Recent Amendments To The Personal Health Information Protection Act

On March 25, 2020, Ontario amended the Personal Health Information Protection Act (PHIPA). The amendments are unrelated to the COVID-19 pandemic and largely fall in two categories. First, there are increases to the penalties for offenses and a new power given to the Information and Privacy Commissioner (IPC) to impose administrative penalties. Second, there are various amendments, many of which have yet to come into force, that aim to further regulate the use of electronically-stored Personal Health Information (PHI).

Tougher enforcement measures

Administrative penalties

The amendments grant the IPC the novel power to impose "administrative penalties." These penalties may be imposed to encourage compliance with PHIPA, or to prevent people from deriving a direct or indirect economic benefit from a breach of PHIPA. The IPC will determine the amounts for these administrative penalties in accordance with regulations that the Government of Ontario has yet to enact.