Personal Health Information Protection Act, 2004

Personal Health Information Protection Act, 2004
Name	Personal Health Information Protection Act, 2004
Enacted by	Legislative Assembly of Ontario
Enacted	2004
Status	in force

Personal Health Information Protection Act, 2004 is a statute enacted by the Legislative Assembly of Ontario that establishes rules for the handling of personal health information by regulated entities in Ontario. It delineates obligations for custodians, sets out individual rights to access and correct records, and creates administrative mechanisms for oversight and enforcement involving provincial institutions and tribunals. The Act interacts with other statutory schemes and has been referenced in proceedings before bodies such as the Ontario Court of Appeal, the Supreme Court of Canada, and administrative agencies including the Information and Privacy Commissioner of Ontario.

Background and Legislative History

The Act emerged during policy debates in the early 2000s involving the Government of Ontario, the Ministry of Health and Long-Term Care (Ontario), and advocacy by stakeholders including the Registered Nurses' Association of Ontario, the Ontario Medical Association, and civil liberties groups such as the Canadian Civil Liberties Association. Its genesis was influenced by precedent legislation like the Personal Information Protection and Electronic Documents Act at the federal level and comparative frameworks in jurisdictions such as Quebec and British Columbia. Key legislative milestones include committee hearings before the Standing Committee on General Government (Ontario), royal assent in 2004, and later policy reviews by the Information and Privacy Commissioner of Ontario that prompted statutory and regulatory amendments. Court decisions from the Ontario Superior Court of Justice and appellate courts have shaped interpretation, often intersecting with jurisprudence on the Charter of Rights and Freedoms in cases involving privacy and access.

Scope and Key Definitions

The statute defines its territorial and subject-matter scope to apply to prescribed custodians and affiliates operating within Ontario, including hospitals like Toronto General Hospital, long-term care homes such as Sunnyside Home for the Aged, and regulated health professionals represented by bodies like the College of Physicians and Surgeons of Ontario and the College of Nurses of Ontario. Core definitions include "personal health information," "health information custodian," "consent," and "health care," terms that interface with regulatory instruments issued by the Minister of Health (Ontario) and statutory instruments such as the Regulated Health Professions Act, 1991. The Act distinguishes between clinical records used by institutions such as Health Sciences North and administrative data held by organizations like Cancer Care Ontario.

Consent, Collection, Use, and Disclosure of PHI

Under the Act, consent principles govern collection, use, and disclosure of personal health information by custodians, with explicit and implicit consent regimes that reflect standards advocated by bodies such as the World Health Organization and the Canadian Medical Association. Provisions address disclosures for purposes including treatment at facilities like Sunnybrook Health Sciences Centre, billing to entities such as Ontario Health Insurance Plan, research overseen by institutional review boards including those at McMaster University, and public health reporting to agencies like Public Health Ontario. Exceptions permitting disclosure without consent are enumerated and have been litigated in contexts involving law enforcement such as the Ontario Provincial Police and coroner investigations linked to the Office of the Chief Coroner (Ontario).

Rights of Individuals and Access to Records

The Act grants individuals rights of access and correction to records held by custodians, procedures frequently invoked at institutions such as The Hospital for Sick Children and clinics affiliated with University Health Network. Administrative processes allow requests to the Information and Privacy Commissioner of Ontario for complaints about access refusals, and related appeals have been considered by tribunals like the Health Professions Appeal and Review Board. Judicial review petitions raising access disputes have appeared before courts including the Divisional Court (Ontario), often surfacing in cases involving privacy interests recognized by the Supreme Court of Canada.

Duties of Health Information Custodians and Safeguards

Custodians are subject to statutory duties to protect confidentiality and implement safeguards—technical, administrative, and physical—echoing standards promoted by organizations such as the Canadian Institute for Health Information and guidelines from the Institute for Clinical Evaluative Sciences. Obligations include retention policies for records kept by institutions like St. Michael's Hospital, secure electronic health record practices used by networks such as Ontario Health, and data-sharing agreements with bodies like eHealth Ontario. The Act requires privacy impact assessments and policies aligned with pan-Canadian interoperability initiatives involving agencies such as the Canadian Institute for Advanced Research.

Enforcement, Complaints, and Penalties

Enforcement mechanisms permit complaints to the Information and Privacy Commissioner of Ontario, orders for access, and directions to custodians; compliance can be compelled through order-making powers and, in some cases, prosecution under the provincial statute. High-profile complaints have involved major health institutions, and adjudications before bodies such as the Ontario Civilian Police Commission and judicial review in courts including the Court of Appeal for Ontario have clarified remedies. Unlike some federal statutes, criminal sanctions are limited; administrative penalties, compliance orders, and reputational consequences via media outlets such as The Globe and Mail have been significant drivers of enforcement.

Impact, Criticisms, and Amendments

The Act has influenced health information governance across Canada and has been critiqued by parties including privacy advocates and professional associations for issues such as consent complexity, administrative burden for institutions like Champlain Local Health Integration Network, and interoperability barriers highlighted by stakeholders like Canada Health Infoway. Subsequent amendments and regulatory changes have sought to address concerns raised by the Information and Privacy Commissioner of Ontario, courts, and professional regulators including the Ontario Hospital Association. Ongoing debates involve balancing privacy with innovation involving universities such as University of Toronto and research institutes like the Ontario Institute for Cancer Research.

Category:Ontario statutes