Ontario Personal Health Information Protection Act

Ontario Personal Health Information Protection Act
Name	Ontario Personal Health Information Protection Act
Enacted by	Legislative Assembly of Ontario
Introduced by	Ministry of Health and Long-Term Care
Status	in force

Ontario Personal Health Information Protection Act

The Ontario Personal Health Information Protection Act (PHIPA) is provincial legislation enacted to regulate the collection, use and disclosure of personal health information in Ontario, balancing privacy law protections with the needs of health care delivery. It was passed by the Legislative Assembly of Ontario following policy development by the Ministry of Health and Long-Term Care (Ontario), and operates alongside federal statutes such as the Personal Information Protection and Electronic Documents Act and provincial statutes like the Freedom of Information and Protection of Privacy Act (Ontario). The Act shapes practices across hospitals, clinics, long-term care homes and other institutions governed by Ontario health policy.

Background and Purpose

PHIPA was developed in the context of health policy reforms promoted by Ontario premiers and health ministers responding to concerns raised after high-profile inquiries into health system failures and privacy breaches. Influences include provincial reviews and reports from bodies such as the Health Council of Canada, the Canadian Institute for Health Information, and judicial decisions from the Ontario Court of Appeal and the Supreme Court of Canada that clarified rights under Canadian privacy jurisprudence. The Act aims to protect patients’ personal health information while facilitating information flow needed by providers like Toronto General Hospital, St. Michael's Hospital (Toronto), and community-based organizations such as Family Health Teams (Ontario).

Key Definitions and Scope

PHIPA defines key terms including "personal health information", "health information custodian", and "consent" with reference to health professions regulated by bodies such as the College of Physicians and Surgeons of Ontario, the Royal College of Physicians and Surgeons of Canada, the College of Nurses of Ontario, and institutions like Public Health Ontario. The Act applies to custodians ranging from academic hospitals like The Hospital for Sick Children to pharmacies represented by the Ontario Pharmacists Association and community providers affiliated with entities such as Community Care Access Centres and organizations overseen by the Ontario Ministry of Community and Social Services. PHIPA’s scope excludes certain records held by federal agencies such as Health Canada or by provinces under other statutory regimes like the Workers' Compensation Board of Ontario.

Privacy and Consent Provisions

PHIPA establishes standards for obtaining express or implied consent for collection, use and disclosure of personal health information, reflecting principles advanced by the Office of the Privacy Commissioner of Canada and recommendations from commissions such as the Commission on the Future of Health Care in Canada (Romanow Commission). Consent rules interact with professional obligations enforced by the College of Respiratory Therapists of Ontario and settings such as long-term care homes regulated under the Long-Term Care Homes Act, 2007 (Ontario). The Act permits certain disclosures without consent for purposes like public health reporting to Public Health Ontario or emergency interventions involving organizations such as Toronto Public Health.

Rights of Individuals and Access to Records

Individuals have statutory rights to access and request correction of their personal health information held by custodians, paralleling access regimes in instruments such as the Access to Information Act. Remedies for denied access involve review by the Information and Privacy Commissioner of Ontario, which adjudicates disputes similar to matters heard by administrative tribunals like the Tribunal de l’Ontario and informs policy across institutions including Ontario Shores Centre for Mental Health Sciences. The Act requires custodians to provide records in a timely manner and to inform individuals about disclosure practices involving parties such as Ontario Works or insurers like the Insurance Bureau of Canada.

Obligations of Health Information Custodians

Custodians must implement administrative, technical and physical safeguards for information security, aligning with standards promoted by organizations such as the Canadian Medical Association and the Canadian Institute for Health Information. Obligations include appointing privacy officers, conducting privacy impact assessments often used by entities like Ontario Health (agency), and training staff from multidisciplinary teams including practitioners from the College of Occupational Therapists of Ontario. Custodians must also establish policies for electronic health records interoperable with provincial initiatives such as ConnectingGTA and provincial electronic health record strategies.

Enforcement, Compliance and Penalties

Enforcement mechanisms include investigations and orders by the Information and Privacy Commissioner of Ontario, civil remedies, and possible referrals to regulatory colleges like the College of Physicians and Surgeons of Ontario for professional discipline. Non-compliance can trigger corrective orders, reports to bodies such as the Ontario Human Rights Commission in discrimination-related incidents, and civil litigation in courts including the Ontario Superior Court of Justice. The Act’s enforcement framework interacts with federal enforcement under statutes enforced by the Office of the Privacy Commissioner of Canada when cross-jurisdictional issues arise.

Impact and Criticism

PHIPA has influenced privacy practices across major institutions such as University Health Network and networked initiatives like provincial eHealth projects, drawing commentary from academics at institutions like the University of Toronto and the University of Ottawa. Advocates including privacy scholars and patient groups such as the Canadian Medical Protective Association and community legal aid clinics have critiqued aspects of the Act for perceived gaps in enforcement, potential barriers to data sharing for research used by organizations like the Canadian Institutes of Health Research, and challenges in harmonizing with federal regimes exemplified by debates involving CIHI and health data initiatives in provinces like British Columbia. Critics also point to tensions with electronic health record adoption championed by leaders at institutions such as Sunnybrook Health Sciences Centre.

Category:Ontario legislation Category:Health law in Canada