IPC Imposes Second Monetary Penalty Under Ontario’s Health Privacy Law

Overview

On April 23, 2026, the Information and Privacy Commissioner (“IPC”) issued a $2,000 administrative penalty under the Personal Health Information Protection Act, 2004 (“PHIPA”), which marks only the second time the IPC has imposed an administrative penalty under Ontario’s health privacy law.

The penalty follows an incident in which a patient service clerk inappropriately accessed 436 patient records while acting as agent for the Children’s Hospital of Eastern Ontario (“CHEO”). The decision raises questions about whether the IPC is moving toward a more robust use of monetary penalties and underscores the importance of compliance for information custodians.

Background

In October 2024, the IPC received a breach report on behalf of CHEO alleging that a patient service clerk inappropriately accessed the personal health information of 436 patients. CHEO discovered the breach after a nurse inquired about her stepchild’s medical care despite not being a legal guardian. An audit