Ontario Personal Health Information Protection Act (PHIPA)

PHIPA is designed to protect the privacy and confidentiality of personal health information.

PHIPA applies to health information custodians, including hospitals, healthcare providers, insurers, and other health service organizations.

PHIPA outlines specific rules for collecting, using, and disclosing personal health information, ensuring responsible and secure handling of healthcare data.

A health information custodian is prohibited from collecting, using, or disclosing an individual's personal health information without the individual's consent, and only if, to the best of the custodian's knowledge, such actions are necessary for a lawful purpose under the Act.

PHIPA outlines several disclosure requirements for health information custodians.

PHIPA grants individuals the right to access their personal health information and enables them to request corrections to their health information, with certain limitations.

PHIPA establishes independent mechanisms for reviewing and resolving complaints related to personal health information.

PHIPA imposes noncompliance penalties. For an individual, the penalty is a fine of up to $200,000, imprisonment of up to one year, or both. For an organization, the penalty is a fine of up to $1,000,000.