Medical Clinics
By checking the people at the assembly point against a list of everyone signed in when the alarm went, which Visitor Assistant keeps on a roll-call page you can open or print. Patients and other visitors sign in on a tablet at the door; staff sign in and out on their own phones by scanning a poster. Anyone who never signed in is missing from it, so it starts your head count rather than replacing it.
The alarm went at twenty past three on a Thursday, with the afternoon clinic running forty minutes behind. You got people moving, and you think you got everyone. On the sidewalk there were three doctors, a nurse still wearing gloves, a patient in a paper gown under somebody's parka, a father holding a baby who had been due for her vaccinations, and a man from the waiting room asking whether he would lose his place. Then a firefighter asked whether everybody was out, and you could not say yes. The day sheet tells you who was booked, not who turned up, who came with them, or who had already gone home. The nurse from the morning shift might have left at noon, or might still have been charting in the back office. And the technician servicing the furnace had been in the basement since two, and the only person who knew that was the receptionist who let him in, who was now at the far end of the parking lot. This time it was toast in the staff room. Next time you want the answer before anybody has to ask.
It is a list of who was expected, which is a different thing. Even where the desk marks patients as arrived, the schedule does not show the parent or interpreter who came with them, or who slipped out forty minutes ago, and it has never heard of the courier or the furnace technician, or of which of your own staff are in. A roll call has to be built from the people who came through the door. With Visitor Assistant, each person coming in touches the tablet's screen, answers a few short questions one at a time and gets a badge number — no app, no account, no password — and from then on they are among the people your reception sees as in the building. Anyone who does not sign in is not on the list, so if you want parents and caregivers counted, ask them to sign in as well; a card beside the tablet can do the asking.
From their own phones. A poster goes up at the staff entrance; each person scans it, signing in on arrival and out on leaving, with nothing to install and no password. That matters at a clinic because the shift schedule is not the building. The nurse scheduled until noon may have stayed on to finish her charting, and the physician booked for the evening session may already be upstairs. The roll call's staff list shows who has actually signed in, not who was on the schedule. The Canadian Centre for Occupational Health and Safety (CCOHS), a federal body whose guidance is advice rather than law, says enough alternates must be named for each responsible position so that someone with authority is on site at all times. With split shifts, the staff list is where you see which of those alternates has signed in.
If he signed in at the tablet like any other visitor, yes, and he stays on it until he is signed out. Whoever he picks from the list of people on the tablet — the office manager, say — is told by email, text or Teams, and his name is on the reception screen and the roll call, so the fact that he is in the building no longer lives in one receptionist's head. What the tablet cannot do is catch a technician who goes straight downstairs by a side door, so how trades get into the building is worth settling with your building manager. If the work is construction rather than servicing, and your building falls under the Fire Code's planning section, the Code requires the fire safety plan to be revised before demolition or construction, "including hot surface applications", begins in or on the building.
Whatever your plan says, settled before the alarm rather than on the stairs. The roll call is a page: open it and it lists every visitor and member of staff signed in at that moment; print it and you have that moment on paper. Paper needs no battery and no signal, and it begins going out of date as soon as it leaves the printer. We would not ask anyone to stand at a printer while an alarm is sounding, so if paper is part of your answer, work out ahead of time how a current copy reaches whoever runs the count, and use a drill to see whether it does.
Possibly not, and it is worth finding out which. Section 2.8 of Division B, on emergency planning, applies to buildings containing certain occupancies, among them a care and treatment occupancy and a business and personal services occupancy where the occupant load exceeds 300, and to any building of 4 storeys or more, counting storeys below grade. Where it applies, a fire safety plan must be prepared, approved by the Chief Fire Official, and implemented, and the plan must provide for evacuating occupants, "including special provisions for persons requiring assistance", for appointing and organising supervisory staff, and for holding fire drills. Which side of the line your clinic is on turns on how its building is classified and how many people it was designed for, and your landlord or your fire department is the place to ask; a family practice on the second floor of a five-storey medical building is inside a building the section covers, whatever the size of the practice. If the Code does not reach your building, CCOHS notes that where occupational health and safety legislation does not specifically address emergency planning, the general duty clause would apply, requiring employers to take all reasonable precautions to prevent injuries or incidents in the workplace; and the reason to know who is inside has not changed. Other provinces have their own fire codes; this page describes Ontario's.
The Fire Code never uses the words "roll call". Where Section 2.8 applies, it requires a fire drill for supervisory staff — the occupants with some delegated responsibility for the fire safety of others under the plan — at least once in every 12-month period, and at least monthly in a care and treatment occupancy, with the drill procedures prepared in consultation with the Chief Fire Official and a record of every drill kept for at least 12 months. How your clinic confirms that everyone is out is for your plan and your fire department to settle. CCOHS is blunter: among the "musts" of an emergency plan it lists safe places for staff to gather for head counts, to make sure that everyone has left the danger zone, and among the duties someone must be given, confirming that evacuation is complete. A drill is where to find out, before it matters, whether the list in your hand matches the people on the sidewalk.
For most of the day it is, and that should change how you handle it. Ontario's Personal Health Information Protection Act treats as personal health information any identifying information that relates to providing health care to a person, including identifying who their health care provider is. On our reading of the Act, and it is ours rather than a regulator's, a list of the people inside a medical clinic is largely that. The staff half is likely different: the Act leaves out identifying information in a custodian's record that relates mainly to the custodian's own employees and other agents, where the record is kept mainly for a purpose other than their health care. The Act also requires a custodian to take reasonable steps to protect personal health information against "theft, loss and unauthorized use or disclosure". So a printed roll call is a document to keep track of: who prints it, who holds it outside, and that it goes into the shredder afterwards rather than staying on a bench by the parking lot. On the tablet, the screen a patient finishes on shows no name; while somebody is typing, whoever stands behind them can read what they type.
It does not sound the alarm, ring the fire department or send anybody an alert; it lists names. It does not know which room anyone is in, and it does not mark who will need help on the stairs: the patient on the exam table and the man with the walker belong to the special provisions your plan makes for people requiring assistance, and to the staff it assigns to them, not to a list. It can only be as complete as the signing in and out. A person who left without being signed out is still on it, which costs some checking; a person who never signed in is not, and that is the mistake that matters more. If people can reach your exam rooms without passing the tablet, they can be inside without being on the roll call.
An illustration: the clinic, its people and the drill are invented, and no real practice is described. Wexcombe Family Health has four family physicians, two nurses and three front-desk staff working split shifts, on the second floor of a five-storey medical building with a pharmacy at street level and a plant room in the basement. With five storeys, the building comes under the Fire Code's emergency planning section and has a fire safety plan, and the clinic's office manager and lead nurse are named in it as supervisory staff for their floor. The tablet stands on the reception counter and asks two things: a name, and who the person is here to see, from a list of the four physicians, the two nurses and the office manager, ending with "I'm not sure — I need help". Couriers and tradespeople choose the office manager. A card beside it asks parents and caregivers to sign in too. The staff poster hangs by the door from the parking lot, because that is the door staff use. In October the clinic joins the building's drill at twenty to eleven on a Tuesday morning. A drill can afford what an alarm cannot, so the receptionist prints the roll call before following everyone down, and at the assembly point across the street the office manager reads it against the faces: fourteen visitors, seven staff. Two names do not match. A patient listed as inside had gone home twenty minutes earlier without being signed out; the receptionist remembers her leaving, and that clears it in a minute. And the nurse starting the afternoon shift, who came in early by the front door, is on the sidewalk but not on the page, because she never passed the poster. That is the dangerous error of the two: had she still been inside, nothing on the list would have said so. Afterwards the clinic puts a second copy of the poster inside the front door, and the front desk signs each patient out on their way past. The drill record goes in the binder with the date, the time the floor was clear and what the count found, without any patient's name; the printed roll call goes into the shredder. One patient uses a wheelchair; what happens for her is set by the plan's provisions for persons requiring assistance and carried out by the nurse it names. The list does none of that. All it does is put her name on the page that is read at the assembly point.
PHIPA allows a health information custodian to disclose personal health information if it believes on reasonable grounds that doing so is necessary to eliminate or reduce a significant risk of serious bodily harm to a person or group of persons. That is the provision to have in mind when a firefighter asks whether a patient is still in an exam room. Whether a given moment meets its test is the custodian's judgement, which means yours rather than ours, and this is not legal advice. The roll call can tell you who is signed in; it cannot tell you, or a crew, where in the building anyone is.
Better than a list built from bookings, because walk-ins have no booking. A patient is on the roll call from the moment they sign in at the tablet. A walk-in patient may have no particular doctor in mind, so the list of people on the tablet can end with "I'm not sure — I need help", and whoever taps it is signed in like anybody else. That option needs your opening hours set, because it promises somebody is at the desk.
We would keep it out. Where the Fire Code's planning section applies, a record must be made of every fire drill and kept for at least 12 months, but that article does not say the record must name the people who were in the building. A note of the date, when the alarm sounded, when the floor was clear and what the count found ("two names did not match; both resolved") keeps the lesson without keeping a list of patients. If your fire department gives you a form to use, use theirs.
How long is your setting: keep what a visitor typed, clear it after a number of days you choose, or clear it as soon as the visit is over. Photo capture, ID checks and spoken questions stay off unless you turn them on. Where the product stores and processes what it holds, and through which providers, is set out on our privacy page; at a clinic, where most arrivals are patients, read it before the first one touches the screen.
Setting this up is our work, not a form you fill in. We go through your wording with you, and you can change any of it afterwards.
Digital Front Desk