 | |
 |
 |
|
 |
 |
 |
 |
 | |
|
Public Information
Health Care Providers
News Media
Text Only Version
| ||||||
 |
|
|
Declaration of PHIPA as substantially similar to PIPEDA
Questions and Answers
 What is Part I the Personal Information Protection and Electronic Documents Act (PIPEDA)?
Part I of the Personal Information Protection and Electronic Documents Act (PIPEDA) is federal legislation that establishes rules to govern the collection, use, and disclosure of personal information by organizations in the course of commercial activities. Commercial activities can arise in the business, health and not-for profit sectors. The Governor in Council of Canada may, where satisfied that provincial legislation is "substantially similar" to Part I of PIPEDA, and exempt organizations from the application of Part I of PIPEDA in respect of collections, uses and disclosures of personal information within the province.
What is the difference between PIPEDA and Ontario's Personal Health Information Protection Act, 2004 (PHIPA)?
PHIPA came into effect on November 1, 2004 and sets out the rules that health information custodians must follow when collecting, using and disclosing personal health information. Health information custodians include healthcare providers (e.g., doctors, nurses, etc.), hospitals, long-term care homes, homes for special care, community care access centres, pharmacies, medical laboratories, local medical officers of health, ambulance services, community mental health programs, and the Ministry of Health and Long-Term Care. A key difference between PIPEDA and PHIPA is that PIPEDA applies to organizations that collect, use and disclose personal information in the course of commercial activities while PHIPA applies to health information custodians that collect, use and disclose personal health information, whether or not in the course of commercial activities.
What does the term 'substantially similar' mean?
In 2002, Industry Canada published the criteria used to determine whether provincial or territorial legislation would be considered to be substantially similar to PIPEDA. Under the policy, laws are substantially similar that :
What does the order mean for "health information custodians" in Ontario?
The order exempts health information custodians and their agents from the application of PIPEDA to the extent that they collect, use and disclose personal information within the province of Ontario. Therefore, in collecting, using, and disclosing personal information within Ontario, whether or not in the course of a commercial activity, health information custodians must comply with PHIPA, and are not required to comply with PIPEDA.
What are the benefits of this order?
In the absence of the designation, both PIPEDA and PHIPA would apply to a health information custodian's collection, use and disclosure of personal information in Ontario in the course of commercial activities. This would impose an unnecessarily complicated dual regime of privacy regulations on the affected parts of the health sector. Note that as many of health information custodians' collections, uses, and disclosures of personal health information do not occur in the course of commercial activities, they would not have been regulated by PIPEDA. Privacy rules that apply to health information custodians whether or not they are engaged in commercial activity provide a consistent framework for the protection of personal health information in Ontario. It is not necessary to overlay PIPEDA on top of PHIPA, since PHIPA provides a comprehensive privacy framework developed especially for the needs of the health sector.
Are researchers, entities prescribed under s. 45 of PHIPA, and persons prescribed under s. 39(1)(c) of PHIPA that are not health information custodians subject to the exemption order?
The order only exempts health information custodians and their agents from the application of PIPEDA with respect to the collection, use and disclosure of personal information in the province of Ontario. Where PIPEDA and PHIPA apply to them, researchers, entities prescribed under s. 45 of PHIPA, and persons prescribed under s. 39(1)(c) of PHIPA, that are neither health information custodians nor agents of such custodians will be required to comply with both PIPEDA and PHIPA.
I am an agent of a "health information custodian." Am I subject to the exemption order?
Yes. Under PHIPA, an "agent" acts on behalf of a "health information custodian" and, therefore, is also subject to the exemption order with respect to the handling of personal information for the custodian within Ontario.
Given this order, does PIPEDA have any application to health information custodians?
PIPEDA will continue to apply to collections, uses and disclosures of personal information by health information custodians outside Ontario in the course of commercial activities. For example, PIPEDA will continue to apply to the disclosure of personal information by health information custodians in Ontario to persons in other provinces and territories and to persons outside Canada in the course of commercial activities.
Where can I find more information?
More information on PIPEDA can be found on the Office of the Privacy Commissioner of Canada's website The Order declaring PHIPA substantially similar to PIPEDA is also available.
| ||||||||||||
| 