PHIPA
PHIPA is Ontario’s health-privacy law, which sets the rules that hospitals, clinics, and other health information custodians must follow when collecting, using, and disclosing personal health information.
Ontario’s Personal Health Information Protection Act (PHIPA) applies to “health information custodians” — hospitals, doctors, pharmacies, long-term care homes, and others — and to their agents. It requires consent for most collection, use, and disclosure of personal health information, subject to specific exceptions such as providing care.
PHIPA mandates safeguards, patient access to their own records, and correction rights. Custodians must notify affected individuals of a privacy breach and, in defined circumstances, report it to the regulator.
It is overseen by the Information and Privacy Commissioner of Ontario, who can investigate complaints and, in serious cases, refer matters for prosecution.
