The Personal Health Information Protection Act, 2004 (PHIPA) is Ontario’s primary statute governing the collection, use, and disclosure of personal health information by health information custodians. It applies to hospitals, physicians’ offices, long-term care homes, community care providers, and most other entities that provide health care in Ontario. PHIPA sets out the consent framework for using and sharing personal health information, the patient’s right to access and correct their own records, the obligations of custodians to keep records secure and to track access through audit logs, and the notification obligations that arise when a privacy breach occurs.
PHIPA is enforced by the Information and Privacy Commissioner of Ontario, who has investigatory and order-making powers and, as a result of more recent amendments, the ability to impose administrative monetary penalties for certain breaches. PHIPA also creates a statutory cause of action for individuals affected by breaches in some circumstances, in addition to any common law remedy that may be available through the tort of intrusion upon seclusion recognized in Jones v Tsige, 2012 ONCA 32.
Posts tagged PHIPA analyze Ontario decisions involving health information privacy, including breach investigations, the application of circle-of-care principles, audit log obligations, and the interaction between PHIPA and civil litigation.
A new review in Laws argues that medical schools are not teaching enough law, and that the gap is making patients less safe. The article is European and persuasive only in Ontario, where CanMEDS, the CPSO and the CMPA already supply most of the framework it recommends. The place the diagnosis actually lands is artificial intelligence.
A patient treated at Sunnybrook over three years, a claim issued on the last day of the Trustee Act limitation period, and eighty Doe defendants. Justice Merritt refused to treat the case as misnomer, holding that the litigation finger pointed at everyone and therefore at no one. The three physicians were added anyway, with the limitation defence preserved for trial.
An Ontario hospital patient relations meeting is a complaint resolution process, not an investigation. Here is what the hospital is legally required to tell you after a serious event, what it can keep to itself, and how to prepare so the meeting is worth your time. Most importantly: the hospital’s process does not pause the limitation clock.
A cosmetic surgery clinic recorded patients in consultation rooms and the operating room without telling them. In J.C. v Jugenburg, 2026 ONSC 3061, the court awarded $21.5 million in aggregate damages and $1 million in punitive damages, and clarified how intrusion upon seclusion applies inside the doctor-patient relationship.
Communication failures cause some of the most preventable harm in Canadian healthcare. The legal framework, the practical reality, and the federal response.
An Ontario tribunal ruled physicians have no Charter privacy interest in their patients’ records. Subsequent proceedings produced a 12-month suspension.
A diagnostic radiologist conducted hundreds of unauthorized searches of patient records over six years. The OPSDT imposed a four-month suspension, reprimand, and costs.
A defendant physician accessed his former patient’s hospital records during litigation. The Divisional Court remitted the CPSO disposition for reconsideration.
A practical guide to obtaining your medical records in Ontario under PHIPA, including what to ask for, how to find every custodian, and what to expect.
Free, confidential consultations. Paul reviews every potential case personally and tells you honestly whether it merits investigation.