Privacy responsibilities Ontario
Ontario: your duties as a health information custodian (PHIPA)
In Ontario, your clinic is a health information custodian under PHIPA. Your staff and the vendors who handle information for you are your agents, and you stay responsible for what they do with it. In practice that means a named contact person, a public statement of how you handle information, sensible safeguards, answers to patient requests within 30 days, and notice to patients and the IPC when something goes wrong.
What you must do
Name a contact person.
Patients and the IPC need one person to ask.
Choose someone to handle privacy questions, access requests and complaints. Put their name or title on your statement. IPC Ontario
Publish a written statement of your information practices.
Patients have a right to know how you handle their information.
Say what you collect and why, how to reach your contact person, how to see or correct a record, and how to complain to you and to the IPC. Post it in your clinic and on your website. PHIPA, section 16
Protect records with reasonable safeguards.
Many breaches start with an open door: a shared password, an unlocked screen, a misdirected fax.
Limit access to people who need it, use strong sign-in, lock devices, and sign agreements with every vendor that handles records. PHIPA, section 12
Let patients see and correct their records.
It is their information, and the law sets the clock.
Answer access requests within 30 days. You can extend once, by up to 30 more days, if you tell the patient in writing why. Answer correction requests within 30 days too. IPC Ontario, Access and correction
Tell patients if their information is lost, stolen or wrongly used.
Patients can only protect themselves if they know.
Notify them at the first reasonable opportunity, and tell them they can complain to the IPC. IPC Ontario, Report a health privacy breach
Tell the IPC in the cases the regulation lists.
Some breaches must reach the regulator, whatever their size.
These include theft, use or disclosure without authority, a pattern of similar breaches, and any significant breach. IPC Ontario
Send the IPC your annual breach statistics.
The IPC tracks breaches across the health sector.
If you had any breach in the year, file your statistics by March 1 of the next year, including breaches you did not have to report at the time. IPC Ontario, Annual reporting
Keep records for as long as your college requires.
Records support care, billing and complaints long after the visit.
For physicians, the CPSO requires 10 years from the last entry for adults, and 10 years after a minor turns 18. Other colleges set their own periods. CPSO, Medical Records Management
Why it matters
PHIPA treats your public statement as a promise to patients. Doing what it says, and being able to show it, is what protects your clinic when a patient asks a question or the IPC reviews a complaint.
Common mistakes
- A statement that names a contact person who has since left the clinic.
- Treating a vendor agreement as the vendor’s responsibility. You remain the custodian.
- Answering an access request informally and letting the 30 days run out.
- Forgetting the March 1 statistics because the year’s breaches were small.
How PulseAI helps
- We use health information only to do the work your clinic asks for, and never share it.
- Everyone who works with it has agreed to the same rules in writing.
- If anything is ever accessed or shared without permission, we tell you right away.
- Your access records and our risk-assessment results are yours on request.
See how we protect your data on the Trust Center.
Questions, answered
Is my clinic a health information custodian?
In most cases, yes. Health care practitioners and the people who operate clinics that provide health care are custodians under PHIPA. Your staff and vendors act as your agents.
How long do I have to answer a patient's access request?
30 days. You can extend once, by up to 30 more days, if you tell the patient in writing why.
When do I have to tell the IPC about a breach?
In the cases the regulation lists, such as theft, use or disclosure without authority, a pattern of similar breaches, or any significant breach. Separately, file your annual breach statistics by March 1 if you had any breach that year.
How long must an Ontario physician keep records?
The CPSO requires 10 years from the last entry for adult patients, and 10 years after a minor turns 18.
Your next step
Give every patient a clear privacy statement, and keep their acknowledgement on file.
Comparing vendors? Request our security package.
This page explains common obligations in plain language. It isn’t legal advice. Check with your privacy officer or lawyer for your situation.
Your privacy responsibilities: the other pages
- QuébecLaw 25 and the health information act.
- Rest of CanadaPIPEDA and provincial health acts.
- United StatesDuties of a covered entity.
- Working with vendorsBAAs and service agreements.
- Using AI with patient dataFive plain rules.
- If something goes wrongBreach basics, and who to tell.
- Patient privacy templatesFree statements and acknowledgements.
How we protect your patients’ information is on our Trust Center.