Personal Health Information Protection Act, 2004, access to electronic health record and digital health identifier records
S.O. 2004, c. 3, Sched. A, ss. 51 (5)-(8), 55 (1.1)-(1.2); O. Reg. 329/04, ss. 18.1.1 and 18.1.2.3
In force since .
A data subject rights rule binding public and private bodies.
- Obligation class
- Data subject rights, Reporting
- Audit expectation
- none
What it requires
- If you are the prescribed organization, handle a request for access to a record accessible through the electronic health record, to an electronic record kept under paragraphs 4, 5 and 6 of section 55.3, or to digital health identifier records, as a health information custodian would under Part V, subject to the prescribed exceptions and additional requirements (s. 51 (5), (6) and (7)).
- If you are a health information custodian, give access under Part V to the record of all instances in which an individual's personal health information accessible through the electronic health record was viewed, handled or otherwise dealt with by you (s. 51 (8)).
- Do not expect a correction request to be accepted by the prescribed organization for the records described in subsection 51 (5), (6) or (7), or by a health information custodian for the records described in subsection 51 (8) (s. 55 (1.1) and (1.2)).
- If you are the Agency, make available an electronic system to act as a digital means of access that permits individuals who have a digital health identifier and are specified on your website to access the records described in section 18.1.1 of the regulation, and from also make available an alternative process for individuals who cannot or do not wish to use it (O. Reg. 329/04, s. 18.1.1).
- Provide the Commissioner with an annual report on the previous calendar year on or before March 1 in each year starting in 2027 (O. Reg. 329/04, s. 18.1.2.3).
These lines are LexLint's reading of the law's text.
What record it asks for
Logging duty
Subsection 51 (8) extends the Part V right of access to the record of the instances in which electronic health record information was viewed, handled or otherwise dealt with by a custodian, and the regulation requires the Agency to keep, audit and monitor certain electronic records. The sections pinned here name no log of their own, set no period for keeping one and say nobody may demand one beyond that access right, so no separate logging duty is coded.
- Kind
- None
- As of
What this law does
Part V applies to the prescribed organization as if it were a health information custodian, and as if it had custody or control of a record of personal health information that is accessible to health information custodians by means of the electronic health record developed and maintained by the prescribed organization, subject to prescribed exceptions and additional requirements.
Part V applies to the prescribed organization as if it were a health information custodian with respect to an electronic record the prescribed organization keeps under paragraphs 4, 5 and 6 of section 55.3, subject to prescribed exceptions and additional requirements. Part V applies to the prescribed organization as if it were a health information custodian with respect to digital health identifier records, subject to prescribed exceptions and additional requirements.
Part V applies to a record in the custody or control of a health information custodian respecting all instances where all or part of an individual's personal health information that is accessible by means of the electronic health record is viewed, handled or otherwise dealt with by the custodian, subject to prescribed exceptions and additional requirements.
An individual is not entitled to request a correction by the prescribed organization when it acts as if it were a health information custodian with respect to the records described in subsection 51 (5), (6) or (7). An individual is not entitled to request a correction by a health information custodian with respect to the records described in subsection 51 (8).
The Agency shall make available an electronic system or systems to act as a digital means of access that permits individuals who have a digital health identifier and who are specified by the Agency on its website to access the records described in subsection 18.1.1 (2) of the regulation. From the regulation requires the Agency to make available both the digital means of access and an alternative process for individuals who cannot or do not wish to use the digital means of access.
The Agency shall provide an annual report to the Commissioner with respect to the previous calendar year. The Agency shall provide the report to the Commissioner on or before March 1 in each year starting in 2027. Section 5 of Schedule 6 to chapter 7 of 2025, which enacted subsections 51 (5) to (8), was in force on . Section 6 of Schedule 6 to chapter 7 of 2025, which enacted subsections 55 (1.1) and (1.2), was in force on .
When LexLint raises it
When your app profile says your app handles health records or processes personal data.
Back to the example · Lint your app
Page updated .