Ontario. Health data. Act
PHIPAPersonal Health Information Protection Act, 2004 (SO 2004, c. 3, Sch. A)
Partly verified
Medium confidence.Penalty and AMP details from general knowledge; IPC page fetched did not state them.
§1Summary
- Synopsis
Governs collection, use and disclosure of personal health information by health information custodians and their agents in Ontario, and sets rules for electronic service providers and health information network providers.
- Key themes
- Unique features
Declared substantially similar to PIPEDA for health information; IPC can impose administrative monetary penalties and offence fines are among the highest in Canada; specific duties for health information network providers.
- SaaS relevance
Health SaaS vendors acting as agents, electronic service providers or information managers for custodians in this province must meet the Act's security, contract and breach obligations.
§2Obligations
- Extraterritorial
- No
- Breach notification
- Individuals at first reasonable opportunity; IPC for prescribed categories; annual breach statistics to IPC
- DPO
- Yes
- Maximum penalty
- Offences up to CAD 200,000 (individuals) / CAD 1m (organisations); AMPs available
§3Dates
- Key dates
- Adopted
- In force
§4Text and authority
- Text
- Authoritative text ontario.ca
- Authority
- Information and Privacy Commissioner of Ontario (IPC)
§5Where it applies
- Domestic law of
- Ontario
§6Sources and verification
- Sources consulted
- Verification
Medium confidence.
Partly verified
Medium confidence.Penalty and AMP details from general knowledge; IPC page fetched did not state them.