Personal Health Information Protection Act, 2004, custodian and agent duties: consent, safeguards, information practices and marketing
Also known as PHIPA.
S.O. 2004, c. 3, Sched. A, ss. 10 (1)-(3), 11, 12 (1), 13, 15-20, 29-33, 49
In force since .
A sensitive categories rule binding public and private bodies.
- Obligation class
- Consent, Disclosure, Security, Governance, Retention
- Audit expectation
- none
As of .
What it requires
- These duties bind a health information custodian (a health care practitioner, hospital, pharmacy, laboratory, long-term care home, ambulance service or other class the Act lists) and a person acting as its agent.
- Do not collect, use or disclose personal health information about an individual unless you have the individual's consent and, to the best of your knowledge, the collection, use or disclosure is necessary for a lawful purpose, or the Act permits or requires it.
- Make sure a consent is the individual's own, is knowledgeable, relates to the information and is not obtained through deception or coercion. A consent to disclosure to a person that is not a health information custodian must be express unless an exception in section 18 applies.
- Do not collect, use or disclose personal health information if other information will serve the purpose, and do not collect, use or disclose more than is reasonably necessary to meet the purpose.
- Do not collect, use or disclose personal health information for marketing or market research unless the individual expressly consents and you follow the prescribed requirements.
- Use or disclose personal health information for fundraising only with the individual's express consent, or with implied consent where the information is only the individual's name and the prescribed contact information.
- Take steps that are reasonable in the circumstances to protect personal health information against theft, loss and unauthorized use or disclosure, and records against unauthorized copying, modification or disposal.
- Retain, transfer and dispose of records of personal health information in a secure manner and in accordance with the prescribed requirements.
- Take reasonable steps to ensure that personal health information you use is as accurate, complete and up-to-date as is necessary for the purposes of the use, and that it is not collected without authority.
- Have information practices that comply with the Act, follow them, designate a contact person if you are not a natural person, and make available to the public a written statement describing your information practices, how to contact you, how to seek access or correction and how to complain.
- Permit an agent to collect, use, disclose, retain or dispose of personal health information only where you are permitted to do so, it is necessary in the course of the agent's duties and the prescribed requirements are met, and take reasonable steps to ensure the agent acts only within that permission. You remain responsible for what your agents do.
- If you are not a health information custodian and receive personal health information from one, use or disclose it only for the purpose for which the custodian was authorized to disclose it or to carry out a statutory or legal duty, and no more of it than is reasonably necessary.
What this law does
The Act binds a health information custodian, a class that includes health care practitioners, hospitals, pharmacies, laboratories, long-term care homes and ambulance services, and it also binds an agent acting for a custodian.
A custodian must not collect, use or disclose personal health information about an individual unless it has the individual's consent and the collection, use or disclosure is, to the best of the custodian's knowledge, necessary for a lawful purpose, or unless the Act permits or requires it. A consent must be a consent of the individual, must be knowledgeable, must relate to the information and must not be obtained through deception or coercion.
A custodian must not collect, use or disclose personal health information if other information will serve the purpose, and must not collect, use or disclose more than is reasonably necessary to meet the purpose. A custodian must not collect, use or disclose personal health information for the purpose of marketing anything or for the purpose of market research unless the individual expressly consents.
A custodian must take steps that are reasonable in the circumstances to ensure that personal health information in its custody or control is protected against theft, loss and unauthorized use or disclosure. A custodian must have in place information practices that comply with the Act and its regulations, and must make available to the public a written statement of those practices.
A custodian is responsible for personal health information that its agents collect, use, disclose, retain or dispose of on its behalf. A person that is not a health information custodian and to whom a custodian discloses personal health information may use or disclose it only for the purpose for which the custodian was authorized to disclose it, or to carry out a statutory or legal duty, subject to the exceptions in the Act and its regulations.
When LexLint raises it
When your app profile says your app handles health records.