PHIPA in Ontario: What Clinics Need to Know About Health Information Privacy

PHIPA, the Personal Health Information Protection Act, 2004, is the Ontario statute that sets the rules for how health information is collected, used, disclosed and protected, and it matters to any Ontario clinic that keeps patient records, including aesthetic and wellness clinics run by regulated health professionals. The Act places duties on a defined group called health information custodians, requires reasonable security, requires patients to be told when their information is lost or misused, and creates offences with fines for wilful misuse. This guide summarises those points from the statute text on the Ontario e-Laws site, read in a browser on 15 November 2026. It does not cover the Information and Privacy Commissioner's guidance, which could not be opened for this guide, and it does not decide whether a particular clinic is a custodian. It is general information, not legal advice, and an Ontario clinic should take advice on its own position.

Key takeaways

• PHIPA defines a health information custodian as a listed person or organisation with custody or control of personal health information, and the first listed group is a health care practitioner or a person who operates a group practice of health care practitioners.
• Section 12(1) requires a custodian to take reasonable steps to protect personal health information against theft, loss and unauthorised use or disclosure, and to protect records against unauthorised copying, modification or disposal.
• Where information is stolen, lost or used or disclosed without authority, the custodian must notify the individual at the first reasonable opportunity.
• Section 72 makes it an offence to wilfully collect, use or disclose personal health information in contravention of the Act, with fines up to $200,000 for a natural person or $1,000,000 for other persons.
• Clinics should map where patient data lives, including software and messaging tools, and ask vendors how they protect it.

What PHIPA is and who it covers

PHIPA is Schedule A to the Ontario statute S.O. 2004, c. 3. Section 3(1) says a health information custodian, subject to later subsections, means a person or organisation described in one of the listed paragraphs who has custody or control of personal health information as a result of or in connection with performing the powers, duties or work described in that paragraph. The first paragraph lists a health care practitioner or a person who operates a group practice of health care practitioners. Other paragraphs cover other health service providers. Whether a clinic that offers cosmetic treatments counts depends on who delivers the services and how the clinic is structured, which this guide does not decide. The related guide to opening a med spa in Ontario explains the health professions side, and the Regulated Health Professions Act, 1991 is the separate statute that governs those professions.

Agents and service providers

Section 2 defines an agent of a custodian as a person that, with the custodian's authorisation, acts for or on behalf of the custodian in respect of personal health information for the custodian's purposes, and not the agent's own purposes, whether or not the agent is employed by the custodian or paid. Staff, contractors and software vendors that handle patient information on behalf of a clinic can therefore fall within the Act's framework. This is why a clinic should have written terms with every vendor that touches patient data, and should understand what each vendor can see.

Security and breach notice

Section 12(1) says a custodian shall take steps that are reasonable in the circumstances to ensure that personal health information in its custody or control is protected against theft, loss and unauthorised use or disclosure, and that the records containing it are protected against unauthorised copying, modification or disposal. Section 12(2) says that, subject to exceptions and any additional requirements that are prescribed, if personal health information is stolen or lost, or is used or disclosed without authority, the custodian shall notify the individual at the first reasonable opportunity, and the notice has further required content. The Act also deals with reporting to the Information and Privacy Commissioner, which this guide did not verify, so clinics should read the rest of section 12 and the Commissioner's guidance before writing a breach procedure.

Offences and fines

Section 72(1) lists offences, including wilfully collecting, using or disclosing personal health information in contravention of the Act or its regulations, and disposing of a record with intent to evade an access request. Section 72(2) says a person guilty of an offence is liable on conviction, if a natural person, to a fine of not more than $200,000 or imprisonment of not more than one year or both, and if not a natural person, to a fine of not more than $1,000,000. Section 72(3) adds that officers, members, employees and other agents of a corporation who authorised or acquiesced in an offence can also be liable. The figures are taken from the statute text read on the date above, and they apply to offences, not to every privacy mistake.

Practical steps for an Ontario clinic

• Decide who the custodian is: take advice on whether the clinic, a practitioner or a group practice holds that role.
• Map the data: list every place patient information sits, including the record system, email, photos, messaging apps and backups.
• Limit access: give each staff role only the access it needs, and keep an audit trail.
• Write a breach procedure: who investigates, who notifies patients and how, and when the Commissioner is told.
• Control messaging: avoid putting treatment details in messages sent over consumer channels, and take advice before using WhatsApp or email for health information.
• Paper the vendors: keep written terms with each software provider and check where data is stored.
• Train staff: misuse by a staff member can be an offence, so training matters.

Questions for a software vendor

• Where is patient data stored and backed up, and who can access it?
• Can access be limited by role, and is every access logged?
• How are records exported and deleted when the clinic leaves?
• What happens in a breach: how will the vendor tell the clinic, and how quickly?
• Which sub-processors are used, such as cloud hosts or messaging providers?

Where CareTrack fits

CreativeIn Tek builds CareTrack, a clinic management system covering appointments, patient records, billing, packages and reporting, with WhatsApp messaging linked by QR code. This is a disclosure, not a recommendation. CareTrack does not send SMS or email reminders, has no French interface and runs on a single server region, and it is not certified under any healthcare compliance scheme. CareTrack does not make a clinic meet PHIPA, because that depends on how each clinic is organised and how it uses the system. Clinics in Alberta can compare the equivalent law in the guide to Alberta's Health Information Act for clinics, and a clinic can talk to CreativeIn Tek about its needs.

Frequently asked questions

What is PHIPA?

It is Ontario's Personal Health Information Protection Act, 2004, which sets rules for collecting, using, disclosing and protecting personal health information.

Who is a health information custodian under PHIPA?

Section 3(1) lists persons and organisations with custody or control of personal health information, starting with a health care practitioner or a person who operates a group practice of health care practitioners. Take advice on your own clinic.

Does a clinic have to tell patients about a privacy breach?

Section 12(2) says that if personal health information is stolen, lost or used or disclosed without authority, the custodian shall notify the individual at the first reasonable opportunity, subject to exceptions.

What are the fines under PHIPA?

Section 72(2) sets fines of up to $200,000 or one year in prison, or both, for a natural person and up to $1,000,000 for other persons, for the offences listed in section 72(1).

Are software vendors covered?

A vendor acting on a custodian's behalf can fall within the Act's definition of an agent, so clinics should have written terms with vendors and check how they protect data.

Last reviewed: 15 November 2026, against the statute text of the Personal Health Information Protection Act, 2004 on Ontario e-Laws, and the Regulated Health Professions Act, 1991 for the health professions framework. The Information and Privacy Commissioner's guidance was not read. Laws change, and this article is general information and not legal advice.