Personal Health Information Protection Act

Last updated
Personal Health Information Protection Act
Ontario legislative building.jpg
Legislative Assembly of Ontario
  • An Ontario Act to establish consistent rules governing the collection, use and disclosure of personal health information in the hands of ’health information custodians‘, such as doctors, hospitals or other health care providers.
Citation S.O. 2004, Chapter 3 Schedule A
Enacted by Legislative Assembly of Ontario
Assented to20 May 2004
Commenced1 November 2004
Legislative history
Bill titleBill 31, Schedule A
Introduced by Ministry of Consumer and Business Services and the Ministry of Health and Long Term Care

The Personal Health Information Protection Act, also known as PHIPA, is Ontario legislation established in November 2004. PHIPA is one of two components of the Health Information Protection Act 2004. [1]

Contents

The Health Information Protection Act, also established in 2004, comprises two schedules: PHIPA (Schedule A) and the Quality of Care Information Protection Act (Schedule B). [1] The PHIPA replaced the Health Cards and Numbers Control Act (SO 1991, c 1). [2]

PHIPA provides a set of rules for the collection, use and disclosure of personal health information by a "Health Information Custodian" (HIC), and includes the following provisions: [1]

History

Application

PHIPA applies to individuals and organizations involved in the delivery of healthcare services. Under the Act, they are referred to as HICs, "prescribed organizations", or "agencies", each with various function.

Health information custodians

A HIC can be any number of individuals or organizations who have custody or control of personal health information. [4] To elaborate, some examples of an HIC include:

Agents of health information custodians

An “agent” of an HIC includes anyone who is authorized by the HIC to do anything on behalf of the HIC with respect to personal health information. These actions are for the purposes of the HIC and not the agent. [4]

Examples include:

Role of the Information and Privacy Commissioner

The Information and Privacy Commissioner of Ontario (IPC) is appointed by the Legislative Assembly of Ontario and is independent of the government. [7] The IPC is responsible for ensuring that HICs comply with the Act. [8] Under PHIPA, the IPC has the power to review and make rulings about complaints.

ComplaintTime to File the Complaint
Personal health information has been collected, used or shared contrary to PHIPAWithin 1 year
A request to see personal health information has been deniedWithin 6 months
A request to have personal health information corrected has been deniedWithin 6 months

When the commissioner receives a complaint, a mediator may be appointed to try to solve the problem. The IPC has various powers to resolve complaints, including the power to order an HIC to:

Content

The Act covers the following subjects relating to personal health information in the province of Ontario:

Related Research Articles

Information privacy is the relationship between the collection and dissemination of data, technology, the public expectation of privacy, contextual information norms, and the legal and political issues surrounding them. It is also known as data privacy or data protection.

Confidentiality involves a set of rules or a promise usually executed through confidentiality agreements that limits the access to or places restrictions on distribution of certain types of information.

Medical privacy, or health privacy, is the practice of maintaining the security and confidentiality of patient records. It involves both the conversational discretion of health care providers and the security of medical records. The terms can also refer to the physical privacy of patients from other patients and providers while in a medical facility, and to modesty in medical settings. Modern concerns include the degree of disclosure to insurance companies, employers, and other third parties. The advent of electronic medical records (EMR) and patient care management systems (PCMS) have raised new concerns about privacy, balanced with efforts to reduce duplication of services and medical errors.

<span class="mw-page-title-main">Health Insurance Portability and Accountability Act</span> United States federal law concerning health information

The Health Insurance Portability and Accountability Act of 1996 is a United States Act of Congress enacted by the 104th United States Congress and signed into law by President Bill Clinton on August 21, 1996. It aimed to alter the transfer of healthcare information, stipulated the guidelines by which personally identifiable information maintained by the healthcare and healthcare insurance industries should be protected from fraud and theft, and addressed some limitations on healthcare insurance coverage. It generally prohibits healthcare providers and businesses called covered entities from disclosing protected information to anyone other than a patient and the patient's authorized representatives without their consent. The bill does not restrict patients from receiving information about themselves. Furthermore, it does not prohibit patients from voluntarily sharing their health information however they choose, nor does it require confidentiality where a patient discloses medical information to family members, friends or other individuals not employees of a covered entity.

<span class="mw-page-title-main">Data Protection Act 1998</span> United Kingdom legislation

The Data Protection Act 1998 was an Act of Parliament of the United Kingdom designed to protect personal data stored on computers or in an organised paper filing system. It enacted provisions from the European Union (EU) Data Protection Directive 1995 on the protection, processing, and movement of data.

<span class="mw-page-title-main">Medical record</span> Medical term

The terms medical record, health record and medical chart are used somewhat interchangeably to describe the systematic documentation of a single patient's medical history and care across time within one particular health care provider's jurisdiction. A medical record includes a variety of types of "notes" entered over time by healthcare professionals, recording observations and administration of drugs and therapies, orders for the administration of drugs and therapies, test results, X-rays, reports, etc. The maintenance of complete and accurate medical records is a requirement of health care providers and is generally enforced as a licensing or certification prerequisite.

<i>Personal Information Protection and Electronic Documents Act</i> 2000 Canadian law

The Personal Information Protection and Electronic Documents Act is a Canadian law relating to data privacy. It governs how private sector organizations collect, use and disclose personal information in the course of commercial business. In addition, the Act contains various provisions to facilitate the use of electronic documents. PIPEDA became law on 13 April 2000 to promote consumer trust in electronic commerce. The act was also intended to reassure the European Union that the Canadian privacy law was adequate to protect the personal information of European citizens. In accordance with section 29 of PIPEDA, Part I of the Act must be reviewed by Parliament every five years. The first Parliamentary review occurred in 2007.

A privacy policy is a statement or legal document that discloses some or all of the ways a party gathers, uses, discloses, and manages a customer or client's data. Personal information can be anything that can be used to identify an individual, not limited to the person's name, address, date of birth, marital status, contact information, ID issue, and expiry date, financial records, credit information, medical history, where one travels, and intentions to acquire goods and services. In the case of a business, it is often a statement that declares a party's policy on how it collects, stores, and releases personal information it collects. It informs the client what specific information is collected, and whether it is kept confidential, shared with partners, or sold to other firms or enterprises. Privacy policies typically represent a broader, more generalized treatment, as opposed to data use statements, which tend to be more detailed and specific.

<span class="mw-page-title-main">Ann Cavoukian</span> Canadian data privacy researcher and former Ontario civil servant (born 1952)

Ann Cavoukian is the former Information and Privacy Commissioner for the Canadian province of Ontario. Her concept of privacy by design, which takes privacy into account throughout the system engineering process, was expanded on, as part of a joint Canadian-Dutch team, both before and during her tenure as commissioner of Ontario.

Information privacy, data privacy or data protection laws provide a legal framework on how to obtain, use and store data of natural persons. The various laws around the world describe the rights of natural persons to control who is using its data. This includes usually the right to get details on which data is stored, for what purpose and to request the deletion in case the purpose is not given anymore.

<i>Privacy Act</i> (Canada) Canadian federal legislation (1983)

The Privacy Act is the federal information-privacy legislation of Canada that came into effect on July 1, 1983. Administered by the Privacy Commissioner of Canada, the Act sets out rules for how institutions of the Government of Canada collect, use, disclose, retain, and dispose of personal information of individuals.

Privacy law is the body of law that deals with the regulating, storing, and using of personally identifiable information, personal healthcare information, and financial information of individuals, which can be collected by governments, public or private organisations, or other individuals. It also applies in the commercial sector to things like trade secrets and the liability that directors, officers, and employees have when handing sensitive information.

<span class="mw-page-title-main">Canadian Institute for Health Information</span>

The Canadian Institute for Health Information (CIHI) is an independent, not-for-profit organization that provides essential information on Canada’s health systems and the health of Canadians. CIHI provides comparable and actionable data and information that are used to accelerate improvements in health care, health system performance and population health across Canada.

<span class="mw-page-title-main">Information and Privacy Commissioner of Ontario</span>

The Information and Privacy Commissioner of Ontario was established as an officer of the Legislature by Ontario's Freedom of Information and Protection of Privacy Act, which came into effect on January 1, 1988. The current commissioner is Patricia Kosseim.

<span class="mw-page-title-main">Canadian privacy law</span> Privacy law in Canada

Canadian privacy law is derived from the common law, statutes of the Parliament of Canada and the various provincial legislatures, and the Canadian Charter of Rights and Freedoms. Perhaps ironically, Canada's legal conceptualization of privacy, along with most modern legal Western conceptions of privacy, can be traced back to Warren and Brandeis’s "The Right to Privacy" published in the Harvard Law Review in 1890, Holvast states "Almost all authors on privacy start the discussion with the famous article 'The Right to Privacy' of Samuel Warren and Louis Brandeis".

Nursing home residents' rights are the legal and moral rights of the residents of a nursing home. Legislation exists in various jurisdictions to protect such rights. An early example of a statute protecting such rights is Florida statute 400.022, enacted in 1980, and commonly known as the Residents' Rights Act.

There is no absolute right to privacy in Australian law and there is no clearly recognised tort of invasion of privacy or similar remedy available to people who feel their privacy has been violated. Privacy is, however, affected and protected in limited ways by common law in Australia and a range of federal, state and territorial laws, as well as administrative arrangements.

<span class="mw-page-title-main">Data Protection Act, 2012</span> Legislation enacted by the Parliament of the Republic of Ghana

The Data Protection Act, 2012 is legislation enacted by the Parliament of the Republic of Ghana to protect the privacy and personal data of individuals. It regulates the process personal information is acquired, kept, used or disclosed by data controllers and data processors by requiring compliance with certain data protection principles. Non compliance with provisions of the Act may attract either civil liability, or criminal sanctions, or both, depending on the nature of the infraction. The Act also establishes a Data Protection Commission, which is mandated to ensure compliance with its provisions, as well as maintain the Data Protection Register.

ICES is an independent, non-profit corporation that applies the study of health informatics for health services research and population-wide health outcomes research in Ontario, Canada, using data collected through the routine administration of Ontario's system of publicly funded health care. 

Privacy in education refers to the broad area of ideologies, practices, and legislation that involve the privacy rights of individuals in the education system. Concepts that are commonly associated with privacy in education include the expectation of privacy, the Family Educational Rights and Privacy Act (FERPA), the Fourth Amendment, and the Health Insurance Portability and Accountability Act of 1996 (HIPAA). Most privacy in education concerns relate to the protection of student data and the privacy of medical records. Many scholars are engaging in an academic discussion that covers the scope of students’ privacy rights, from student in K-12 and even higher education, and the management of student data in an age of rapid access and dissemination of information.

References

  1. 1 2 3 Cavoukian, Ann (February 2005). "Frequently Asked Questions: Personal Health Information Protection Act" (PDF). Information and Privacy Commissioner of Ontario. Archived from the original (PDF) on 26 February 2007.
  2. "Personal Health Information Protection Act, 2004, SO 2004, c 3, Sch A". CanLII. Retrieved 21 January 2024.
  3. "Personal Health Personal Health Information Protection Information Protection Act, 2004: Act, 2004: An Overview An Overview" (PDF). Ministry of Health and Long-Term Care. Retrieved 11 December 2012.
  4. 1 2 3 Bearwood, John P.; Kerr, J. Alexis (2004). "Coming soon to a health sector near you: Advance look at the Ontario Personal Health Information Protection Act (PHIPA)". Healthcare Quarterly. 7 (4): 62–67. doi: 10.12927/hcq..16817 . PMID   15540406.
  5. "Your Health Information: Your Rights" (PDF). Information and Privacy Commissioner of Ontario. Archived from the original (PDF) on 3 November 2012. Retrieved 10 December 2012.
  6. "Personal Health Information Protection Act, 2004". Service Ontario. Retrieved 11 December 2012.
  7. "The role of the Information and Privacy Commissioner". IPC. Retrieved 2020-11-15.
  8. 1 2 "A Guide to the Personal Health Information Protection Act" (PDF). Archived from the original (PDF) on 22 February 2007. Retrieved 11 December 2012.