Personal Health Information Protection Act, 2004

part i INTERPRETation and application

Purposes, Definitions and Interpretation

1 The purposes of this Act are, (a) to establish rules for the collection, use and disclosure of personal health information about individuals that protect the confidentiality of that information and the privacy of individuals with respect to that information, while facilitating the effective provision of health care; (b) to provide individuals with a right of access to personal health information about themselves, subject to limited and specific exceptions set out in this Act; (c) to provide individuals with a right to require the correction or amendment of personal health information about themselves, subject to limited and specific exceptions set out in this Act; (d) to provide for independent review and resolution of complaints with respect to personal health information; and (e) to provide effective remedies for contraventions of this Act. 2004, c. 3, Sched. A, s. 1.

2 In this Act, “account management services” means the services provided by the prescribed organization that, (a) maintain the confidentiality, integrity or availability of an individual’s digital health identifier or related personal health information, (b) relate to the maintenance of an individual’s digital health identifier or related personal health information, (c) manage the activation, deactivation, reactivation or disposal of an individual’s digital health identifier or related personal health information, or (d) are prescribed; (“services de gestion des comptes”) “Agency” means the corporation continued by section 3 of the Connecting Care Act, 2019; (“Agence”) “agent”, in relation to a health information custodian, means a person that, with the authorization of the custodian, acts for or on behalf of the custodian in respect of personal health information for the purposes of th…

3 (1) In this Act, “health information custodian”, subject to subsections (3) to (11), means a person or organization described in one of the following paragraphs who has custody or control of personal health information as a result of or in connection with performing the person’s or organization’s powers or duties or the work described in the paragraph, if any: 1. A health care practitioner or a person who operates a group practice of health care practitioners. 2. Repealed: 2020, c. 13, Sched. 3, s. 8 (3). 3. A health service provider or person or entity that is part of an Ontario Health Team and that provides a home and community care service pursuant to funding under section 21 of the Connecting Care Act, 2019, including a person or entity from whom the provider or Team has purchased the home and community care service. A health service provider or person or entity that is part of an …

4 (1) In this Act, “personal health information”, subject to subsections (3) and (4), means identifying information about an individual in oral or recorded form, if the information, (a) relates to the physical or mental health of the individual, including information that consists of the health history of the individual’s family, (b) relates to the providing of health care to the individual, including the identification of a person as a provider of health care to the individual, (c) Repealed: 2020, c. 13, Sched. 3, s. 8 (7). (c.1) is a plan that sets out the home and community care services for the individual to be provided by a health service provider or Ontario Health Team pursuant to funding under section 21 of the Connecting Care Act, 2019, (d) relates to payments or eligibility for health care, or eligibility for coverage for health care, in respect of the individual, (e) relates to…

5 (1) In this Act, “substitute decision-maker”, in relation to an individual, means, unless the context requires otherwise, a person who is authorized under this Act to consent on behalf of the individual to the collection, use or disclosure of personal health information about the individual. 2004, c. 3, Sched. A, s. 5 (1). Decision about treatment (2) A substitute decision-maker of an individual within the meaning of section 9 of the Health Care Consent Act, 1996 shall be deemed to be a substitute decision-maker of the individual in respect of the collection, use or disclosure of personal health information about the individual if the purpose of the collection, use or disclosure is necessary for, or ancillary to, a decision about a treatment under Part II of that Act. 2004, c. 3, Sched. A, s. 5 (2). Admission to a care facility (3) A substitute decision-maker of an individual within th…

6 (1) For the purposes of this Act, the providing of personal health information between a health information custodian and an agent of the custodian is a use by the custodian, and not a disclosure by the person providing the information or a collection by the person to whom the information is provided. 2004, c. 3, Sched. A, s. 6 (1). Provisions based on consent (2) A provision of this Act that applies to the collection, use or disclosure of personal health information about an individual by a health information custodian with the consent of the individual, whatever the nature of the consent, does not affect the collection, use or disclosure that this Act permits or requires the health information custodian to make of the information without the consent of the individual. 2004, c. 3, Sched. A, s. 6 (2). Permissive disclosure (3) A provision of this Act that permits a health information c…

Application of Act

7 (1) Except if this Act or its regulations specifically provide otherwise, this Act applies to, (a) the collection of personal health information by a health information custodian on or after the day this section comes into force; (b) the use or disclosure of personal health information, on or after the day this section comes into force, by, (i) a health information custodian, even if the custodian collected the information before that day, or (ii) a person who is not a health information custodian and to whom a health information custodian disclosed the information, even if the person received the information before that day; and (c) the collection, use or disclosure of a health number by any person on or after the day this section comes into force. 2004, c. 3, Sched. A, s. 7 (1). Conflict (2) In the event of a conflict between a provision of this Act or its regulations and a provision…

8 (1) Subject to subsection (2), the Freedom of Information and Protection of Privacy Act and the Municipal Freedom of Information and Protection of Privacy Act do not apply to personal health information in the custody or under the control of a health information custodian unless this Act specifies otherwise. 2007, c. 10, Sched. H, s. 4. Exceptions (2) Sections 11, 12, 15, 16, 17, 33 and 34, subsection 35 (2) and sections 36 and 44 of the Freedom of Information and Protection of Privacy Act and sections 5, 9, 10, 25, 26 and 34 of the Municipal Freedom of Information and Protection of Privacy Act apply in respect of records of personal health information in the custody or under the control of a health information custodian that is an institution within the meaning of either of those Acts, as the case may be, or that is acting as part of such an institution. 2007, c. 10, Sched. H, s. 4. S…

9 (1) This Act does not apply to personal health information about an individual after the earlier of 120 years after a record containing the information was created and 50 years after the death of the individual. 2004, c. 3, Sched. A, s. 9 (1). Other rights and Acts (2) Nothing in this Act shall be construed to interfere with, (a) anything in connection with a subrogated claim or a potential subrogated claim; (b) any legal privilege, including solicitor-client privilege; (c) the law of evidence or information otherwise available by law to a party or a witness in a proceeding; (d) the power of a court or a tribunal to compel a witness to testify or to compel the production of a document; (e) the regulatory activities of a College under the Regulated Health Professions Act, 1991, the College under the Social Work and Social Service Work Act, 1998, the Board under the Drugless Practitioner…

PART II PRACTICES TO PROTECT PERSONAL HEALTH INFORMATION

General

10 (1) A health information custodian that has custody or control of personal health information shall have in place information practices that comply with the requirements of this Act and its regulations. 2004, c. 3, Sched. A, s. 10 (1). Duty to follow practices (2) A health information custodian shall comply with its information practices. 2004, c. 3, Sched. A, s. 10 (2). Use of electronic means (3) A health information custodian that uses electronic means to collect, use, modify, disclose, retain or dispose of personal health information shall comply with the prescribed requirements, if any. 2004, c. 3, Sched. A, s. 10 (3). Providers to custodians (4) A person who provides goods or services for the purpose of enabling a health information custodian to use electronic means to collect, use, modify, disclose, retain or dispose of personal health information shall comply with the prescrib…

10.1 (1) Subject to any prescribed exceptions, a health information custodian that uses electronic means to collect, use, disclose, modify, retain or dispose of personal health information shall, (a) maintain, or require the maintenance of, an electronic audit log described in subsection (4); (b) audit and monitor the electronic audit log as often as is required by the regulations; and (c) comply with any requirements that may be prescribed. 2020, c. 5, Sched. 6, s. 3. Access by Commissioner (2) A health information custodian referred to in subsection (1) shall provide a copy of the electronic audit log to the Commissioner, upon request. 2020, c. 5, Sched. 6, s. 3. Same (3) Despite subsection 60 (13), the Commissioner may be provided with a copy of the electronic audit log even if it contains personal health information. 2020, c. 5, Sched. 6, s. 3. Content of log (4) The electronic audit…

11 (1) A health information custodian that uses personal health information about an individual shall take reasonable steps to ensure that the information is as accurate, complete and up-to-date as is necessary for the purposes for which it uses the information. 2004, c. 3, Sched. A, s. 11 (1). Same, disclosure (2) A health information custodian that discloses personal health information about an individual shall, (a) take reasonable steps to ensure that the information is as accurate, complete and up-to-date as is necessary for the purposes of the disclosure that are known to the custodian at the time of the disclosure; or (b) clearly set out for the recipient of the disclosure the limitations, if any, on the accuracy, completeness or up-to-date character of the information. 2004, c. 3, Sched. A, s. 11 (2).

11.1 A health information custodian shall take steps that are reasonable in the circumstances to ensure that personal health information is not collected without authority. 2016, c. 6, Sched. 1, s. 1 (3). Section Amendments with date in force (d/m/y) 2016, c. 6, Sched. 1, s. 1 (3) - 01/06/2016

11.2 (1) Subject to subsection (2) and to any other exceptions that may be prescribed, no person shall use or attempt to use information that has been de-identified to identify an individual, either alone or with other information, unless this Act or another Act permits the information to be used to identify the individual. 2019, c. 15, Sched. 30, s. 3. Exceptions (2) The limitation in subsection (1) does not prevent any of the following from using information that they de-identified, either alone or with other information, to identify an individual: 1. A health information custodian. 2. A prescribed entity mentioned in subsection 45 (1). 3. A prescribed person who compiles or maintains a registry of personal health information. 4. Any other prescribed person. 2019, c. 15, Sched. 30, s. 3. Section Amendments with date in force (d/m/y) 2019, c. 15, Sched. 30, s. 3 - 31/07/2020

12 (1) A health information custodian shall take steps that are reasonable in the circumstances to ensure that personal health information in the custodian’s custody or control is protected against theft, loss and unauthorized use or disclosure and to ensure that the records containing the information are protected against unauthorized copying, modification or disposal. 2004, c. 3, Sched. A, s. 12 (1). Notice of theft, loss, etc. to individual (2) Subject to subsection (4) and to the exceptions and additional requirements, if any, that are prescribed, if personal health information about an individual that is in the custody or control of a health information custodian is stolen or lost or if it is used or disclosed without authority, the health information custodian shall, (a) notify the individual at the first reasonable opportunity of the theft or loss or of the unauthorized use or dis…

Records

13 (1) A health information custodian shall ensure that the records of personal health information that it has in its custody or under its control are retained, transferred and disposed of in a secure manner and in accordance with the prescribed requirements, if any. 2004, c. 3, Sched. A, s. 13 (1). Retention of records subject to a request (2) Despite subsection (1), a health information custodian that has custody or control of personal health information that is the subject of a request for access under section 53 shall retain the information for as long as necessary to allow the individual to exhaust any recourse under this Act that he or she may have with respect to the request. 2004, c. 3, Sched. A, s. 13 (2).

14 (1) A health information custodian may keep a record of personal health information about an individual in the individual’s home in any reasonable manner to which the individual consents, subject to any restrictions set out in a regulation, by-law or published guideline under the Regulated Health Professions Act, 1991, an Act referred to in Schedule 1 of that Act, the Drugless Practitioners Act or the Social Work and Social Service Work Act, 1998. 2004, c. 3, Sched. A, s. 14 (1). Records kept in other places (2) A health care practitioner may keep a record of personal health information about an individual in a place other than the individual’s home and other than a place in the control of the practitioner if, (a) the record is kept in a reasonable manner; (b) the individual consents; (c) the health care practitioner is permitted to keep the record in the place in accordance with a re…

Accountability and Openness

15 (1) A health information custodian that is a natural person may designate a contact person described in subsection (3). 2004, c. 3, Sched. A, s. 15 (1). Same (2) A health information custodian that is not a natural person shall designate a contact person described in subsection (3). 2004, c. 3, Sched. A, s. 15 (2). Functions of contact person (3) A contact person is an agent of the health information custodian and is authorized on behalf of the custodian to, (a) facilitate the custodian’s compliance with this Act; (b) ensure that all agents of the custodian are appropriately informed of their duties under this Act; (c) respond to inquiries from the public about the custodian’s information practices; (d) respond to requests of an individual for access to or correction of a record of personal health information about the individual that is in the custody or under the control of the cust…

16 (1) A health information custodian shall, in a manner that is practical in the circumstances, make available to the public a written statement that, (a) provides a general description of the custodian’s information practices; (b) describes how to contact, (i) the contact person described in subsection 15 (3), if the custodian has one, or (ii) the custodian, if the custodian does not have that contact person; (c) describes how an individual may obtain access to or request correction of a record of personal health information about the individual that is in the custody or control of the custodian; and (d) describes how to make a complaint to the custodian and to the Commissioner under this Act. 2004, c. 3, Sched. A, s. 16 (1). Notification (2) If a health information custodian uses or discloses personal health information about an individual, without the individual’s consent, in a manne…

17 (1) A health information custodian is responsible for personal health information in the custody or control of the health information custodian and may permit the custodian’s agents to collect, use, disclose, retain or dispose of personal health information on the custodian’s behalf only if, (a) the custodian is permitted or required to collect, use, disclose, retain or dispose of the information, as the case may be; (b) the collection, use, disclosure, retention or disposal of the information, as the case may be, is necessary in the course of the agent’s duties and is not contrary to this Act or another law; and (c) the prescribed requirements, if any, are met. 2004, c. 3, Sched. A, s. 17 (1); 2016, c. 6, Sched. 1, s. 1 (5). Same (1.1) A permission granted to an agent under subsection (1) may be subject to such conditions or restrictions as the health information custodian may impose…

17.1 (1) In this section, “Authority” means the Authority within the meaning of the Health and Supportive Care Providers Oversight Authority Act, 2021; (“Office”) “College” means, (a) in the case of a member of health profession regulated under the Regulated Health Professions Act, 1991, a College of the health profession named in Schedule 1 to that Act, and (b) in the case of a member of the Ontario College of Social Workers and Social Service Workers, that College. 2016, c. 6, Sched. 1, s. 1 (8); 2021, c. 27, Sched. 2, s. 68 (3). Termination, suspension, etc., of employed members or registrants (2) Subject to any exceptions and additional requirements, if any, that are prescribed, if a health information custodian employs a health care practitioner who is a member of a College or a registrant of the Authority, the health information custodian shall give written notice of any of the fol…

PART III CONSENT COnCERNING PERSONAL HEALTH INFORMATION

General

18 (1) If this Act or any other Act requires the consent of an individual for the collection, use or disclosure of personal health information by a health information custodian, the consent, (a) must be a consent of the individual; (b) must be knowledgeable; (c) must relate to the information; and (d) must not be obtained through deception or coercion. 2004, c. 3, Sched. A, s. 18 (1). Implied consent (2) Subject to subsection (3), a consent to the collection, use or disclosure of personal health information about an individual may be express or implied. 2004, c. 3, Sched. A, s. 18 (2). Exception (3) A consent to the disclosure of personal health information about an individual must be express, and not implied, if, (a) a health information custodian makes the disclosure to a person that is not a health information custodian; or (b) a health information custodian makes the disclosure to an…

19 (1) If an individual consents to have a health information custodian collect, use or disclose personal health information about the individual, the individual may withdraw the consent, whether the consent is express or implied, by providing notice to the health information custodian, but the withdrawal of the consent shall not have retroactive effect. 2004, c. 3, Sched. A, s. 19 (1). Conditional consent (2) If an individual places a condition on his or her consent to have a health information custodian collect, use or disclose personal health information about the individual, the condition is not effective to the extent that it purports to prohibit or restrict any recording of personal health information by a health information custodian that is required by law or by established standards of professional practice or institutional practice. 2004, c. 3, Sched. A, s. 19 (2).

20 (1) A health information custodian who has obtained an individual’s consent to a collection, use or disclosure of personal health information about the individual or who has received a copy of a document purporting to record the individual’s consent to the collection, use or disclosure is entitled to assume that the consent fulfils the requirements of this Act and the individual has not withdrawn it, unless it is not reasonable to assume so. 2004, c. 3, Sched. A, s. 20 (1). Implied consent (2) A health information custodian described in paragraph 1, 3 or 4 of the definition of “health information custodian” in subsection 3 (1), that receives personal health information about an individual from the individual, the individual’s substitute decision-maker or another health information custodian for the purpose of providing health care or assisting in the provision of health care to the in…

Capacity and Substitute Decision-Making

21 (1) An individual is capable of consenting to the collection, use or disclosure of personal health information if the individual is able, (a) to understand the information that is relevant to deciding whether to consent to the collection, use or disclosure, as the case may be; and (b) to appreciate the reasonably foreseeable consequences of giving, not giving, withholding or withdrawing the consent. 2004, c. 3, Sched. A, s. 21 (1). Different information (2) An individual may be capable of consenting to the collection, use or disclosure of some parts of personal health information, but incapable of consenting with respect to other parts. 2004, c. 3, Sched. A, s. 21 (2). Different times (3) An individual may be capable of consenting to the collection, use or disclosure of personal health information at one time, but incapable of consenting at another time. 2004, c. 3, Sched. A, s. 21 (3…

22 (1) A health information custodian that determines the incapacity of an individual to consent to the collection, use or disclosure of personal health information under this Act shall do so in accordance with the requirements and restrictions, if any, that are prescribed. 2004, c. 3, Sched. A, s. 22 (1). Information about determination (2) If it is reasonable in the circumstances, a health information custodian shall provide, to an individual determined incapable of consenting to the collection, use or disclosure of his or her personal health information by the custodian, information about the consequences of the determination of incapacity, including the information, if any, that is prescribed. 2004, c. 3, Sched. A, s. 22 (2). Review of determination (3) An individual whom a health information custodian determines is incapable of consenting to the collection, use or disclosure of his …

23 (1) If this Act or any other Act refers to a consent required of an individual to a collection, use or disclosure by a health information custodian of personal health information about the individual, a person described in one of the following paragraphs may give, withhold or withdraw the consent: 1. If the individual is capable of consenting to the collection, use or disclosure of the information, i. the individual, or ii. if the individual is at least 16 years of age, any person who is capable of consenting, whom the individual has authorized in writing to act on his or her behalf and who, if a natural person, is at least 16 years of age. 2. If the individual is a child who is less than 16 years of age, a parent of the child or a children’s aid society or other person who is lawfully entitled to give or refuse consent in the place of the parent unless the information relates to, i. …

24 (1) A person who consents under this Act or any other Act on behalf of or in the place of an individual to a collection, use or disclosure of personal health information by a health information custodian, who withholds or withdraws such a consent or who provides an express instruction under clause 37 (1) (a), 38 (1) (a) or 50 (1) (e) shall take into consideration, (a) the wishes, values and beliefs that, (i) if the individual is capable, the person knows the individual holds and believes the individual would want reflected in decisions made concerning the individual’s personal health information, or (ii) if the individual is incapable or deceased, the person knows the individual held when capable or alive and believes the individual would have wanted reflected in decisions made concerning the individual’s personal health information; (b) whether the benefits that the person expects fr…

25 (1) If this Act permits or requires an individual to make a request, give an instruction or take a step and a substitute decision-maker is authorized to consent on behalf of the individual to the collection, use or disclosure of personal health information about the individual, the substitute decision-maker may make the request, give the instruction or take the step on behalf of the individual. 2004, c. 3, Sched. A, s. 25 (1). Same (2) If a substitute decision-maker makes a request, gives an instruction or takes a step under subsection (1) on behalf of an individual, references in this Act to the individual with respect to the request made, the instruction given or the step taken by the substitute decision-maker shall be read as references to the substitute decision-maker, and not to the individual. 2004, c. 3, Sched. A, s. 25 (2).

26 (1) If an individual is determined to be incapable of consenting to the collection, use or disclosure of personal health information by a health information custodian, a person described in one of the following paragraphs may, on the individual’s behalf and in the place of the individual, give, withhold or withdraw the consent: 1. The individual’s guardian of the person or guardian of property, if the consent relates to the guardian’s authority to make a decision on behalf of the individual. 2. The individual’s attorney for personal care or attorney for property, if the consent relates to the attorney’s authority to make a decision on behalf of the individual. 3. The individual’s representative appointed by the Board under section 27, if the representative has authority to give the consent. 4. The individual’s spouse or partner. 5. A child or parent of the individual, or a children’s …

27 (1) An individual who is 16 years old or older and who is determined to be incapable of consenting to the collection, use or disclosure of personal health information may apply to the Board for appointment of a representative to consent on the individual’s behalf to a collection, use or disclosure of the information by a health information custodian. 2004, c. 3, Sched. A, s. 27 (1). Application by proposed representative (2) If an individual is incapable of consenting to the collection, use or disclosure of personal health information, another individual who is 16 years old or older may apply to the Board to be appointed as a representative to consent on behalf of the incapable individual to a collection, use or disclosure of the information. 2004, c. 3, Sched. A, s. 27 (2). Deemed application concerning capacity (2.1) An application to the Board under subsection (1) or (2) shall be d…

28 (1) This Act applies to a representative whom the Board appointed under section 36.2 of the Mental Health Act or who was deemed to be appointed under that section before the day this section comes into force for an individual with respect to the individual’s personal health information, as if the representative were the individual’s representative appointed by the Board under section 27. 2004, c. 3, Sched. A, s. 28 (1). Limited authority (2) The authority conferred on the representative by subsection (1) is limited to the purposes for which the representative was appointed. 2004, c. 3, Sched. A, s. 28 (2).

PART IV COLLECTION, USE AND DISCLOSURE OF PERSONAL HEALTH INFORMATION

General Limitations and Requirements

29 A health information custodian shall not collect, use or disclose personal health information about an individual unless, (a) it has the individual’s consent under this Act and the collection, use or disclosure, as the case may be, to the best of the custodian’s knowledge, is necessary for a lawful purpose; or (b) the collection, use or disclosure, as the case may be, is permitted or required by this Act. 2004, c. 3, Sched. A, s. 29.

30 (1) A health information custodian shall not collect, use or disclose personal health information if other information will serve the purpose of the collection, use or disclosure. 2004, c. 3, Sched. A, s. 30 (1). Extent of information (2) A health information custodian shall not collect, use or disclose more personal health information than is reasonably necessary to meet the purpose of the collection, use or disclosure, as the case may be. 2004, c. 3, Sched. A, s. 30 (2). Exception (3) This section does not apply to personal health information that a health information custodian is required by law to collect, use or disclose. 2004, c. 3, Sched. A, s. 30 (3).

31 (1) A health information custodian that collects personal health information in contravention of this Act shall not use it or disclose it unless required by law to do so. 2004, c. 3, Sched. A, s. 31 (1). (2) Repealed: 2004, c. 3, Sched. A, s. 31 (4). (3) Repealed: 2004, c. 3, Sched. A, s. 31 (4). (4) Spent: 2004, c. 3, Sched. A, s. 31 (4). Section Amendments with date in force (d/m/y) 2004, c. 3, Sched. A, s. 31 (4) - 01/11/2005

32 (1) Subject to subsection (2), a health information custodian may collect, use or disclose personal health information about an individual for the purpose of fundraising activities only where, (a) the individual expressly consents; or (b) the individual consents by way of an implied consent and the information consists only of the individual’s name and the prescribed types of contact information. 2004, c. 3, Sched. A, s. 32 (1); 2007, c. 10, Sched. H, s. 9. Requirements and restrictions (2) The manner in which consent is obtained under subsection (1) and the resulting collection, use or disclosure of personal health information for the purpose of fundraising activities shall comply with the requirements and restrictions that are prescribed, if any. 2004, c. 3, Sched. A, s. 32 (2). Section Amendments with date in force (d/m/y) 2007, c. 10, Sched. H, s. 9 - 04/06/2007

33 A health information custodian shall not collect, use or disclose personal health information about an individual for the purpose of marketing anything or for the purpose of market research unless the individual expressly consents and the custodian collects, uses or discloses the information, as the case may be, subject to the prescribed requirements and restrictions, if any. 2004, c. 3, Sched. A, s. 33.

34 (1) In this section, “health card” means a card provided to an insured person within the meaning of the Health Insurance Act by the General Manager of the Ontario Health Insurance Plan; (“carte Santé”) “provincially funded health resource” means a service, thing, subsidy or other benefit funded, in whole or in part, directly or indirectly by the Government of Ontario, if it is health related or prescribed. (“ressource en matière de santé subventionnée par la province”) 2004, c. 3, Sched. A, s. 34 (1). Collection or use (2) Despite subsection 49 (1), a person who is neither a health information custodian nor acting as an agent of a health information custodian shall not collect or use another person’s health number except, (a) for purposes related to the provision of provincially funded health resources to that other person; (b) for the purposes for which a health information custodian…

35 (1) A health information custodian shall not charge a person a fee for collecting or using personal health information except as authorized by the regulations made under this Act. 2004, c. 3, Sched. A, s. 35 (1). Same, for disclosure (2) When disclosing personal health information, a health information custodian shall not charge fees to a person that exceed the prescribed amount or the amount of reasonable cost recovery, if no amount is prescribed. 2004, c. 3, Sched. A, s. 35 (2).

Collection

36 (1) A health information custodian may collect personal health information about an individual indirectly if, (a) the individual consents to the collection being made indirectly; (b) the information to be collected is reasonably necessary for providing health care or assisting in providing health care to the individual and it is not reasonably possible to collect, directly from the individual, (i) personal health information that can reasonably be relied on as accurate and complete, or (ii) personal health information in a timely manner; (c) the custodian is an institution within the meaning of the Freedom of Information and Protection of Privacy Act or the Municipal Freedom of Information and Protection of Privacy Act, or is acting as part of such an institution, and the custodian is collecting the information for a purpose related to, (i) investigating a breach of an agreement or a …

Use

37 (1) A health information custodian may use personal health information about an individual, (a) for the purpose for which the information was collected or created and for all the functions reasonably necessary for carrying out that purpose, but not if the information was collected with the consent of the individual or under clause 36 (1) (b) and the individual expressly instructs otherwise; (b) for a purpose for which this Act, another Act or an Act of Canada permits or requires a person to disclose it to the custodian; (c) for planning or delivering programs or services that the custodian provides or that the custodian funds in whole or in part, allocating resources to any of them, evaluating or monitoring any of them or detecting, monitoring or preventing fraud or any unauthorized receipt of services or benefits related to any of them; (d) for the purpose of risk management, error m…

Disclosure

38 (1) A health information custodian may disclose personal health information about an individual, (a) to a health information custodian described in paragraph 1, 3 or 4 of the definition of “health information custodian” in subsection 3 (1), if the disclosure is reasonably necessary for the provision of health care and it is not reasonably possible to obtain the individual’s consent in a timely manner, but not if the individual has expressly instructed the custodian not to make the disclosure; (b) in order for the Minister, another health information custodian or the Agency to determine or provide funding or payment to the custodian for the provision of health care; or (c) for the purpose of contacting a relative, friend or potential substitute decision-maker of the individual, if the individual is injured, incapacitated or ill and unable to give consent personally. 2004, c. 3, Sched. …

39 (1) Subject to the requirements and restrictions, if any, that are prescribed, a health information custodian may disclose personal health information about an individual, (a) for the purpose of determining or verifying the eligibility of the individual to receive health care or related goods, services or benefits provided under an Act of Ontario or Canada and funded in whole or in part by the Government of Ontario or Canada, by a municipality or by the Agency, or to receive coverage with respect to such health care, goods, services or benefits; (b) to a person conducting an audit or reviewing an application for accreditation or reviewing an accreditation, if the audit or review relates to services provided by the custodian and the person does not remove any records of personal health information from the custodian’s premises; (c) to a prescribed person who compiles or maintains a reg…

40 (1) A health information custodian may disclose personal health information about an individual if the custodian believes on reasonable grounds that the disclosure is necessary for the purpose of eliminating or reducing a significant risk of serious bodily harm to a person or group of persons. 2004, c. 3, Sched. A, s. 40 (1). Disclosures related to care or custody (2) A health information custodian may disclose personal health information about an individual to the head of a penal or other custodial institution in which the individual is being lawfully detained or to the officer in charge of a psychiatric facility within the meaning of the Mental Health Act in which the individual is being lawfully detained for the purposes described in subsection (3). 2004, c. 3, Sched. A, s. 40 (2). Same (3) A health information custodian may disclose personal health information about an individual …

41 (1) A health information custodian may disclose personal health information about an individual, (a) subject to the requirements and restrictions, if any, that are prescribed, for the purpose of a proceeding or contemplated proceeding in which the custodian or the agent or former agent of the custodian is, or is expected to be, a party or witness, if the information relates to or is a matter in issue in the proceeding or contemplated proceeding; (b) to a proposed litigation guardian or legal representative of the individual for the purpose of having the person appointed as such; (c) to a litigation guardian or legal representative who is authorized under the Rules of Civil Procedure, or by a court order, to commence, defend or continue a proceeding on behalf of the individual or to represent the individual in a proceeding; or (d) for the purpose of complying with, (i) a summons, order…

42 (1) A health information custodian may disclose personal health information about an individual to a potential successor of the custodian, for the purpose of allowing the potential successor to assess and evaluate the operations of the custodian, if the potential successor first enters into an agreement with the custodian to keep the information confidential and secure and not to retain any of the information longer than is necessary for the purpose of the assessment or evaluation. 2004, c. 3, Sched. A, s. 42 (1). Transfer to successor (2) A health information custodian may transfer records of personal health information about an individual to the custodian’s successor if the custodian makes reasonable efforts to give notice to the individual before transferring the records or, if that is not reasonably possible, as soon as possible after transferring the records. 2004, c. 3, Sched. A…

43 (1) A health information custodian may disclose personal health information about an individual, (a) for the purpose of determining, assessing or confirming capacity under the Health Care Consent Act, 1996, the Substitute Decisions Act, 1992 or this Act; (b) to a College within the meaning of the Regulated Health Professions Act, 1991 for the purpose of the administration or enforcement of the Drug and Pharmacies Regulation Act, the Regulated Health Professions Act, 1991 or an Act named in Schedule 1 to that Act; (b.1) to the Authority within the meaning of the Health and Supportive Care Providers Oversight Authority Act, 2021 for the purpose of the administration or enforcement of that Act; (c) to the Board of Regents continued under the Drugless Practitioners Act for the purpose of the administration or enforcement of that Act; (d) to the Ontario College of Social Workers and Social…

44 (1) A health information custodian may disclose personal health information about an individual to a researcher if the researcher, (a) submits to the custodian, (i) an application in writing, (ii) a research plan that meets the requirements of subsection (2), and (iii) a copy of the decision of a research ethics board that approves the research plan; and (b) enters into the agreement required by subsection (5). 2004, c. 3, Sched. A, s. 44 (1). Same (1.1) For greater certainty, the decision of only one research ethics board is sufficient for the purposes of subclause (1) (a) (iii). 2020, c. 5, Sched. 6, s. 6. Research plan (2) A research plan must be in writing and must set out, (a) the affiliation of each person involved in the research; (b) the nature and objectives of the research and the public or scientific benefit of the research that the researcher anticipates; and (c) all other…

45 (1) A health information custodian may disclose to a prescribed entity personal health information for the purpose of analysis or compiling statistical information with respect to the management of, evaluation or monitoring of, the allocation of resources to or planning for all or part of the health system, including the delivery of services, if the entity meets the requirements under subsection (3). 2004, c. 3, Sched. A, s. 45 (1). Exception (2) Subsection (1) does not apply to, (a) notes of personal health information about an individual that are recorded by a health information custodian and that document the contents of conversations during a private counselling session or a group, joint or family counselling session; or (b) prescribed information in circumstances that are prescribed. 2004, c. 3, Sched. A, s. 45 (2). Approval (3) A health information custodian may disclose persona…

46 (1) If requested by the Minister or the minister of a prescribed ministry, a health information custodian shall disclose personal health information to the minister who made the request for the purpose of determining, providing, monitoring or verifying payment or funding for health care funded wholly or in part by the Ministry, the prescribed ministry or the Agency or for goods used for health care funded wholly or in part by one or more of them. 2020, c. 5, Sched. 6, s. 8. Disclosure by minister (2) The Minister or a minister of a prescribed ministry may disclose information collected under subsection (1) to any person for a purpose set out in that subsection if the disclosure is reasonably necessary for that purpose. 2020, c. 5, Sched. 6, s. 8 (1). Other information (3) The Minister or minister of a prescribed ministry, as the case may be, who makes a request under subsection (1) sh…

47 (1) Repealed: 2019, c. 15, Sched. 30, s. 4. Same (2) Subject to the restrictions, if any, that are prescribed, a health information custodian shall, upon the request of the Minister, disclose personal health information to a health data institute that the Minister approves under subsection (9) for analysis with respect to the management of, evaluation or monitoring of, the allocation of resources to or planning for all or part of the health system, including the delivery of services, if the requirements of this section are met. 2004, c. 3, Sched. A, s. 47 (2). Form, manner and time of disclosure (3) The Minister may specify the form and manner in which and the time at which the health information custodian is required to disclose the personal health information under subsection (2). 2004, c. 3, Sched. A, s. 47 (3). Requirements for Minister (4) Before requesting the disclosure of pers…

48 (1) A health data institute to which a health information custodian has disclosed personal health information under section 47, shall, upon the request of the Minister and in accordance with the Commissioner’s approval given under this section, disclose the information to the Minister or another person approved by the Minister if the Minister is of the opinion that it is in the public interest to request the disclosure and the requirements of this section have been met. 2004, c. 3, Sched. A, s. 48 (1). Non-application of section (2) The personal health information mentioned in subsection (1) is not, (a) notes of personal health information about an individual that are recorded by a health information custodian and that document the contents of conversations during a private counselling session or a group, joint or family counselling session; or (b) information that is prescribed. 2004…

49 (1) Except as permitted or required by law and subject to the exceptions and additional requirements, if any, that are prescribed, a person who is not a health information custodian and to whom a health information custodian discloses personal health information, shall not use or disclose the information for any purpose other than, (a) the purpose for which the custodian was authorized to disclose the information under this Act; or (b) the purpose of carrying out a statutory or legal duty. 2004, c. 3, Sched. A, s. 49 (1). Extent of use or disclosure (2) Subject to the exceptions and additional requirements, if any, that are prescribed, a person who is not a health information custodian, and to whom a health information custodian discloses personal health information, shall not use or disclose more of the information than is reasonably necessary to meet the purpose of the use or disclo…

50 (1) A health information custodian may disclose personal health information about an individual collected in Ontario to a person outside Ontario only if, (a) the individual consents to the disclosure; (b) this Act permits the disclosure; (c) the person receiving the information performs functions comparable to the functions performed by a person to whom this Act would permit the custodian to disclose the information in Ontario under subsection 40 (2) or clause 43 (1) (b), (c), (d) or (e); (d) the following conditions are met: (i) the custodian is a prescribed entity mentioned in subsection 45 (1) and is prescribed for the purpose of this clause, (ii) the disclosure is for the purpose of health planning or health administration, (iii) the information relates to health care provided in Ontario to a person who is resident of another province or territory of Canada, and (iv) the disclosur…

PART V ACCESS TO Records of PERSONAL HEALTH INFORMATION AND CORRECTION

Access

51 (1) This Part does not apply to a record that contains, (a) quality of care information; (b) personal health information collected or created for the purpose of complying with the requirements of a quality assurance program within the meaning of the Health Professions Procedural Code that is Schedule 2 to the Regulated Health Professions Act, 1991; (c) raw data from standardized psychological tests or assessments; or (d) personal health information of the prescribed type in the custody or under the control of a prescribed class or classes of health information custodians. 2004, c. 3, Sched. A, s. 51 (1). Severable record (2) Despite subsection (1), this Part applies to that part of a record of personal health information that can reasonably be severed from the part of the record that contains the information described in clauses (1) (a) to (d). 2004, c. 3, Sched. A, s. 51 (2). Health …

52 (1) Subject to this Part, an individual has a right of access to a record of personal health information about the individual that is in the custody or under the control of a health information custodian unless, (a) the record or the information in the record is subject to a legal privilege that restricts disclosure of the record or the information, as the case may be, to the individual; (b) another Act, an Act of Canada or a court order prohibits disclosure to the individual of the record or the information in the record in the circumstances; (c) the information in the record was collected or created primarily in anticipation of or for use in a proceeding, and the proceeding, together with all appeals or processes resulting from it, have not been concluded; (d) the following conditions are met: (i) the information was collected or created in the course of an inspection, investigation…

53 (1) An individual may exercise a right of access to a record of personal health information by making a written request for access to the health information custodian that has custody or control of the information. 2004, c. 3, Sched. A, s. 53 (1). Detail in request (2) The request must contain sufficient detail to enable the health information custodian to identify and locate the record with reasonable efforts. 2004, c. 3, Sched. A, s. 53 (2). Assistance (3) If the request does not contain sufficient detail to enable the health information custodian to identify and locate the record with reasonable efforts, the custodian shall offer assistance to the person requesting access in reformulating the request to comply with subsection (2). 2004, c. 3, Sched. A, s. 53 (3).

54 (1) A health information custodian that receives a request from an individual for access to a record of personal health information shall, (a) make the record available to the individual for examination and, at the request of the individual, provide a copy of the record to the individual and if reasonably practical, an explanation of any term, code or abbreviation used in the record; (b) give a written notice to the individual stating that, after a reasonable search, the custodian has concluded that the record does not exist, cannot be found, or is not a record to which this Part applies, if that is the case; (c) if the custodian is entitled to refuse the request, in whole or in part, under any provision of this Part other than clause 52 (1) (c), (d) or (e), give a written notice to the individual stating that the custodian is refusing the request, in whole or in part, providing a rea…

54.1 (1) In this section, “consumer electronic service provider” means a person who provides electronic services to individuals at their request, primarily for, (a) the purpose of allowing those individuals to access, use, disclose, modify, maintain or otherwise manage their records of personal health information, or (b) such other purposes as may be prescribed. 2020, c. 5, Sched. 6, s. 10. Prescribed requirements (2) In providing electronic services to an individual, a consumer electronic service provider shall comply with the prescribed requirements. 2020, c. 5, Sched. 6, s. 10. Health number (3) Despite section 34, a consumer electronic service provider may, if authorized by the individual who requested the provider’s services, collect and use health numbers in accordance with any prescribed rules in order to verify the identity of an individual or for any other prescribed purpose. 20…

Correction

55 (1) If a health information custodian has granted an individual access to a record of his or her personal health information and if the individual believes that the record is inaccurate or incomplete for the purposes for which the custodian has collected, uses or has used the information, the individual may request in writing that the custodian correct the record. 2004, c. 3, Sched. A, s. 55 (1); 2007, c. 10, Sched. H, s. 21. Exception (1.1) Despite subsection (1), an individual is not entitled to request a correction by the prescribed organization when it acts as if it were a health information custodian with respect to the records described in subsection 51 (5), (6) or (7). 2025, c. 7, Sched. 6, s. 6 (1-3). Same (1.2) Despite subsection (1), an individual is not entitled to request a correction by a health information custodian with respect to the records described in subsection 51 …

Part v.1 Electronic Health Record

55.1 (1) In this Part, “advisory committee” means the advisory committee established by the Minister under section 55.11; (“comité consultatif”) “consent directive” means a directive under section 55.6 and includes a directive to modify or withdraw a directive that has already been made; (“directive en matière de consentement”) “electronic health record” means the electronic systems that are developed and maintained by the prescribed organization for the purpose of enabling health information custodians to collect, use and disclose personal health information by means of the systems in accordance with this Part and the regulations made under this Part; (“dossier de santé électronique”) “identifying information” has the same meaning as in subsection 4 (2). (“renseignements identificatoires”) 2016, c. 6, Sched. 1, s. 1 (11); 2019, c. 15, Sched. 30, s. 5. What constitutes collection, use, d…

55.2 (1) The prescribed organization has the power and the duty to develop and maintain the electronic health record in accordance with this Part and the regulations made under this Part. 2016, c. 6, Sched. 1, s. 1 (12). Functions of prescribed organization (2) The prescribed organization shall perform the following functions: 1. Manage and integrate personal health information it receives from health information custodians. 2. Ensure the proper functioning of the electronic health record by servicing the electronic systems that support the electronic health record. 3. Ensure the accuracy and quality of the personal health information that is accessible by means of the electronic health record by conducting data quality assurance activities on the personal health information it receives from health information custodians. 4. Conduct analyses of the personal health information that is acc…

55.3 The prescribed organization shall comply with the following requirements in developing and maintaining the electronic health record: 1. It shall take reasonable steps to limit the personal health information it receives to that which is reasonably necessary for developing and maintaining the electronic health record. 2. It shall not permit its employees or any other person acting on its behalf to view, handle or otherwise deal with the personal health information received from health information custodians, unless the employee or person acting on behalf of the prescribed organization agrees to comply with the restrictions that apply to the prescribed organization. 3. It shall make available to the public and to each health information custodian that provides personal health information to it, i. a plain language description of the electronic health record, including a general descri…

55.4 (1) The Minister may make directives to the prescribed organization with respect to the carrying out of its powers, duties and functions under this Part, and the prescribed organization shall comply with the directives of the Minister. 2016, c. 6, Sched. 1, s. 1 (14). Consultation (2) Before making a directive under subsection (1), the Minister shall, (a) submit a draft of the directive to the Commissioner and the advisory committee for the purpose of reviewing and making recommendations on the draft directive; and (b) consider the recommendations, if any, made by the Commissioner and the advisory committee and amend the directive if the Minister considers it appropriate to do so. 2016, c. 6, Sched. 1, s. 1 (14). Timing (3) The Minister shall allow the Commissioner and the advisory committee a period of at least 30 days for the purposes of review and recommendation under subsection …

55.5 (1) A health information custodian shall not collect personal health information by means of the electronic health record except for the purpose of, (a) providing or assisting in the provision of health care to the individual to whom the information relates; or (b) eliminating or reducing a significant risk of serious bodily harm to a person or group of persons, where the health information custodian believes on reasonable grounds that the collection is necessary for this purpose. 2016, c. 6, Sched. 1, s. 1 (15). Unique identification (2) A health information custodian may collect, use and disclose prescribed data elements for the purpose of uniquely identifying an individual in order to collect personal health information under subsection (1). 2016, c. 6, Sched. 1, s. 1 (15). Where consent directive exists (3) Despite subsection (1), where personal health information that is access…

55.6 (1) Subject to the limitations prescribed in the regulations, if any, an individual may at any time make a directive that withholds or withdraws, in whole or in part, the individual’s consent to the collection, use and disclosure of his or her personal health information by means of the electronic health record by a health information custodian for the purposes of providing or assisting in the provision of health care to the individual. 2016, c. 6, Sched. 1, s. 1 (16). Compliance (2) Where the prescribed organization receives a directive made under subsection (1), it shall, in accordance with the requirements prescribed in the regulations, if any, implement the directive. 2016, c. 6, Sched. 1, s. 1 (16). Withdrawal or modifications (3) Subject to the limitations prescribed in the regulations, if any, an individual who has made a directive under subsection (1) may withdraw or modify …

55.7 (1) Despite the contents of a consent directive, a health information custodian may disclose personal health information that is subject to the directive by means of the electronic health record if the custodian that is seeking to collect the information obtains the express consent of the individual to whom the information relates. 2016, c. 6, Sched. 1, s. 1 (17). Same, protection of individual (2) Despite the contents of a consent directive, a health information custodian may disclose personal health information that is subject to the directive by means of the electronic health record if, (a) the custodian that is seeking to collect the personal health information believes, on reasonable grounds, that the collection is necessary for the purpose of eliminating or reducing a significant risk of serious bodily harm to the individual to whom the information relates; and (b) it is not r…

55.8 Despite the contents of a consent directive, personal health information may be utilized by a system that is maintained by the prescribed organization and that retrieves, processes or integrates personal health information that is accessible by means of the electronic health record to provide alerts to health information custodians about potentially harmful medication interactions, as long as the alerts do not reveal personal health information that is subject to the consent directive. 2016, c. 6, Sched. 1, s. 1 (18). Section Amendments with date in force (d/m/y) 2016, c. 6, Sched. 1, s. 1 (18) - 01/10/2020

55.9 (1) Despite section 55.5, members of a ministry data integration unit located within the Ministry may collect personal health information by means of the electronic health record for the purposes set out in section 49.2 of the Freedom of Information and Protection of Privacy Act in accordance with the requirements set out in Part III.1 (Data Integration) of that Act. 2020, c. 5, Sched. 6, s. 11. No other uses and disclosures permitted (2) Despite any other provision in this Act or the regulations, members of a ministry data integration unit shall not use or disclose the personal health information collected under subsection (1) except as authorized by this section or by Part III.1 of the Freedom of Information and Protection of Privacy Act. 2020, c. 5, Sched. 6, s. 11. Direction to prescribed organization (3) A member of a ministry data integration unit located within the Ministry m…