PHIPA.

## What it is PHIPA is Ontario's sector-specific privacy statute governing personal health information (PHI). Enforced by the Information and Privacy Commissioner of Ontario (IPC), it operates as substantially-similar legislation to PIPEDA for the Ontario health sector — PIPEDA does not apply to PHI handled by Ontario health information custodians (HICs). ## Who it applies to Health information custodians as defined in section 3 — a broad category including: - Health care practitioners (physicians, dentists, nurses, pharmacists, psychologists, and other regulated health professionals) - Hospitals, long-term care homes, community care access centres - Independent health facilities, laboratories, specimen collection centres - Ambulance services - Ministry of Health and Long-Term Care in specified capacities - Local health integration networks Agents of custodians (employees, contractors, service providers) are bound by the same duties on the custodian's behalf. ## Key data protection requirements Custodians must obtain express or implied consent depending on circumstance, limit collection/use/disclosure to what is reasonably necessary, provide individuals with access to their PHI, and implement safeguards appropriate to sensitivity. The circle-of-care doctrine allows PHI sharing among practitioners providing care to the same individual without explicit consent for each transfer. ## Breach reporting Since October 1, 2017, PHIPA has required custodians to: - **Notify affected individuals** at the first reasonable opportunity of any theft, loss, or unauthorized use/disclosure of PHI - **Notify the IPC** in prescribed circumstances (Ontario Regulation 224/17): where the incident was theft/deliberate act by an agent, involved further unauthorized use after initial breach, is part of a pattern of breaches, or the custodian would be required to notify the College or regulator - **Report annually to the IPC** the total number of privacy breaches — regardless of whether they met the individual-notification threshold ## Penalties Provincial offence prosecutions can result in fines up to CAD $200,000 for individuals and CAD $1,000,000 for corporations under section 72. Wilful contravention, use of PHI for personal gain, or obstruction of the Commissioner is treated as an offence. The IPC also has order-making powers to require compliance, cease certain practices, and require security improvements. ## How LeakTrace aligns LeakTrace runs continuous monitoring on healthcare-sector exposures — credential leaks affecting practitioner accounts, misconfigured PHI-adjacent infrastructure, dark-web listings of Ontario health data. Breach evidence is prepared for IPC submission with chain-of-custody documentation and includes the annual breach statistics format IPC now requires from HICs.