Personal Health Information Protection Act, 2004, breach notification by the prescribed organization for digital health identifier records
S.O. 2004, c. 3, Sched. A, s. 55.24; O. Reg. 329/04, ss. 18.13 and 18.14
In force since .
A breach notification rule binding government bodies.
- Obligation class
- Breach notice, Reporting
- Audit expectation
- none
What it requires
- If you are the prescribed organization and determine that digital health identifier records have been stolen, lost or used or disclosed without authority, notify the individual to whom the personal health information relates at the first reasonable opportunity, and include a statement that the individual is entitled to make a complaint to the Commissioner (s. 55.24 (1) and (2)).
- Notify the Commissioner at the first reasonable opportunity where the prescribed circumstances exist, including reasonable grounds to believe a digital health identifier record was stolen, or was used or disclosed without authority by a person who knew or ought to have known they were doing so (s. 55.24 (3); O. Reg. 329/04, s. 18.13).
- On or before March 1 in each year starting in 2027, report to the Commissioner, by the electronic means and in the format the Commissioner determines, the number of times in the previous calendar year that digital health identifier records were stolen, lost, used without authority or disclosed without authority, and that personal health information was collected for Part V.2 purposes without authority (O. Reg. 329/04, s. 18.14).
These lines are LexLint's reading of the law's text.
What record it asks for
Logging duty
Section 55.24 and the regulation require notices to individuals and to the Commissioner and an annual count of thefts, losses and unauthorized uses, disclosures and collections. They do not require a log or register of incidents by name, set no period for keeping one, and say nobody may demand one, so no logging duty is found in the sections pinned here.
- Kind
- None
- As of
What this law does
If the prescribed organization determines that digital health identifier records have been stolen, lost or used or disclosed without authority, it shall, at the first reasonable opportunity, notify the individual to whom the personal health information relates. The notice to the individual must include a statement that the individual is entitled to make a complaint to the Commissioner under Part VI.
The prescribed organization shall, in accordance with the regulations, if any, notify the Commissioner of a theft or loss of or an unauthorized use or disclosure of digital health identifier records if the circumstances meet the prescribed requirements.
The circumstances in which the Agency must notify the Commissioner include reasonable grounds to believe that a digital health identifier record was used or disclosed without authority by a person who knew or ought to have known that they were doing so, and reasonable grounds to believe that a digital health identifier record was stolen. The Agency shall notify the Commissioner of the existence of such a circumstance at the first reasonable opportunity.
The Agency is an agent of the Crown and may exercise its powers only as an agent of the Crown. On or before March 1 in each year starting in 2027, the Agency shall provide the Commissioner with a report setting out the number of times in the previous calendar year that digital health identifier records were stolen, lost, used without authority or disclosed without authority, and that personal health information was collected by the Agency for the purposes of Part V.2 without authority. Section 8 of Schedule 6 to chapter 7 of 2025, which enacted section 55.24, was in force on .
When LexLint raises it
When your app profile says your app handles health records or processes personal data.
Back to the example · Lint your app
Page updated .