PHIPA

The Personal Health Information Protection Act, 2004 (PHIPA) is Ontario’s primary statute governing the collection, use, and disclosure of personal health information by health information custodians. It applies to hospitals, physicians’ offices, long-term care homes, community care providers, and most other entities that provide health care in Ontario. PHIPA sets out the consent framework for using and sharing personal health information, the patient’s right to access and correct their own records, the obligations of custodians to keep records secure and to track access through audit logs, and the notification obligations that arise when a privacy breach occurs.

PHIPA is enforced by the Information and Privacy Commissioner of Ontario, who has investigatory and order-making powers and, as a result of more recent amendments, the ability to impose administrative monetary penalties for certain breaches. PHIPA also creates a statutory cause of action for individuals affected by breaches in some circumstances, in addition to any common law remedy that may be available through the tort of intrusion upon seclusion recognized in Jones v Tsige, 2012 ONCA 32.

Posts tagged PHIPA analyze Ontario decisions involving health information privacy, including breach investigations, the application of circle-of-care principles, audit log obligations, and the interaction between PHIPA and civil litigation.