Personal Health Information Protection Act, 2004 – Key Principles

Health information in Ontario is protected by the Personal Health Information Protection Act, 2004 (“PHIPA”). PHIPA is a privacy law that came into effect on November 1, 2004. It applies to all Health Information Custodians or “HIC”s in Ontario. The term “HIC” refers to most health care providers including doctors, nurses, dentists, pharmacists, hospitals, labs, long-term care facilities, ambulance services, etc. The County of Oxford has two municipal HIC’s (EMS and Woodingford Lodge) that are subject to this law.


PHIPA protects the privacy of all individuals by:

• establishing rules for the collection, use and disclosure of personal health information that protect the privacy of individuals, while facilitating the provision of health care;
• providing individuals with a legal right to access and correct their own personal health information held by HICs, subject to limited and specific exceptions; and
• ensuring accountability by appointing an independent body, the Information and Privacy Commissioner (“IPC”), to investigate complaints from the public concerning the information handling practices of HICs in Ontario.

What is Personal Health Information?

Personal health information or “PHI” is information, whether in oral or recorded form, that identifies you and that relates to the following:

• your physical or mental health, including family medical history;
• details of your health care, including treatments, medications;
• payments or eligibility for coverage for health care;
• your Ontario health card number; or
• the identity of your substitute decision-maker.