​

When you visit a doctor, clinic, pharmacy, laboratory or any other health facility, you share some of the most personal information about your life. You have a right to expect that information to be kept private. The Health Regulation Authority (HRA) licenses and regulates health care facilities in the Turks and Caicos Islands, and protecting patient confidentiality is part of the standard every licensed facility must meet.

 

What confidentiality means

 

Confidentiality means that the information you share with a health facility, and the information it records about you, is used only to care for you and is not shared without a proper reason. This includes:

​

• Your medical history, diagnoses, test results and treatment

• Your prescriptions and medicines

• Your personal details, such as your name, address, date of birth and contact information

• Your insurance and billing details

• The fact that you visited the facility at all

​

Your information should be seen only by the people directly involved in your care, or by others when you have agreed or when the law requires it. Confidentiality applies to paper files, electronic records, phone calls, messages and conversations in the waiting room alike.

 

What the HRA expects of licensed facilities

​

Every health care facility licensed by the HRA is expected to protect patient information. In practice, that means a facility should:

​

1. Limit access. Only staff who need your information to care for you, or to run the service (for example, billing), should see it.

2. Get your consent. Ask your permission before sharing your information with anyone outside your care team, unless the law requires or permits it.

3. Keep records secure. Store paper files in locked areas and protect electronic records with passwords and access controls.

4. Train staff. Make sure every staff member, including reception and support staff, understands their duty of confidentiality.

5. Protect your privacy on site. Hold consultations where others cannot overhear, and avoid calling out sensitive details in waiting areas.

6. Give you access. Allow you to request a copy of your records, in line with the facility's procedures.

7. Keep records accurate. Correct information that is wrong when you point it out.

8. Dispose of records safely. Shred or securely destroy records that are no longer needed.

9. Act on breaches. Investigate any loss or improper sharing of patient information, take steps to prevent it happening again, and tell affected patients where appropriate.

10. Have a clear complaints process. Tell patients how to raise a privacy concern and respond promptly.

 

The HRA checks these practices during facility inspections and licensing, and can take action when a facility falls short.

Frequently asked questions

​

1. Who can see my health information?

The health professionals directly involved in your care, and staff who need it to run the service, such as for billing or appointments. Anyone else should see it only with your consent or where the law requires it.

​

2. Can a facility share my information with my family or employer?

Not without your permission. If you would like a family member to be kept informed, tell the facility who that person is. Your employer has no right to your medical details unless you agree.

​

3. Are there times my information can be shared without my consent?

Yes, in limited cases. These include when the law requires it, to protect public health, or in an emergency where your life or someone else's is at serious risk. A facility should share only what is necessary.

​

4. Can I get a copy of my medical records?

Yes. Ask the facility for its records request process. It may ask you to complete a form, show identification and pay a reasonable copying fee.

 

5. What if my records contain a mistake?

Tell the facility in writing and ask for it to be corrected. If the facility disagrees, ask that your comments be added to your record.

 

6. Does confidentiality apply to my insurance information?

Yes. Your insurance details, and the reasons you sought care, are part of your confidential information and must be protected.

 

7. What should I do if I think my privacy has been breached?

Raise it with the facility first. If it is not resolved, or if the breach is serious, contact the HRA. See "How to raise a concern" below.

 

8. Will making a complaint affect my care?

No. You have the right to raise a concern without it affecting the quality of care you receive. Facilities must not treat you differently for speaking up.

​

How to raise a concern

​

1. Speak to the facility. Raise the issue with the staff member involved or the facility manager. Many concerns are resolved quickly this way.

2. Put it in writing. If the issue is not resolved, send a written complaint to the facility. Include the date, the names of anyone involved, what happened and what outcome you are seeking. Keep a copy.

3. Contact the HRA. If you are not satisfied with the facility's response, or the breach is serious, contact the Health Regulation Authority. We will review your concern and, where appropriate, investigate.

​

Health Regulation Authority Tel: 1-649-338-4924 Email: info@hra.gov.tc Website: www. hra.tc Office: 2nd Floor, Town Centre Mall, 23 Parade Ave., Providenciales, Turks and Caicos Islands, Office hours: 8:30am to 4:30pm

​

Complaint forms are available at www.hra.tc/forms-documents. Your complaint will be handled confidentially.