Changes To Ontario's Health Information Privacy Law Include Breach Notification, Increased Penalties

Notification to affected individuals and regulators will be required in the event of unauthorized use or disclosure of personal health information under amendments to Ontario's health information legislation.

The Ontario legislature passed Bill 119 ¹ in May, which amended the Personal Health Information Protection Act, 2004, c 3, Sched. A ("PHIPA") and repealed and replaced the Quality of Care Information Protection Act, 2004, SO 2004, c 3. PHIPA governs the collection, use and disclosure of personal health information by health information custodians, such as doctors and hospitals. The Information and Privacy Commissioner for Ontario ("Privacy Commissioner") oversees PHIPA and had been advocating for amendments to PHIPA to regulate electronic health records ("EHRs") and the creation of shared provincial electronic health record system.