents and factum.
Approved by the CMA Board of Directors Dec 2018
Clinical photography is a valuable tool for physicians. Smartphones, as well as other devices supporting network connectivity, offer a convenient, efficient method to take and share images. However, due to the private nature of the information contained in clinical photographs there are concerns as to the appropriate storage, dissemination, and documentation of clinical images. Confidentiality of image data must be considered and the dissemination of these images onto servers must respect the privacy and rights of the patient. Importantly, patient information should be considered as any information deriving from a patient, and the concepts outlined therefore apply to any media that can be collected on, or transmitted with, a smart-device.
Clinical photography can aid in documenting form and function, in tracking conditions and wound healing, in planning surgical operations, and in clinical decision-making. Additionally, clinical photographs can provide physicians with a valuable tool for patient communication and education. Due to the convenience of this type of technology it is not appropriate to expect physicians to forego their use in providing their patients with the best care available.
The technology and software required for secure transfer, communication, and storage of clinical media is presently available, but many devices have non-secure storage/dissemination options enabled and lack user-control for permanently deleting digital files. In addition, data uploaded onto server systems commonly cross legal jurisdictions. Many physicians are not comfortable with the practice, citing security, privacy, and confidentiality concerns as well as uncertainty in regards to regional regulations governing this practice.1 Due to concern for patient privacy and confidentiality it is therefore incredibly important to limit the unsecure or undocumented acquisition or dissemination of clinical photographs.
To assess the current state of this topic, Heyns et al. have reviewed the accessibility and completeness of provincial and territorial medical regulatory college guidelines.2 Categories identified as vital and explored in this review included: Consent; Storage; Retention; Audit; Transmission; and Breach. While each regulatory body has addressed limited aspects of the overall issue, the authors found a general lack of available information and call for a unified document outlining pertinent instructions for conducting clinical photography using a smartphone and the electronic transmission of patient information.2
The discussion of this topic will need to be ongoing and it is important that physicians are aware of applicable regulations, both at the federal and provincial levels, and how these regulations may impact the use of personal devices. The best practices supported here aim to provide physicians and healthcare providers with an understanding of the scope and gravity of the current environment, as well as the information needed to ensure patient privacy and confidentiality is assessed and protected while physicians utilize accessible clinical photography to advance patient care. Importantly, this document only focusses on medical use (clinical, academic, and educational) of clinical photography and, while discussing many core concepts of patient privacy and confidentiality of information, should not be perceived as a complete or binding framework. Additionally, it is recommended that physicians understand the core competencies of clinical photography, which are not described here.
The Canadian Medical Association (CMA) suggests that the following recommendations be implemented, as thoroughly as possible, to best align with the CMA policy on the Principles for the Protection of Patient Privacy (CMA Policy PD2018-02). These key recommendations represent a non-exhaustive set of best practices - physicians should seek additional information as needed to gain a thorough understanding and to stay current in this rapidly changing field.
* Informed consent must be obtained, preferably prior, to photography with a mobile device. This applies for each and any such encounter and the purpose made clear (i.e. clinical, research, education, publication, etc.). Patients should also be made aware that they may request a copy of a picture or for a picture to be deleted.
* A patient's consent to use electronic transmission does not relieve a physician of their duty to protect the confidentiality of patient information. Also, a patient's consent cannot override other jurisdictionally mandated security requirements.
* All patient consents (including verbal) should be documented. The acquisition and recording of patient consent for medical photography/dissemination may be held to a high standard of accountability due to the patient privacy and confidentiality issues inherent in the use of this technology. Written and signed consent is encouraged.
* Consent should be considered as necessary for any and all photography involving a patient, whether or not that patient can be directly recognized, due to the possibility of linked information and the potential for breach of privacy. The definition of non-identifiable photos must be carefully considered. Current technologies such as face recognition and pattern matching (e.g. skin markers, physical structure, etc.), especially in combination with identifying information, have the potential to create a privacy breach.
* Unsecure text and email messaging requires explicit patient consent and should not be used unless the current gold standards of security are not accessible. For a patient-initiated unsecure transmission, consent should be clarified and not assumed.
* Transmission of photos and patient information should be encrypted as per current-day gold standards (presently, end-to-end encryption (E2EE)) and use only secure servers that are subject to Canadian laws. Explicit, informed consent is required otherwise due to privacy concerns or standards for servers in other jurisdictions. Generally, free internet-based communication services and public internet access are unsecure technologies and often operate on servers outside of Canadian jurisdiction.
* Efforts should be made to use the most secure transmission method possible. For data security purposes, identifying information should never be included in the image, any frame of a video, the file name, or linked messages.
* The sender should always ensure that each recipient is intended and appropriate and, if possible, receipt of transmission should be confirmed by the recipient.
* Storing images and data on a smart-device should be limited as much as possible for data protection purposes.
* Clinical photos, as well as messages or other patient-related information, should be completely segregated from the device's personal storage. This can be accomplished by using an app that creates a secure, password-protected folder on the device.
* All information stored (on internal memory or cloud) must be strongly encrypted and password protected. The security measures must be more substantial than the general password unlock feature on mobile devices.
* Efforts should be made to dissociate identifying information from images when images are exported from a secure server. Media should not be uploaded to platforms without an option for securely deleting information without consent from the patient, and only if there are no better options. Automatic back-up of photos to unsecure cloud servers should be deactivated. Further, other back-up or syncing options that could lead to unsecure server involvement should be ascertained and the risks mitigated.
4. Cloud storage should be on a Canadian and SOCII certified server. Explicit, informed consent is required otherwise due to privacy concerns for servers in other jurisdictions.
5. AUDIT & RETENTION
* It is important to create an audit trail for the purposes of transparency and medical best practice. Key information includes patient and health information, consent type and details, pertinent information regarding the photography (date, circumstance, photographer), and any other important facts such as access granted/deletion requests.
* Access to the stored information must be by the authorized physician or health care provider and for the intended purpose, as per the consent given. Records should be stored such that it is possible to print/transfer as necessary.
* Original photos should be retained and not overwritten.
* All photos and associated messages may be considered part of the patient's clinical records and should be maintained for at least 10 years or 10 years after the age of majority, whichever is longer. When possible, patient information (including photos and message histories between health professionals) should be retained and amalgamated with a patient's medical record. Provincial regulations regarding retention of clinical records may vary and other regulations may apply to other entities - e.g. 90 years from date of birth applies to records at the federal level.
* It may not be allowable to erase a picture if it is integral to a clinical decision or provincial, federal, or other applicable regulations require their retention.
* Any breach should be taken seriously and should be reviewed. All reasonable efforts must be made to prevent a breach before one occurs. A breach occurs when personal information, communication, or photos of patients are stolen, lost, or mistakenly disclosed. This includes loss or theft of one's mobile device, texting to the wrong number or emailing/messaging to the wrong person(s), or accidentally showing a clinical photo that exists in the phone's personal photo album.
* It should be noted that non-identifying information, when combined with other available information (e.g. a text message with identifiers or another image with identifiers), can lead to highly accurate re-identification.
* At present, apps downloaded to a smart-device for personal use may be capable of collecting and sharing information - the rapidly changing nature of this technology and the inherent privacy concerns requires regular attention. Use of specialized apps designed for health-information sharing that help safeguard patient information in this context is worth careful consideration.
* Having remote wipe (i.e. device reformatting) capabilities is an asset and can help contain a breach. However, inappropriate access may take place before reformatting occurs.
* If a smartphone is strongly encrypted and has no clinical photos stored locally then its loss may not be considered a breach.
* In the event of a breach any patient potentially involved must be notified as soon as possible. The CMPA, the organization/hospital, and the Provincial licensing College should also be contacted immediately. Provincial regulations regarding notification of breach may vary.
Approved by the CMA Board of Directors March 2018
i Heyns M†, Steve A‡, Dumestre DO‡, Fraulin FO‡, Yeung JK‡
† University of Calgary, Canada
‡ Section of Plastic Surgery, Department of Surgery, University of Calgary, Canada
1 Chan N, Charette J, Dumestre DO, Fraulin FO. Should 'smart phones' be used for patient photography? Plast Surg (Oakv). 2016;24(1):32-4.
2 Unpublished - Heyns M, Steve A, Dumestre DO, Fraulin FO, Yeung J. Canadian Guidelines on Smartphone Clinical Photography.
These Guidelines constitute an implementation tool of seven recommendations and are informed by Guidelines for CMA’s Activities and Relationships with Other Parties (aka CMA’s Corporate Relationships Policy) and CMA’s Advertising and Sponsorship Policy.
These Guidelines apply to the Canadian Medical Association (and not to its subsidiaries). As these are Guidelines, exceptions may be necessary from time to time wherein staff may use their discretion and judgment.
Endorsement is an umbrella term encompassing “policy endorsement”, “sponsorship1” and “branding”.
Policy endorsement includes:
(a) CMA considering upon request, non-pecuniary public approval, which may include the use of
CMA’s name and/or logo, of an organization’s written policy, on an issue that aligns with CMA policy, where there is no immediate expectation of return; or,
(b) CMA adopting the policy of another organization as our policy; or
(c) CMA asking another organization to publicly support our policy.
(a) Criteria: For policy endorsement requests from another organization to endorse their policy2 the following criteria shall be applied:
i) we have a policy on the subject-matter and
ii) we are actively working on advancing that policy position and
iii) the organization has a follow-up action plan associated with its request.
(b) Approval: Where policy exists, approval requires a policy staff member (with portfolio responsibility) and the VP of Medical Professionalism, or the policy staff member (with portfolio responsibility) and the Chief Policy Advisor. Where no policy exists, approval of the Board of Directors is required.
(c) Annual confirmation: Where CMA adopts the policy of another organization3, CMA staff shall confirm annually, or more frequently if circumstances dictate, that the policy has not been altered by the other organization.
(d) Requests: Pursuit of personal endorsement requests are not appropriate. Wherever possible, requests should come from an organization and not an individual.
(a) Where CMA adopts the policy of another organization, the adopted policy shall become CMA policy, and will include a notation on the document as being an adopted policy of [organization].
(b) All adopted policies will be housed in an accessible searchable database.
(c) All requests by organizations for CMA to endorse their policy will be tracked in a central location, along with any response.
1 Sponsorship means, to consider upon request, pecuniary public approval, which may include the use of CMA’s name and/or logo, of an organization’s event (eg., conference), on an issue that is supported by CMA policy or that promotes CMA brand awareness, where there is an immediate expectation of return.
2 That is, part (a) of the definition in Section 2.
3 That is, part (b) of the definition in Section 2.