The Personal Health Information Protection Act (PHIPA) of Canada

Each province or territory in Canada has specific laws to protect individuals’ private health information from being shared without their consent. The Personal Health Information Protection Act (the name slightly differs by province or territory) protects information such as name, age, identification numbers, income, ethnicity, blood type, evaluations, opinion, social status, etc. This protection applies to documents (recorded in writing, print, audio tape, or film) held by any health information custodian (HIC).

Health information custodians

The Personal Health Information Protection Act (PHIPA) defines seven categories of health information custodians. The Act ensures that custodians treat all personal health information as confidential to maintain its security. The definition of an HIC may differ according to each province or territory, but health information custodians generally include the following:

• Hospitals and other health facilities
• Pharmacies
• Laboratories
• Health care practitioners (anyone who provides health care for payment exchange, publicly funded or not)
• Medical officers of health
• Long-term care providers
• Community care access corporations

Consent

Certain restrictions on the use and disclosure of personal information must also be followed by agents and service providers of the custodian. Generally, consent is required:

• for the collection, usage, and disclosure of personal health information, unless the PHIPA of the province allows the use without consent.
• for the purpose of proceeding.
• for the purpose of obtaining payment for health care or related health services.
• for the purpose of research (conditions apply).
• if required by law.

Specific rules, guidelines, and conditions are provided in each province or territory for marketing, fundraising or research purposes.

Accountability

If an individual identifies an error in their personal health records, they can file a written request to the health information custodian responsible for the error. If an individual believes the Act has been contravened by an HIC, they can file a complaint with the Privacy Commissioner of their province or territory.

Additional resource: Information and Privacy Commissioner of Ontario