PHIPA for clinics and health information custodians

PHIPA is built around the health information custodian: generally the health care practitioner, clinic, hospital or other organization that has custody or control of personal health information in connection with its work. Custodians carry the core legal duties.

Agents act for the custodian: employees, volunteers, students and contractors who handle personal health information on the custodian's behalf. Custodians remain responsible for what their agents do and must make sure agents follow the rules.

Electronic service providers, such as the IT company that manages a clinic's network or the vendor that hosts an electronic medical record, supply services that let a custodian use electronic information. They have their own restrictions under the Act and its regulations on how they may use and disclose the information they handle. If you are a clinic, your contracts with these providers should spell out confidentiality, security, breach notice and access limits.

Custodians must take reasonable steps to protect personal health information against theft, loss and unauthorized use or disclosure. Electronic records make one risk especially visible: staff looking at records they have no work reason to see.

The Information and Privacy Commissioner of Ontario (IPC) describes snooping as an employee looking at the information of a neighbour, a friend's child or a celebrity for a non-work purpose. Whether done out of curiosity or concern, it is unauthorized use, and the IPC states that regardless of motive this type of breach must be reported to it. Prevention depends on role-based access, clear policy, training, confidentiality agreements and, above all, audit logs that someone actually reviews.

Yes. Under section 12(2) of Ontario's Personal Health Information Protection Act (PHIPA), a health information custodian must notify the individual at the first reasonable opportunity if their personal health information is stolen, lost, or used or disclosed without authority. An agent acting for the custodian, such as an IT provider, must tell the custodian at the first reasonable opportunity.

PHIPA has two separate notification duties. First, a custodian must notify the affected individual at the first reasonable opportunity if personal health information is stolen, lost, or used or disclosed without authority. Second, under the Act and its regulation, the custodian must notify the IPC at the first reasonable opportunity in specified situations. The IPC summarizes these as seven categories:

1. 01

   Use or disclosure without authority

   Where the person knew or ought to have known it was not permitted, including snooping. Purely accidental misdirection is generally not in this category.

2. 02

   Stolen information

   Theft of paper records, a laptop or USB drive, or a ransomware or other malware attack. Information that was de-identified or encrypted is an exception.

3. 03

   Further use or disclosure

   You learn the information was or will be further used or disclosed without authority after an initial breach.

4. 04

   Pattern of similar breaches

   Even small accidental breaches, if they form a pattern.

5. 05

   Disciplinary action against a college member

   Where a breach leads to discipline, or a resignation you believe is related, for a member of a regulated health college.

6. 06

   Disciplinary action against a non-member

   The same circumstances for agents who are not college members.

7. 07

   Significant breach

   Considering sensitivity, volume, number of people affected and whether more than one custodian or agent was responsible.

By March 1 each year, custodians must give the IPC an annual report of the previous calendar year's privacy breach statistics. These statistics include breaches that did not meet the threshold for reporting individually to the IPC. In practice, that means every clinic needs a breach log maintained throughout the year, not reconstructed in February. Record the date, category (theft, loss, unauthorized use, unauthorized disclosure), cause and number of individuals for each event so the annual figures can be compiled accurately.

If you need help with the assessment itself, see privacy breach assessment and notification.

Audit logs are the backbone of PHIPA compliance in an electronic clinic. They let you detect snooping, investigate complaints, determine whether a stolen-credential incident actually exposed records, and respond to patients who ask who looked at their file. Check that your EMR and practice management systems log viewing as well as editing, that logs are kept long enough to be useful, that someone is assigned to review them, and that you can export them for an investigation. Where clinics use Ontario's shared electronic health record systems, additional rules under Part V.1 of PHIPA apply, including notifying the IPC of certain unauthorized collections through the EHR.

Our healthcare and dental IT pages describe how we run these controls day to day.

• Unique logins for every staff member and practitioner; no shared front-desk accounts.
• Multi-factor authentication on email, remote access and cloud EMR portals.
• Full-disk encryption on every laptop and workstation that stores or caches patient data, with encryption status reported centrally.
• Role-based access in the EMR, reviewed when staff change roles or leave.
• Scheduled audit-log reviews, plus targeted reviews for VIP or staff-family patients.
• Email safeguards: external-sender warnings, data-loss prevention for health numbers, and a procedure for misdirected messages.
• Backups kept offline or immutable, and tested restores, so ransomware does not become both an outage and a reportable theft.
• Written agreements with IT providers and software vendors covering confidentiality, security and breach notice.
• A breach log maintained all year to feed the March 1 statistics report.