PHIPA

What it is

PHIPA is Ontario's sector-specific privacy statute governing personal health information (PHI). Enforced by the Information and Privacy Commissioner of Ontario (IPC), it operates as substantially-similar legislation to PIPEDA for the Ontario health sector, PIPEDA does not apply to PHI handled by Ontario health information custodians (HICs).

Who it applies to

Health information custodians as defined in section 3, a broad category including:

• Health care practitioners (physicians, dentists, nurses, pharmacists, psychologists, and other regulated health professionals)
• Hospitals, long-term care homes, community care access centres
• Independent health facilities, laboratories, specimen collection centres
• Ambulance services
• Ministry of Health and Long-Term Care in specified capacities
• Local health integration networks

Agents of custodians (employees, contractors, service providers) are bound by the same duties on the custodian's behalf.

Key provisions

Key data protection requirements

Custodians must obtain express or implied consent depending on circumstance, limit collection/use/disclosure to what is reasonably necessary, provide individuals with access to their PHI, and implement safeguards appropriate to sensitivity. The circle-of-care doctrine allows PHI sharing among practitioners providing care to the same individual without explicit consent for each transfer.

Breach reporting

Since October 1, 2017, PHIPA has required custodians to:

• Notify affected individuals at the first reasonable opportunity of any theft, loss, or unauthorized use/disclosure of PHI
• Notify the IPC in prescribed circumstances (Ontario Regulation 224/17): where the incident was theft/deliberate act by an agent, involved further unauthorized use after initial breach, is part of a pattern of breaches, or the custodian would be required to notify the College or regulator
• Report annually to the IPC the total number of privacy breaches, regardless of whether they met the individual-notification threshold

Enforcement

Section 72 sets out the offences, most of which turn on a wilful act or a stated intent, such as wilfully collecting, using or disclosing personal health information in contravention of the Act, or obstructing the Commissioner. It applies to health information custodians and their agents. The IPC also has order-making powers to require compliance, cease certain practices, and require security improvements.

Recent amendments

• Oct 2017Mandatory individual notification and expanded IPC notification triggers (Ontario Regulation 224/17) came into force.
• Mar 2020Status under review
  Bill 188 (Economic and Fiscal Update Act, 2020), expanded IPC powers including administrative monetary penalties (AMP) framework.

How LeakTrace maps to it

An External Cybersecurity Assessment reads what a firm exposes from outside: email settings, the firm’s addresses in monitored breach databases, lookalike domains, exposed services and keys left in the firm's own website code. The Rules and Insurance Briefing that comes with it maps each finding to PHIPA, with the proof behind it, so the firm can see which obligation a finding touches. The assessment is human-verified before it is released.