Personal Health Information Protection Act, 2004, Commissioner's orders and administrative penalties
S.O. 2004, c. 3, Sched. A, ss. 56-64; O. Reg. 329/04, s. 35
In force since .
An enforcement supervision rule binding public and private bodies.
- Enforcement body
- Information and Privacy Commissioner of Ontario
- Audit expectation
- on_request
- Who audits it
- Regulator
As of .
What it requires
- These powers run against any person whose activities the Commissioner reviews, including a custodian, an agent of a custodian and a supplier of services to a custodian.
- Comply with an order of the Commissioner under the Act, including an order to perform a duty, to stop collecting, using or disclosing personal health information, or to return, transfer or dispose of records.
- If ordered to pay an administrative penalty, pay it to the Minister of Finance in the manner and by the time the order specifies.
If you get it wrong
Penalty structure
Ontario Regulation 329/04, section 35 (1), caps an administrative penalty for any number of contraventions set out in one order at $500,000 for a person that is not a natural person and $50,000 for a natural person. Section 35 (2) lets the Commissioner increase the amount by the economic benefit the person acquired from the contraventions.
- Rule
- Fixed only
- As of
- Currency
- CAD
- Fixed cap
- 500,000
What this law does
A person who has reasonable grounds to believe that another person has contravened or is about to contravene a provision of the Act or its regulations may make a complaint to the Commissioner.
After a review the Commissioner may order any person whose activities the Commissioner reviewed to perform a duty imposed by the Act or its regulations, to cease collecting, using or disclosing personal health information in contravention of the Act, or to return, transfer or dispose of records collected, used or disclosed in contravention of the Act.
The Commissioner may also order a person whose activities the Commissioner reviewed to pay an administrative penalty, for the purposes of encouraging compliance or preventing the person from deriving any economic benefit from a contravention. The power to order an administrative penalty has been in force since . The regulation that sets the maximum amounts, filed on , came into force on .
Under the regulation, an administrative penalty for any number of contraventions set out in an order may not exceed $50,000 for a natural person and $500,000 for a person that is not a natural person, and the Commissioner may increase the amount by the economic benefit the person acquired from the contraventions.
An order requiring payment of an administrative penalty may not be issued more than two years after the day the most recent contravention on which it is based first came to the knowledge of the Commissioner. An order that has become final may be filed with the Superior Court of Justice and is then enforceable as a judgment or order of that court.
When LexLint raises it
When your app profile says your app handles health records.