9.6 Protective Words

Last updated on August 13, 2020

General Policy Description

A patient has the option of attaching a protective word to his or her PharmaNet patient record. The protective word limits access to the patient’s record to only those pharmacists and authorized health practitioners to whom the patient provides the protective word. 

Policy Details

 

Protective word requirements

The Pharmaceutical Services Act and its Information Management Regulation establish that at the request of an adult patient, a pharmacist must establish, delete or change the patient's PharmaNet protective word. Other requests (from minors or requests for protective words on another patient’s record) must be submitted in writing to Health Insurance BC.

Protective words are not required but all patients must be informed of the protective word option.

Patients must be informed of, and understand, the importance of keeping PharmaNet protective words confidential.

Patients must be made aware that they cannot apply a protective word to only selected parts of their record (e.g., they cannot prevent users from viewing only specific prescriptions in their medication history). The patient’s entire record is either restricted by the protective word or not.

Patients must also be informed that the protective word may be overridden by authorized health care practitioners in an emergency situation where they are unable to provide it. See Emergency Access if Protective Word Not Known.

Hospital Access to PharmaNet, Emergency Department Access to PharmaNet, and Medical Practice Access to PharmaNet require compliance with the applicable PharmaNet Professional and Software Conformance Standards with regard to patient protective words. Refer to the Conformance Standards for PharmaNet website for further details

 

Access to protected PharmaNet records

After the protective word is set, it must be provided when

  • Accessing a patient’s medication history
  • Performing a Drug Use Evaluation (DUE)
  • Dispensing a prescription
  • Viewing any information about a patient’s prescriptions (e.g., number of refills remaining, allergies recorded, prescription costs, etc.)
  • Submitting a request on a patient’s behalf to have their PharmaNet Medication History mailed to them (pharmacists only)
  • Changing a protective word (pharmacists only)

A patient’s physician must provide the protective word when calling the pharmacist for information contained on a patient medication history.

The pharmacist may use the patient record on the pharmacy’s local system, when necessary, without a protective word.

 

Emergency access if protective word not known

Only an authorized regulatory body, such as the College of Pharmacists of BC, is able to enter a patient file without the protective word (for regulatory monitoring purposes only).

In an emergency, however, if a patient is unconscious or unable to provide their protective word, authorized health care practitioners can contact the PharmaNet Help Desk at Health Insurance BC to have it removed if they determine access to the patient’s PharmaNet patient profile is necessary for safe and effective treatment.

Within a reasonable period of time after the protective word has been removed, the patient will be notified that it has been removed and that they must request a new word be applied, if they so choose.

 

Who may request a protective word at a community pharmacy

Any person who is 19 or older can apply in person at a community pharmacy to update their PharmaNet record by adding, removing or changing a protective word.

>> See Procedures for Pharmacies below for details.

All other persons must apply in writing to Health Insurance BC. This includes the following:

  • Minors (under 19) who wish to update their own PharmaNet record
  • Persons (such as the guardian of a minor, or a person who is legally authorized to make decisions on another adult’s behalf) who wish to apply, remove or change a protective word on another person’s PharmaNet record

>> Refer these patients to the Protective word for a PharmaNet Record page on the PharmaCare website. It contains the necessary guidelines and application forms.

 

Acceptable proofs of identity when managing patient protective words 

The following identification requirements apply when managing patient protective words (i.e., when applying, removing or changing a protective word on the patient’s own PharmaNet record).

Acceptable pieces of identification are set forth in the British Columbia Office of the Chief Information Officer’s Evidence of Identity Standard: Section 3 (PDF, 1420 KB). The tables below summarize the acceptable pieces of identification.

All proofs of identification must be originals, not photocopies.

Acceptable Proof of Identity

Document Type Requirements/Restrictions
Option 1

BC Services Card with the patient's photo

Must be valid (not expired)

Must display a recent (within 5 years) photo

Option 2

BC Services Card without photo

Must be valid (not expired)

OR

BC CareCard

 
AND one of the following pieces of government-issued photo ID

Canadian or U.S. driver's licence, learner's licence or enhanced driver's licence

Must be valid (not expired)

Must display a recent (within 5 years) photo

BC Identification (BCID) card or enhanced identification card 

Must be valid (not expired)

Must display a recent (within 5 years) photo

Passport (Canadian or foreign)

Must be valid (not expired)

Foreign government passport

Must be valid (not expired)

U.S. passport card

Must be valid (not expired)

Canadian citizenship card

Must be valid (not expired)

Must display a recent (within 5 years) photo

Canadian permanent resident card

Must be valid (not expired)

Must display a recent (within 5 years) photo

Canadian Forces identification

Must be valid (not expired)

Must display a recent (within 5 years) photo

Royal Canadian Mounted Police identification

Must be valid (not expired)

Must display a recent (within 5 years) photo

Secure Certificate of Indian Status

Must be new secure version issued after 2009. Certificate of Indian Status cards issued prior to 2009 are not accepted

Must display a recent (within 5 years) photo

Any other credential or evidence approved by the Chief Information Officer for the Province of British Columbia

Where an individual is ineligible for one of the required credentials, additional credentials or evidence may be accepted where approved by the Chief Information for the Province of British Columbia as providing equivalent assurance.

 

When names do not match

When the name on the patient’s photo ID does not match the name in the PharmaNet record or on one or more other pieces of identification, the patient must provide additional documentation to establish a link between the two names.

Acceptable Proof of Identity: Change of Name

Document Type Requirements/Restrictions

Change of name certificate

Must be issued by Canadian province or territory’s registrar of vital statistics

Marriage certificate, certified statement of marriage, or record of marriage form

Must be issued by Canadian Province or Territory’s Registrar of Vital Statistics; or Clergy member, judge or justice of the peace that performed the marriage

Must be signed by the person who performed the marriage

Must contain the name of both spouses, the date of the marriage and licence number

Any other credential or evidence approved by the Chief Information Officer for the Province of British Columbia

Where an individual is ineligible for one of the required credentials, additional credentials or evidence may be accepted where approved by the Chief Information for the Province of British Columbia as providing equivalent assurance.

 

Protective word removal

If an adult at a pharmacy has forgotten their protective word, a pharmacist can ask the PharmaNet Help Desk to remove it.

If the patient’s protective word is removed, Health Insurance BC will notify the patient in writing.

The protective word can be changed only once in 24 hours but—should a patient lose or forget the protective word—the PharmaNet Help Desk may remove it.

 

Creating a protective word

A patient must choose their own protective word which is then entered on PharmaNet by the pharmacist. A pharmacist cannot choose a protective word for a patient.

The pharmacy must have policies and procedures in place to protect patient privacy when providing protective words (e.g., if the protective word cannot be spoken in a confidential manner, the pharmacy may provide pen and paper, disposing of the paper appropriately after use).

The patient’s protective word must contain the following:

  • Six to eight characters (no spaces allowed)
  • Letters and numbers only (no special characters such as #,\ and &)
  • At least two letters (A…Z)
  • At least two numbers (0…9)

Examples: PA6729BC, 90PAMA17, FOTO2609

Tips: Patients should create a word that is easy for them to remember but hard for someone else to guess. They should NOT use their mother’s maiden name, their birth date or their phone number. There is an increased likelihood of the information being discovered by an outside source and used to access PharmaNet information.

Patients should be encouraged to write down their protective word and store it in a safe place.

 

Storing and sharing patient protective words

Protective words can be stored in the local system only with prior, explicit, consent from the patient. The individual should be advised that all pharmacy staff will be able to view and use the protective word and will not need to ask the individual for it before accessing their PharmaNet record.

Protective words can be stored only in encrypted form in the local system’s software. Consult your software documentation for directions.

Protective words must not be stored on paper. If a patient writes out the protective word for you to enter into the system, you must either (a) return the paper to the patient for destruction or (b) immediately destroy it in a secure fashion.

Protective words must not be shared with any other person or facility. They must not be made available to any other user across a shared network (e.g., pharmacy chain).

You must remove a stored protective word from the local system immediately if the patient requests it.

 

Procedures for Pharmacies

 

Adding a protective word to a patient's own PharmaNet record

The patient must be 19 or older and must provide adequate proofs of their identity before you can process their request.

  1. Review the patient’s proofs of identity and confirm their age. If you have any concerns about these proofs, refer the patient to Health Insurance BC.
  2. Provide a private location in which the patient can provide you with a protective word that meets the rules above or have them write out the protective word so that it cannot be overheard.
  3. Attach the protective word to the patient’s PharmaNet record using the Patient Keyword Maintenance (TCP) transaction.
  4. If applicable, destroy the paper bearing the protective word.
  5. Inform the patient that the change takes effect immediately.
 

Removing a protective word from a patient's own PharmaNet record

The patient must be 19 or older and must provide adequate proofs of their identity before you can process their request.

  1. Review the patient’s proofs of identity and confirm their age. If you have any concerns about these proofs, refer the patient to Health Insurance BC.
  2. Telephone the PharmaNet Help Desk at HIBC to remove the protective word.
  3. Inform the patient that the change takes effect immediately.
 

Changing a protective word on a patient's own PharmaNet record

A patient can apply to change a protective word only once in a 24-hour period.

The patient must be 19 or older and must provide adequate proofs of their identity before you can process their request.

The patient must provide you with their current protective word for you to process the change using the Patient Keyword Maintenance (TCP) transaction.

If they cannot remember the word, telephone the PharmaNet Help Desk at HIBC to have them remove the current protective word. Once it is removed, you can use the Patient Keyword Maintenance (TCP) transaction to add a new protective word.

When the patient can provide their current protective word

  1. Review the patient’s proofs of identity and confirm their age. If you have any concerns about these proofs, refer the patient to Health Insurance BC.
  2. Provide a private location in which the patient can provide you with a protective word that meets the rules above or have them write out the protective word so that it cannot be overheard.
  3. Attach the protective word to the patient’s PharmaNet record using the Patient Keyword Maintenance (TCP) transaction.
  4. If applicable, destroy the paper bearing the protective word.
  5. Inform the patient that the change takes effect immediately.

When the patient cannot provide their current protective word

  1. Review the patient’s proofs of identity and confirm their age. If you have any concerns about these proofs, refer the patient to Health Insurance BC.
  2. Telephone the PharmaNet Help Desk at HIBC to remove the patient’s current protective word. Cite the type of identification provided.

    The change will take effect immediately.
     
  3. Provide a private location in which the patient can provide you with a new protective word that meets the rules above or have them write out the protective word so that it cannot be overheard.
  4. Attach the protective word to the patient’s PharmaNet record using the Patient Keyword Maintenance (TCP) transaction.
  5. If applicable, destroy the paper bearing the protective word.
  6. Inform the patient that the new protective word takes effect immediately.

 

Tools and Resources