CareCard and PHIPA

CareCard serves two client groups: individuals who have and manage a Care Portfolio, and organizations that consume, or view, portfolios to which they have been given access.

• An individual client has a Care Portfolio: the user’s complete CareCard Profile containing information, credentials, validated documents, and other requirements for clinical placements, employment, and roles in health care and human services, including work involving close contact with or care for vulnerable populations.

• An organization client may be an educational institution, placement organization, employer, or other authorized organization that views a portfolio for an authorized program, placement, employment, or related purpose.

• A portfolio holder may also give another authorized individual access. Access through CareCard is directed by the portfolio holder and limited to the people and organizations authorized in the platform.

Each user has a secure and portable CareCard Profile containing their information and validated documents. Users remain in control of their profile and decide which institutions, placement organizations, employers, or individuals can access it.

• Users can upload documents as they receive them, see what is required for a placement, program, or employment, and work toward completion without waiting until every item is ready.

• CareCard can validate submitted documents and show what is complete, missing, expiring, or needs attention.

• The profile can be shared with multiple authorized educational institutions, placement organizations, employers, or individuals.

• Users can keep validated documents in one reusable portfolio and avoid repeatedly collecting and submitting the same documents for each placement or opportunity.

A Care Portfolio can contain both personal health information and other personal information. PHIPA applies to particular information and participants according to the Act’s definitions and actual custody, control, purpose, and information flow—not merely because the information is stored in CareCard.

• An organization that views a portfolio is not automatically a health information custodian. Depending on its functions and the information flow, it may be a custodian, a custodian’s agent, a non-custodian recipient subject to PHIPA’s recipient restrictions when a custodian discloses personal health information to it, or an organization governed by another privacy law.

• CareCard’s role for particular information depends on the service provided, the governing agreements, and how that information is actually collected, used, disclosed, stored, and controlled. CareCard is responsible for the commitments and safeguards that apply to that role.

• Managing or correcting a portfolio copy in CareCard does not necessarily amend the source record. Formal PHIPA access or correction rights for a source health record are exercised through the custodian that has custody or control of that record.

User control describes who the portfolio holder allows to access the CareCard Profile through the platform. It does not displace legal duties or lawful authority that may apply to information after an authorized recipient receives it.

• PHIPA does not create a general product certification that makes software ‘PHIPA certified,’ and CareCard does not make that claim here.

• A CareCard validation status confirms the result of the applicable CareCard workflow; it does not by itself establish PHIPA compliance. Compliance depends on the full legal, contractual, technical, and operational context.

• Authorized recipients must follow the platform’s access controls and the purposes, agreements, retention duties, and privacy law applicable to their own role. Sharing through CareCard does not transfer one participant’s legal responsibilities to another.

• This page is general information, does not change any agreement or legal responsibility, and is not legal advice. Verify the current Act, regulation, and IPC guidance for a specific deployment or record.