What does Ontario's PHIPA ask a health information custodian to do after a breach?

Who does this apply to?

Health information custodians. Section 12(1) says a custodian must take reasonable steps to protect the personal health information it holds or controls against theft, loss and unauthorized use or disclosure.

A health information custodian shall take steps that are reasonable in the circumstances to ensure that personal health information in the custodian's custody or control is protected against theft, loss and unauthorized use or disclosure and to ensure that the records containing the information are protected against unauthorized copying, modification or disposal.

When must a breach be reported?

Section 12(2) has no separate harm test. It applies when personal health information is stolen, lost, or used or disclosed without authority. The Act notes exceptions for researchers and any set by regulation.

if personal health information about an individual that is in the custody or control of a health information custodian is stolen or lost or if it is used or disclosed without authority, the health information custodian shall, (a) notify the individual at the first reasonable opportunity of the theft or loss or of the unauthorized use or disclosure;

Who must be told?

The individual the information is about, with a statement that they may complain to the Commissioner. The custodian must also notify the Information and Privacy Commissioner when the circumstances meet the conditions set by regulation.

(b) include in the notice a statement that the individual is entitled to make a complaint to the Commissioner under Part VI.

If the circumstances surrounding a theft, loss or unauthorized use or disclosure referred to in subsection (2) meet the prescribed requirements, the health information custodian shall notify the Commissioner of the theft or loss or of the unauthorized use or disclosure.

How fast?

The Act's words are "at the first reasonable opportunity". It gives no fixed number of days.

What can an outside reading show for this rule?

This law is about what a business does after a breach: who it tells, and how fast. An outside reading cannot tell whether a breach has happened inside your systems, what personal information you hold, whether it is encrypted where you keep it, or whether anyone has been told.

What it can show, read from outside the way anyone could, is evidence about ways someone could get in: whether your domain publishes a rule telling mail servers to refuse email forged in your name, whether remote access or file sharing services answer from the internet, and whether addresses at your domain are listed in monitored breach databases.

The text names none of these. They are evidence about how a breach could start, never proof that a firm meets the law.

Is this legal advice?

No. This summarises the public text; it is not legal advice.

The text itself is the authority. Read it at the source below.