PHIPA and health information privacy in Ontario

PHIPA establishes Ontario rules for personal health information while balancing individual privacy with the effective provision of health care.

• Set rules for collecting, using, and disclosing personal health information that protect confidentiality and individual privacy.

• Give individuals a right to access personal health information about themselves, subject to limited and specific exceptions.

• Give individuals a right to request correction or amendment of their personal health information, subject to limited and specific exceptions.

• Provide independent complaint review, resolution, and remedies through the statutory oversight framework.

PHIPA defines personal health information as identifying information about an individual in oral or recorded form when it falls within categories set out in the Act.

• Information about physical or mental health, including family health history.

• Information about the provision of health care, including identification of a health care provider, and a plan setting out funded home and community care services to be provided to an individual.

• Information about payment or eligibility for health care, and information concerning donation, testing, or examination of a body part or bodily substance.

• A health number, information identifying an individual’s substitute decision-maker, and the individual’s digital health identifier or identifying information related to its creation are personal health information.

PHIPA assigns different rights and duties according to who controls the information, who acts on that person’s behalf, and whose information is involved.

• Health information custodians can include health practitioners, hospitals, pharmacies, laboratories, long-term care homes, and ambulance services when they have custody or control of personal health information.

• An agent acts for or on behalf of a custodian, with the custodian’s authorization, for the custodian’s purposes. Communication of personal health information between them is a use by the custodian, not a disclosure by the sender or collection by the recipient.

• Individuals, or authorized substitute decision-makers where applicable, exercise consent, access, correction, and complaint rights.

• PHIPA generally governs personal health information in a custodian’s custody or control. FIPPA or MFIPPA provisions identified by PHIPA still apply in specified circumstances, and those statutes may govern other or reasonably severed records held by a public institution.