Personal Health Information Protection Act, 2004, digital health identifier activities of the prescribed organization
S.O. 2004, c. 3, Sched. A, ss. 55.15-55.23, 55.25, 55.26; O. Reg. 329/04, s. 18.1
In force since .
A sensitive categories rule binding government bodies.
- Obligation class
- Consent, Governance, Security, Retention, DPIA
- Audit expectation
- none
What it requires
- If you are the prescribed organization, carry out digital health identifier activities only in accordance with Part V.2 of the Act and the regulations (s. 55.16).
- Collect or use personal health information for digital health identifier activities only with the express consent of the individual it relates to, and do not collect, use or disclose it where other information will serve the purpose or in a greater amount than is reasonably necessary (s. 55.17).
- On and after the first anniversary of the day section 55.19 comes into force, have in place and comply with practices and procedures approved by the Commissioner that protect the privacy of the individuals whose personal health information is in the digital health identifier records, and publish a summary of them on your website as soon as possible after approval or renewal (s. 55.19).
- Make available to the public a plain language description of your digital health identifier activities, including a general description of the technical, administrative and physical safeguards in place (s. 55.20).
- Take reasonable steps to protect digital health identifier records against theft, loss, unauthorized use or disclosure, and unauthorized copying, modification or disposal, and dispose of a digital health identifier that has been inactive for two or more years in a secure manner (ss. 55.21 and 55.22).
- Assess the threats, vulnerabilities and risks to the security and integrity of digital health identifier records and the effect of the activities on privacy, before you first begin the activities, whenever a new significant security threat is identified, before a significant change is made to them, and whenever your approved practices and procedures require it (s. 55.25; O. Reg. 329/04, s. 18.15).
- Carry out every directive the Minister issues to you about digital health identifiers and digital health identifier activities (s. 55.26).
These lines are LexLint's reading of the law's text.
What record it asks for
Logging duty
Part V.2 requires approved practices and procedures, security assessments and secure disposal of an inactive digital health identifier, and allows the Minister to issue directives that include audit log and auditing requirements. Sections 55.15 to 55.25 name no log or register of their own and set no period for keeping one, so no logging duty is found in the sections pinned here.
- Kind
- None
- As of
What this law does
The Agency, the corporation continued by section 3 of the Connecting Care Act, 2019, is prescribed as the prescribed organization for the purposes of the Act. The Agency is an agent of the Crown and may exercise its powers only as an agent of the Crown. The prescribed organization may, in accordance with Part V.2 and the regulations, carry out digital health identifier activities.
The prescribed organization may, with the express consent of the individual to whom the personal health information relates, collect or use personal health information for the purpose of carrying out digital health identifier activities.
In carrying out digital health identifier activities, the prescribed organization shall not collect, use or disclose personal health information if other information will serve the purpose, or collect, use or disclose more personal health information than is reasonably necessary to meet the purpose.
On and after the first anniversary of the day section 55.19 comes into force, the prescribed organization shall have in place and comply with practices and procedures for protecting the privacy of the individuals whose personal health information is in the digital health identifier records, approved by the Commissioner.
The prescribed organization shall make available to the public a plain language description of the activities or services it provides under Part V.2, including a general description of the technical, administrative and physical safeguards in place.
The prescribed organization shall take steps that are reasonable in the circumstances to ensure that digital health identifier records are protected against theft, loss and unauthorized use or disclosure, and against unauthorized copying, modification or disposal. The prescribed organization shall ensure that a digital health identifier that has been inactive for two or more years is disposed of in a secure manner.
The prescribed organization shall assess the threats, vulnerabilities and risks to the security and integrity of digital health identifier records, and how its digital health identifier activities may affect the privacy of the individuals to whom the information relates. The prescribed organization shall carry out every directive that the Minister issues to it under section 55.26 about digital health identifiers and digital health identifier activities. Section 8 of Schedule 6 to chapter 7 of 2025, which enacted Part V.2, was in force on .
When LexLint raises it
When your app profile says your app handles health records.
Back to the example · Lint your app
Page updated .