9.6 Protective Words

The Pharmaceutical Services Act and its Information Management Regulation establish that at the request of an adult patient, a pharmacist must establish, delete or change the patient's PharmaNet protective word. Other requests (from minors or requests for protective words on another patient’s record) must be submitted in writing to Health Insurance BC.

Protective words are not required but all patients must be informed of the protective word option.

Patients must be informed of, and understand, the importance of keeping PharmaNet protective words confidential.

Patients must be made aware that they cannot apply a protective word to only selected parts of their record (e.g., they cannot prevent users from viewing only specific prescriptions in their medication history). The patient’s entire record is either restricted by the protective word or not.

Patients must also be informed that the protective word may be overridden by authorized health care practitioners in an emergency situation where they are unable to provide it. See Emergency Access if Protective Word Not Known.

Hospital Access to PharmaNet, Emergency Department Access to PharmaNet, and Medical Practice Access to PharmaNet require compliance with the applicable PharmaNet Professional and Software Conformance Standards with regard to patient protective words. Refer to the Conformance Standards for PharmaNet website for further details

After the protective word is set, it must be provided when

• Accessing a patient’s medication history
• Performing a Drug Use Evaluation (DUE)
• Dispensing a prescription
• Viewing any information about a patient’s prescriptions (e.g., number of refills remaining, allergies recorded, prescription costs, etc.)
• Submitting a request on a patient’s behalf to have their PharmaNet Medication History mailed to them (pharmacists only)
• Changing a protective word (pharmacists only)

A patient’s physician must provide the protective word when calling the pharmacist for information contained on a patient medication history.

The pharmacist may use the patient record on the pharmacy’s local system, when necessary, without a protective word.

Only an authorized regulatory body, such as the College of Pharmacists of BC, is able to enter a patient file without the protective word (for regulatory monitoring purposes only).

In an emergency, however, if a patient is unconscious or unable to provide their protective word, authorized health care practitioners can contact the PharmaCare Help Desk at Health Insurance BC to have it removed if they determine access to the patient’s PharmaNet patient profile is necessary for safe and effective treatment.

Within a reasonable period of time after the protective word has been removed, the patient will be notified that it has been removed and that they must request a new word be applied, if they so choose.

Any person who is 19 or older can apply in person at a community pharmacy to update their PharmaNet record by adding, removing or changing a protective word.

>> See Procedures for Pharmacies below for details.

All other persons must apply in writing to Health Insurance BC. This includes the following:

• Minors (under 19) who wish to update their own PharmaNet record
• Persons (such as the guardian of a minor, or a person who is legally authorized to make decisions on another adult’s behalf) who wish to apply, remove or change a protective word on another person’s PharmaNet record

>> Refer these patients to the Protective word for a PharmaNet Record page on the PharmaCare website. It contains the necessary guidelines and application forms.

The following identification requirements apply when managing patient protective words (i.e., when applying, removing or changing a protective word on the patient’s own PharmaNet record).

Acceptable pieces of identification are set forth in the British Columbia Office of the Chief Information Officer’s Evidence of Identity Standard: Section 3 (PDF, 1420 KB). The tables below summarize the acceptable pieces of identification.

All proofs of identification must be originals, not photocopies.

When the name on the patient’s photo ID does not match the name in the PharmaNet record or on one or more other pieces of identification, the patient must provide additional documentation to establish a link between the two names.

If an adult at a pharmacy has forgotten their protective word, a pharmacist can ask the PharmaCare Help Desk to remove it.

If the patient’s protective word is removed, Health Insurance BC will notify the patient in writing.

The protective word can be changed only once in 24 hours but—should a patient lose or forget the protective word—the PharmaCare Help Desk may remove it.

A patient must choose their own protective word which is then entered on PharmaNet by the pharmacist. A pharmacist cannot choose a protective word for a patient.

The pharmacy must have policies and procedures in place to protect patient privacy when providing protective words (e.g., if the protective word cannot be spoken in a confidential manner, the pharmacy may provide pen and paper, disposing of the paper appropriately after use).

The patient’s protective word must contain the following:

• Six to eight characters (no spaces allowed)
• Letters and numbers only (no special characters such as #,\ and &)
• At least two letters (A…Z)
• At least two numbers (0…9)

Examples: PA6729BC, 90PAMA17, FOTO2609

Tips: Patients should create a word that is easy for them to remember but hard for someone else to guess. They should NOT use their mother’s maiden name, their birth date or their phone number. There is an increased likelihood of the information being discovered by an outside source and used to access PharmaNet information.

Patients should be encouraged to write down their protective word and store it in a safe place.

Protective words can be stored in the local system only with prior, explicit, consent from the patient. The individual should be advised that all pharmacy staff will be able to view and use the protective word and will not need to ask the individual for it before accessing their PharmaNet record.

Protective words can be stored only in encrypted form in the local system’s software. Consult your software documentation for directions.

Protective words must not be stored on paper. If a patient writes out the protective word for you to enter into the system, you must either (a) return the paper to the patient for destruction or (b) immediately destroy it in a secure fashion.

Protective words must not be shared with any other person or facility. They must not be made available to any other user across a shared network (e.g., pharmacy chain).

You must remove a stored protective word from the local system immediately if the patient requests it.

The patient must be 19 or older and must provide adequate proofs of their identity before you can process their request.

1. Review the patient’s proofs of identity and confirm their age. If you have any concerns about these proofs, refer the patient to Health Insurance BC.
2. Provide a private location in which the patient can provide you with a protective word that meets the rules above or have them write out the protective word so that it cannot be overheard.
3. Attach the protective word to the patient’s PharmaNet record using the Patient Keyword Maintenance (TCP) transaction.
4. If applicable, destroy the paper bearing the protective word.
5. Inform the patient that the change takes effect immediately.

The patient must be 19 or older and must provide adequate proofs of their identity before you can process their request.

1. Review the patient’s proofs of identity and confirm their age. If you have any concerns about these proofs, refer the patient to HIBC.
2. Telephone the PharmaCare Help Desk to remove the protective word.
3. Inform the patient that the change takes effect immediately.

A patient can apply to change a protective word only once in a 24-hour period.

The patient must be 19 or older and must provide adequate proofs of their identity before you can process their request.

The patient must provide you with their current protective word for you to process the change using the Patient Keyword Maintenance (TCP) transaction.

If they cannot remember the word, telephone the PharmaCare Help Desk at HIBC to have them remove the current protective word. Once it is removed, you can use the Patient Keyword Maintenance (TCP) transaction to add a new protective word.

When the patient can provide their current protective word

1. Review the patient’s proofs of identity and confirm their age. If you have any concerns about these proofs, refer the patient to HIBC.
2. Provide a private location in which the patient can provide you with a protective word that meets the rules above or have them write out the protective word so that it cannot be overheard.
3. Attach the protective word to the patient’s PharmaNet record using the Patient Keyword Maintenance (TCP) transaction.
4. If applicable, destroy the paper bearing the protective word.
5. Inform the patient that the change takes effect immediately.

When the patient cannot provide their current protective word

1. Review the patient’s proofs of identity and confirm their age. If you have any concerns about these proofs, refer the patient to HIBC.
2. Telephone the PharmaCare Help Desk to remove the patient’s current protective word. Cite the type of identification provided.
   
   The change will take effect immediately.
3. Provide a private location in which the patient can provide you with a new protective word that meets the rules above or have them write out the protective word so that it cannot be overheard.
4. Attach the protective word to the patient’s PharmaNet record using the Patient Keyword Maintenance (TCP) transaction.
5. If applicable, destroy the paper bearing the protective word.
6. Inform the patient that the new protective word takes effect immediately.