Compliance Guide
PHIPA Compliance Guide for Ontario Health Providers
A plain guide to PHIPA compliance for Ontario clinics, dental offices and health practices: what the law expects, common IT gaps and how to fix them.
Book a Toronto consultationPHIPA Compliance Guide for Ontario Health Providers
A plain guide to PHIPA compliance for Ontario clinics, dental offices and health practices: what the law expects, common IT gaps and how to fix them.
Where Toronto Healthcare IT Commonly Falls Short
- Unencrypted devices and endpoints
- Third-party and cloud vendor agreements
- Access logging and audit trails
- Staff device and email practices
A plain guide to PHIPA compliance for Ontario clinics, dental offices and health practices: what the law expects, common IT gaps and how to fix them.
What is PHIPA?
PHIPA is Ontario's Personal Health Information Protection Act. It sets the rules for how personal health information is collected, used, disclosed and protected.
The law applies to health information in Ontario. It is separate from PIPEDA, which covers personal information in commercial activity more generally.
Who PHIPA applies to
PHIPA applies to health information custodians in Ontario. That includes physicians, dentists, clinics, pharmacies, laboratories and other health practices that have custody or control of personal health information. A solo dental office is in scope. So is a multi-site clinic. The location of the office inside Ontario does not change the duty.
It also applies to agents. An agent is a person or organization that handles personal health information for a custodian. Staff, a billing service, an EMR vendor and an IT provider can all be agents. The custodian stays accountable for the safeguards those agents use.
Health information custodians and agents
The custodian decides why the information is collected and is the party a patient or the Information and Privacy Commissioner of Ontario will look to. Agents may only use the information for the purpose the custodian authorized. In an IT engagement that means written terms: what systems are in scope, where the data sits, how a breach is reported back to the custodian, and how access is removed when a person leaves.
A practical split is this. The clinic owns the policy and the patient relationship. The IT provider operates encryption, accounts, logs and backups, and hands the clinic the evidence. Neither side should assume the other has written it down.
Technical safeguards checklist
This is an IT checklist, not a legal opinion. Use it to see which safeguards are actually running.
Breach notification basics
PHIPA requires a health information custodian to notify affected individuals in circumstances the Act sets out, and to notify the Information and Privacy Commissioner of Ontario in circumstances the Act sets out. This page does not restate those tests and it is not legal advice. The IT role is to contain the incident, preserve logs, identify which records were involved and give that list to the custodian and their counsel.
A lost, unencrypted laptop that holds personal health information is a common trigger for that process. Encryption and an asset list are what make the scope knowable on the day it happens. The first-hour technical steps are in the incident response checklist.
PHIPA vs PIPEDA
PHIPA governs personal health information in Ontario. PIPEDA is the federal law for personal information collected in commercial activity. A clinic can deal with both: PHIPA for the health record, and PIPEDA for other personal information such as a marketing list or some vendor contacts.
Do not copy a PIPEDA checklist into a health practice and stop. The safeguards above are the health-specific IT work. The PIPEDA guide on this site stays a supporting explanation and does not try to be that checklist.
How to close the usual gaps
Start with an inventory. List every laptop, tablet, server, EMR and billing system that can open a patient record, including the ones staff use at home. Note who has an account and whether that account is unique. Shared front-desk logins are the first thing to replace, because an audit log that says "reception" does not tell you who looked at a record.
Turn on full-disk encryption before you write the policy that says devices are encrypted. Then confirm multi-factor authentication on remote access and on the EMR if the vendor supports it. Export a sample of the access log and check that it shows a person, a record and a time. If it does not, the safeguard is not actually running.
Put the vendor agreements next to that inventory. The IT provider, the EMR host and any billing service that sees personal health information need terms that say they are agents, where the data sits, and how they will tell the custodian about a breach. A contract that only covers uptime does not answer a PHIPA question.
Finish with backups and a short breach note. The backup section should name the systems, the retention and the date of the last restore test. The breach note should name who isolates a device, who preserves logs and who calls counsel. SecureIT Solutions can operate those controls. The custodian still decides when a notice goes out. None of this is legal advice, and none of it depends on a badge or a score.
PHIPA questions
Where Ontario healthcare IT commonly falls short
Unencrypted devices and endpoints
Laptops, tablets, and practice-management workstations that access PHI without full-disk encryption are a common gap, and a mandatory breach report if one is lost or stolen.
Third-party and cloud vendor agreements
Custodians remain accountable for PHI handled by billing services, EMR vendors, and IT providers. Agreements need to specify safeguards, breach notification timelines, and data location.
Access logging and audit trails
PHIPA gives patients the right to know who accessed their record. EMR and file systems need audit logging turned on and retained, not just theoretically available.
Staff device and email practices
PHI sent over personal email or unmanaged messaging apps is one of the most frequent real-world PHIPA issues, it's a training and technical-controls gap, not just a policy one.
A practical PHIPA readiness checklist
How SecureIT Solutions helps
We work with Toronto clinics and healthcare businesses on the IT side of PHIPA compliance: device encryption, access controls, audit logging, secure backups, and staff training, coordinated with your existing EMR and billing systems rather than replacing them.
Need a PHIPA-focused IT review?
Talk to our team about a PHIPA readiness review for an Ontario clinic, dental office or health practice.
On This Page
Related Reading
Compliance Management Services
What is PHIPA?
PHIPA is Ontario's Personal Health Information Protection Act. It sets rules for how personal health information is collected, used, disclosed and protected.
Who does PHIPA apply to?
It applies to health information custodians in Ontario, such as clinics, dental offices, pharmacies and other health practices, and to agents who handle personal health information for a custodian.
What is the difference between a custodian and an agent?
The custodian is the person or organization accountable for the health information. An agent, such as a staff member, a billing service or an IT provider, handles that information on the custodian's behalf and has to follow the custodian's safeguards.
How is PHIPA different from PIPEDA?
PHIPA is Ontario's health privacy law. PIPEDA is the federal law for personal information in commercial activity. A clinic can deal with both when it holds health records and also holds other personal information, such as a marketing list.