PHIPA compliance for Ontario health data
PHIPA governs personal health information in Ontario. Most companies that need to understand it are not hospitals. They are vendors who signed a contract with one.
Ontario's Personal Health Information Protection Act came into force in 2004 and governs how personal health information is collected, used and disclosed in the province. It displaces PIPEDA for health information held by the organizations it covers, which means a company handling Ontario health data is usually looking at PHIPA rather than the federal regime.
The question that matters commercially is rarely "what does a hospital have to do". It is "what does the hospital's software vendor have to do", because that vendor has just been sent a fifty page agreement and needs to know which obligations it has actually taken on.
Who is a health information custodian
PHIPA's obligations attach in the first instance to health information custodians. The definition is a list, not a principle, and it covers health care practitioners, hospitals, psychiatric facilities, long-term care homes, pharmacies, laboratories, ambulance services, community health centres, medical officers of health, and a number of others.
A software company is almost never a custodian. This matters, because being a custodian and being bound by PHIPA are not the same thing, and vendors routinely conclude they are out of scope on the strength of the first without checking the second.
Agents, service providers and network providers
If you handle personal health information for an Ontario custodian, you fall into one of three categories. Which one determines what you owe.
| Role | What it means | What you take on |
|---|---|---|
| Agent | You act for a custodian, on its authority, in respect of personal health information. | You may only handle the information as the custodian permits and for the purposes it authorizes. You cannot use it for your own purposes, including product improvement, without separate authority. |
| Electronic service provider | You supply services that let a custodian use electronic means to collect, use, disclose or store the information. | You must not use the information except as necessary to provide the service, and must not disclose it. |
| Health information network provider | You provide services to two or more custodians to enable them to share the information electronically. | The full set. Breach notification to every affected custodian, a threat risk assessment, a plain-language description of safeguards made available to the public, a written agreement, retained records of every access and transfer, and an audit report. |
The network provider trap
A vendor becomes a health information network provider by serving two or more custodians in a way that lets them share information with each other. That threshold is easy to cross without noticing, and the obligations that come with it are the heaviest in the Act. The obligation to make a plain language description of your services and safeguards publicly available is the one most often discovered late, because it requires publishing something rather than filing it.
Consent and the circle of care
PHIPA runs on implied consent within what practitioners call the circle of care. A custodian providing health care may generally assume consent to collect, use and disclose the information needed for that care, which is what allows a referral to work without a signature at each step.
Two limits matter for anyone building software against this. First, implied consent covers the provision of health care, not secondary purposes. Analytics, research, training a model, or improving a product are not inside the circle of care and need their own basis. Second, an individual may withhold or withdraw consent for specific information, which practitioners call a lock-box. A system that cannot express a partial restriction on a record cannot support that right, and that is a product design problem rather than a policy one.
Breach notification
A custodian must notify the affected individual at the first reasonable opportunity when personal health information is stolen, lost, used or disclosed without authority. The notice has to tell the person they may complain to the Information and Privacy Commissioner of Ontario.
Since 2017 there are two further duties. Custodians must report to the Commissioner directly in prescribed circumstances, which include theft, further use or disclosure without authority, a pattern of similar breaches, and cases where a practitioner's privileges are revoked or restricted for privacy reasons. Separately, every custodian must submit annual statistics on breaches to the Commissioner.
If you are an agent, you generally have no direct line to the Commissioner. Your duty runs to the custodian, at the first reasonable opportunity, and the custodian then discharges its own obligations. In practice this means your incident response has a contractual clock in it that is usually tighter than anything in the statute, so read the agreement rather than the Act for your actual deadline.
Penalties
PHIPA creates offences, and the 2016 amendments doubled the maximums. On conviction, fines reach $100,000 CAD for an individual and $500,000 CAD for an organization. Wilfully collecting, using or disclosing personal health information in contravention of the Act is an offence, as is disposing of records to evade an access request.
The practical exposure for most vendors is not the fine. It is that the Commissioner's orders are binding and public, and that a custodian facing an order will look hard at the contract that put it there.
What a vendor actually has to do
- Establish which of the three roles you occupy, in writing, before you sign. Agent and network provider carry different duties and the agreement will often assert one without analysis.
- Restrict use to what the custodian has authorized. If you want to use data for anything else, get it addressed explicitly rather than relying on a general clause.
- Log access at the record level and retain it. Custodians are asked to produce access logs during investigations, and cannot produce what you did not keep.
- Support the lock-box in the product, not in a runbook.
- Have an incident process that meets the contractual notification clock, which is usually measured in hours.
- If you serve two or more custodians in a way that lets them share, treat yourself as a network provider until advised otherwise, and get the threat risk assessment and the public description done.
- Keep personal health information segregated from other tenants and environments, and be able to demonstrate it rather than assert it.
How this relates to SOC 2 and ISO 27001
Ontario custodians increasingly ask vendors for a SOC 2 Type 2 report as part of procurement, because it gives them independent evidence of the safeguards they are accountable for. PHIPA does not require it and no attestation makes you PHIPA compliant, but the two fit together well: the access control, logging, encryption and vendor management work behind a SOC 2 engagement is most of what a custodian will ask you to evidence anyway.
If you are selling into hospitals and expect the question, do the audit scoping and the PHIPA role analysis at the same time. The system boundary you draw for SOC 2 and the environment you designate for personal health information should be the same boundary, and it is far cheaper to make them match at the start than to reconcile two different answers later.
Selling software to an Ontario custodian
Tell us what you handle and what the agreement says. We will tell you which role you are in and what it commits you to.
Get matchedCommon questions
Does PHIPA or PIPEDA apply to us?
For personal health information held by an Ontario custodian or its agents, PHIPA applies and PIPEDA is displaced. PIPEDA can still reach the same company for other personal information, for example customer billing data that is not health information, and for information crossing a provincial or national border. Most vendors end up in scope for both, for different data.
Is there a PHIPA certification?
No. PHIPA is legislation and nothing certifies against it. What custodians ask for instead is a SOC 2 Type 2 report, a completed privacy and security questionnaire, and for network providers, the threat risk assessment and public description the regulation requires.
Can we store Ontario health data outside Canada?
PHIPA does not impose a general residency requirement. The constraint almost always arrives through the custodian's own policy or the contract, and many Ontario custodians do require Canadian residency. Assume it will be asked and design for it rather than discovering it during procurement.
Can we use the data to improve our product?
Not on implied consent. Product improvement is a secondary purpose outside the circle of care, and as an agent you may only handle the information as the custodian permits. If you want de-identified data for development, negotiate it explicitly and define the de-identification standard in the agreement.
We only handle de-identified data. Are we out of scope?
Possibly, but the burden is on the de-identification being real. Information that can be re-identified, alone or in combination with other data you hold, is still personal health information. Get the method reviewed rather than assuming that removing names is sufficient.