PHIPA (Personal Health Information Protection Act)
Also known as: PHIPA, Ontario PHIPA
PHIPA, Ontario's Personal Health Information Protection Act, sets rules for how health information custodians, such as doctors, hospitals, pharmacies, and labs, collect, use, disclose, and protect personal health information.
It gives patients rights to access and correct their records and requires breach notification. While other provinces have their own health privacy laws, PHIPA is often treated as a reference point, and its enforcement has become noticeably stronger in recent years.
PHIPA (Personal Health Information Protection Act), explained at three levels
At home
Think of your health record as a sealed file that only certain people may open, for certain reasons, with a log of every opening. PHIPA is the Ontario law that sets those rules. It decides who can collect, use, and share your health information, requires organizations to protect it, and gives you the right to see your own records and ask for corrections.
At work
PHIPA is Ontario's health privacy law. It governs health information custodians, such as hospitals, physicians, pharmacies, and labs, along with the agents and technology vendors working for them. It sets rules for consent, use, disclosure, security, breach notification, and patient access. For organizations, compliance shapes vendor contracts, system design, staff training, and exposure to fines and penalties.
At home
PHIPA works through roles. A custodian, such as your hospital, is responsible for your information. Agents, such as staff and contractors, act on the custodian's behalf. Within your circle of care, the people treating you can share information based on implied consent. You can ask for a copy of your records, request corrections, and place a 'lockbox' to stop certain information being shared. If your information is lost or viewed improperly, you must generally be told.
At work
Custodians may use and disclose information for treatment within the circle of care on implied consent, while uses such as marketing need express consent, and research needs ethics approval or another legal authority. Agents act under the custodian's direction, and electronic service providers and health information network providers have their own duties. Custodians must log access to electronic records, notify patients and the Information and Privacy Commissioner of certain breaches, and generally answer access requests within 30 days.
At home
Most health privacy breaches are not outside attacks but insiders viewing records they have no reason to see, often out of curiosity about a neighbour, relative, or celebrity. PHIPA treats this snooping as an offence, and access logs make it detectable, since every record view is recorded. Prosecutions and fines have followed. While firewalls matter, in my view audit logs and real consequences for snooping protect patients more than any firewall.
At work
New tools strain PHIPA's framework. AI scribes create audio recordings; analytics need de-identification that holds up against re-identification; cloud hosting outside Canada raises security and disclosure questions; and training models on patient data may be a new use needing legal authority. Since 2024, the Commissioner can issue administrative monetary penalties. Run privacy impact assessments, define data flows tightly in vendor contracts, follow IPC guidance, and map PHIPA against other provincial health laws and federal rules.
Real-world examples
At home
Sophie wanted to see her own hospital records in Ontario after an emergency visit. Using her PHIPA rights, she requested a copy and received it within the legal time limit, which helped her follow up with her family doctor.
At work
Marcus is a privacy officer at a Toronto health clinic network adopting an AI scribe. Under PHIPA, his team completed a privacy impact assessment, confirmed audio is deleted after notes are drafted, and updated patient consent notices.
How it compares
| feature | PHIPA (Personal Health Information Protection Act) | PIPEDA | HIPAA |
|---|---|---|---|
| Applies to | Ontario health information custodians | Private-sector commercial activity across Canada | US healthcare providers, plans, and partners |
| Jurisdiction | Ontario | Federal | United States |
| Regulator | Information and Privacy Commissioner of Ontario | Privacy Commissioner of Canada | US Department of Health and Human Services |
| Patient access rights | Yes | Yes | Yes |
PHIPA is Ontario's health-specific counterpart to PIPEDA, and Canada's rough equivalent of HIPAA.
For analysts
Health tech vendors selling into Ontario should design for PHIPA from the start. I'd document data flows, hosting locations, and access logging before the first hospital asks, because procurement privacy reviews can otherwise stall deals for months.
History & origin
Ontario's PHIPA came into force on November 1, 2004, around the same time the federal PIPEDA began applying to private-sector organizations. The federal government declared PHIPA substantially similar to PIPEDA for health information custodians, so PHIPA governs in their place. Ontario's Information and Privacy Commissioner oversees the law. High-profile 'snooping' cases, in which hospital staff looked at records of patients they weren't treating, led to prosecutions and stronger rules. Amendments in 2020 raised maximum fines and gave patients more rights over electronic records, and the commissioner gained the power to impose administrative monetary penalties. Other provinces, such as Alberta (Health Information Act) and Manitoba, have comparable laws. In my opinion, PHIPA's real test now is AI: scribes, analytics, and data sharing all depend on how it's interpreted.