• What is the Health Information Protection Act, 2004?
• Who does the Personal Health Information Protection Act, 2004 apply to? apply to?
• What is personal health information?
• What is the difference between the Personal Health Information Protection Act, 2004 and how your health information was treated before?
• With whom can your doctor share your personal health information?
• Can hospitals or other health care providers use your personal health information for fundraising purposes?
• Can the Minister of Health see your personal health information?
• How can you find out how your personal health information is protected?
• Is a health care provider able to report someone they think is at risk of spreading a communicable disease?
• Who can you complain to if you feel the rules have been broken?
• What are the penalties for committing an offence under the Personal Health Information Protection Act, 2004?
• Why is it necessary to protect quality of care information?

The Health Information Protection Act, 2004 creates a comprehensive approach to protecting health information across the health care system. The Act has two parts : the Personal Health Information Protection Act, 2004 (Schedule A) and the Quality of Care Information Protection Act, 2004 (Schedule B).

This legislation received Royal Assent on May 20, 2004 and came into force on November 1, 2004.

• The Personal Health Information Protection Act, 2004 establishes consistent rules governing the collection, use and disclosure of personal health information in the hands of ’health information custodians‘, such as doctors, hospitals and other health care providers.
• It also has rules for non-health information custodians, such as insurance companies and employers that receive personal health information from a custodian.
• It gives you the right to request access your own health care records and correct your records when you find the information incomplete or inaccurate.
• The legislation applies to everyone in respect of the collection, use or disclosure ofthe health card number.
• The Quality of Care Information Protection Act, 2004 is designed to encourage health professionals to share information and hold open discussions to improve patient care. Information provided to a Quality of Care Committee that deals with quality improvement is protected from disclosure in legal proceedings. These protections do not allow the shielding of the facts of a medical incident from the patient.

The legislation applies to defined "health information custodians" where they collect, use or disclose personal health information.

A health information custodian includes doctors, other health care practitioners, hospitals, and long-term care facilities. It also includes health care clinics, laboratories, pharmacies, the Ministry of Health and Long-Term Care, and other health-related organizations.

The legislation also applies to individuals and organizations outside the health system that receive personal health information from the health care system, such as insurance companies and employers. The legislation applies to everyone regarding the collection, use or disclosure of the OHIP numbers.

Personal health information is identifiable information relating to your health and health care history. This includes information that may be contained in your health record such as diagnostic, treatment and care information, your OHIP number, and genetic information if it is part of your health record. Personal health information also includes any other identifying information included in a record of personal health information.

Privacy protections for personal health information were set out in several statutes and in professional standards. In some cases, the rules were unclear or inconsistent, or there were gaps.

The Personal Health Information Protection Act, 2004 creates consistent rules to safeguard personal health information across the health sector in Ontario as of November 1, 2004. This legislation means you have a legislated right to request access to and correction of incorrect or incomplete information in your records of personal health information held by health information custodians.

This legislation also provides an independent body to oversee it and to ensure accountability. The Information and Privacy Commissioner of Ontario investigates complaints, and makes binding orders to ensure compliance with the legislation.

Your doctor can share your personal health information in the health system when it's necessary to provide care to you. For example, your doctor can share your personal health information with a specialist that you have been referred to for care. Your consent to this disclosure may be implied.

However, the legislation allows you to tell your doctor if you don't want part of your personal health information shared with others providing you health care.

Health information custodians are also responsible for the actions of those who work for him or her, and must make sure they handle information confidentially and appropriately.

Health information custodians, in general, must get your consent to share your health information outside the health care system, or to share your information for any purpose other than one related to providing health care. For example, a doctor or any other health care provider would have to obtain your express consent before providing your personal health information to an employer. However, the Act authorizes a health information to disclose information without consent in some instances, such for the purpose of reporting a public health matter.

The legislation allows a health information custodian to use a patient's name and mailing address for fundraising purposes with the patient's implied consent. Thepatient is notified of his/her right to opt-out of future fundraising solicitations. Fundraisers would not have access to any information about a person's treatment or state of health.

This allows for an appropriate balance between the good work undertaken by hospital foundations, for example, in raising much-needed funds and the individual's right to control his or her information.

The Minister does not have the authority to direct disclosures of patient health records under the legislation except for the purpose of monitoring or verifying claims for payment for Ministry-funded health care and related goods.

If the Minister requires certain types of information for health care planning and management purposes, disclosures would be made to a secure health data institute, which in turn would generally release anonymous information to the Ministry of Health and Long-Term Care.

Your doctor, or any other health information custodian, is required to make available to the public a written statement that decribes the custodian's policy on personal health information collection, use and disclosure. Their patients must be notified of any collection, use or disclosure outside of this policy. They must also designate someone responsible to answer questions from the public.

Under Ontario's public health legislation, the Health Protection and Promotion Act, doctors and other health care providers are required to report anyone to their local Medical Officer of Health who they believe may have a reportable or communicable disease. This is to control and contain specific diseases. The Personal Health Information Protection Act, 2004 does not interfere with this requirement.

Individuals can make a complaint to the Information and Privacy Commissioner. The legislation is not retroactive, so actions taken before November 1, 2004 could not be the subject of a complaint to the Commissioner.

The IPC website is www.ipc.on.ca for further information.
The office phone number is 416-326-3333.
The fax number is 416-325-9195.

There are strict penalties of up to $50,000 for an individual and $250,000 for a corporation. These are the toughest penalties in Canada for breaches of health privacy legislation. The Act also allows for an award of damages in appropriate cases.

The Quality of Care Information Protection Act, 2004 is an important piece of Ontario's efforts to reduce medical errors and ensure patient safety in hospitals.

When a medical error occurs, an open discussion about the incident is important. Without this, the institution cannot properly analyze what led to the incident. It cannot identify and make changes to avoid similar incidents in the future.

Most other provinces - including Saskatchewan, New Brunswick, Nova Scotia, Alberta, and British Columbia - already provide legislative provisions encouraging such discussions by shielding the disclosure of quality of care information in legal proceedings.

The protections available under this Act cannot be used to shield the facts of a medical incident unless the facts are also contained in the patient's health record and therefore available to the patient.

© Queen's Printer for Ontario, 2002  |  Privacy Policy  |  Disclaimers  |   Last Modified :