PHIPA security for Ontario clinics and health information custodians

Who PHIPA applies to: custodians, their agents and IT providers

PHIPA applies to every health information custodian in Ontario and to the people and companies who handle personal health information for them. Custodians include health care practitioners and group practices, hospitals, long-term care and retirement homes, pharmacies, laboratories, ambulance services and community or mental health centres whose main purpose is health care.¹

A clinic, a dental office or a physiotherapy practice is usually a custodian. The custodian stays responsible for the information its agents handle, and an organization that is a custodian must name a contact person who helps it follow the Act.¹ IT companies have their own rules: a provider that supplies electronic services to a custodian without being its agent may use the information only as needed for the service and may not disclose it.²

What “reasonable steps” means for a clinic’s computers

PHIPA sets a standard and leaves the method to the custodian: the steps must be reasonable in the circumstances, and records must be protected against unauthorized copying, modification or disposal.¹ For a clinic or practice, that standard is tested in a handful of places where patient information is actually exposed. These are the points our review checks:

• Accounts and sign-in. Who can open the electronic medical record and the clinic email, whether multi-factor sign-in is on, and whether former staff and locums still have access.
• Who sees which chart. Roles in the medical record system, shared logins at the front desk, and how access is removed when someone leaves.
• Laptops and phones. Disk encryption, screen locks, and what happens when a device is lost on a home visit or in a car.
• Email. Sender protection for the clinic domain (SPF, DKIM and DMARC), forwarding rules to personal mailboxes, and how results and referrals are sent. See email security.
• Backups. Whether copies are kept apart from the main network and accounts, and whether a restore has been tested. See backup and disaster recovery.
• Vendors and remote access. Which outside companies can connect to your systems, with what tool, and under which agreement.
• Disposal. Old drives, printers and scanners that still hold patient information.

When a privacy breach must be reported to the IPC

A custodian must tell each affected person at the first reasonable opportunity when their health information is stolen, lost, or used or disclosed without authority, and the notice must say they can complain to the Information and Privacy Commissioner of Ontario (IPC).¹ The custodian must also notify the IPC itself, at the first reasonable opportunity, when at least one of seven circumstances in the regulation applies:^{2 3}

• use or disclosure without authority by someone who knew or ought to have known it was unauthorized;
• the information was stolen;
• after the first breach, the information was or will be used or disclosed again without authority;
• the breach is part of a pattern of similar breaches;
• the custodian must notify a regulatory College about the event, for example disciplinary action against a member;
• the custodian would have to notify a College if the agent involved were a member;
• the breach is significant, judged by how sensitive the information is, how much of it was involved, how many people it concerns, and whether more than one custodian or agent was responsible.

How a PHIPA security review goes with us

A PHIPA security review with us follows the same order every time: a signed scope letter, a review of the places listed above, a written report, fixes if you order them, and a re-check. The scope letter names your medical record system and its vendor, the email service, the devices, the backup set-up and every outside company with access.

While we work on systems that hold health information, we act on the custodian’s instructions, look only at what the review needs, and keep everything we see under a confidentiality agreement, in line with the limits PHIPA sets for service providers.² Most findings come from settings, account lists and logs; reading patient charts is outside the review.

What the custodian has in hand afterwards

At the end of the review the custodian owns a written record of its safeguards, the gaps found and what was done about them, which is useful when the IPC, an insurer or a partner hospital asks how patient information is protected.

• a report in plain language with each finding ranked: fix today, fix this month, plan for later;
• a technical appendix for whoever supports your systems;
• a short note on breach roles: who decides whether one of the seven circumstances applies, who notifies patients, who files with the IPC;
• the changed settings, if you ordered the fixes, with a list of what was changed;
• a re-check of the fixes, dated, in the same report.

Where a security review stops and legal advice begins

A security review covers the technical and practical side of PHIPA: the safeguards, the logs, the backups and the people with access. Questions about consent, disclosure to third parties, access requests or the wording of a notice to patients belong to a lawyer or to the IPC’s published guidance.

For that reason we give no legal opinion and issue no “PHIPA-compliant” label. The decision to notify patients and the IPC stays with the custodian; we help gather the facts it needs to decide. When the breach comes from a cyber attack, the custodian can also report it to the Canadian Centre for Cyber Security, which is separate from the police.⁴ Children’s aid societies follow a separate set of privacy rules for their service records, covered on the page for children’s aid societies.