Personal Health Information Protection Act, 2004, S.O. 2004, c. 3, Sched. A

CONTENTS PART I INTERPRETATION AND APPLICATION Purposes, Definitions and Interpretation 1. Purposes 2. Definitions 3. Health information custodian 4. Personal health information 5. Substitute decision-maker 6. Interpretation Application of Act 7. Application of Act 8. Freedom of information legislation 9. Non-application of Act PART II PRACTICES TO PROTECT PERSONAL HEALTH INFORMATION General 10. Information practices 10.1 Electronic audit log 11. Accuracy 11.1 Steps to ensure collection 11.2 Limits on use of de-identified information 12. Security Records 13. Handling of records 14. Place where records kept Accountability and Openness 15. Contact person 16. Written public statement 17. Agents and information 17.1 Notice to governing College PART III CONSENT CONCERNING PERSONAL HEALTH INFORMATION General 18. Elements of consent 19. Withdrawal of consent 20. Assumption of validity Capacity and Substitute Decision-Making 21. Capacity to consent 22. Determination of incapacity 23. Persons who may consent 24. Factors to consider for consent 25. Authority of substitute decision-maker 26. Incapable individual: persons who may consent 27. Appointment of representative 28. Transition, representative appointed by Board PART IV COLLECTION, USE AND DISCLOSURE OF PERSONAL HEALTH INFORMATION General Limitations and Requirements 29. Requirement for consent 30. Other information 31. Use and disclosure of personal health information 32. Fundraising 33. Marketing 34. Health cards and health numbers 35. Fees for personal health information Collection 36. Indirect collection Use 37. Permitted use Disclosure 38. Disclosures related to providing health care 39. Disclosures for health or other programs 40. Disclosures related to risks 41. Disclosures for proceedings 42. Disclosure to successor 43. Disclosures related to this or other Acts 44. Disclosure for research 45. Disclosure for planning and management of health system 46. Health care payments 47. Disclosure for analysis of health system 48. Disclosure with Commissioner’s approval 49. Restrictions on recipients 50. Disclosure outside Ontario PART V ACCESS TO RECORDS OF PERSONAL HEALTH INFORMATION AND CORRECTION Access 51. Application of Part 52. Individual’s right of access 53. Request for access 54. Response of health information custodian 54.1 Consumer electronic service providers Correction 55. Correction PART V.1 ELECTRONIC HEALTH RECORD 55.1 Interpretation 55.2 Electronic health record 55.3 Requirements for electronic health record 55.4 Minister’s directives 55.5 Collection, use, disclosure by custodians 55.6 Consent directives 55.7 Consent overrides 55.8 Medication interaction checks 55.9 Collection of information by Ministry 55.9.1 Provision of personal health information to, and collection by, coroners and medical officers of health 55.10 Provision of information for purposes other than health care 55.11 Advisory committee 55.12 Practices and procedures review 55.13 Protection from liability for health information custodian 55.14 Regulations PART V.2 DIGITAL HEALTH IDENTIFIER ACTIVITIES Interpretation 55.15 Interpretation Power and Duty of Prescribed Organization 55.16 Digital health identifier activities Collection, Use and Disclosure of Personal Health Information 55.17 Personal health information for digital health identifier activities 55.18 Application of Part III Administration 55.19 Practices and procedures 55.20 Description to public 55.21 Protection of information 55.22 Disposal of inactive digital health identifier 55.23 Persons acting on prescribed organization’s behalf 55.24 Breach notification 55.25 Prescribed organization’s assessment 55.26 Directives Regulations 55.27 Regulations PART VI ADMINISTRATION AND ENFORCEMENT Complaints, Reviews and Inspections 56. Complaint to Commissioner 57. Response of Commissioner 58. Commissioner’s self-initiated review 59. Conduct of Commissioner’s review 60. Inspection powers 61. Powers of Commissioner 61.1 Administrative penalties 62. Appeal of order 63. Enforcement of order 64. Further order of Commissioner 65. Damages for breach of privacy 65.1 Enforcement measures Commissioner 66. General powers 67. Delegation 68. Limitations re personal health information 69. Immunity PART VII GENERAL 70. Non-retaliation 71. Immunity 71.1 Production order 72. Offences 73. Regulations 74. Public consultation before making regulations 75. Review of Act part i INTERPRETation and application Purposes, Definitions and Interpretation Purposes 1 The purposes of this Act are, (a) to establish rules for the collection, use and disclosure of personal health information about individuals that protect the confidentiality of that information and the privacy of individuals with respect to that information, while facilitating the effective provision of health care; (b) to provide individuals with a right of access to personal health information about themselves, subject to limited and specific exceptions set out in this Act; (c) to provide individuals with a right to require the correction or amendment of personal health information about themselves, subject to limited and specific exceptions set out in this Act; (d) to provide for independent review and resolution of complaints with respect to personal health information; and (e) to provide effective remedies for contraventions of this Act. 2004, c. 3, Sched. A, s. 1. Definitions 2 In this Act, “account management services” means the services provided by the prescribed organization that, (a) maintain the confidentiality, integrity or availability of an individual’s digital health identifier or related personal health information, (b) relate to the maintenance of an individual’s digital health identifier or related personal health information, (c) manage the activation, deactivation, reactivation or disposal of an individual’s digital health identifier or related personal health information, or (d) are prescribed; (“services de gestion des comptes”) “Agency” means the corporation continued by section 3 of the Connecting Care Act, 2019; (“Agence”) “agent”, in relation to a health information custodian, means a person that, with the authorization of the custodian, acts for or on behalf of the custodian in respect of personal health information for the purposes of the custodian, and not the agent’s own purposes, whether or not the agent has the authority to bind the custodian, whether or not the agent is employed by the custodian and whether or not the agent is being remunerated; (“mandataire”) “Assistant Commissioner” means the Assistant Commissioner for Personal Health Information appointed under the Freedom of Information and Protection of Privacy Act; (“commissaire adjoint”) “attorney for personal care” means an attorney under a power of attorney for personal care made in accordance with the Substitute Decisions Act, 1992; (“procureur au soin de la personne”) “attorney for property” means an attorney under a continuing power of attorney for property made in accordance with the Substitute Decisions Act, 1992; (“procureur aux biens”) “authentication services” means, (a) services that rely upon validation and verification services to establish confidence in an individual’s identity, or (b) any other prescribed services; (“services d’authentification”) “Board” means the Consent and Capacity Board constituted under the Health Care Consent Act, 1996; (“Commission”) “capable” means mentally capable, and “capacity” has a corresponding meaning; (“capable”, “capacité”) “collect”, in relation to personal health information, means to gather, acquire, receive or obtain the information by any means from any source, and “collection” has a corresponding meaning; (“recueillir”, “collecte”) “Commissioner” means the Information and Privacy Commissioner appointed under the Freedom of Information and Protection of Privacy Act; (“commissaire”) “Crown” means the Crown in right of Ontario; (“Couronne”) “de-identify”, in relation to the personal health information of an individual, means to remove any information that identifies the individual or for which it is reasonably foreseeable in the circumstances that it could be utilized, either alone or with other information, to identify the individual, and “de-identification” has a corresponding meaning; (“anonymiser”) Note: On a day to be named by proclamation of the Lieutenant Governor, the definition of “de-identify” in section 2 of the Act is amended by striking out “to remove any information” and substituting “to remove, in accordance with such requirements as may be prescribed, any information”. (See: 2020, c. 5, Sched. 6, s. 1 (2)) “digital health identifier” means the unique identifier created by the prescribed organization for an individual through validation and verification services that confirm the identity of the individual; (“identifiant Santé numérique”) “digital health identifier activities” means, (a) account management services, (b) authentication services, (c) validation and verification services, (d) any other activities reasonably necessary for providing digital health identifiers to persons, including activities to improve or maintain the quality or efficacy of these activities, or (e) any other prescribed activities; (“activités liées aux identifiants Santé numériques”) “digital health identifier records” means records of personal health information that, (a) are in the prescribed organization’s custody or under its control, and (b) are collected or used by the prescribed organization under Part V.2; (“dossiers liés aux identifiants Santé numériques”) “disclose”, in relation to personal health information in the custody or under the control of a health information custodian or a person, means to make the information available or to release it to another health information custodian or to another person, but does not include to use the information, and “disclosure” has a corresponding meaning; (“divulguer”, “divulgation”) “guardian of property” means a guardian of property or a statutory guardian of property under the Substitute Decisions Act, 1992; (“tuteur aux biens”) “guardian of the person” means a guardian of the person appointed under the Substitute Decisions Act, 1992; (“tuteur à la personne”) “health care” means any observation, examination, assessment, care, service or procedure that is done for a health‑related purpose and that, (a) is carried out or provided to diagnose, treat or maintain an individual’s physical or mental condition, (b) is carried out or provided to prevent disease or injury or to promote health, or (c) is carried out or provided as part of palliative care, and includes, (d) the compounding, dispensing or selling of a drug, a device, equipment or any other item to an individual, or for the use of an individual, pursuant to a prescription, and (e) Repealed: 2020, c. 13, Sched. 3, s. 8 (1). (f) a home and community care service that is funded under section 21 of the Connecting Care Act, 2019, “health care practitioner” means, (a) a person who is a member within the meaning of the Regulated Health Professions Act, 1991 and who provides health care, (b) Repealed: 2007, c. 10, Sched. P, s. 19. (c) a person who is a member of the Ontario College of Social Workers and Social Service Workers and who provides health care, or (d) any other person whose primary function is to provide health care for payment; (“praticien de la santé”) “health information custodian” has the meaning set out in section 3; (“dépositaire de renseignements sur la santé”) “health number” means the number, the version code or both of them assigned to an insured person within the meaning of the Health Insurance Act by the General Manager within the meaning of that Act; (“numéro de la carte Santé”) “incapable” means mentally incapable, and “incapacity” has a corresponding meaning; (“incapable”, “incapacité”) “individual”, in relation to personal health information, means the individual, whether living or deceased, with respect to whom the information was or is being collected or created; (“particulier”) “information practices”, in relation to a health information custodian, means the policy of the custodian for actions in relation to personal health information, including, (a) when, how and the purposes for which the custodian routinely collects, uses, modifies, discloses, retains or disposes of personal health information, and (b) the administrative, technical and physical safeguards and practices that the custodian maintains with respect to the information; (“pratiques relatives aux renseignements”) “Minister” means the Minister of Health and Long-Term Care; (“ministre”) “Ministry” means the Ministry of Health and Long-Term Care; (“ministère”) “partner” means either of two persons who have lived together for at least one year and have a close personal relationship that is of primary importance in both persons’ lives; (“partenaire”) “person” includes a partnership, association or other entity; (“personne”) “personal health information” has the meaning set out in section 4; (“renseignements personnels sur la santé”) “prescribed” means prescribed by the regulations made under this Act; (“prescrit”) “prescribed organization” means the organization prescribed under clause 73 (1) (d.1) and, if more than one organization is prescribed, means every applicable prescribed organization; (“organisation prescrite”) “proceeding” includes a proceeding held in, before or under the rules of a court, a tribunal, a commission, a justice of the peace, a coroner, a committee of a College within the meaning of the Regulated Health Professions Act, 1991, a committee of the Board of Regents continued under the Drugless Practitioners Act, a committee of the Ontario College of Social Workers and Social Service Workers under the Social Work and Social Service Work Act, 1998, a committee of the Authority within the meaning of the Health and Supportive Care Providers Oversight Authority Act, 2021, an arbitrator or a mediator; (“instance”) “quality of care information” has the same meaning as in the Quality of Care Information Protection Act, 2004; (“renseignements sur la qualité des soins”) “record” means a record of information in any form or in any medium, whether in written, printed, photographic or electronic form or otherwise, but does not include a computer program or other mechanism that can produce a record; (“dossier”) “relative” means either of two persons who are related to each other, including through marriage or adoption; (“membre de la famille”) “research” means a systematic investigation designed to develop or establish principles, facts or generalizable knowledge, or any combination of them, and includes the development, testing and evaluation of research; (“recherche”) “researcher” means a person who conducts research; (“chercheur”) “research ethics board” means a board of persons that is established for the purpose of approving research plans under section 44 and that meets the prescribed requirements; (“commission d’éthique de la recherche”) “spouse” means either of two persons who, (a) are married to each other, or (b) live together in a conjugal relationship outside marriage and, (i) have cohabited for at least one year, (ii) are together the parents of a child, or (iii) have together entered into a cohabitation agreement under section 53 of the Family Law Act, unless they are living separate and apart as a result of a breakdown of their relationship; (“conjoint”) “substitute decision-maker” has the meaning set out in section 5; (“mandataire spécial”) “use”, in relation to personal health information in the custody or under the control of a health information custodian or a person, means to view, handle or otherwise deal with the information, subject to subsection 6 (1), but does not include to disclose the information, and “use”, as a noun, has a corresponding meaning. (“utiliser”, “utilisation”) “validation and verification services” means services that, (a) validate the health number and additional personal health information from the health card provided by the individual, including by relying on a database for health cards maintained by the Minister, (b) verify that an individual who is providing the health number or additional personal health information, and such other identifying information as may be requested by the prescribed organization, is the individual to whom the health number or personal health information relates, (c) rely upon the services described in clauses (a) and (b), or such other services as may be prescribed, to create or renew an individual’s digital health identifier, or (d) are prescribed. (“services de validation et de vérification”) 2004, c. 3, Sched. A, s. 2; 2006, c. 4, s. 51 (1); 2007, c. 8, s. 224 (1); 2007, c. 10, Sched. P, s. 19; 2016, c. 6, Sched. 1, s. 1 (1, 2); 2016, c. 23, s. 64 (1); 2019, c. 5, Sched. 3, s. 17 (1, 2); 2019, c. 15, Sched. 30, s. 1; 2020, c. 5, Sched. 6, s. 1 (1); 2020, c. 13, Sched. 3, s. 8 (1, 2); 2021, c. 4, Sched. 11, s. 27 (1); 2021, c. 27, Sched. 2, s. 68 (1); 2025, c. 7, Sched. 6, s. 1. Section Amendments with date in force (d/m/y) 2006, c. 4, s. 51 (1) - 28/03/2006 2007, c. 8, s. 224 (1) - 01/07/2010; 2007, c. 10, Sched. P, s. 19 - 01/07/2015 2016, c. 6, Sched. 1, s. 1 (1, 2) - 03/06/2016; 2016, c. 23, s. 64 (1) - 05/12/2016 2019, c. 5, Sched. 3, s. 17 (1) - 28/06/2024; 2019, c. 5, Sched. 3, s. 17 (2) - 06/06/2019; 2019, c. 15, Sched. 30, s. 1 - 31/07/2020 2020, c. 5, Sched. 6, s. 1 (1) - 25/03/2020; 2020, c. 5, Sched. 6, s. 1 (2) - not in force; 2020, c. 13, Sched. 3, s. 8 (1, 2) - 01/05/2022 2021, c. 4, Sched. 11, s. 27 (1) - 19/04/2021; 2021, c. 27, Sched. 2, s. 68 (1) - 01/12/2024 2025, c. 7, Sched. 6, s. 1 (1, 2) - 01/01/2026 Health information custodian 3 (1) In this Act, “health information custodian”, subject to subsections (3) to (11), means a person or organization described in one of the following paragraphs who has custody or control of personal health information as a result of or in connection with performing the person’s or organization’s powers or duties or the work described in the paragraph, if any: 1. A health care practitioner or a person who operates a group practice of health care practitioners. 2. Repealed: 2020, c. 13, Sched. 3, s. 8 (3). 3. A health service provider or person or entity that is part of an Ontario Health Team and that provides a home and community care service pursuant to funding under section 21 of the Connecting Care Act, 2019, including a person or entity from whom the provider or Team has purchased the home and community care service. A health service provider or person or entity that is part of an Ontario Health Team is a health information custodian in connection with the provision of any home and community care service within the meaning of the Connecting Care Act, 2019, even where a particular home and community care service is not funded under that Act. 4. A person who operates one of the following facilities, programs or services: i. A hospital within the meaning of the Public Hospitals Act, a private hospital within the meaning of the Private Hospitals Act, a psychiatric facility within the meaning of the Mental Health Act or an integrated community health services centre within the meaning of the Integrated Community Health Services Centres Act, 2023. ii. A long-term care home within the meaning of the Fixing Long-Term Care Act, 2021, a placement co-ordinator described in subsection 47 (1) of that Act, or a care home within the meaning of the Residential Tenancies Act, 2006. ii.1 a retirement home within the meaning of the Retirement Homes Act, 2010. iii. A pharmacy within the meaning of the Drug and Pharmacies Regulation Act. iv. A laboratory or a specimen collection centre as defined in section 5 of the Laboratory and Specimen Collection Centre Licensing Act. v. An ambulance service within the meaning of the Ambulance Act. vi. A home for special care within the meaning of the Homes for Special Care Act. vii. A centre, program or service for community health or mental health whose primary purpose is the provision of health care. 5. An evaluator within the meaning of the Health Care Consent Act, 1996 or an assessor within the meaning of the Substitute Decisions Act, 1992. 6. A medical officer of health of a board of health within the meaning of the Health Protection and Promotion Act. 7. The Minister, together with the Ministry of the Minister if the context so requires. 8. Any other person prescribed as a health information custodian if the person has custody or control of personal health information as a result of or in connection with performing prescribed powers, duties or work or any prescribed class of such persons. 2004, c. 3, Sched. A, s. 3 (1); 2006, c. 17, s. 253; 2007, c. 8, s. 224 (2-4); 2007, c. 10, Sched. H, s. 1; 2009, c. 33, Sched. 18, s. 25 (1); 2010, c. 11, s. 128; 2016, c. 30, s. 43 (1); 2019, c. 15, Sched. 30, s. 2; 2020, c. 5, Sched. 6, s. 2, 26 (3); 2020, c. 13, Sched. 3, s. 8 (3, 4); 2021, c. 39, Sched. 2, s. 20; 2023, c. 4, Sched. 1, s. 75. (2) Repealed: 2009, c. 33, Sched. 18, s. 25 (2). Exceptions (3) Except as is prescribed, a person described in any of the following paragraphs is not a health information custodian in respect of personal health information that the person collects, uses or discloses while performing the person’s powers or duties or the work described in the paragraph, if any: 1. A person described in paragraph 1, 3 or 5 of the definition of “health information custodian” in subsection (1) who is an agent of a health information custodian. 2. A person who is authorized to act for or on behalf of a person that is not a health information custodian, if the scope of duties of the authorized person does not include the provision of health care. 3. The Minister when acting on behalf of an institution within the meaning of the Freedom of Information and Protection of Privacy Act or the Municipal Freedom of Information and Protection of Privacy Act that is not a health information custodian. 2004, c. 3, Sched. A, s. 3 (3); 2020, c. 13, Sched. 3, s. 8 (5, 6). Other exceptions (4) A health information custodian does not include a person described in one of the following paragraphs who has custody or control of personal health information as a result of or in connection with performing the work described in the paragraph: 1. An aboriginal healer who provides traditional healing services to aboriginal persons or members of an aboriginal community. 2. An aboriginal midwife who provides traditional midwifery services to aboriginal persons or members of an aboriginal community. 3. A person who treats another person solely by prayer or spiritual means in accordance with the tenets of the religion of the person giving the treatment. 2004, c. 3, Sched. A, s. 3 (4). Multiple facilities (5) Subject to subsection (6) or an order of the Minister under subsection (8), a health information custodian that operates more than one facility described in one of the subparagraphs of paragraph 4 of the definition of “health information custodian” in subsection (1) shall be deemed to be a separate custodian with respect to personal health information of which it has custody or control as a result of or in connection with operating each of the facilities that it operates. 2004, c. 3, Sched. A, s. 3 (5). Single custodian (6) Despite subsection (5), the following persons shall be deemed to be a single health information custodian with respect to all the functions described in the applicable paragraph, if any: 1. A person who operates a hospital within the meaning of the Public Hospitals Act and any of the facilities, programs or services described in paragraph 4 of the definition of “health information custodian” in subsection (1). 2. Repealed: 2016, c. 30, s. 43 (2). 3. Health information custodians or facilities that are prescribed. 2004, c. 3, Sched. A, s. 3 (6); 2007, c. 8, s. 224 (5); 2016, c. 30, s. 43 (2). Application to act as one custodian (7) A health information custodian that operates more than one facility described in one of the subparagraphs of paragraph 4 of the definition of “health information custodian” in subsection (1) or two or more health information custodians may apply to the Minister, in a form approved by the Minister, for an order described in subsection (8). 2004, c. 3, Sched. A, s. 3 (7). Minister’s order (8) Upon receiving an application described in subsection (7), the Minister may make an order permitting all or some of the applicants to act as a single health information custodian on behalf of those facilities, powers, duties or work that the Minister specifies, subject to the terms that the Minister considers appropriate and specifies in the order, if the Minister is of the opinion that it is appropriate to make the order in the circumstances, having regard to, (a) the public interest; (b) the ability of the applicants to provide individuals with reasonable access to their personal health information; (c) the ability of the applicants to comply with the requirements of this Act; and (d) whether permitting the applicants to act as a single health information custodian is necessary to enable them to effectively provide integrated health care. 2004, c. 3, Sched. A, s. 3 (8). Scope of order (9) In an order made under subsection (8), the Minister may order that any class of health information custodians that the Minister considers to be situated similarly to the applicants is permitted to act as a single health information custodian, subject to the terms that the Minister considers appropriate and specifies in the order, if the Minister is of the opinion that it is appropriate to so order, having regard to, (a) the public interest; (b) the ability of the custodians that are subject to the order made under this subsection to provide individuals with reasonable access to their personal health information; (c) the ability of the custodians that are subject to the order made under this subsection to comply with the requirements of this Act; and (d) whether permitting the custodians that are subject to the order made under this subsection to act as a single health information custodian is necessary to enable them to effectively provide integrated health care. 2004, c. 3, Sched. A, s. 3 (9). No hearing required (10) The Minister is not required to hold a hearing or to afford to any person an opportunity for a hearing before making an order under subsection (8). 2004, c. 3, Sched. A, s. 3 (10). Duration (11) Subject to subsection (12), a health information custodian does not cease to be a health information custodian with respect to a record of personal health information until complete custody and control of the record, where applicable, passes to another person who is legally authorized to hold the record. 2004, c. 3, Sched. A, s. 3 (11). Death of custodian (12) If a health information custodian dies, the following person shall be deemed to be the health information custodian with respect to records of personal health information held by the deceased custodian until custody and control of the records, where applicable, passes to another person who is legally authorized to hold the records: 1. The estate trustee of the deceased custodian. 2. The person who has assumed responsibility for the administration of the deceased custodian’s estate, if the estate does not have an estate trustee. 2004, c. 3, Sched. A, s. 3 (12). Section Amendments with date in force (d/m/y) 2006, c. 17, s. 253 - 31/01/2007 2007, c. 8, s. 224 (2-5) - 01/07/2010; 2007, c. 10, Sched. H, s. 1 - 04/06/2007 2009, c. 33, Sched. 18, s. 25 (1, 2) - 15/12/2009 2010, c. 11, s. 128 - 01/01/2013 2016, c. 30, s. 43 (1, 2) - 01/11/2017 2017, c. 25, Sched. 9, s. 109 (1, 2) - no effect - see 2023, c. 4, Sched. 1, s. 67 - 18/05/2023 2019, c. 15, Sched. 30, s. 2 - 31/07/2020 2020, c. 5, Sched. 6, s. 2 - 25/03/2020; 2020, c. 5, Sched. 6, s. 26 (3) - 28/06/2024; 2020, c. 13, Sched. 3, s. 8 (3-6) - 01/05/2022 2021, c. 39, Sched. 2, s. 20 - 11/04/2022 2023, c. 4, Sched. 1, s. 75 - 25/09/2023 Personal health information 4 (1) In this Act, “personal health information”, subject to subsections (3) and (4), means identifying information about an individual in oral or recorded form, if the information, (a) relates to the physical or mental health of the individual, including information that consists of the health history of the individual’s family, (b) relates to the providing of health care to the individual, including the identification of a person as a provider of health care to the individual, (c) Repealed: 2020, c. 13, Sched. 3, s. 8 (7). (c.1) is a plan that sets out the home and community care services for the individual to be provided by a health service provider or Ontario Health Team pursuant to funding under section 21 of the Connecting Care Act, 2019, (d) relates to payments or eligibility for health care, or eligibility for coverage for health care, in respect of the individual, (e) relates to the donation by the individual of any body part or bodily substance of the individual or is derived from the testing or examination of any such body part or bodily substance, (f) is the individual’s health number, (g) identifies an individual’s substitute decision-maker, or (h) is the individual’s digital health identifier or other identifying information related to the creation of the digital health identifier. 2004, c. 3, Sched. A, s. 4 (1); 2007, c. 8, s. 224 (6); 2007, c. 10, Sched. H, s. 2; 2020, c. 13, Sched. 3, s. 8 (7, 8); 2025, c. 7, Sched. 6, s. 2. Identifying information (2) In this section, “identifying information” means information that identifies an individual or for which it is reasonably foreseeable in the circumstances that it could be utilized, either alone or with other information, to identify an individual. 2004, c. 3, Sched. A, s. 4 (2). Mixed records (3) Personal health information includes identifying information that is not personal health information described in subsection (1) but that is contained in a record that contains personal health information described in that subsection. 2009, c. 33, Sched. 18, s. 25 (3). Exception (4) Personal health information does not include identifying information contained in a record that is in the custody or under the control of a health information custodian if, (a) the identifying information contained in the record relates primarily to one or more employees or other agents of the custodian; and (b) the record is maintained primarily for a purpose other than the provision of health care or assistance in providing health care to the employees or other agents. 2004, c. 3, Sched. A, s. 4 (4). Section Amendments with date in force (d/m/y) 2007, c. 8, s. 224 (6) - 01/07/2010; 2007, c. 10, Sched. H, s. 2 - 04/06/2007 2009, c. 33, Sched. 18, s. 25 (3) - 15/12/2009 2020, c. 13, Sched. 3, s. 8 (7, 8) - 01/05/2022 2025, c. 7, Sched. 6, s. 2 - 01/01/2026 Substitute decision-maker 5 (1) In this Act, “substitute decision-maker”, in relation to an individual, means, unless the context requires otherwise, a person who is authorized under this Act to consent on behalf of the individual to the collection, use or disclosure of personal health information about the individual. 2004, c. 3, Sched. A, s. 5 (1). Decision about treatment (2) A substitute decision-maker of an individual within the meaning of section 9 of the Health Care Consent Act, 1996 shall be deemed to be a substitute decision-maker of the individual in respect of the collection, use or disclosure of personal health information about the individual if the purpose of the collection, use or disclosure is necessary for, or ancillary to, a decision about a treatment under Part II of that Act. 2004, c. 3, Sched. A, s. 5 (2). Admission to a care facility (3) A substitute decision-maker of an individual within the meaning of section 39 of the Health Care Consent Act, 1996 shall be deemed to be a substitute decision-maker of the individual in respect of the collection, use or disclosure of personal health information about the individual if the purpose of the collection, use or disclosure is necessary for, or ancillary to, a decision about admission to a care facility under Part III of that Act. 2004, c. 3, Sched. A, s. 5 (3). Note: On a day to be named by proclamation of the Lieutenant Governor, section 5 of the Act is amended by adding the following subsection: (See: 2017, c. 25, Sched. 5, s. 69) Confining in a care facility (3.1) A substitute decision-maker of an individual within the meaning of section 54.4 of the Health Care Consent Act, 1996 shall be deemed to be a substitute decision-maker of the individual in respect of the collection, use or disclosure of personal health information about the individual if the purpose of the collection, use or disclosure is necessary for, or ancillary to, a decision about confining in a care facility under Part III.1 of that Act. 2017, c. 25, Sched. 5, s. 69. Personal assistance services (4) A substitute decision-maker of an individual within the meaning of section 56 of the Health Care Consent Act, 1996 shall be deemed to be a substitute decision-maker of the individual in respect of the collection, use or disclosure of personal health information about the individual if the purpose of the collection, use or disclosure is necessary for, or ancillary to, a decision about a personal assistance service under Part IV of that Act. 2004, c. 3, Sched. A, s. 5 (4). Section Amendments with date in force (d/m/y) 2017, c. 25, Sched. 5, s. 69 - not in force Interpretation 6 (1) For the purposes of this Act, the providing of personal health information between a health information custodian and an agent of the custodian is a use by the custodian, and not a disclosure by the person providing the information or a collection by the person to whom the information is provided. 2004, c. 3, Sched. A, s. 6 (1). Provisions based on consent (2) A provision of this Act that applies to the collection, use or disclosure of personal health information about an individual by a health information custodian with the consent of the individual, whatever the nature of the consent, does not affect the collection, use or disclosure that this Act permits or requires the health information custodian to make of the information without the consent of the individual. 2004, c. 3, Sched. A, s. 6 (2). Permissive disclosure (3) A provision of this Act that permits a health information custodian to disclose personal health information about an individual without the consent of the individual, (a) does not require the custodian to disclose it unless required to do so by law; (b) does not relieve the custodian from a legal requirement to disclose the information; and (c) does not prevent the custodian from obtaining the individual’s consent for the disclosure. 2004, c. 3, Sched. A, s. 6 (3). Application of Act Application of Act 7 (1) Except if this Act or its regulations specifically provide otherwise, this Act applies to, (a) the collection of personal health information by a health information custodian on or after the day this section comes into force; (b) the use or disclosure of personal health information, on or after the day this section comes into force, by, (i) a health information custodian, even if the custodian collected the information before that day, or (ii) a person who is not a health information custodian and to whom a health information custodian disclosed the information, even if the person received the information before that day; and (c) the collection, use or disclosure of a health number by any person on or after the day this section comes into force. 2004, c. 3, Sched. A, s. 7 (1). Conflict (2) In the event of a conflict between a provision of this Act or its regulations and a provision of any other Act or its regulations, this Act and its regulations prevail unless this Act, its regulations or the other Act specifically provide otherwise. 2004, c. 3, Sched. A, s. 7 (2). Interpretation (3) For the purpose of this section, there is no conflict unless it is not possible to comply with both this Act and its regulations and any other Act or its regulations. 2004, c. 3, Sched. A, s. 7 (3). Exception (4) This Act and its regulations do not prevail in the event of a conflict between a provision of this Act or its regulations and a provision of the Quality of Care Information Protection Act, 2004 or its regulations. 2004, c. 3, Sched. A, s. 7 (4). Crown bound (5) For greater certainty, this Act binds the Crown, including all ministries, agencies and employees of the Crown. 2007, c. 10, Sched. H, s. 3. Section Amendments with date in force (d/m/y) 2007, c. 10, Sched. H, s. 3 - 04/06/2007 Freedom of information legislation 8 (1) Subject to subsection (2), the Freedom of Information and Protection of Privacy Act and the Municipal Freedom of Information and Protection of Privacy Act do not apply to personal health information in the custody or under the control of a health information custodian unless this Act specifies otherwise. 2007, c. 10, Sched. H, s. 4. Exceptions (2) Sections 11, 12, 15, 16, 17, 33 and 34, subsection 35 (2) and sections 36 and 44 of the Freedom of Information and Protection of Privacy Act and sections 5, 9, 10, 25, 26 and 34 of the Municipal Freedom of Information and Protection of Privacy Act apply in respect of records of personal health information in the custody or under the control of a health information custodian that is an institution within the meaning of either of those Acts, as the case may be, or that is acting as part of such an institution. 2007, c. 10, Sched. H, s. 4. Same (3) A record of personal health information prepared by or in the custody or control of an institution within the meaning of the Freedom of Information and Protection of Privacy Act or the Municipal Freedom of Information and Protection of Privacy Act shall be deemed to be a record to which clause 32 (b) of the Freedom of Information and Protection of Privacy Act or clause 25 (1) (b) of the Municipal Freedom of Information and Protection of Privacy Act applies, as the case may be. 2004, c. 3, Sched. A, s. 8 (3). Access (4) This Act does not limit a person’s right of access under section 10 of the Freedom of Information and Protection of Privacy Act or section 4 of the Municipal Freedom of Information and Protection of Privacy Act to a record of personal health information if all the types of information referred to in subsection 4 (1) are reasonably severed from the record. 2004, c. 3, Sched. A, s. 8 (4). Prescribed organization (4.1) The Freedom of Information and Protection of Privacy Act does not apply to personal health information in the custody or under the control of the prescribed organization, or to personal health information that is described in this Act as being treated as if it were in the custody or under the control of the prescribed organization, unless this Act or the regulations provide otherwise. 2025, c. 7, Sched. 6, s. 3. Transition (5) This Act does not apply to a collection, use or disclosure of personal health information, a request for access or an appeal made under the Freedom of Information and Protection of Privacy Act or the Municipal Freedom of Information and Protection of Privacy Act before the day this section comes into force, and the applicable Act continues to apply to the collection, use, disclosure, request or appeal. 2004, c. 3, Sched. A, s. 8 (5). Section Amendments with date in force (d/m/y) 2007, c. 10, Sched. H, s. 4 - 04/06/2007 2025, c. 7, Sched. 6, s. 3 - 01/01/2026 Non-application of Act 9 (1) This Act does not apply to personal health information about an individual after the earlier of 120 years after a record containing the information was created and 50 years after the death of the individual. 2004, c. 3, Sched. A, s. 9 (1). Other rights and Acts (2) Nothing in this Act shall be construed to interfere with, (a) anything in connection with a subrogated claim or a potential subrogated claim; (b) any legal privilege, including solicitor-client privilege; (c) the law of evidence or information otherwise available by law to a party or a witness in a proceeding; (d) the power of a court or a tribunal to compel a witness to testify or to compel the production of a document; (e) the regulatory activities of a College under the Regulated Health Professions Act, 1991, the College under the Social Work and Social Service Work Act, 1998, the Board under the Drugless Practitioners Act or the Health and Supportive Care Providers Oversight Authority under the Health and Supportive Care Providers Oversight Authority Act, 2021; or (f) any provision of any Act of Ontario or Canada or any court order, if the provision or order, as the case may be, prohibits a person from making information public or from publishing information. 2004, c. 3, Sched. A, s. 9 (2); 2021, c. 27, Sched. 2, s. 68 (2). Section Amendments with date in force (d/m/y) 2021, c. 27, Sched. 2, s. 68 (2) - 01/12/2024 PART II PRACTICES TO PROTECT PERSONAL HEALTH INFORMATION General Information practices 10 (1) A health information custodian that has custody or control of personal health information shall have in place information practices that comply with the requirements of this Act and its regulations. 2004, c. 3, Sched. A, s. 10 (1). Duty to follow practices (2) A health information custodian shall comply with its information practices. 2004, c. 3, Sched. A, s. 10 (2). Use of electronic means (3) A health information custodian that uses electronic means to collect, use, modify, disclose, retain or dispose of personal health information shall comply with the prescribed requirements, if any. 2004, c. 3, Sched. A, s. 10 (3). Providers to custodians (4) A person who provides goods or services for the purpose of enabling a health information custodian to use electronic means to collect, use, modify, disclose, retain or dispose of personal health information shall comply with the prescribed requirements, if any. 2004, c. 3, Sched. A, s. 10 (4). Note: On a day to be named by proclamation of the Lieutenant Governor, the Act is amended by adding the following section: (See: 2020, c. 5, Sched. 6, s. 3) Electronic audit log 10.1 (1) Subject to any prescribed exceptions, a health information custodian that uses electronic means to collect, use, disclose, modify, retain or dispose of personal health information shall, (a) maintain, or require the maintenance of, an electronic audit log described in subsection (4); (b) audit and monitor the electronic audit log as often as is required by the regulations; and (c) comply with any requirements that may be prescribed. 2020, c. 5, Sched. 6, s. 3. Access by Commissioner (2) A health information custodian referred to in subsection (1) shall provide a copy of the electronic audit log to the Commissioner, upon request. 2020, c. 5, Sched. 6, s. 3. Same (3) Despite subsection 60 (13), the Commissioner may be provided with a copy of the electronic audit log even if it contains personal health information. 2020, c. 5, Sched. 6, s. 3. Content of log (4) The electronic audit log must include, for every instance in which a record or part of a record of personal health information that is accessible by electronic means is viewed, handled, modified or otherwise dealt with, (a) the type of information that was viewed, handled, modified or otherwise dealt with; (b) the date and time on which the information was viewed, handled, modified or otherwise dealt with; (c) the identity of all persons who viewed, handled, modified or otherwise dealt with the personal health information; (d) the identity of the individual to whom the personal health information relates; and (e) any other information that may be prescribed. 2020, c. 5, Sched. 6, s. 3. Section Amendments with date in force (d/m/y) 2020, c. 5, Sched. 6, s. 3 - not in force Accuracy 11 (1) A health information custodian that uses personal health information about an individual shall take reasonable steps to ensure that the information is as accurate, complete and up-to-date as is necessary for the purposes for which it uses the information. 2004, c. 3, Sched. A, s. 11 (1). Same, disclosure (2) A health information custodian that discloses personal health information about an individual shall, (a) take reasonable steps to ensure that the information is as accurate, complete and up-to-date as is necessary for the purposes of the disclosure that are known to the custodian at the time of the disclosure; or (b) clearly set out for the recipient of the disclosure the limitations, if any, on the accuracy, completeness or up-to-date character of the information. 2004, c. 3, Sched. A, s. 11 (2). Steps to ensure collection 11.1 A health information custodian shall take steps that are reasonable in the circumstances to ensure that personal health information is not collected without authority. 2016, c. 6, Sched. 1, s. 1 (3). Section Amendments with date in force (d/m/y) 2016, c. 6, Sched. 1, s. 1 (3) - 01/06/2016 Limits on use of de-identified information 11.2 (1) Subject to subsection (2) and to any other exceptions that may be prescribed, no person shall use or attempt to use information that has been de-identified to identify an individual, either alone or with other information, unless this Act or another Act permits the information to be used to identify the individual. 2019, c. 15, Sched. 30, s. 3. Exceptions (2) The limitation in subsection (1) does not prevent any of the following from using information that they de-identified, either alone or with other information, to identify an individual: 1. A health information custodian. 2. A prescribed entity mentioned in subsection 45 (1). 3. A prescribed person who compiles or maintains a registry of personal health information. 4. Any other prescribed person. 2019, c. 15, Sched. 30, s. 3. Section Amendments with date in force (d/m/y) 2019, c. 15, Sched. 30, s. 3 - 31/07/2020 Security 12 (1) A health information custodian shall take steps that are reasonable in the circumstances to ensure that personal health information in the custodian’s custody or control is protected against theft, loss and unauthorized use or disclosure and to ensure that the records containing the information are protected against unauthorized copying, modification or disposal. 2004, c. 3, Sched. A, s. 12 (1). Notice of theft, loss, etc. to individual (2) Subject to subsection (4) and to the exceptions and additional requirements, if any, that are prescribed, if personal health information about an individual that is in the custody or control of a health information custodian is stolen or lost or if it is used or disclosed without authority, the health information custodian shall, (a) notify the individual at the first reasonable opportunity of the theft or loss or of the unauthorized use or disclosure; and (b) include in the notice a statement that the individual is entitled to make a complaint to the Commissioner under Part VI. 2016, c. 6, Sched. 1, s. 1 (4). Notice to Commissioner (3) If the circumstances surrounding a theft, loss or unauthorized use or disclosure referred to in subsection (2) meet the prescribed requirements, the health information custodian shall notify the Commissioner of the theft or loss or of the unauthorized use or disclosure. 2016, c. 6, Sched. 1, s. 1 (4).

Exception (4) If the health information custodian is a researcher who has received the personal health information from another health information custodian under subsection 44 (1), the researcher shall not notify the individual if the information is stolen or lost or if it is used or disclosed without authority, unless the health information custodian that disclosed the personal health information under subsection 44 (1), (a) first obtains the individual’s consent to having the researcher contact the individual; and (b) informs the researcher that the individual has given the consent. 2016, c. 6, Sched. 1, s. 1 (4). Section Amendments with date in force (d/m/y) 2016, c. 6, Sched. 1, s. 1 (4) - 03/06/2016 Records Handling of records 13 (1) A health information custodian shall ensure that the records of personal health information that it has in its custody or under its control are retained, transferred and disposed of in a secure manner and in accordance with the prescribed requirements, if any. 2004, c. 3, Sched. A, s. 13 (1). Retention of records subject to a request (2) Despite subsection (1), a health information custodian that has custody or control of personal health information that is the subject of a request for access under section 53 shall retain the information for as long as necessary to allow the individual to exhaust any recourse under this Act that he or she may have with respect to the request. 2004, c. 3, Sched. A, s. 13 (2). Place where records kept 14 (1) A health information custodian may keep a record of personal health information about an individual in the individual’s home in any reasonable manner to which the individual consents, subject to any restrictions set out in a regulation, by-law or published guideline under the Regulated Health Professions Act, 1991, an Act referred to in Schedule 1 of that Act, the Drugless Practitioners Act or the Social Work and Social Service Work Act, 1998. 2004, c. 3, Sched. A, s. 14 (1). Records kept in other places (2) A health care practitioner may keep a record of personal health information about an individual in a place other than the individual’s home and other than a place in the control of the practitioner if, (a) the record is kept in a reasonable manner; (b) the individual consents; (c) the health care practitioner is permitted to keep the record in the place in accordance with a regulation, by-law or published guideline under the Regulated Health Professions Act, 1991, an Act referred to in Schedule 1 to that Act, the Drugless Practitioners Act or the Social Work and Social Service Work Act, 1998, if the health care practitioner is described in any of clauses (a) to (c) of the definition of “health care practitioner” in section 2; and (d) the prescribed conditions, if any, are satisfied. 2004, c. 3, Sched. A, s. 14 (2). Accountability and Openness Contact person 15 (1) A health information custodian that is a natural person may designate a contact person described in subsection (3). 2004, c. 3, Sched. A, s. 15 (1). Same (2) A health information custodian that is not a natural person shall designate a contact person described in subsection (3). 2004, c. 3, Sched. A, s. 15 (2). Functions of contact person (3) A contact person is an agent of the health information custodian and is authorized on behalf of the custodian to, (a) facilitate the custodian’s compliance with this Act; (b) ensure that all agents of the custodian are appropriately informed of their duties under this Act; (c) respond to inquiries from the public about the custodian’s information practices; (d) respond to requests of an individual for access to or correction of a record of personal health information about the individual that is in the custody or under the control of the custodian; and (e) receive complaints from the public about the custodian’s alleged contravention of this Act or its regulations. 2004, c. 3, Sched. A, s. 15 (3). If no contact person (4) A health information custodian that is a natural person and that does not designate a contact person under subsection (1) shall perform on his or her own the functions described in clauses (3) (b), (c), (d) and (e). 2004, c. 3, Sched. A, s. 15 (4). Written public statement 16 (1) A health information custodian shall, in a manner that is practical in the circumstances, make available to the public a written statement that, (a) provides a general description of the custodian’s information practices; (b) describes how to contact, (i) the contact person described in subsection 15 (3), if the custodian has one, or (ii) the custodian, if the custodian does not have that contact person; (c) describes how an individual may obtain access to or request correction of a record of personal health information about the individual that is in the custody or control of the custodian; and (d) describes how to make a complaint to the custodian and to the Commissioner under this Act. 2004, c. 3, Sched. A, s. 16 (1). Notification (2) If a health information custodian uses or discloses personal health information about an individual, without the individual’s consent, in a manner that is outside the scope of the custodian’s description of its information practices under clause (1) (a), the custodian shall, (a) inform the individual of the uses and disclosures at the first reasonable opportunity unless, under section 52, the individual does not have a right of access to a record of the information; (b) make a note of the uses and disclosures; and (c) keep the note as part of the records of personal health information about the individual that it has in its custody or under its control or in a form that is linked to those records. 2004, c. 3, Sched. A, s. 16 (2). Agents and information 17 (1) A health information custodian is responsible for personal health information in the custody or control of the health information custodian and may permit the custodian’s agents to collect, use, disclose, retain or dispose of personal health information on the custodian’s behalf only if, (a) the custodian is permitted or required to collect, use, disclose, retain or dispose of the information, as the case may be; (b) the collection, use, disclosure, retention or disposal of the information, as the case may be, is necessary in the course of the agent’s duties and is not contrary to this Act or another law; and (c) the prescribed requirements, if any, are met. 2004, c. 3, Sched. A, s. 17 (1); 2016, c. 6, Sched. 1, s. 1 (5). Same (1.1) A permission granted to an agent under subsection (1) may be subject to such conditions or restrictions as the health information custodian may impose. 2016, c. 6, Sched. 1, s. 1 (6). Restriction, collection, use, etc. by agents (2) Subject to any exception that may be prescribed, an agent of a health information custodian may collect, use, disclose, retain or dispose of personal health information only if, (a) the collection, use, disclosure, retention or disposal of the information, as the case may be, (i) is permitted by the custodian in accordance with subsection (1), (ii) is necessary for the purpose of carrying out his or her duties as agent of the custodian, (iii) is not contrary to this Act or another law, and (iv) complies with any conditions or restrictions that the custodian has imposed under subsection (1.1); and (b) the prescribed requirements, if any, are met. 2016, c. 6, Sched. 1, s. 1 (7). Responsibilities of health information custodian (3) A health information custodian shall, (a) take steps that are reasonable in the circumstances to ensure that no agent of the custodian collects, uses, discloses, retains or disposes of personal health information unless it is in accordance with subsection (2); and (b) remain responsible for any personal health information that is collected, used, disclosed, retained or disposed of by the custodian’s agents, regardless of whether or not the collection, use, disclosure, retention or disposal was carried out in accordance with subsection (2). 2016, c. 6, Sched. 1, s. 1 (7). Responsibilities of the agent (4) An agent of a health information custodian shall, (a) comply with the conditions or restrictions imposed by the health information custodian on the agent’s collection, use, disclosure, retention or disposal of personal health information under subsection (1.1); and (b) notify the custodian at the first reasonable opportunity if personal health information that the agent collected, used, disclosed, retained or disposed of on behalf of the custodian is stolen or lost or if it is used or disclosed without authority. 2016, c. 6, Sched. 1, s. 1 (7). Section Amendments with date in force (d/m/y) 2016, c. 6, Sched. 1, s. 1 (5-7) - 03/06/2016 Notice to governing College Definition 17.1 (1) In this section, “Authority” means the Authority within the meaning of the Health and Supportive Care Providers Oversight Authority Act, 2021; (“Office”) “College” means, (a) in the case of a member of health profession regulated under the Regulated Health Professions Act, 1991, a College of the health profession named in Schedule 1 to that Act, and (b) in the case of a member of the Ontario College of Social Workers and Social Service Workers, that College. 2016, c. 6, Sched. 1, s. 1 (8); 2021, c. 27, Sched. 2, s. 68 (3). Termination, suspension, etc., of employed members or registrants (2) Subject to any exceptions and additional requirements, if any, that are prescribed, if a health information custodian employs a health care practitioner who is a member of a College or a registrant of the Authority, the health information custodian shall give written notice of any of the following events to the College or Authority within 30 days of the event occurring: 1. The employee is terminated, suspended or subject to disciplinary action as a result of the unauthorized collection, use, disclosure, retention or disposal of personal health information by the employee. 2. The employee resigns and the health information custodian has reasonable grounds to believe that the resignation is related to an investigation or other action by the custodian with respect to an alleged unauthorized collection, use, disclosure, retention or disposal of personal health information by the employee. 2016, c. 6, Sched. 1, s. 1 (8); 2021, c. 27, Sched. 2, s. 68 (4). Same, custodian’s agent (3) Subject to any exceptions and additional requirements, if any, that are prescribed, a health information custodian shall give written notice of an event described in subsection (4) to a College if, (a) the health information custodian is a medical officer of health of a board of health within the meaning of the Health Protection and Promotion Act; and (b) a health care practitioner, who is a member of the College, is employed to provide health care for the board of health and is an agent of the custodian. 2016, c. 6, Sched. 1, s. 1 (8). Same (4) The health information custodian shall give written notice of any of the following events to a College within 30 days of the event occurring: 1. The agent’s employment is terminated or suspended, or the agent is subject to disciplinary action with respect to his or her employment, as a result of his or her unauthorized collection, use, disclosure, retention or disposal of personal health information. 2. The agent resigns from his or her employment and the health information custodian has reasonable grounds to believe that the resignation is related to an investigation or other action by the custodian with respect to an alleged unauthorized collection, use, disclosure, retention or disposal of personal health information by the agent. 2016, c. 6, Sched. 1, s. 1 (8). Member’s privileges revoked, etc. (5) Subject to any exceptions and additional requirements, if any, that are prescribed, if a health information custodian extends privileges to, or is otherwise affiliated with, a health care practitioner who is a member of a College, the custodian shall give written notice of any of the following events to the College within 30 days of the event occurring: 1. The member’s privileges are revoked, suspended or restricted, or his or her affiliation is revoked, suspended or restricted, as a result of the unauthorized collection, use, disclosure, retention or disposal of personal health information by the member. 2. The member relinquishes or voluntarily restricts his or her privileges or his or her affiliation and the health information custodian has reasonable grounds to believe that the relinquishment or restriction is related to an investigation or other action by the custodian with respect to an alleged unauthorized collection, use, disclosure, retention or disposal of personal health information by the member. 2016, c. 6, Sched. 1, s. 1 (8). Contents of notice (6) A notice made under this section shall meet the prescribed requirements, if any. 2016, c. 6, Sched. 1, s. 1 (8). Section Amendments with date in force (d/m/y) 2016, c. 6, Sched. 1, s. 1 (8) - 03/06/2016 2021, c. 27, Sched. 2, s. 68 (3, 4) - 01/12/2024 PART III CONSENT COnCERNING PERSONAL HEALTH INFORMATION General Elements of consent 18 (1) If this Act or any other Act requires the consent of an individual for the collection, use or disclosure of personal health information by a health information custodian, the consent, (a) must be a consent of the individual; (b) must be knowledgeable; (c) must relate to the information; and (d) must not be obtained through deception or coercion. 2004, c. 3, Sched. A, s. 18 (1). Implied consent (2) Subject to subsection (3), a consent to the collection, use or disclosure of personal health information about an individual may be express or implied. 2004, c. 3, Sched. A, s. 18 (2). Exception (3) A consent to the disclosure of personal health information about an individual must be express, and not implied, if, (a) a health information custodian makes the disclosure to a person that is not a health information custodian; or (b) a health information custodian makes the disclosure to another health information custodian and the disclosure is not for the purposes of providing health care or assisting in providing health care. 2004, c. 3, Sched. A, s. 18 (3). Same (4) Subsection (3) does not apply to, (a) a disclosure pursuant to an implied consent described in subsection 20 (4); (b) a disclosure pursuant to clause 32 (1) (b); or (c) a prescribed type of disclosure that does not include information about an individual’s state of health. 2004, c. 3, Sched. A, s. 18 (4). Knowledgeable consent (5) A consent to the collection, use or disclosure of personal health information about an individual is knowledgeable if it is reasonable in the circumstances to believe that the individual knows, (a) the purposes of the collection, use or disclosure, as the case may be; and (b) that the individual may give or withhold consent. 2004, c. 3, Sched. A, s. 18 (5). Notice of purposes (6) Unless it is not reasonable in the circumstances, it is reasonable to believe that an individual knows the purposes of the collection, use or disclosure of personal health information about the individual by a health information custodian if the custodian posts or makes readily available a notice describing the purposes where it is likely to come to the individual’s attention or provides the individual with such a notice. 2004, c. 3, Sched. A, s. 18 (6). Transition (7) A consent that an individual gives, before the day that subsection (1) comes into force, to a collection, use or disclosure of information that is personal health information is a valid consent if it meets the requirements of this Act for consent. 2004, c. 3, Sched. A, s. 18 (7). Withdrawal of consent 19 (1) If an individual consents to have a health information custodian collect, use or disclose personal health information about the individual, the individual may withdraw the consent, whether the consent is express or implied, by providing notice to the health information custodian, but the withdrawal of the consent shall not have retroactive effect. 2004, c. 3, Sched. A, s. 19 (1). Conditional consent (2) If an individual places a condition on his or her consent to have a health information custodian collect, use or disclose personal health information about the individual, the condition is not effective to the extent that it purports to prohibit or restrict any recording of personal health information by a health information custodian that is required by law or by established standards of professional practice or institutional practice. 2004, c. 3, Sched. A, s. 19 (2). Assumption of validity 20 (1) A health information custodian who has obtained an individual’s consent to a collection, use or disclosure of personal health information about the individual or who has received a copy of a document purporting to record the individual’s consent to the collection, use or disclosure is entitled to assume that the consent fulfils the requirements of this Act and the individual has not withdrawn it, unless it is not reasonable to assume so. 2004, c. 3, Sched. A, s. 20 (1). Implied consent (2) A health information custodian described in paragraph 1, 3 or 4 of the definition of “health information custodian” in subsection 3 (1), that receives personal health information about an individual from the individual, the individual’s substitute decision-maker or another health information custodian for the purpose of providing health care or assisting in the provision of health care to the individual, is entitled to assume that it has the individual’s implied consent to collect, use or disclose the information for the purposes of providing health care or assisting in providing health care to the individual, unless the custodian that receives the information is aware that the individual has expressly withheld or withdrawn the consent. 2004, c. 3, Sched. A, s. 20 (2); 2016, c. 30, s. 43 (3); 2020, c. 13, Sched. 3, s. 8 (9, 10). Limited consent (3) If a health information custodian discloses, with the consent of an individual, personal health information about the individual to a health information custodian described in paragraph 1, 3 or 4 of the definition of “health information custodian” in subsection 3 (1) for the purpose of the provision of health care to the individual and if the disclosing custodian does not have the consent of the individual to disclose all the personal health information about the individual that it considers reasonably necessary for that purpose, the disclosing custodian shall notify the custodian to whom it disclosed the information of that fact. 2004, c. 3, Sched. A, s. 20 (3); 2016, c. 30, s. 43 (3); 2020, c. 13, Sched. 3, s. 8 (11, 12). Implied consent, affiliation (4) If an individual who is a resident or patient in a facility that is a health information custodian provides to the custodian information about his or her religious or other organizational affiliation, the facility may assume that it has the individual’s implied consent to provide his or her name and location in the facility to a representative of the religious or other organization, where the custodian has offered the individual the opportunity to withhold or withdraw the consent and the individual has not done so. 2004, c. 3, Sched. A, s. 20 (4). Section Amendments with date in force (d/m/y) 2016, c. 30, s. 43 (3) - 01/11/2017 2020, c. 13, Sched. 3, s. 8 (9-12) - 01/05/2022 Capacity and Substitute Decision-Making Capacity to consent 21 (1) An individual is capable of consenting to the collection, use or disclosure of personal health information if the individual is able, (a) to understand the information that is relevant to deciding whether to consent to the collection, use or disclosure, as the case may be; and (b) to appreciate the reasonably foreseeable consequences of giving, not giving, withholding or withdrawing the consent. 2004, c. 3, Sched. A, s. 21 (1). Different information (2) An individual may be capable of consenting to the collection, use or disclosure of some parts of personal health information, but incapable of consenting with respect to other parts. 2004, c. 3, Sched. A, s. 21 (2). Different times (3) An individual may be capable of consenting to the collection, use or disclosure of personal health information at one time, but incapable of consenting at another time. 2004, c. 3, Sched. A, s. 21 (3). Presumption of capacity (4) An individual is presumed to be capable of consenting to the collection, use or disclosure of personal health information. 2004, c. 3, Sched. A, s. 21 (4). Non-application (5) A health information custodian may rely on the presumption described in subsection (4) unless the custodian has reasonable grounds to believe that the individual is incapable of consenting to the collection, use or disclosure of personal health information. 2004, c. 3, Sched. A, s. 21 (5). Determination of incapacity 22 (1) A health information custodian that determines the incapacity of an individual to consent to the collection, use or disclosure of personal health information under this Act shall do so in accordance with the requirements and restrictions, if any, that are prescribed. 2004, c. 3, Sched. A, s. 22 (1). Information about determination (2) If it is reasonable in the circumstances, a health information custodian shall provide, to an individual determined incapable of consenting to the collection, use or disclosure of his or her personal health information by the custodian, information about the consequences of the determination of incapacity, including the information, if any, that is prescribed. 2004, c. 3, Sched. A, s. 22 (2). Review of determination (3) An individual whom a health information custodian determines is incapable of consenting to the collection, use or disclosure of his or her personal health information by a health information custodian may apply to the Board for a review of the determination unless there is a person who is entitled to act as the substitute decision-maker of the individual under subsection 5 (2), (3) or (4). 2004, c. 3, Sched. A, s. 22 (3). Note: On a day to be named by proclamation of the Lieutenant Governor, subsection 22 (3) of the Act is amended by striking out “(3) or (4)” at the end and substituting “(3), (3.1) or (4)”. (See: 2017, c. 25, Sched. 5, s. 70) Parties (4) The parties to the application are: 1. The individual applying for the review of the determination. 2. The health information custodian that has custody or control of the personal health information. 3. All other persons whom the Board specifies. 2004, c. 3, Sched. A, s. 22 (4). Powers of Board (5) The Board may confirm the determination of incapacity or may determine that the individual is capable of consenting to the collection, use or disclosure of personal health information. 2004, c. 3, Sched. A, s. 22 (5). Restriction on repeated applications (6) If a determination that an individual is incapable with respect to consenting to the collection, use or disclosure of personal health information is confirmed on the final disposition of an application under this section, the individual shall not make a new application under this section for a determination with respect to the same or a similar issue within six months after the final disposition of the earlier application, unless the Board gives leave in advance. 2004, c. 3, Sched. A, s. 22 (6). Grounds for leave (7) The Board may give leave for the new application to be made if it is satisfied that there has been a material change in circumstances that justifies reconsideration of the individual’s capacity. 2004, c. 3, Sched. A, s. 22 (7). Procedure (8) Sections 73 to 81 of the Health Care Consent Act, 1996 apply with necessary modifications to an application under this section. 2004, c. 3, Sched. A, s. 22 (8). Section Amendments with date in force (d/m/y) 2017, c. 25, Sched. 5, s. 70 - not in force Persons who may consent 23 (1) If this Act or any other Act refers to a consent required of an individual to a collection, use or disclosure by a health information custodian of personal health information about the individual, a person described in one of the following paragraphs may give, withhold or withdraw the consent: 1. If the individual is capable of consenting to the collection, use or disclosure of the information, i. the individual, or ii. if the individual is at least 16 years of age, any person who is capable of consenting, whom the individual has authorized in writing to act on his or her behalf and who, if a natural person, is at least 16 years of age. 2. If the individual is a child who is less than 16 years of age, a parent of the child or a children’s aid society or other person who is lawfully entitled to give or refuse consent in the place of the parent unless the information relates to, i. treatment within the meaning of the Health Care Consent Act, 1996, about which the child has made a decision on his or her own in accordance with that Act, or ii. counselling in which the child has participated on his or her own under the Child, Youth and Family Services Act, 2017. 3. If the individual is incapable of consenting to the collection, use or disclosure of the information, a person who is authorized under subsection 5 (2), (3) or (4) or section 26 to consent on behalf of the individual. Note: On a day to be named by proclamation of the Lieutenant Governor, paragraph 3 of subsection 23 (1) of the Act is amended by striking out “(3) or (4)” and substituting “(3), (3.1) or (4)”. (See: 2017, c. 25, Sched. 5, s. 71) 4. If the individual is deceased, the deceased’s estate trustee or the person who has assumed responsibility for the administration of the deceased’s estate, if the estate does not have an estate trustee. 5. A person whom an Act of Ontario or Canada authorizes or requires to act on behalf of the individual. 2004, c. 3, Sched. A, s. 23 (1); 2007, c. 10, Sched. H, s. 5; 2017, c. 14, Sched. 4, s. 28 (1); 2021, c. 4, Sched. 11, s. 27 (2). Definition (2) In subsection (1), “parent” does not include a parent who has only a right of access to the child. 2004, c. 3, Sched. A, s. 23 (2); 2021, c. 4, Sched. 11, s. 27 (3, 4). Conflict if child capable (3) If the individual is a child who is less than 16 years of age and who is capable of consenting to the collection, use or disclosure of the information and if there is a person who is entitled to act as the substitute decision-maker of the child under paragraph 2 of subsection (1), a decision of the child to give, withhold or withdraw the consent or to provide the information prevails over a conflicting decision of that person. 2004, c. 3, Sched. A, s. 23 (3). Section Amendments with date in force (d/m/y) 2007, c. 10, Sched. H, s. 5 - 04/06/2007 2017, c. 14, Sched. 4, s. 28 (1) - 30/04/2018; 2017, c. 25, Sched. 5, s. 71 - not in force 2021, c. 4, Sched. 11, s. 27 (2-4) - 19/04/2021 Factors to consider for consent 24 (1) A person who consents under this Act or any other Act on behalf of or in the place of an individual to a collection, use or disclosure of personal health information by a health information custodian, who withholds or withdraws such a consent or who provides an express instruction under clause 37 (1) (a), 38 (1) (a) or 50 (1) (e) shall take into consideration, (a) the wishes, values and beliefs that, (i) if the individual is capable, the person knows the individual holds and believes the individual would want reflected in decisions made concerning the individual’s personal health information, or (ii) if the individual is incapable or deceased, the person knows the individual held when capable or alive and believes the individual would have wanted reflected in decisions made concerning the individual’s personal health information; (b) whether the benefits that the person expects from the collection, use or disclosure of the information outweigh the risk of negative consequences occurring as a result of the collection, use or disclosure; (c) whether the purpose for which the collection, use or disclosure is sought can be accomplished without the collection, use or disclosure; and (d) whether the collection, use or disclosure is necessary to satisfy any legal obligation. 2004, c. 3, Sched. A, s. 24 (1). Determination of compliance (2) If a substitute decision-maker, on behalf of an incapable individual, gives, withholds or withdraws a consent to a collection, use or disclosure of personal health information about the individual by a health information custodian or provides an express instruction under clause 37 (1) (a), 38 (1) (a) or 50 (1) (e) and if the custodian is of the opinion that the substitute decision-maker has not complied with subsection (1), the custodian may apply to the Board for a determination as to whether the substitute decision-maker complied with that subsection. 2004, c. 3, Sched. A, s. 24 (2). Deemed application concerning capacity (2.1) An application to the Board under subsection (2) shall be deemed to include an application to the Board under subsection 22 (3) with respect to the individual’s capacity to consent to the collection, use or disclosure of his or her personal health information, unless the individual’s capacity has been determined by the Board within the previous six months. 2007, c. 10, Sched. H, s. 6. Parties (3) The parties to the application are: 1. The health information custodian. 2. The incapable individual. 3. The substitute decision-maker. 4. Any other person whom the Board specifies. 2004, c. 3, Sched. A, s. 24 (3). Power of Board (4) In determining whether the substitute decision-maker complied with subsection (1), the Board may substitute its opinion for that of the substitute decision-maker. 2004, c. 3, Sched. A, s. 24 (4). Directions (5) If the Board determines that the substitute decision-maker did not comply with subsection (1), it may give him or her directions and, in doing so, shall take into consideration the matters set out in clauses (1) (a) to (d). 2004, c. 3, Sched. A, s. 24 (5). Time for compliance (6) The Board shall specify the time within which the substitute decision-maker must comply with its directions. 2004, c. 3, Sched. A, s. 24 (6). Deemed not authorized (7) If the substitute decision-maker does not comply with the Board’s directions within the time specified by the Board, he or she shall be deemed not to meet the requirements of subsection 26 (2). 2004, c. 3, Sched. A, s. 24 (7). Public Guardian and Trustee (8) If the substitute decision-maker who is given directions is the Public Guardian and Trustee, he or she is required to comply with the directions and subsection (6) does not apply to him or her. 2004, c. 3, Sched. A, s. 24 (8). Procedure (9) Sections 73 to 81 of the Health Care Consent Act, 1996 apply with necessary modifications to an application under this section. 2004, c. 3, Sched. A, s. 24 (9). Section Amendments with date in force (d/m/y) 2007, c. 10, Sched. H, s. 6 - 04/06/2007 Authority of substitute decision-maker 25 (1) If this Act permits or requires an individual to make a request, give an instruction or take a step and a substitute decision-maker is authorized to consent on behalf of the individual to the collection, use or disclosure of personal health information about the individual, the substitute decision-maker may make the request, give the instruction or take the step on behalf of the individual. 2004, c. 3, Sched. A, s. 25 (1). Same (2) If a substitute decision-maker makes a request, gives an instruction or takes a step under subsection (1) on behalf of an individual, references in this Act to the individual with respect to the request made, the instruction given or the step taken by the substitute decision-maker shall be read as references to the substitute decision-maker, and not to the individual. 2004, c. 3, Sched. A, s. 25 (2). Incapable individual: persons who may consent 26 (1) If an individual is determined to be incapable of consenting to the collection, use or disclosure of personal health information by a health information custodian, a person described in one of the following paragraphs may, on the individual’s behalf and in the place of the individual, give, withhold or withdraw the consent: 1. The individual’s guardian of the person or guardian of property, if the consent relates to the guardian’s authority to make a decision on behalf of the individual. 2. The individual’s attorney for personal care or attorney for property, if the consent relates to the attorney’s authority to make a decision on behalf of the individual. 3. The individual’s representative appointed by the Board under section 27, if the representative has authority to give the consent. 4. The individual’s spouse or partner. 5. A child or parent of the individual, or a children’s aid society or other person who is lawfully entitled to give or refuse consent in the place of the parent. This paragraph does not include a parent who has only a right of access to the individual. If a children’s aid society or other person is lawfully entitled to consent in the place of the parent, this paragraph does not include the parent. 6. A parent of the individual with only a right of access to the individual. 7. A brother or sister of the individual. 8. Any other relative of the individual. 2004, c. 3, Sched. A, s. 26 (1); 2016, c. 23, s. 64 (2); 2021, c. 4, Sched. 11, s. 27 (5, 6). Requirements (2) A person described in subsection (1) may consent only if the person, (a) is capable of consenting to the collection, use or disclosure of personal health information by a health information custodian; (b) in the case of an individual, is at least 16 years old or is the parent of the individual to whom the personal health information relates; (c) is not prohibited by court order or separation agreement from having access to the individual to whom the personal health information relates or from giving or refusing consent on the individual’s behalf; (d) is available; and (e) is willing to assume the responsibility of making a decision on whether or not to consent. 2004, c. 3, Sched. A, s. 26 (2); 2021, c. 4, Sched. 11, s. 27 (7). Meaning of “available” (3) For the purpose of clause (2) (d), a person is available if it is possible, within a time that is reasonable in the circumstances, to communicate with the person and obtain a consent. 2004, c. 3, Sched. A, s. 26 (3). Ranking (4) A person described in a paragraph of subsection (1) may consent only if no person described in an earlier paragraph meets the requirements of subsection (2). 2004, c. 3, Sched. A, s. 26 (4). Same (5) Despite subsection (4), a person described in a paragraph of subsection (1) who is present or has otherwise been contacted may consent if the person believes that, (a) no other person described in an earlier paragraph or the same paragraph exists; or (b) although such other person exists, the other person is not a person described in paragraph 1, 2 or 3 of subsection (1) and would not object to the person who is present or has otherwise been contacted making the decision. 2004, c. 3, Sched. A, s. 26 (5); 2007, c. 10, Sched. H, s. 7. Public Guardian and Trustee (6) If no person described in subsection (1) meets the requirements of subsection (2), the Public Guardian and Trustee may make the decision to consent. 2004, c. 3, Sched. A, s. 26 (6). Conflict between persons in same paragraph (7) If two or more persons who are described in the same paragraph of subsection (1) and who meet the requirements of subsection (2) disagree about whether to consent, and if their claims rank ahead of all others, the Public Guardian and Trustee may make the decision in their stead. 2004, c. 3, Sched. A, s. 26 (7). Transition, representative appointed by individual (8) Where an individual, to whom personal health information relates, appointed a representative under section 36.1 of the Mental Health Act before the day this section comes into force, the representative shall be deemed to have the same authority as a person mentioned in paragraph 2 of subsection (1). 2004, c. 3, Sched. A, s. 26 (8). Limited authority (9) The authority conferred on the representative by subsection (8) is limited to the purposes for which the representative was appointed. 2004, c. 3, Sched. A, s. 26 (9). Revocation (10) An individual who is capable of consenting with respect to personal health information may revoke the appointment mentioned in subsection (8) in writing. 2004, c. 3, Sched. A, s. 26 (10). Ranking (11) A person who is entitled to be the substitute decision-maker of the individual under this section may act as the substitute decision-maker only in circumstances where there is no person who may act as the substitute decision-maker of the individual under subsection 5 (2), (3) or (4). 2004, c. 3, Sched. A, s. 26 (11). Note: On a day to be named by proclamation of the Lieutenant Governor, subsection 26 (11) of the Act is amended by striking out “(3) or (4)” at the end and substituting “(3), (3.1) or (4)”. (See: 2017, c. 25, Sched. 5, s. 72) Section Amendments with date in force (d/m/y) 2007, c. 10, Sched. H, s. 7 - 04/06/2007 2016, c. 23, s. 64 (2) - 05/12/2016 2017, c. 25, Sched. 5, s. 72 - not in force 2021, c. 4, Sched. 11, s. 27 (5-7) - 19/04/2021 Appointment of representative 27 (1) An individual who is 16 years old or older and who is determined to be incapable of consenting to the collection, use or disclosure of personal health information may apply to the Board for appointment of a representative to consent on the individual’s behalf to a collection, use or disclosure of the information by a health information custodian. 2004, c. 3, Sched. A, s. 27 (1). Application by proposed representative (2) If an individual is incapable of consenting to the collection, use or disclosure of personal health information, another individual who is 16 years old or older may apply to the Board to be appointed as a representative to consent on behalf of the incapable individual to a collection, use or disclosure of the information. 2004, c. 3, Sched. A, s. 27 (2). Deemed application concerning capacity (2.1) An application to the Board under subsection (1) or (2) shall be deemed to include an application to the Board under subsection 22 (3) with respect to the individual’s capacity to consent to the collection, use or disclosure of his or her personal health information, unless the individual’s capacity has been determined by the Board within the previous six months. 2007, c. 10, Sched. H, s. 8. Exception (3) Subsections (1) and (2) do not apply if the individual to whom the personal health information relates has a guardian of the person, a guardian of property, an attorney for personal care, or an attorney for property, who has authority to give or refuse consent to the collection, use or disclosure. 2004, c. 3, Sched. A, s. 27 (3). Parties (4) The parties to the application are: 1. The individual to whom the personal health information relates. 2. The proposed representative named in the application. 3. Every person who is described in paragraph 4, 5, 6 or 7 of subsection 26 (1). 4. All other persons whom the Board specifies. 2004, c. 3, Sched. A, s. 27 (4). Appointment (5) In an appointment under this section, the Board may authorize the representative to consent, on behalf of the individual to whom the personal health information relates, to, (a) a particular collection, use or disclosure at a particular time; (b) a collection, use or disclosure of the type specified by the Board in circumstances specified by the Board, if the individual is determined to be incapable of consenting to the collection, use or disclosure of personal health information at the time the consent is sought; or (c) any collection, use or disclosure at any time, if the individual is determined to be incapable of consenting to the collection, use or disclosure of personal health information at the time the consent is sought. 2004, c. 3, Sched. A, s. 27 (5). Criteria for appointment (6) The Board may make an appointment under this section if it is satisfied that the following requirements are met: 1. The individual to whom the personal health information relates does not object to the appointment. 2. The representative consents to the appointment, is at least 16 years old and is capable of consenting to the collection, use or disclosure of personal health information. 3. The appointment is in the best interests of the individual to whom the personal health information relates. 2004, c. 3, Sched. A, s. 27 (6). Powers of Board (7) Unless the individual to whom the personal health information relates objects, the Board may, (a) appoint as representative a different individual than the one named in the application; (b) limit the duration of the appointment; (c) impose any other condition on the appointment; or (d) on any person’s application, remove, vary or suspend a condition imposed on the appointment or impose an additional condition on the appointment. 2004, c. 3, Sched. A, s. 27 (7). Termination (8) The Board may, on any person’s application, terminate an appointment made under this section if, (a) the individual to whom the personal health information relates or the representative requests the termination; (b) the representative is no longer capable of consenting to the collection, use or disclosure of personal health information; (c) the appointment is no longer in the best interests of the individual to whom the personal health information relates; or (d) the individual to whom the personal health information relates has a guardian of the person, a guardian of property, an attorney for personal care, or an attorney for property, who has authority to give or refuse consent to the types of collections, uses and disclosures for which the appointment was made and in the circumstances to which the appointment applies. 2004, c. 3, Sched. A, s. 27 (8). Procedure (9) Sections 73 to 81 of the Health Care Consent Act, 1996 apply with necessary modifications to an application under this section. 2004, c. 3, Sched. A, s. 27 (9). Section Amendments with date in force (d/m/y) 2007, c. 10, Sched. H, s. 8 - 04/06/2007 Transition, representative appointed by Board 28 (1) This Act applies to a representative whom the Board appointed under section 36.2 of the Mental Health Act or who was deemed to be appointed under that section before the day this section comes into force for an individual with respect to the individual’s personal health information, as if the representative were the individual’s representative appointed by the Board under section 27. 2004, c. 3, Sched. A, s. 28 (1). Limited authority (2) The authority conferred on the representative by subsection (1) is limited to the purposes for which the representative was appointed. 2004, c. 3, Sched. A, s. 28 (2). PART IV COLLECTION, USE AND DISCLOSURE OF PERSONAL HEALTH INFORMATION General Limitations and Requirements Requirement for consent 29 A health information custodian shall not collect, use or disclose personal health information about an individual unless, (a) it has the individual’s consent under this Act and the collection, use or disclosure, as the case may be, to the best of the custodian’s knowledge, is necessary for a lawful purpose; or (b) the collection, use or disclosure, as the case may be, is permitted or required by this Act. 2004, c. 3, Sched. A, s. 29. Other information 30 (1) A health information custodian shall not collect, use or disclose personal health information if other information will serve the purpose of the collection, use or disclosure. 2004, c. 3, Sched. A, s. 30 (1). Extent of information (2) A health information custodian shall not collect, use or disclose more personal health information than is reasonably necessary to meet the purpose of the collection, use or disclosure, as the case may be. 2004, c. 3, Sched. A, s. 30 (2). Exception (3) This section does not apply to personal health information that a health information custodian is required by law to collect, use or disclose. 2004, c. 3, Sched. A, s. 30 (3). Use and disclosure of personal health information 31 (1) A health information custodian that collects personal health information in contravention of this Act shall not use it or disclose it unless required by law to do so. 2004, c. 3, Sched. A, s. 31 (1). (2) Repealed: 2004, c. 3, Sched. A, s. 31 (4). (3) Repealed: 2004, c. 3, Sched. A, s. 31 (4). (4) Spent: 2004, c. 3, Sched. A, s. 31 (4). Section Amendments with date in force (d/m/y) 2004, c. 3, Sched. A, s. 31 (4) - 01/11/2005 Fundraising 32 (1) Subject to subsection (2), a health information custodian may collect, use or disclose personal health information about an individual for the purpose of fundraising activities only where, (a) the individual expressly consents; or (b) the individual consents by way of an implied consent and the information consists only of the individual’s name and the prescribed types of contact information. 2004, c. 3, Sched. A, s. 32 (1); 2007, c. 10, Sched. H, s. 9. Requirements and restrictions (2) The manner in which consent is obtained under subsection (1) and the resulting collection, use or disclosure of personal health information for the purpose of fundraising activities shall comply with the requirements and restrictions that are prescribed, if any. 2004, c. 3, Sched. A, s. 32 (2). Section Amendments with date in force (d/m/y) 2007, c. 10, Sched. H, s. 9 - 04/06/2007 Marketing 33 A health information custodian shall not collect, use or disclose personal health information about an individual for the purpose of marketing anything or for the purpose of market research unless the individual expressly consents and the custodian collects, uses or discloses the information, as the case may be, subject to the prescribed requirements and restrictions, if any. 2004, c. 3, Sched. A, s. 33. Health cards and health numbers 34 (1) In this section, “health card” means a card provided to an insured person within the meaning of the Health Insurance Act by the General Manager of the Ontario Health Insurance Plan; (“carte Santé”) “provincially funded health resource” means a service, thing, subsidy or other benefit funded, in whole or in part, directly or indirectly by the Government of Ontario, if it is health related or prescribed. (“ressource en matière de santé subventionnée par la province”) 2004, c. 3, Sched. A, s. 34 (1). Collection or use (2) Despite subsection 49 (1), a person who is neither a health information custodian nor acting as an agent of a health information custodian shall not collect or use another person’s health number except, (a) for purposes related to the provision of provincially funded health resources to that other person; (b) for the purposes for which a health information custodian has disclosed the number to the person; (b.1) if the person is prescribed and is collecting or using the health number, as the case may be, with the express consent of the other person, for the purpose of accurately identifying the other person’s records of personal health information, verifying their identity or linking their records of personal health information, subject to the additional requirements, if any, that are prescribed; (c) if the person is the governing body of health care practitioners who provide provincially funded health resources and is collecting or using health numbers for purposes related to its duties or powers; (d) if the person is prescribed and is collecting or using the health number, as the case may be, for purposes related to health administration, health planning, health research or epidemiological studies; (e) if the person is prescribed and is collecting or using the health number, as the case may be, for purposes related to the electronic health record developed and maintained by the prescribed organization;

or (f) if the prescribed organization or any other prescribed person is collecting or using the health number, as the case may be, for prescribed purposes related to digital health identifier activities in accordance with any additional prescribed requirements. 2007, c. 10, Sched. H, s. 10; 2016, c. 6, Sched. 1, s. 1 (9); 2020, c. 5, Sched. 6, s. 4 (1); 2025, c. 7, Sched. 6, s. 4. Disclosure (3) Despite subsection 49 (1) and subject to the exceptions and additional requirements, if any, that are prescribed, a person who is neither a health information custodian nor acting as an agent of a health information custodian shall not disclose a health number except as required by law. 2007, c. 10, Sched. H, s. 10. Confidentiality of health cards (4) No person shall require the production of another person’s health card, but a person who provides a provincially funded health resource to a person who has a health card may require the production of the health card. 2004, c. 3, Sched. A, s. 34 (4). Exceptions (5) Subsections (2) and (3) do not apply to, (a) a person who collects, uses or discloses a health number for the purposes of a proceeding; (b) a prescribed entity mentioned in subsection 45 (1) that collects, uses or discloses the health number in the course of carrying out its functions under section 45; or (c) a health data institute that the Minister approves under subsection 47 (9) and that collects, uses or discloses the health number in the course of carrying out its functions under sections 47 and 48. 2004, c. 3, Sched. A, s. 34 (5). Collection, use and disclosure, non-provincially funded health resource (6) Subject to the additional requirements, if any, that are prescribed, a health information custodian that is providing health care to a person may collect, use or disclose the person’s health number with the consent of the person for the purpose of accurately identifying the person’s records of personal health information, verifying their identity or linking their records of personal health information, even where the health information custodian is not providing a provincially funded health resource. 2020, c. 5, Sched. 6, s. 4 (2). Same, provincially funded health resource (7) Subject to the additional requirements, if any, that are prescribed, a health information custodian that has collected a health number for purposes related to the provision of a provincially funded health resource to a person may use the health number for the purpose of accurately identifying the person’s records of personal health information, verifying their identity or linking their records of personal health information. 2020, c. 5, Sched. 6, s. 4 (2). Other permitted collection, etc. not affected (8) Nothing in subsection (6) or (7) limits a health information custodian’s authority to collect, use or disclose a health number as otherwise permitted or required by this Act. 2020, c. 5, Sched. 6, s. 4 (2). Section Amendments with date in force (d/m/y) 2007, c. 10, Sched. H, s. 10 - 04/06/2007 2016, c. 6, Sched. 1, s. 1 (9) - 01/10/2020 2020, c. 5, Sched. 6, s. 4 (1, 2) - 25/03/2020 2025, c. 7, Sched. 6, s. 4 - 01/01/2026 Fees for personal health information 35 (1) A health information custodian shall not charge a person a fee for collecting or using personal health information except as authorized by the regulations made under this Act. 2004, c. 3, Sched. A, s. 35 (1). Same, for disclosure (2) When disclosing personal health information, a health information custodian shall not charge fees to a person that exceed the prescribed amount or the amount of reasonable cost recovery, if no amount is prescribed. 2004, c. 3, Sched. A, s. 35 (2). Collection Indirect collection 36 (1) A health information custodian may collect personal health information about an individual indirectly if, (a) the individual consents to the collection being made indirectly; (b) the information to be collected is reasonably necessary for providing health care or assisting in providing health care to the individual and it is not reasonably possible to collect, directly from the individual, (i) personal health information that can reasonably be relied on as accurate and complete, or (ii) personal health information in a timely manner; (c) the custodian is an institution within the meaning of the Freedom of Information and Protection of Privacy Act or the Municipal Freedom of Information and Protection of Privacy Act, or is acting as part of such an institution, and the custodian is collecting the information for a purpose related to, (i) investigating a breach of an agreement or a contravention or an alleged contravention of the laws of Ontario or Canada, (ii) the conduct of a proceeding or a possible proceeding, or (iii) the statutory function of the custodian; (d) the custodian collects the information from a person who is not a health information custodian for the purpose of carrying out research conducted in accordance with subsection 37 (3) or research that a research ethics board has approved under section 44 or that meets the criteria set out in clauses 44 (10) (a) to (c), except if the person is prohibited by law from disclosing the information to the custodian; (e) the custodian is a prescribed entity mentioned in subsection 45 (1) and the custodian is collecting personal health information from a person who is not a health information custodian for the purpose of that subsection; (f) the Commissioner authorizes that the collection be made in a manner other than directly from the individual; (g) the custodian collects the information from a person who is permitted or required by law or by a treaty, agreement or arrangement made under an Act or an Act of Canada to disclose it to the custodian; or (h) subject to the requirements and restrictions, if any, that are prescribed, the health information custodian is permitted or required by law or by a treaty, agreement or arrangement made under an Act or an Act of Canada to collect the information indirectly. 2004, c. 3, Sched. A, s. 36 (1); 2007, c. 10, Sched. H, s. 11. Direct collection without consent (2) A health information custodian may collect personal health information about an individual directly from the individual, even if the individual is incapable of consenting, if the collection is reasonably necessary for the provision of health care and it is not reasonably possible to obtain consent in a timely manner. 2004, c. 3, Sched. A, s. 36 (2). Section Amendments with date in force (d/m/y) 2007, c. 10, Sched. H, s. 11 - 04/06/2007 Use Permitted use 37 (1) A health information custodian may use personal health information about an individual, (a) for the purpose for which the information was collected or created and for all the functions reasonably necessary for carrying out that purpose, but not if the information was collected with the consent of the individual or under clause 36 (1) (b) and the individual expressly instructs otherwise; (b) for a purpose for which this Act, another Act or an Act of Canada permits or requires a person to disclose it to the custodian; (c) for planning or delivering programs or services that the custodian provides or that the custodian funds in whole or in part, allocating resources to any of them, evaluating or monitoring any of them or detecting, monitoring or preventing fraud or any unauthorized receipt of services or benefits related to any of them; (d) for the purpose of risk management, error management or for the purpose of activities to improve or maintain the quality of care or to improve or maintain the quality of any related programs or services of the custodian; (e) for educating agents to provide health care; (f) in a manner consistent with Part II, for the purpose of disposing of the information or modifying the information in order to conceal the identity of the individual; (g) for the purpose of seeking the individual’s consent, or the consent of the individual’s substitute decision-maker, when the personal health information used by the custodian for this purpose is limited to the name and contact information of the individual and the name and contact information of the substitute decision-maker, where applicable; (h) for the purpose of a proceeding or contemplated proceeding in which the custodian or the agent or former agent of the custodian is, or is expected to be, a party or witness, if the information relates to or is a matter in issue in the proceeding or contemplated proceeding; (i) for the purpose of obtaining payment or processing, monitoring, verifying or reimbursing claims for payment for the provision of health care or related goods and services; (j) for research conducted by the custodian, subject to subsection (3), unless another clause of this subsection applies; or (k) subject to the requirements and restrictions, if any, that are prescribed, if permitted or required by law or by a treaty, agreement or arrangement made under an Act or an Act of Canada. 2004, c. 3, Sched. A, s. 37 (1); 2007, c. 10, Sched. H, s. 12. Agents (2) If subsection (1) authorizes a health information custodian to use personal health information for a purpose, the custodian may provide the information to an agent of the custodian who may use it for that purpose on behalf of the custodian. 2004, c. 3, Sched. A, s. 37 (2). Research (3) Under clause (1) (j), a health information custodian may use personal health information about an individual only if the custodian prepares a research plan and has a research ethics board approve it and for that purpose subsections 44 (2) to (4) and clauses 44 (6) (a) to (f) apply to the use as if it were a disclosure. 2004, c. 3, Sched. A, s. 37 (3). Mixed uses (4) If a research plan mentioned in subsection (3) proposes that a health information custodian that is an institution within the meaning of the Freedom of Information and Protection of Privacy Act or the Municipal Freedom of Information and Protection of Privacy Act or that is acting as part of such an institution use personal health information, together with personal information within the meaning of those two Acts that is not personal health information, those two Acts do not apply to the use and this section applies to the use. 2004, c. 3, Sched. A, s. 37 (4). Section Amendments with date in force (d/m/y) 2007, c. 10, Sched. H, s. 12 - 04/06/2007 Disclosure Disclosures related to providing health care 38 (1) A health information custodian may disclose personal health information about an individual, (a) to a health information custodian described in paragraph 1, 3 or 4 of the definition of “health information custodian” in subsection 3 (1), if the disclosure is reasonably necessary for the provision of health care and it is not reasonably possible to obtain the individual’s consent in a timely manner, but not if the individual has expressly instructed the custodian not to make the disclosure; (b) in order for the Minister, another health information custodian or the Agency to determine or provide funding or payment to the custodian for the provision of health care; or (c) for the purpose of contacting a relative, friend or potential substitute decision-maker of the individual, if the individual is injured, incapacitated or ill and unable to give consent personally. 2004, c. 3, Sched. A, s. 38 (1); 2006, c. 4, s. 51 (2); 2007, c. 10, Sched. H, s. 13; 2016, c. 23, s. 64 (2); 2016, c. 30, s. 43 (3); 2019, c. 5, Sched. 3, s. 17 (3, 4); 2020, c. 13, Sched. 3, s. 8 (13, 14). Notice of instruction (2) If a health information custodian discloses personal health information about an individual under clause (1) (a) and if an instruction of the individual made under that clause prevents the custodian from disclosing all the personal health information that the custodian considers reasonably necessary to disclose for the provision of health care or assisting in the provision of health care to the individual, the custodian shall notify the person to whom it makes the disclosure of that fact. 2004, c. 3, Sched. A, s. 38 (2). Facility that provides health care (3) A health information custodian that is a facility that provides health care may disclose to a person the following personal health information relating to an individual who is a patient or a resident in the facility if the custodian offers the individual the option, at the first reasonable opportunity after admission to the facility, to object to such disclosures and if the individual does not do so: 1. The fact that the individual is a patient or resident in the facility. 2. The individual’s general health status described as critical, poor, fair, stable or satisfactory, or in similar terms. 3. The location of the individual in the facility. 2004, c. 3, Sched. A, s. 38 (3). Deceased individual (4) A health information custodian may disclose personal health information about an individual who is deceased, or is reasonably suspected to be deceased, (a) for the purpose of identifying the individual; (b) for the purpose of informing any person whom it is reasonable to inform in the circumstances of, (i) the fact that the individual is deceased or reasonably suspected to be deceased, and (ii) the circumstances of death, where appropriate; or (c) to the spouse, partner, sibling or child of the individual if the recipients of the information reasonably require the information to make decisions about their own health care or their children’s health care. 2004, c. 3, Sched. A, s. 38 (4). Section Amendments with date in force (d/m/y) 2006, c. 4, s. 51 (2) - 28/03/2006 2007, c. 10, Sched. H, s. 13 - 04/06/2007 2016, c. 23, s. 64 (2) - 05/12/2016; 2016, c. 30, s. 43 (3) - 01/11/2017 2019, c. 5, Sched. 3, s. 17 (3) - 06/06/2019; 2019, c. 5, Sched. 3, s. 17 (4) - 28/06/2024 2020, c. 13, Sched. 3, s. 8 (13, 14) - 01/05/2022 Disclosures for health or other programs 39 (1) Subject to the requirements and restrictions, if any, that are prescribed, a health information custodian may disclose personal health information about an individual, (a) for the purpose of determining or verifying the eligibility of the individual to receive health care or related goods, services or benefits provided under an Act of Ontario or Canada and funded in whole or in part by the Government of Ontario or Canada, by a municipality or by the Agency, or to receive coverage with respect to such health care, goods, services or benefits; (b) to a person conducting an audit or reviewing an application for accreditation or reviewing an accreditation, if the audit or review relates to services provided by the custodian and the person does not remove any records of personal health information from the custodian’s premises; (c) to a prescribed person who compiles or maintains a registry of personal health information for purposes of facilitating or improving the provision of health care or that relates to the storage or donation of body parts or bodily substances; or (d) where, (i) the disclosure is to another custodian described in paragraph 1, 3 or 4 of the definition of “health information custodian” in subsection 3 (1), (ii) the individual to whom the information relates is one to whom both the disclosing custodian and recipient custodian provide health care or assist in the provision of health care or have previously provided health care or assisted in the provision of health care, and (iii) the disclosure is for the purpose of activities to improve or maintain the quality of care provided by the receiving custodian to the individual to whom the information relates or individuals provided with similar health care. 2004, c. 3, Sched. A, s. 39 (1); 2006, c. 4, s. 51 (3); 2007, c. 10, Sched. H, s. 14; 2009, c. 33, Sched. 18, s. 25 (4); 2016, c. 30, s. 43 (3); 2019, c. 5, Sched. 3, s. 17 (5, 6); 2020, c. 13, Sched. 3, s. 8 (15, 16). Same (2) A health information custodian may disclose personal health information about an individual, (a) to the Chief Medical Officer of Health or a medical officer of health within the meaning of the Health Protection and Promotion Act if the disclosure is made for a purpose of that Act or the Immunization of School Pupils Act; (a.1) to the Ontario Agency for Health Protection and Promotion if the disclosure is made for a purpose of the Ontario Agency for Health Protection and Promotion Act, 2007; or (b) to a public health authority that is similar to the persons described in clause (a) and that is established under the laws of Canada, another province or a territory of Canada or other jurisdiction, if the disclosure is made for a purpose that is substantially similar to a purpose of the Health Protection and Promotion Act or the Immunization of School Pupils Act. 2004, c. 3, Sched. A, s. 39 (2); 2007, c. 10, Sched. K, s. 32; 2020, c. 5, Sched. 6, s. 5. Removal allowed (3) Despite clause (1) (b), the person described in that clause may remove records of personal health information from the custodian’s premises if, (a) the removal is authorized by or under an Act of Ontario or Canada; or (b) an agreement between the custodian and the person authorizes the removal and provides that the records will be held in a secure and confidential manner and will be returned when the audit or review is completed. 2004, c. 3, Sched. A, s. 39 (3). Authorization to collect (4) A person who is not a health information custodian is authorized to collect the personal health information that a health information custodian may disclose to the person under clause (1) (c). 2004, c. 3, Sched. A, s. 39 (4). Section Amendments with date in force (d/m/y) 2006, c. 4, s. 51 (3) - 28/03/2006 2007, c. 10, Sched. H, s. 14 - 04/06/2007; 2007, c. 10, Sched. K, s. 32 - 04/06/2007 2009, c. 33, Sched. 18, s. 25 (4) - 15/12/2009 2016, c. 30, s. 43 (3) - 01/11/2017 2019, c. 5, Sched. 3, s. 17 (5) - 06/06/2019; 2019, c. 5, Sched. 3, s. 17 (6) - 28/06/2024 2020, c. 5, Sched. 6, s. 5 - 25/03/2020; 2020, c. 13, Sched. 3, s. 8 (15, 16) - 01/05/2022 Disclosures related to risks 40 (1) A health information custodian may disclose personal health information about an individual if the custodian believes on reasonable grounds that the disclosure is necessary for the purpose of eliminating or reducing a significant risk of serious bodily harm to a person or group of persons. 2004, c. 3, Sched. A, s. 40 (1). Disclosures related to care or custody (2) A health information custodian may disclose personal health information about an individual to the head of a penal or other custodial institution in which the individual is being lawfully detained or to the officer in charge of a psychiatric facility within the meaning of the Mental Health Act in which the individual is being lawfully detained for the purposes described in subsection (3). 2004, c. 3, Sched. A, s. 40 (2). Same (3) A health information custodian may disclose personal health information about an individual under subsection (2) to assist an institution or a facility in making a decision concerning, (a) arrangements for the provision of health care to the individual; or (b) the placement of the individual into custody, detention, release, conditional release, discharge or conditional discharge under Part VI of the Child, Youth and Family Services Act, 2017, the Mental Health Act, the Ministry of Correctional Services Act, the Corrections and Conditional Release Act (Canada), Part XX.1 of the Criminal Code (Canada), the Prisons and Reformatories Act (Canada) or the Youth Criminal Justice Act (Canada). 2004, c. 3, Sched. A, s. 40 (3); 2017, c. 14, Sched. 4, s. 28 (2). Note: On a day to be named by proclamation of the Lieutenant Governor, clause 40 (3) (b) of the Act is amended by striking out “the Mental Health Act, the Ministry of Correctional Services Act” and substituting “the Correctional Services and Reintegration Act, 2018, the Mental Health Act”. (See: 2018, c. 6, Sched. 3, s. 11) Section Amendments with date in force (d/m/y) 2017, c. 14, Sched. 4, s. 28 (2) - 30/04/2018 2018, c. 6, Sched. 3, s. 11 - not in force Disclosures for proceedings 41 (1) A health information custodian may disclose personal health information about an individual, (a) subject to the requirements and restrictions, if any, that are prescribed, for the purpose of a proceeding or contemplated proceeding in which the custodian or the agent or former agent of the custodian is, or is expected to be, a party or witness, if the information relates to or is a matter in issue in the proceeding or contemplated proceeding; (b) to a proposed litigation guardian or legal representative of the individual for the purpose of having the person appointed as such; (c) to a litigation guardian or legal representative who is authorized under the Rules of Civil Procedure, or by a court order, to commence, defend or continue a proceeding on behalf of the individual or to represent the individual in a proceeding; or (d) for the purpose of complying with, (i) a summons, order or similar requirement issued in a proceeding by a person having jurisdiction to compel the production of information, or (ii) a procedural rule that relates to the production of information in a proceeding. 2004, c. 3, Sched. A, s. 41 (1). Disclosure by agent or former agent (2) An agent or former agent who receives personal health information under subsection (1) or under subsection 37 (2) for purposes of a proceeding or contemplated proceeding may disclose the information to the agent’s or former agent’s professional advisor for the purpose of providing advice or representation to the agent or former agent, if the advisor is under a professional duty of confidentiality. 2004, c. 3, Sched. A, s. 41 (2). Disclosure to successor 42 (1) A health information custodian may disclose personal health information about an individual to a potential successor of the custodian, for the purpose of allowing the potential successor to assess and evaluate the operations of the custodian, if the potential successor first enters into an agreement with the custodian to keep the information confidential and secure and not to retain any of the information longer than is necessary for the purpose of the assessment or evaluation. 2004, c. 3, Sched. A, s. 42 (1). Transfer to successor (2) A health information custodian may transfer records of personal health information about an individual to the custodian’s successor if the custodian makes reasonable efforts to give notice to the individual before transferring the records or, if that is not reasonably possible, as soon as possible after transferring the records. 2004, c. 3, Sched. A, s. 42 (2). Transfer to archives (3) Subject to the agreement of the person who is to receive the transfer, a health information custodian may transfer records of personal health information about an individual to, (a) the Archives of Ontario; or (b) in the prescribed circumstances, a prescribed person whose functions include the collection and preservation of records of historical or archival importance, if the disclosure is made for the purpose of that function. 2004, c. 3, Sched. A, s. 42 (3). Disclosures related to this or other Acts 43 (1) A health information custodian may disclose personal health information about an individual, (a) for the purpose of determining, assessing or confirming capacity under the Health Care Consent Act, 1996, the Substitute Decisions Act, 1992 or this Act; (b) to a College within the meaning of the Regulated Health Professions Act, 1991 for the purpose of the administration or enforcement of the Drug and Pharmacies Regulation Act, the Regulated Health Professions Act, 1991 or an Act named in Schedule 1 to that Act; (b.1) to the Authority within the meaning of the Health and Supportive Care Providers Oversight Authority Act, 2021 for the purpose of the administration or enforcement of that Act; (c) to the Board of Regents continued under the Drugless Practitioners Act for the purpose of the administration or enforcement of that Act; (d) to the Ontario College of Social Workers and Social Service Workers for the purpose of the administration or enforcement of the Social Work and Social Service Work Act, 1998; (e) to the Public Guardian and Trustee, the Children’s Lawyer, a children’s aid society, a residential placement advisory committee established under subsection 63 (1) of the Child, Youth and Family Services Act, 2017 or a designated custodian under section 223 of that Act so that they can carry out their statutory functions; (f) in the circumstances described in clause 42 (1) (c), (g) or (n) of the Freedom of Information and Protection of Privacy Act or clause 32 (c), (g) or (l) of the Municipal Freedom of Information and Protection of Privacy Act, if the custodian is an institution within the meaning of whichever of those Acts applies, or is acting as part of such an institution; (g) subject to the requirements and restrictions, if any, that are prescribed, to a person carrying out an inspection, investigation or similar procedure that is authorized by a warrant or by or under this Act or any other Act of Ontario or an Act of Canada for the purpose of complying with the warrant or for the purpose of facilitating the inspection, investigation or similar procedure; (h) subject to the requirements and restrictions, if any, that are prescribed, if permitted or required by law or by a treaty, agreement or arrangement made under an Act or an Act of Canada. 2004, c. 3, Sched. A, s. 43 (1); 2005, c. 25, s. 35; 2006, c. 34, Sched. C, s. 26; 2007, c. 10, Sched. H, s. 15; 2017, c. 14, Sched. 4, s. 28 (3); 2021, c. 27, Sched. 2, s. 68 (5). Interpretation (2) For the purposes of clause (1) (h) and subject to the regulations made under this Act, if an Act, an Act of Canada or a regulation made under any of those Acts specifically provides that information is exempt, under stated circumstances, from a confidentiality or secrecy requirement, that provision shall be deemed to permit the disclosure of the information in the stated circumstances. 2004, c. 3, Sched. A, s. 43 (2). Section Amendments with date in force (d/m/y) 2005, c. 25, s. 35 - 17/09/2007 2006, c. 34, Sched. C, s. 26 - 01/04/2007 2007, c. 10, Sched. H, s. 15 - 04/06/2007 2017, c. 14, Sched. 4, s. 28 (3) - 30/04/2018 2021, c. 27, Sched. 2, s. 68 (5) - 01/12/2024 Disclosure for research 44 (1) A health information custodian may disclose personal health information about an individual to a researcher if the researcher, (a) submits to the custodian, (i) an application in writing, (ii) a research plan that meets the requirements of subsection (2), and (iii) a copy of the decision of a research ethics board that approves the research plan; and (b) enters into the agreement required by subsection (5). 2004, c. 3, Sched. A, s. 44 (1). Same (1.1) For greater certainty, the decision of only one research ethics board is sufficient for the purposes of subclause (1) (a) (iii). 2020, c. 5, Sched. 6, s. 6. Research plan (2) A research plan must be in writing and must set out, (a) the affiliation of each person involved in the research; (b) the nature and objectives of the research and the public or scientific benefit of the research that the researcher anticipates; and (c) all other prescribed matters related to the research. 2004, c. 3, Sched. A, s. 44 (2). Consideration by board (3) When deciding whether to approve a research plan that a researcher submits to it, a research ethics board shall consider the matters that it considers relevant, including, (a) whether the objectives of the research can reasonably be accomplished without using the personal health information that is to be disclosed; (b) whether, at the time the research is conducted, adequate safeguards will be in place to protect the privacy of the individuals whose personal health information is being disclosed and to preserve the confidentiality of the information; (c) the public interest in conducting the research and the public interest in protecting the privacy of the individuals whose personal health information is being disclosed; and (d) whether obtaining the consent of the individuals whose personal health information is being disclosed would be impractical. 2004, c. 3, Sched. A, s. 44 (3). Decision of board (4) After reviewing a research plan that a researcher has submitted to it, the research ethics board shall provide to the researcher a decision in writing, with reasons, setting out whether the board approves the plan, and whether the approval is subject to any conditions, which must be specified in the decision. 2004, c. 3, Sched. A, s. 44 (4). Agreement respecting disclosure (5) Before a health information custodian discloses personal health information to a researcher under subsection (1), the researcher shall enter into an agreement with the custodian in which the researcher agrees to comply with the conditions and restrictions, if any, that the custodian imposes relating to the use, security, disclosure, return or disposal of the information. 2004, c. 3, Sched. A, s. 44 (5). Compliance by researcher (6) A researcher who receives personal health information about an individual from a health information custodian under subsection (1) shall, (a) comply with the conditions, if any, specified by the research ethics board in respect of the research plan; (b) use the information only for the purposes set out in the research plan as approved by the research ethics board; (c) not publish the information in a form that could reasonably enable a person to ascertain the identity of the individual; (d) despite subsection 49 (1), not disclose the information except as required by law and subject to the exceptions and additional requirements, if any, that are prescribed; (e) not make contact or attempt to make contact with the individual, directly or indirectly, unless the custodian first obtains the individual’s consent to being contacted; (f) notify the custodian immediately in writing if the researcher becomes aware of any breach of this subsection or the agreement described in subsection (5); and (g) comply with the agreement described in subsection (5). 2004, c. 3, Sched. A, s. 44 (6). Mixed disclosures (7) If a researcher submits a research plan under subsection (1) that proposes that a health information custodian that is an institution within the meaning of the Freedom of Information and Protection of Privacy Act or the Municipal Freedom of Information and Protection of Privacy Act or that is acting as part of such an institution disclose to the researcher personal health information, together with personal information within the meaning of those two Acts that is not personal health information, those two Acts do not apply to the disclosure and this section applies to the disclosure. 2004, c. 3, Sched. A, s. 44 (7). Transition (8) Despite subsection (7), nothing in this section prevents a health information custodian that is an institution within the meaning of the Freedom of Information and Protection of Privacy Act or the Municipal Freedom of Information and Protection of Privacy Act or that is acting as part of such an institution from disclosing to a researcher personal health information, that is personal information within the meaning of those two Acts, if, before November 1, 2004, the researcher entered into an agreement with the custodian under subclause 21 (1) (e) (iii) of the Freedom of Information and Protection of Privacy Act or subclause 14 (1) (e) (iii) of the Municipal Freedom of Information and Protection of Privacy Act and the disclosure is within the scope of the agreement. 2007, c. 10, Sched. H, s. 16. Disclosure under other Acts (9) Despite any other Act that permits a health information custodian to disclose personal health information to a researcher for the purpose of conducting research, this section applies to the disclosure as if it were a disclosure for research under this section unless the regulations made under this Act provide otherwise. 2004, c. 3, Sched. A, s. 44 (9). Research approved outside Ontario (10) Subject to subsection (11), a health information custodian may disclose personal health information to a researcher or may use the information to conduct research if, (a) the research involves the use of personal health information originating wholly or in part outside Ontario; (b) the research has received the prescribed approval from a body outside Ontario that has the function of approving research; and (c) the prescribed requirements are met. 2004, c. 3, Sched. A, s. 44 (10). Same (11) Subsections (1) to (4) and clauses (6) (a) and (b) do not apply to a disclosure or use made under subsection (10) and references in the rest of this section to subsection (1) shall be read as references to this subsection with respect to that disclosure or use. 2004, c. 3, Sched. A, s. 44 (11). (12), (13) Repealed: 2004, c. 3, Sched. A, s. 44 (14). (14) Spent: 2004, c. 3, Sched. A, s. 44 (14). Section Amendments with date in force (d/m/y) 2004, c. 3, Sched. A, s. 44 (14) - 01/11/2007 2007, c. 10, Sched. H, s. 16 - 04/06/2007 2020, c. 5, Sched. 6, s. 6 - 25/03/2020 Disclosure for planning and management of health system 45 (1) A health information custodian may disclose to a prescribed entity personal health information for the purpose of analysis or compiling statistical information with respect to the management of, evaluation or monitoring of, the allocation of resources to or planning for all or part of the health system, including the delivery of services, if the entity meets the requirements under subsection (3). 2004, c. 3, Sched. A, s. 45 (1). Exception (2) Subsection (1) does not apply to, (a) notes of personal health information about an individual that are recorded by a health information custodian and that document the contents of conversations during a private counselling session or a group, joint or family counselling session; or (b) prescribed information in circumstances that are prescribed. 2004, c. 3, Sched. A, s. 45 (2). Approval (3) A health information custodian may disclose personal health information to a prescribed entity under subsection (1) if, (a) the entity has in place practices and procedures to protect the privacy of the individuals whose personal health information it receives and to maintain the confidentiality of the information; and (b) the Commissioner has approved the practices and procedures, if the custodian makes the disclosure on or after the first anniversary of the day this section comes into force. 2004, c. 3, Sched. A, s. 45 (3). Review by Commissioner (4) The Commissioner shall review the practices and procedures of each prescribed entity every three years from the date of its approval and advise the health information custodian whether the entity continues to meet the requirements of subsection (3). 2004, c. 3, Sched. A, s. 45 (4). Authorization to collect (5) An entity that is not a health information custodian is authorized to collect the personal health information that a health information custodian may disclose to the entity under subsection (1). 2004, c. 3, Sched. A, s. 45 (5). Use and disclosure (6) Subject to the exceptions and additional requirements, if any, that are prescribed and despite subsection 49 (1), an entity that receives personal health information under subsection (1) shall not use the information except for the purposes for which it received the information and shall not disclose the information except as required by law. 2004, c. 3, Sched. A, s. 45 (6). Additional uses, extra-ministerial data integration unit (7) Despite subsection (6), if an entity that receives personal health information under subsection (1) is an extra-ministerial data integration unit within the meaning of Part III.1 of the Freedom of Information and Protection of Privacy Act, or if such an extra-ministerial data integration unit is located within the entity, the entity may also use the personal health information for a purpose set out in section 49.2 of that Act if the entity complies with Part III.1 of that Act as if it were initially collecting the personal health information. 2020, c. 5, Sched. 6, s. 7. Section Amendments with date in force (d/m/y) 2020, c. 5, Sched. 6, s. 7 - 25/03/2020 Health care payments 46 (1) If requested by the Minister or the minister of a prescribed ministry, a health information custodian shall disclose personal health information to the minister who made the request for the purpose of determining, providing, monitoring or verifying payment or funding for health care funded wholly or in part by the Ministry, the prescribed ministry or the Agency or for goods used for health care funded wholly or in part by one or more of them. 2020, c. 5, Sched. 6, s. 8. Disclosure by minister (2) The Minister or a minister of a prescribed ministry may disclose information collected under subsection (1) to any person for a purpose set out in that subsection if the disclosure is reasonably necessary for that purpose. 2020, c. 5, Sched. 6, s. 8 (1). Other information (3) The Minister or minister of a prescribed ministry, as the case may be, who makes a request under subsection (1) shall not collect, use or disclose personal health information if other information will serve the purpose of the collection, use or disclosure. 2020, c. 5, Sched. 6, s. 8 (1). Extent of information (4) The Minister or minister of a prescribed ministry, as the case may be, who makes a request under subsection (1) shall not collect, use or disclose more personal health information than is reasonably necessary to meet the purpose of the collection, use or disclosure, as the case may be. 2020, c. 5, Sched. 6, s. 8 (1). Section Amendments with date in force (d/m/y) 2006, c. 4, s. 51 (4) - 28/03/2006 2019, c. 5, Sched. 3, s. 17 (7) - 06/06/2019; 2019, c. 5, Sched. 3, s. 17 (8) - no effect - see 2020, c. 5, Sched. 6, s. 25 - 25/03/2020 2020, c. 5, Sched. 6, s. 8 (1) - 25/03/2020; 2020, c. 5, Sched. 6, s. 8 (2) - 28/06/2024 Disclosure for analysis of health system 47 (1) Repealed: 2019, c. 15, Sched. 30, s. 4. Same (2) Subject to the restrictions, if any, that are prescribed, a health information custodian shall, upon the request of the Minister, disclose personal health information to a health data institute that the Minister approves under subsection (9) for analysis with respect to the management of, evaluation or monitoring of, the allocation of resources to or planning for all or part of the health system, including the delivery of services, if the requirements of this section are met. 2004, c. 3, Sched. A, s. 47 (2). Form, manner and time of disclosure (3) The Minister may specify the form and manner in which and the time at which the health information custodian is required to disclose the personal health information under subsection (2). 2004, c. 3, Sched. A, s. 47 (3). Requirements for Minister (4) Before requesting the disclosure of personal health information under subsection (2), the Minister shall submit a proposal to the Commissioner and, in accordance with this section, allow the Commissioner to review and comment on the proposal. 2004, c. 3, Sched. A, s. 47 (4). Contents of proposal (5) The proposal must identify a health data institute to which the personal health information would be disclosed under this section and must set out the prescribed matters. 2004, c. 3, Sched. A, s. 47 (5). Review by Commissioner (6) Within 30 days after the Commissioner receives the proposal, the Commissioner shall review the proposal and may comment in writing on the proposal. 2004, c. 3, Sched. A, s. 47 (6). Consideration by Commissioner (7) In reviewing the proposal, the Commissioner shall consider the public interest in conducting the analysis and the privacy interest of the individuals to whom the personal health information relates in the circumstances. 2004, c. 3, Sched. A, s. 47 (7). Consideration by Minister (8) The Minister shall consider the comments, if any, made by the Commissioner within the time specified in subsection (6), and may amend the proposal if the Minister considers it appropriate. 2004, c. 3, Sched. A, s. 47 (8). Approval of health data institute (9) The Minister may approve a health data institute for the purposes of a disclosure made under this section if, (a) the corporate objects of the institute include performing data analysis of personal health information, linking the information with other information and de-identifying the information for the Minister; and (b) the institute has in place practices and procedures to protect the privacy of the individuals whose personal health information it receives and to maintain the confidentiality of the information and the Commissioner has approved those practices and procedures. 2004, c. 3, Sched. A, s. 47 (9). Review by Commissioner (10) The Commissioner shall review the practices and procedures of each health data institute every three years from the date of its approval and advise the Minister whether the institute continues to meet the requirements of clauses (9) (a) and (b). 2004, c. 3, Sched. A, s. 47 (10). Withdrawal of approval (11) The Minister shall withdraw the approval of a health data institute that ceases to meet the requirements of clauses (9) (a) and (b) or to carry out its objects mentioned in clause (9) (a), unless the Minister requires the institute to take immediate steps to satisfy the Minister that it will meet the requirements or that it will carry out the objects. 2004, c. 3, Sched. A, s. 47 (11). Effect of withdrawal of approval (12) If the Minister withdraws the approval of a health data institute, the institute shall, (a) make no further use or disclosure of any personal health information that a health information custodian has disclosed to it under subsection (2) or any information derived from that personal health information; and (b) comply with the written directions of the Minister that the Commissioner has approved in writing with respect to information described in clause (a). 2004, c. 3, Sched. A, s. 47 (12). If institute ceases to exist (13) If a health data institute ceases to exist, the persons holding the personal health information that the institute received under subsection (2) and held when it ceased to exist shall comply with the written directions of the Minister that the Commissioner has approved in writing with respect to the information. 2004, c. 3, Sched. A, s. 47 (13). Disclosure by Minister (14) The Minister may disclose to the health data institute that receives personal health information under subsection (2) other personal health information for the purposes of the analysis and linking that the Minister requires if the disclosure is included in the Minister’s proposal, as amended under subsection (8), if applicable. 2004, c. 3, Sched. A, s. 47 (14). Duties of health data institute (15) A health data institute that receives personal health information under subsection (2) or (14) shall, (a) follow the practices and procedures described in clause (9) (b) that the Commissioner has approved; (b) perform the analysis and linking with other data that the Minister requires; (c) de-identify the information; (d) provide the results of the analysis and linking, using only de-identified information, to the Minister or to the persons that the Minister approves; (e) not disclose the information to the Minister or to the persons that the Minister approves except in a de-identified form; and (f) subject to clauses (d) and (e), not disclose to any persons the information, even in a de-identified form, or any information derived from the information. 2004, c. 3, Sched. A, s. 47 (15). Transition (16) If the Minister has lawfully required the disclosure of personal health information for a purpose described in subsection (2) in the 18 months before this section comes into force, this section does not apply with respect to a disclosure the Minister requires for a substantially similar purpose after this section comes into force until the first anniversary of the coming into force of this section. 2004, c. 3, Sched. A, s. 47 (16). Notification (17) If the Minister requires a disclosure for a substantially similar purpose under subsection (16) after this section comes into force, the Minister shall notify the Commissioner within the later of the time of requiring the disclosure and 90 days after this section comes into force. 2004, c. 3, Sched. A, s. 47 (17). No hearing required (18) The Minister is not required to hold a hearing or to afford to any person an opportunity for a hearing before making a decision under this section. 2004, c. 3, Sched. A, s. 47 (18). Section Amendments with date in force (d/m/y) 2019, c. 15, Sched. 30, s. 4 - 31/07/2020 Disclosure with Commissioner’s approval 48 (1) A health data institute to which a health information custodian has disclosed personal health information under section 47, shall, upon the request of the Minister and in accordance with the Commissioner’s approval given under this section, disclose the information to the Minister or another person approved by the Minister if the Minister is of the opinion that it is in the public interest to request the disclosure and the requirements of this section have been met. 2004, c. 3, Sched. A, s. 48 (1). Non-application of section (2) The personal health information mentioned in subsection (1) is not, (a) notes of personal health information about an individual that are recorded by a health information custodian and that document the contents of conversations during a private counselling session or a group, joint or family counselling session; or (b) information that is prescribed. 2004, c. 3, Sched. A, s. 48 (2). Commissioner’s approval required (3) The Minister shall not request the disclosure of personal health information under subsection (1) unless the Minister has submitted to the Commissioner a proposal for the disclosure and the Commissioner has approved the proposal. 2004, c. 3, Sched. A, s. 48 (3). Contents of proposal (4) The proposal must include, (a) a statement as to why the disclosure is reasonably required in the public interest and why the disclosure under section 47 was insufficient to meet the public interest; (b) the extent of the identifiers that the Minister proposes be part of the information disclosed and a statement as to why the use of those identifiers is reasonably required for the purpose of the disclosure; (c) a copy of all proposals and comments previously made or received under section 47 in respect of the information, if any; and (d) all other information that the Commissioner requires. 2004, c. 3, Sched. A, s. 48 (4). Terms of approval (5) If the Commissioner approves the proposal, the Commissioner may specify terms, conditions or limitations for the disclosure. 2004, c. 3, Sched. A, s. 48 (5). Restrictions on recipients 49 (1) Except as permitted or required by law and subject to the exceptions and additional requirements, if any, that are prescribed, a person who is not a health information custodian and to whom a health information custodian discloses personal health information, shall not use or disclose the information for any purpose other than, (a) the purpose for which the custodian was authorized to disclose the information under this Act; or (b) the purpose of carrying out a statutory or legal duty. 2004, c. 3, Sched. A, s. 49 (1). Extent of use or disclosure (2) Subject to the exceptions and additional requirements, if any, that are prescribed, a person who is not a health information custodian, and to whom a health information custodian discloses personal health information, shall not use or disclose more of the information than is reasonably necessary to meet the purpose of the use or disclosure, as the case may be, unless the use or disclosure is required by law. 2004, c. 3, Sched. A, s. 49 (2).

Employee or agent information (3) Except as permitted or required by law and subject to the exceptions and additional requirements, if any, that are prescribed, if a health information custodian discloses information to another health information custodian and the information is identifying information of the type described in subsection 4 (4) in the custody or under the control of the receiving custodian, the receiving custodian shall not, (a) use or disclose the information for any purpose other than, (i) the purpose for which the disclosing custodian was authorized to disclose the information under this Act, or (ii) the purpose of carrying out a statutory or legal duty; or (b) use or disclose more of the information than is reasonably necessary to meet the purpose of the use or disclosure, as the case may be. 2004, c. 3, Sched. A, s. 49 (3). Same (4) The restrictions set out in clauses (3) (a) and (b) apply to a health information custodian that receives the identifying information described in subsection (3) even if the custodian receives the information before the day that subsection comes into force. 2004, c. 3, Sched. A, s. 49 (4). Freedom of information legislation (5) Except as prescribed, subsections (1) to (4) do not apply to an institution within the meaning of the Freedom of Information and Protection of Privacy Act or the Municipal Freedom of Information and Protection of Privacy Act that is not a health information custodian or to a person employed by or acting for such an institution when the person is acting in that capacity. 2007, c. 10, Sched. H, s. 17. Same (6) Where this Act permits or requires a health information custodian to disclose personal health information to an institution within the meaning of the Freedom of Information and Protection of Privacy Act or the Municipal Freedom of Information and Protection of Privacy Act that is not a health information custodian, the institution may collect the information from the custodian. 2007, c. 10, Sched. H, s. 17. Section Amendments with date in force (d/m/y) 2007, c. 10, Sched. H, s. 17 - 04/06/2007 Disclosure outside Ontario 50 (1) A health information custodian may disclose personal health information about an individual collected in Ontario to a person outside Ontario only if, (a) the individual consents to the disclosure; (b) this Act permits the disclosure; (c) the person receiving the information performs functions comparable to the functions performed by a person to whom this Act would permit the custodian to disclose the information in Ontario under subsection 40 (2) or clause 43 (1) (b), (c), (d) or (e); (d) the following conditions are met: (i) the custodian is a prescribed entity mentioned in subsection 45 (1) and is prescribed for the purpose of this clause, (ii) the disclosure is for the purpose of health planning or health administration, (iii) the information relates to health care provided in Ontario to a person who is resident of another province or territory of Canada, and (iv) the disclosure is made to the government of that province or territory; (e) the disclosure is reasonably necessary for the provision of health care to the individual, but not if the individual has expressly instructed the custodian not to make the disclosure; or (f) the disclosure is reasonably necessary for the administration of payments in connection with the provision of health care to the individual or for contractual or legal requirements in that connection. 2004, c. 3, Sched. A, s. 50 (1). Notice of instruction (2) If a health information custodian discloses personal health information about an individual under clause (1) (e) and if an instruction of the individual made under that clause prevents the custodian from disclosing all the personal health information that the custodian considers reasonably necessary to disclose for the provision of health care to the individual, the custodian shall notify the person to whom it makes the disclosure of that fact. 2004, c. 3, Sched. A, s. 50 (2). PART V ACCESS TO Records of PERSONAL HEALTH INFORMATION AND CORRECTION Access Application of Part 51 (1) This Part does not apply to a record that contains, (a) quality of care information; (b) personal health information collected or created for the purpose of complying with the requirements of a quality assurance program within the meaning of the Health Professions Procedural Code that is Schedule 2 to the Regulated Health Professions Act, 1991; (c) raw data from standardized psychological tests or assessments; or (d) personal health information of the prescribed type in the custody or under the control of a prescribed class or classes of health information custodians. 2004, c. 3, Sched. A, s. 51 (1). Severable record (2) Despite subsection (1), this Part applies to that part of a record of personal health information that can reasonably be severed from the part of the record that contains the information described in clauses (1) (a) to (d). 2004, c. 3, Sched. A, s. 51 (2). Health care practitioner acting for an institution (3) This Part does not apply to a record in the custody or under the control of a health care practitioner who is employed by or acting for an institution within the meaning of the Freedom of Information and Protection of Privacy Act or the Municipal Freedom of Information and Protection of Privacy Act that is not a health information custodian if the individual has the right to request access to the record under one of those Acts. 2007, c. 10, Sched. H, s. 18. Permission to disclose (4) When subsection (3) applies to a record, the health care practitioner may disclose the record to the institution to enable the institution to process the individual’s request under the Freedom of Information and Protection of Privacy Act or the Municipal Freedom of Information and Protection of Privacy Act, as the case may be, for access to the record. 2007, c. 10, Sched. H, s. 18. Application to prescribed organization (5) Subject to any exceptions and additional requirements, if any, that are prescribed, this Part applies to the prescribed organization as if it were a health information custodian and as if it had custody or control of a record of personal health information that is accessible to health information custodians by means of the electronic health record developed and maintained by the prescribed organization. 2025, c. 7, Sched. 6, s. 5 (1). Same (6) Subject to any exceptions and additional requirements, if any, that are prescribed, this Part applies to the prescribed organization as if it were a health information custodian and as if it had custody or control of an electronic record kept by the prescribed organization under paragraphs 4, 5 and 6 of section 55.3. 2025, c. 7, Sched. 6, s. 5 (2). Same (7) Subject to any exceptions and additional requirements, if any, that are prescribed, this Part applies to the prescribed organization as if it were a health information custodian with respect to digital health identifier records. 2025, c. 7, Sched. 6, s. 5 (3). Application to record of a custodian (8) Subject to any exceptions and additional requirements, if any, that are prescribed, this Part applies to a record in the custody or control of a health information custodian respecting all instances where all or part of the personal health information of the individual that is accessible by means of the electronic health record developed and maintained by the prescribed organization is viewed, handled or otherwise dealt with by the custodian. 2025, c. 7, Sched. 6, s. 5 (4). Section Amendments with date in force (d/m/y) 2007, c. 10, Sched. H, s. 18 - 04/06/2007 2016, c. 6, Sched. 1, s. 1 (10) - no effect - see 2025, c. 7, Sched. 6, s. 14 - 05/06/2025 2025, c. 7, Sched. 6, s. 5 (1-4) - 01/01/2026 Individual’s right of access 52 (1) Subject to this Part, an individual has a right of access to a record of personal health information about the individual that is in the custody or under the control of a health information custodian unless, (a) the record or the information in the record is subject to a legal privilege that restricts disclosure of the record or the information, as the case may be, to the individual; (b) another Act, an Act of Canada or a court order prohibits disclosure to the individual of the record or the information in the record in the circumstances; (c) the information in the record was collected or created primarily in anticipation of or for use in a proceeding, and the proceeding, together with all appeals or processes resulting from it, have not been concluded; (d) the following conditions are met: (i) the information was collected or created in the course of an inspection, investigation or similar procedure authorized by law, or undertaken for the purpose of the detection, monitoring or prevention of a person’s receiving or attempting to receive a service or benefit, to which the person is not entitled under an Act or a program operated by the Minister, or a payment for such a service or benefit, and (ii) the inspection, investigation, or similar procedure, together with all proceedings, appeals or processes resulting from them, have not been concluded; (e) granting the access could reasonably be expected to, (i) result in a risk of serious harm to the treatment or recovery of the individual or a risk of serious bodily harm to the individual or another person, (ii) lead to the identification of a person who was required by law to provide information in the record to the custodian, or (iii) lead to the identification of a person who provided information in the record to the custodian explicitly or implicitly in confidence if the custodian considers it appropriate in the circumstances that the identity of the person be kept confidential; or (f) the following conditions are met: (i) the custodian is an institution within the meaning of the Freedom of Information and Protection of Privacy Act or the Municipal Freedom of Information and Protection of Privacy Act or is acting as part of such an institution, and (ii) the custodian would refuse to grant access to the part of the record, (A) under clause 49 (a), (c) or (e) of the Freedom of Information and Protection of Privacy Act, if the request were made under that Act and that Act applied to the record, or (B) under clause 38 (a) or (c) of the Municipal Freedom of Information and Protection of Privacy Act, if the request were made under that Act and that Act applied to the record. 2004, c. 3, Sched. A, s. 52 (1); 2007, c. 10, Sched. H, s. 19; 2009, c. 33, Sched. 18, s. 25 (5). Format of records (1.1) The right to access a record of personal health information includes the right to access the record in, (a) an electronic format that meets the prescribed requirements, subject to any restrictions, additional requirements or exceptions that may be prescribed; or (b) an electronic format specified by the Agency in accordance with the regulations. 2022, c. 11, Sched. 4, s. 1. Severable record (2) Despite subsection (1), an individual has a right of access to that part of a record of personal health information about the individual that can reasonably be severed from the part of the record to which the individual does not have a right of access as a result of clauses (1) (a) to (f). 2004, c. 3, Sched. A, s. 52 (2). Same (3) Despite subsection (1), if a record is not a record dedicated primarily to personal health information about the individual requesting access, the individual has a right of access only to the portion of personal health information about the individual in the record that can reasonably be severed from the record for the purpose of providing access. 2004, c. 3, Sched. A, s. 52 (3). Home and community care service information (4) Despite subsection (1), a health information custodian shall not refuse to grant the individual access to the individual’s personal health information that is described in clause (c.1) of the definition of “personal health information” in subsection 4 (1). 2020, c. 13, Sched. 3, s. 8 (18). Consultation regarding harm (5) Before deciding to refuse to grant an individual access to a record of personal health information under subclause (1) (e) (i), a health information custodian may consult with a member of the College of Physicians and Surgeons of Ontario or a member of the College of Psychologists of Ontario. 2004, c. 3, Sched. A, s. 52 (5). Informal access (6) Nothing in this Act prevents a health information custodian from, (a) granting an individual access to a record of personal health information, to which the individual has a right of access, if the individual makes an oral request for access or does not make any request for access under section 53; or (b) with respect to a record of personal health information to which an individual has a right of access, communicating with the individual or his or her substitute decision-maker who is authorized to consent on behalf of the individual to the collection, use or disclosure of personal health information about the individual. 2004, c. 3, Sched. A, s. 52 (6). Duty of health information custodian (7) Nothing in this Part relieves a health information custodian from a legal duty to provide, in a manner that is not inconsistent with this Act, personal health information as expeditiously as is necessary for the provision of health care to the individual. 2004, c. 3, Sched. A, s. 52 (7). Section Amendments with date in force (d/m/y) 2007, c. 8, s. 224 (7) - 01/07/2010; 2007, c. 10, Sched. H, s. 19 - 04/06/2007 2009, c. 33, Sched. 18, s. 25 (5) - 15/12/2009 2020, c. 5, Sched. 6, s. 9 - 25/03/2020; 2020, c. 13, Sched. 3, s. 8 (17, 18) - 01/05/2022 2022, c. 11, Sched. 4, s. 1 - 14/04/2022 Request for access 53 (1) An individual may exercise a right of access to a record of personal health information by making a written request for access to the health information custodian that has custody or control of the information. 2004, c. 3, Sched. A, s. 53 (1). Detail in request (2) The request must contain sufficient detail to enable the health information custodian to identify and locate the record with reasonable efforts. 2004, c. 3, Sched. A, s. 53 (2). Assistance (3) If the request does not contain sufficient detail to enable the health information custodian to identify and locate the record with reasonable efforts, the custodian shall offer assistance to the person requesting access in reformulating the request to comply with subsection (2). 2004, c. 3, Sched. A, s. 53 (3). Response of health information custodian 54 (1) A health information custodian that receives a request from an individual for access to a record of personal health information shall, (a) make the record available to the individual for examination and, at the request of the individual, provide a copy of the record to the individual and if reasonably practical, an explanation of any term, code or abbreviation used in the record; (b) give a written notice to the individual stating that, after a reasonable search, the custodian has concluded that the record does not exist, cannot be found, or is not a record to which this Part applies, if that is the case; (c) if the custodian is entitled to refuse the request, in whole or in part, under any provision of this Part other than clause 52 (1) (c), (d) or (e), give a written notice to the individual stating that the custodian is refusing the request, in whole or in part, providing a reason for the refusal and stating that the individual is entitled to make a complaint about the refusal to the Commissioner under Part VI; or (d) subject to subsection (1.1), if the custodian is entitled to refuse the request, in whole or in part, under clause 52 (1) (c), (d) or (e), give a written notice to the individual stating that the individual is entitled to make a complaint about the refusal to the Commissioner under Part VI, and that the custodian is refusing, (i) the request, in whole or in part, while citing which of clauses 52 (1) (c), (d) and (e) apply, (ii) the request, in whole or in part, under one or more of clauses 52 (1) (c), (d) and (e), while not citing which of those provisions apply, or (iii) to confirm or deny the existence of any record subject to clauses 52 (1) (c), (d) and (e). 2004, c. 3, Sched. A, s. 54 (1); 2007, c. 10, Sched. H, s. 20 (1, 2). Providing reasons (1.1) A custodian acting under clause (1) (d) shall not act under subclause (1) (d) (i) where doing so would reasonably be expected in the circumstances known to the person making the decision on behalf of the custodian to reveal to the individual, directly or indirectly, information to which the individual does not have a right of access. 2007, c. 10, Sched. H, s. 20 (3). Time for response (2) Subject to subsection (3), the health information custodian shall give the response required by clause (1) (a), (b), (c) or (d) as soon as possible in the circumstances but no later than 30 days after receiving the request. 2004, c. 3, Sched. A, s. 54 (2). Extension of time for response (3) Within 30 days after receiving the request for access, the health information custodian may extend the time limit set out in subsection (2) for a further period of time of not more than 30 days if, (a) meeting the time limit would unreasonably interfere with the operations of the custodian because the information consists of numerous pieces of information or locating the information would necessitate a lengthy search; or (b) the time required to undertake the consultations necessary to reply to the request within 30 days after receiving it would make it not reasonably practical to reply within that time. 2004, c. 3, Sched. A, s. 54 (3). Notice of extension (4) Upon extending the time limit under subsection (3), the health information custodian shall give the individual written notice of the extension setting out the length of the extension and the reason for the extension. 2004, c. 3, Sched. A, s. 54 (4). Expedited access (5) Despite subsection (2), the health information custodian shall give the response required by clause (1) (a), (b), (c) or (d) within the time period that the individual specifies if, (a) the individual provides the custodian with evidence satisfactory to the custodian, acting on a reasonable basis, that the individual requires access to the requested record of personal health information on an urgent basis within that time period; and (b) the custodian is reasonably able to give the required response within that time period. 2004, c. 3, Sched. A, s. 54 (5). Frivolous or vexatious requests (6) A health information custodian that believes on reasonable grounds that a request for access to a record of personal health information is frivolous or vexatious or is made in bad faith may refuse to grant the individual access to the requested record. 2004, c. 3, Sched. A, s. 54 (6). Effect of non-compliance (7) If the health information custodian does not respond to the request within the time limit or before the extension, if any, expires, the custodian shall be deemed to have refused the individual’s request for access. 2004, c. 3, Sched. A, s. 54 (7). Right to complain (8) If the health information custodian refuses or is deemed to have refused the request, in whole or in part, (a) the individual is entitled to make a complaint about the refusal to the Commissioner under Part VI; and (b) in the complaint, the burden of proof in respect of the refusal lies on the health information custodian. 2004, c. 3, Sched. A, s. 54 (8). Identity of individual (9) A health information custodian shall not make a record of personal health information or a part of it available to an individual under this Part or provide a copy of it to an individual under clause (1) (a) without first taking reasonable steps to be satisfied as to the individual’s identity. 2004, c. 3, Sched. A, s. 54 (9). Fee for access (10) A health information custodian that makes a record of personal health information or a part of it available to an individual under this Part or provides a copy of it to an individual under clause (1) (a) may charge the individual a fee for that purpose if the custodian first gives the individual an estimate of the fee. 2004, c. 3, Sched. A, s. 54 (10). Amount of fee (11) The amount of the fee shall not exceed the prescribed amount or the amount of reasonable cost recovery, if no amount is prescribed. 2004, c. 3, Sched. A, s. 54 (11). Waiver of fee (12) A health information custodian mentioned in subsection (10) may waive the payment of all or any part of the fee that an individual is required to pay under that subsection if, in the custodian’s opinion, it is fair and equitable to do so. 2004, c. 3, Sched. A, s. 54 (12). Section Amendments with date in force (d/m/y) 2007, c. 10, Sched. H, s. 20 (1-3) - 04/06/2007 Note: On a day to be named by proclamation of the Lieutenant Governor, the Act is amended by adding the following section: (See: 2020, c. 5, Sched. 6, s. 10) Consumer electronic service providers 54.1 (1) In this section, “consumer electronic service provider” means a person who provides electronic services to individuals at their request, primarily for, (a) the purpose of allowing those individuals to access, use, disclose, modify, maintain or otherwise manage their records of personal health information, or (b) such other purposes as may be prescribed. 2020, c. 5, Sched. 6, s. 10. Prescribed requirements (2) In providing electronic services to an individual, a consumer electronic service provider shall comply with the prescribed requirements. 2020, c. 5, Sched. 6, s. 10. Health number (3) Despite section 34, a consumer electronic service provider may, if authorized by the individual who requested the provider’s services, collect and use health numbers in accordance with any prescribed rules in order to verify the identity of an individual or for any other prescribed purpose. 2020, c. 5, Sched. 6, s. 10. Health information custodians (4) A health information custodian that provides personal health information to a consumer electronic service provider shall comply with any prescribed requirements or procedures. 2020, c. 5, Sched. 6, s. 10. Not required to respond through consumer electronic service provider (5) For greater certainty, a health information custodian that receives an individual’s request for access to their records of personal health information from a consumer electronic service provider is not required to provide the personal health information to the consumer electronic service provider in responding to the request. 2020, c. 5, Sched. 6, s. 10. Section Amendments with date in force (d/m/y) 2020, c. 5, Sched. 6, s. 10 - not in force Correction Correction 55 (1) If a health information custodian has granted an individual access to a record of his or her personal health information and if the individual believes that the record is inaccurate or incomplete for the purposes for which the custodian has collected, uses or has used the information, the individual may request in writing that the custodian correct the record. 2004, c. 3, Sched. A, s. 55 (1); 2007, c. 10, Sched. H, s. 21. Exception (1.1) Despite subsection (1), an individual is not entitled to request a correction by the prescribed organization when it acts as if it were a health information custodian with respect to the records described in subsection 51 (5), (6) or (7). 2025, c. 7, Sched. 6, s. 6 (1-3). Same (1.2) Despite subsection (1), an individual is not entitled to request a correction by a health information custodian with respect to the records described in subsection 51 (8). 2025, c. 7, Sched. 6, s. 6 (4). Informal request (2) If the individual makes an oral request that the health information custodian correct the record, nothing in this Part prevents the custodian from making the requested correction. 2004, c. 3, Sched. A, s. 55 (2). Reply (3) As soon as possible in the circumstances but no later than 30 days after receiving a request for a correction under subsection (1), the health information custodian shall, by written notice to the individual, grant or refuse the individual’s request or extend the deadline for replying for a period of not more than 30 days if, (a) replying to the request within 30 days would unreasonably interfere with the activities of the custodian; or (b) the time required to undertake the consultations necessary to reply to the request within 30 days would make it not reasonably practical to reply within that time. 2004, c. 3, Sched. A, s. 55 (3). Extension of time for reply (4) A health information custodian that extends the time limit under subsection (3) shall, (a) give the individual written notice of the extension setting out the length of the extension and the reason for the extension; and (b) grant or refuse the individual’s request as soon as possible in the circumstances but no later than the expiry of the time limit as extended. 2004, c. 3, Sched. A, s. 55 (4). Deemed refusal (5) A health information custodian that does not grant a request for a correction under subsection (1) within the time required shall be deemed to have refused the request. 2004, c. 3, Sched. A, s. 55 (5). Frivolous or vexatious requests (6) A health information custodian that believes on reasonable grounds that a request for a correction under subsection (1) is frivolous or vexatious or is made in bad faith may refuse to grant the request and, in that case, shall provide the individual with a notice that sets out the reasons for the refusal and that states that the individual is entitled to make a complaint about the refusal to the Commissioner under Part VI. 2004, c. 3, Sched. A, s. 55 (6). Right to complain (7) The individual is entitled to make a complaint to the Commissioner under Part VI about a refusal made under subsection (6). 2004, c. 3, Sched. A, s. 55 (7). Duty to correct (8) The health information custodian shall grant a request for a correction under subsection (1) if the individual demonstrates, to the satisfaction of the custodian, that the record is incomplete or inaccurate for the purposes for which the custodian uses the information and gives the custodian the information necessary to enable the custodian to correct the record. 2004, c. 3, Sched. A, s. 55 (8). Exceptions (9) Despite subsection (8), a health information custodian is not required to correct a record of personal health information if, (a) it consists of a record that was not originally created by the custodian and the custodian does not have sufficient knowledge, expertise and authority to correct the record; or (b) it consists of a professional opinion or observation that a custodian has made in good faith about the individual. 2004, c. 3, Sched. A, s. 55 (9). Duties upon correction (10) Upon granting a request for a correction under subsection (1), the health information custodian shall, (a) make the requested correction by, (i) recording the correct information in the record and, (A) striking out the incorrect information in a manner that does not obliterate the record, or (B) if that is not possible, labelling the information as incorrect, severing the incorrect information from the record, storing it separately from the record and maintaining a link in the record that enables a person to trace the incorrect information, or (ii) if it is not possible to record the correct information in the record, ensuring that there is a practical system in place to inform a person who accesses the record that the information in the record is incorrect and to direct the person to the correct information; (b) give notice to the individual of what it has done under clause (a); (c) at the request of the individual, give written notice of the requested correction, to the extent reasonably possible, to the persons to whom the custodian has disclosed the information with respect to which the individual requested the correction of the record, except if the correction cannot reasonably be expected to have an effect on the ongoing provision of health care or other benefits to the individual. 2004, c. 3, Sched. A, s. 55 (10). Notice of refusal (11) A notice of refusal under subsection (3) or (4) must give the reasons for the refusal and inform the individual that the individual is entitled to, (a) prepare a concise statement of disagreement that sets out the correction that the health information custodian has refused to make; (b) require that the health information custodian attach the statement of disagreement as part of the records that it holds of the individual’s personal health information and disclose the statement of disagreement whenever the custodian discloses information to which the statement relates; (c) require that the health information custodian make all reasonable efforts to disclose the statement of disagreement to any person who would have been notified under clause (10) (c) if the custodian had granted the requested correction; and (d) make a complaint about the refusal to the Commissioner under Part VI. 2004, c. 3, Sched. A, s. 55 (11). Rights of individual (12) If a health information custodian, under subsection (3) or (4), refuses a request for a correction under subsection (1), in whole or in part, or is deemed to have refused the request, the individual is entitled to take the actions described in any of clauses (11) (a), (b), (c) and (d). 2004, c. 3, Sched. A, s. 55 (12). Custodian’s duty (13) If the individual takes an action described in clause (11) (b) or (c), the health information custodian shall comply with the requirements described in the applicable clause. 2004, c. 3, Sched. A, s. 55 (13). Section Amendments with date in force (d/m/y) 2007, c. 10, Sched. H, s. 21 - 04/06/2007 2025, c. 7, Sched. 6, s. 6 (1-4) - 01/01/2026 Part v.1 Electronic Health Record Interpretation 55.1 (1) In this Part, “advisory committee” means the advisory committee established by the Minister under section 55.11; (“comité consultatif”) “consent directive” means a directive under section 55.6 and includes a directive to modify or withdraw a directive that has already been made; (“directive en matière de consentement”) “electronic health record” means the electronic systems that are developed and maintained by the prescribed organization for the purpose of enabling health information custodians to collect, use and disclose personal health information by means of the systems in accordance with this Part and the regulations made under this Part; (“dossier de santé électronique”) “identifying information” has the same meaning as in subsection 4 (2). (“renseignements identificatoires”) 2016, c. 6, Sched. 1, s. 1 (11); 2019, c. 15, Sched. 30, s. 5. What constitutes collection, use, disclosure re: electronic health record (2) Despite anything in section 2, for the purposes of this Part, a health information custodian is considered to be collecting, using or disclosing personal health information in the following circumstances: 1. When a health information custodian views, handles or otherwise deals with all or part of an individual’s personal health information by means of the electronic health record and that information was provided to the prescribed organization by another health information custodian, i. the health information custodian is considered to be collecting the personal health information if it is viewing, handling or otherwise dealing with the information for the first time, and ii. the health information custodian is considered to be using the personal health information each time it subsequently views, handles or otherwise deals with the information. 2. Whenever a health information custodian views, handles or otherwise deals with all or part of an individual’s personal health information by means of the electronic health record and that information was provided to the prescribed organization by the custodian, the custodian is considered to be using the personal health information. 3. A health information custodian who provides personal health information to the prescribed organization is considered to be disclosing the information only when another health information custodian collects the information by means of the electronic health record. 2016, c. 6, Sched. 1, s. 1 (11). Same, where information provided to prescribed organization (3) Despite anything in section 2, when a health information custodian provides personal health information to the prescribed organization, (a) the custodian is considered not to be disclosing the information to the prescribed organization; and (b) the prescribed organization is considered not to be collecting the information from the custodian. 2016, c. 6, Sched. 1, s. 1 (11). Section Amendments with date in force (d/m/y) 2016, c. 6, Sched. 1, s. 1 (11) - 01/10/2020 2019, c. 15, Sched. 30, s. 5 - 01/10/2020 Electronic health record 55.2 (1) The prescribed organization has the power and the duty to develop and maintain the electronic health record in accordance with this Part and the regulations made under this Part. 2016, c. 6, Sched. 1, s. 1 (12). Functions of prescribed organization (2) The prescribed organization shall perform the following functions: 1. Manage and integrate personal health information it receives from health information custodians. 2. Ensure the proper functioning of the electronic health record by servicing the electronic systems that support the electronic health record. 3. Ensure the accuracy and quality of the personal health information that is accessible by means of the electronic health record by conducting data quality assurance activities on the personal health information it receives from health information custodians. 4. Conduct analyses of the personal health information that is accessible by means of the electronic health record in order to provide alerts and reminders to health information custodians for their use in the provision of health care to individuals. 2016, c. 6, Sched. 1, s. 1 (12). Other powers and duties (3) In addition to carrying out the powers, duties and functions described in this Part and in Part V, the prescribed organization shall carry out any prescribed powers, duties or functions. 2016, c. 6, Sched. 1, s. 1 (12). Section Amendments with date in force (d/m/y) 2016, c. 6, Sched. 1, s. 1 (12) - 01/10/2020 Requirements for electronic health record 55.3 The prescribed organization shall comply with the following requirements in developing and maintaining the electronic health record: 1. It shall take reasonable steps to limit the personal health information it receives to that which is reasonably necessary for developing and maintaining the electronic health record. 2. It shall not permit its employees or any other person acting on its behalf to view, handle or otherwise deal with the personal health information received from health information custodians, unless the employee or person acting on behalf of the prescribed organization agrees to comply with the restrictions that apply to the prescribed organization. 3. It shall make available to the public and to each health information custodian that provides personal health information to it, i. a plain language description of the electronic health record, including a general description of the administrative, technical and physical safeguards in place to, A. protect against theft, loss and unauthorized collection, use or disclosure of the personal health information that is accessible by means of the electronic health record, B. protect the personal health information that is accessible by means of the electronic health record against unauthorized copying, modification or disposal, and C. protect the integrity, security and confidentiality of the personal health information that is accessible by means of the electronic health record, and ii. any directives, guidelines and policies of the prescribed organization that apply to the personal health information that is accessible by means of the electronic health record, to the extent that these do not reveal a trade secret or confidential scientific, technical, commercial or labour relations information. 4. It shall, i. keep an electronic record of all instances where all or part of the personal health information that is accessible by means of the electronic health record is viewed, handled or otherwise dealt with, and ensure that the record identifies the individual to whom the information relates, the type of information that is viewed, handled or otherwise dealt with, all persons who have viewed, handled or otherwise dealt with the information, and the date, time and location of the viewing, handling, or dealing with, and ii. in the event that a health information custodian has requested that the prescribed organization transmit to the custodian personal health information that is accessible by means of the electronic health record, keep an electronic record of all instances where personal health information is transmitted to the custodian by means of the electronic health record, and ensure that the record identifies the individual to whom the information relates, the type of information that is transmitted, the custodian requesting the information, the date and time that the information was transmitted, and the location to which the information was transmitted. 5. It shall keep an electronic record of all instances where a consent directive is made, withdrawn or modified, and shall ensure that the record identifies the individual who made, withdrew or modified the consent directive, the instructions that the individual provided regarding the consent directive, the health information custodian, agent or other person to whom the directive is made, withdrawn or modified, and the date and time that the consent directive was made, withdrawn or modified. 6. It shall keep an electronic record of all instances where all or part of the personal health information that is accessible by means of the electronic health record is disclosed under section 55.7 and shall ensure that the record identifies the health information custodian that disclosed the information, the health information custodian that collected the information, any agent of the health information custodian who collected the information, the individual to whom the information relates, the type of information that was disclosed, the date and time of the disclosure and the purpose of the disclosure. 7. It shall audit and monitor the electronic records that it is required to keep under paragraphs 4, 5 and 6. 8. It shall, upon the request of the Commissioner provide to the Commissioner, for the purposes of Part VI, the electronic records kept under paragraphs 4, 5 and 6. 9. It shall, upon request of a health information custodian that requires the records to audit and monitor its compliance with this Act, provide to the custodian or an agent acting on the custodian’s behalf, the records kept under paragraphs 4, 5 and 6. 10. It shall perform, for each system that retrieves, processes or integrates personal health information that is accessible by means of the electronic health record, an assessment with respect to, i. threats, vulnerabilities and risks to the security and integrity of the personal health information, and ii. how each of those systems may affect the privacy of the individuals to whom the information relates. 11. It shall notify, at the first reasonable opportunity, each health information custodian that provided personal health information to the prescribed organization if the personal health information that the health information custodian provided is stolen or lost or if it is collected, used or disclosed without authority. 12. It shall, i. make available to each health information custodian that provided personal health information to the prescribed organization a written copy of the results of the assessments carried out under paragraph 10 that relates to the personal health information the custodian provided, and ii. make available to the public a summary of the results of the assessments carried out under paragraph 10. 13. It shall ensure that any third party it retains to assist in providing services for the purpose of developing or maintaining the electronic health record agrees to comply with the restrictions and conditions that are necessary to enable the prescribed organization to comply with all these requirements. 14. On and after the first anniversary of the day this section comes into force, it shall have in place and comply with practices and procedures, i. that are for the purpose of protecting the privacy of the individuals whose personal health information it receives and for maintaining the confidentiality of the information, and ii. that are approved by the Commissioner. 15. It shall notify the Commissioner, in writing, immediately after becoming aware that personal health information that is accessible by means of the electronic health record, i. has been viewed, handled or otherwise dealt with by the prescribed organization or a third party retained by the prescribed organization, other than in accordance with this Act or its regulations, or ii. has been made available or released by the prescribed organization or a third party retained by the prescribed organization, other than in accordance with this Act or its regulations. 16. It shall submit to the Commissioner, at least annually, a report in the form and manner specified by the Commissioner, and based on or containing any information, other than personal health information, that is kept in the electronic record required under paragraph 6 that the Commissioner may specify, respecting every instance in which personal health information was disclosed under section 55.7 since the time of the last report. 17. It shall comply with the practices and procedures prescribed in the regulations when managing consent directives. 18. It shall have in place and comply with practices and procedures that have been approved by the Minister for responding to or facilitating a response to a request made by an individual under Part V in respect of the individual’s record of personal health information that is accessible by means of the electronic health record. 19. It shall comply with such other requirements as may be prescribed in the regulations. 2016, c. 6, Sched. 1, s. 1 (13). Section Amendments with date in force (d/m/y) 2016, c. 6, Sched. 1, s. 1 (13) - 01/10/2020 Minister’s directives 55.4 (1) The Minister may make directives to the prescribed organization with respect to the carrying out of its powers, duties and functions under this Part, and the prescribed organization shall comply with the directives of the Minister. 2016, c. 6, Sched. 1, s. 1 (14). Consultation (2) Before making a directive under subsection (1), the Minister shall, (a) submit a draft of the directive to the Commissioner and the advisory committee for the purpose of reviewing and making recommendations on the draft directive; and (b) consider the recommendations, if any, made by the Commissioner and the advisory committee and amend the directive if the Minister considers it appropriate to do so. 2016, c. 6, Sched. 1, s. 1 (14). Timing (3) The Minister shall allow the Commissioner and the advisory committee a period of at least 30 days for the purposes of review and recommendation under subsection (2), unless the Minister believes that there are urgent circumstances involving a significant risk to privacy or the confidentiality of personal health information, in which case the Minister may abridge the review period for both the Commissioner and the advisory committee to not less than five business days. 2016, c. 6, Sched. 1, s. 1 (14). Section Amendments with date in force (d/m/y) 2016, c. 6, Sched. 1, s. 1 (14) - 01/10/2020 Collection, use, disclosure by custodians Restrictions on collection 55.5 (1) A health information custodian shall not collect personal health information by means of the electronic health record except for the purpose of, (a) providing or assisting in the provision of health care to the individual to whom the information relates; or (b) eliminating or reducing a significant risk of serious bodily harm to a person or group of persons, where the health information custodian believes on reasonable grounds that the collection is necessary for this purpose. 2016, c. 6, Sched. 1, s. 1 (15). Unique identification (2) A health information custodian may collect, use and disclose prescribed data elements for the purpose of uniquely identifying an individual in order to collect personal health information under subsection (1). 2016, c. 6, Sched. 1, s. 1 (15). Where consent directive exists (3) Despite subsection (1), where personal health information that is accessible by means of the electronic health record is subject to a consent directive made by an individual under subsection 55.6 (1), a health information custodian may only collect the personal health information in the circumstances permitted under subsection 55.7 (1), (2) or (3). 2016, c. 6, Sched. 1, s. 1 (15). Use or disclosure (4) A health information custodian that collects personal health information under clause (1) (a) may use or disclose the information for any purpose for which this Act permits or requires a custodian to use or disclose personal health information. 2016, c. 6, Sched. 1, s. 1 (15). Same (5) Despite any other provision in this Act or the regulations, a health information custodian that collects personal health information under clause (1) (b) may only use or disclose the information for the purpose for which the information was collected. 2016, c. 6, Sched. 1, s. 1 (15). Section 12 obligations (6) If a health information custodian requests that the prescribed organization transmit personal health information to the custodian by means of the electronic health record and the prescribed organization transmits the information as requested, the custodian shall comply with the obligations referred to in subsection 12 (1) with respect to the transmitted information, regardless of whether the custodian has viewed, handled or otherwise dealt with the information. 2016, c. 6, Sched. 1, s. 1 (15). Same, notice of unauthorized collection (7) Subject to the exceptions and additional requirements, if any, that are prescribed, and in addition to any notice that is required to be given in the case of an unauthorized use or disclosure under subsections 12 (2) and (3), if personal health information about an individual is collected without authority by means of the electronic health record, the health information custodian who is responsible for the unauthorized collection shall, (a) notify the individual at the first reasonable opportunity of the unauthorized collection, and include in the notice a statement that the individual is entitled to make a complaint to the Commissioner under Part VI; and (b) if the circumstances surrounding the unauthorized collection meet the prescribed requirements, notify the Commissioner of the unauthorized collection. 2016, c. 6, Sched. 1, s. 1 (15). Section Amendments with date in force (d/m/y) 2016, c. 6, Sched. 1, s. 1 (15) - 01/10/2020 Consent directives 55.6 (1) Subject to the limitations prescribed in the regulations, if any, an individual may at any time make a directive that withholds or withdraws, in whole or in part, the individual’s consent to the collection, use and disclosure of his or her personal health information by means of the electronic health record by a health information custodian for the purposes of providing or assisting in the provision of health care to the individual. 2016, c. 6, Sched. 1, s. 1 (16). Compliance (2) Where the prescribed organization receives a directive made under subsection (1), it shall, in accordance with the requirements prescribed in the regulations, if any, implement the directive.

2016, c. 6, Sched. 1, s. 1 (16). Withdrawal or modifications (3) Subject to the limitations prescribed in the regulations, if any, an individual who has made a directive under subsection (1) may withdraw or modify the directive. 2016, c. 6, Sched. 1, s. 1 (16). How to make directive (4) An individual may make a directive under subsection (1) or withdraw or modify a directive under subsection (3) by submitting the directive to the prescribed organization. 2016, c. 6, Sched. 1, s. 1 (16). Must contain sufficient detail (5) The directive must contain sufficient detail to enable the prescribed organization to implement the directive. 2016, c. 6, Sched. 1, s. 1 (16). Assistance (6) If the directive does not contain sufficient detail to enable the prescribed organization to implement the directive with reasonable efforts, the prescribed organization shall offer assistance to the person in reformulating the directive to comply with subsection (5). 2016, c. 6, Sched. 1, s. 1 (16). Information re directives (7) If a health information custodian seeks to collect personal health information that is subject to a consent directive, the prescribed organization shall notify the custodian that an individual has made a directive under subsection (1) and shall ensure that no personal health information that is subject to the directive is provided. 2016, c. 6, Sched. 1, s. 1 (16). Section Amendments with date in force (d/m/y) 2016, c. 6, Sched. 1, s. 1 (16) - 01/10/2020 Consent overrides 55.7 (1) Despite the contents of a consent directive, a health information custodian may disclose personal health information that is subject to the directive by means of the electronic health record if the custodian that is seeking to collect the information obtains the express consent of the individual to whom the information relates. 2016, c. 6, Sched. 1, s. 1 (17). Same, protection of individual (2) Despite the contents of a consent directive, a health information custodian may disclose personal health information that is subject to the directive by means of the electronic health record if, (a) the custodian that is seeking to collect the personal health information believes, on reasonable grounds, that the collection is necessary for the purpose of eliminating or reducing a significant risk of serious bodily harm to the individual to whom the information relates; and (b) it is not reasonably possible for the health information custodian that is seeking to collect the personal health information to obtain the individual’s consent in a timely manner. 2016, c. 6, Sched. 1, s. 1 (17). Same, protection of others (3) Despite the contents of a consent directive, a health information custodian may disclose personal health information that is subject to the directive by means of the electronic health record, if the health information custodian that is seeking to collect the personal health information believes on reasonable grounds that the collection is necessary for the purpose of eliminating or reducing a significant risk of serious bodily harm to a person other than the individual to whom the information relates or to a group of persons. 2016, c. 6, Sched. 1, s. 1 (17). Use or disclosure (4) Despite any other provision in this Act or its regulations, a health information custodian that collects personal health information under subsection (1), (2) or (3) may only use or disclose the information for the purpose for which the information was collected. 2016, c. 6, Sched. 1, s. 1 (17). Audit, etc. (5) The prescribed organization shall audit and monitor every instance where personal health information is collected in the circumstances described in subsection (1), (2) or (3). 2016, c. 6, Sched. 1, s. 1 (17). Notice re consent overrides (6) Where personal health information has been collected in the circumstances described in subsection (1), (2) or (3), the prescribed organization shall immediately provide written notice, in accordance with the requirements in the regulations, to the health information custodian that collected the personal health information. 2016, c. 6, Sched. 1, s. 1 (17). Same (7) Upon receiving notice under subsection (6), the custodian that collected the personal health information in the circumstances described in subsection (1), (2) or (3) shall, at the first reasonable opportunity, (a) notify the individual to whom the information relates, in accordance with the requirements in the regulations; and (b) if the personal health information has been collected in the circumstances described in subsection (3), give written notice to the Commissioner, in accordance with the regulations, in a manner that does not provide identifying information about the individual to whom the information relates or the person or group of persons at significant risk of serious bodily harm. 2016, c. 6, Sched. 1, s. 1 (17). No identifying information (8) Where personal health information has been collected in the circumstances described in subsection (3), in notifying the individual to whom the information relates, the custodian shall not provide identifying information about the person or group of persons at significant risk of serious bodily harm. 2016, c. 6, Sched. 1, s. 1 (17). Section Amendments with date in force (d/m/y) 2016, c. 6, Sched. 1, s. 1 (17) - 01/10/2020 Medication interaction checks 55.8 Despite the contents of a consent directive, personal health information may be utilized by a system that is maintained by the prescribed organization and that retrieves, processes or integrates personal health information that is accessible by means of the electronic health record to provide alerts to health information custodians about potentially harmful medication interactions, as long as the alerts do not reveal personal health information that is subject to the consent directive. 2016, c. 6, Sched. 1, s. 1 (18). Section Amendments with date in force (d/m/y) 2016, c. 6, Sched. 1, s. 1 (18) - 01/10/2020 Collection of information by Ministry 55.9 (1) Despite section 55.5, members of a ministry data integration unit located within the Ministry may collect personal health information by means of the electronic health record for the purposes set out in section 49.2 of the Freedom of Information and Protection of Privacy Act in accordance with the requirements set out in Part III.1 (Data Integration) of that Act. 2020, c. 5, Sched. 6, s. 11. No other uses and disclosures permitted (2) Despite any other provision in this Act or the regulations, members of a ministry data integration unit shall not use or disclose the personal health information collected under subsection (1) except as authorized by this section or by Part III.1 of the Freedom of Information and Protection of Privacy Act. 2020, c. 5, Sched. 6, s. 11. Direction to prescribed organization (3) A member of a ministry data integration unit located within the Ministry may issue a direction requiring the prescribed organization to provide members of the ministry data integration unit with the information that the members are authorized to collect under subsection (1), and the prescribed organization must comply with the direction. 2020, c. 5, Sched. 6, s. 11. Terms and conditions (4) A direction made under subsection (3) may specify the form, manner and timeframe in which the information that is the subject of the direction is to be provided to the ministry data integration unit. 2020, c. 5, Sched. 6, s. 11. Disclosure (5) If members of a ministry data integration unit collect personal health information by means of the electronic health record under subsection (1), the disclosure of the personal health information to the members of the ministry data integration unit by the health information custodian who provided it to the prescribed organization is permitted under this Act. 2020, c. 5, Sched. 6, s. 11. Definitions (6) In this section, “member” and “ministry data integration unit” have the same meanings as in Part III.1 of the Freedom of Information and Protection of Privacy Act. 2020, c. 5, Sched. 6, s. 11. Section Amendments with date in force (d/m/y) 2016, c. 6, Sched. 1, s. 1 (19) - 01/10/2020 2020, c. 5, Sched. 6, s. 11 - 01/10/2020 Provision of personal health information to, and collection by, coroners and medical officers of health Provision to coroner 55.9.1 (1) Where the prescribed requirements, if any, are met, the prescribed organization may provide personal health information that is accessible by means of the electronic health record to a coroner in relation to an investigation conducted under the Coroners Act. 2020, c. 5, Sched. 6, s. 12. Collection by medical officer of health (2) The Chief Medical Officer of Health or a medical officer of health within the meaning of the Health Protection and Promotion Act may collect personal health information by means of the electronic health record for purposes related to their duties under that Act or the Immunization of School Pupils Act. 2020, c. 5, Sched. 6, s. 12. Disclosure (3) Personal health information may be provided or collected in accordance with subsection (1) or (2) despite any provision of sections 55.5, 55.6 and 55.7. 2020, c. 5, Sched. 6, s. 12. Section Amendments with date in force (d/m/y) 2020, c. 5, Sched. 6, s. 12 - 01/10/2020 Provision of information for purposes other than health care 55.10 (1) Despite any other provision in this Act or the regulations, the Minister may direct the disclosure of personal health information that is accessible by means of the electronic health record to a person, as if the Minister had custody or control of the information, if, (a) a person has requested that the Minister disclose the personal health information in accordance with clause 39 (1) (c), subsection 39 (2), section 44 or 45 of this Act; (b) the personal health information requested by the person was provided to the prescribed organization under this Part by more than one health information custodian; (c) the Minister has, (i) submitted the request to the advisory committee, (ii) provided the advisory committee with 30 days to review the request and make recommendations to the Minister, and (iii) considered the recommendations, if any, made by the advisory committee; and (d) the Minister has determined that the disclosure of the personal health information would be in accordance with clause 39 (1) (c), subsection 39 (2) or section 44 or 45. 2016, c. 6, Sched. 1, s. 1 (20). Shorter time period (2) The Minister may shorten the time period in subclause (1) (c) (ii) if, (a) in the Minister’s opinion, the urgency of the situation requires it; and (b) the request is for the disclosure of personal health information in accordance with subsection 39 (2). 2016, c. 6, Sched. 1, s. 1 (20). Must comply (3) The prescribed organization must comply with a direction under this section. 2016, c. 6, Sched. 1, s. 1 (20). Terms and conditions (4) A direction under this section may specify the form, manner and timeframe in which the information that is the subject of the direction is to be disclosed. 2016, c. 6, Sched. 1, s. 1 (20). Disclosure only if necessary (5) The Minister shall not direct the disclosure of personal health information under this section if other information will serve the purpose of the disclosure. 2016, c. 6, Sched. 1, s. 1 (20). Only necessary disclosure (6) The Minister shall not direct the disclosure of more personal health information than is reasonably necessary to meet the purpose of the disclosure. 2016, c. 6, Sched. 1, s. 1 (20). Section Amendments with date in force (d/m/y) 2016, c. 6, Sched. 1, s. 1 (20) - 01/10/2020 Advisory committee 55.11 (1) The Minister shall establish an advisory committee for the purpose of making recommendations to the Minister concerning, (a) practices and procedures that the prescribed organization must have in place to protect the privacy of the individuals whose personal health information it receives and to maintain the confidentiality of the information; (b) practices and procedures that the prescribed organization must have in place for responding or facilitating a response to a request made by an individual under Part V for a record of personal health information relating to the individual that is accessible by means of the electronic health record; (c) the administrative, technical and physical safeguards the prescribed organization should have in place to protect the privacy of the individuals whose personal health information it receives and to maintain the confidentiality of the information; (d) the role of the prescribed organization in assisting a health information custodian to fulfil its obligations to give notice to individuals under subsections 12 (2) and 55.5 (7) in the event that personal health information that is accessible by means of the electronic health record is stolen or lost or is collected, used or disclosed without authority; (e) the provision of notice in the event that personal health information that is accessible by means of the electronic health record is stolen or lost or is collected, used or disclosed without authority; (f) anything that is referred to in this Part or in the regulations as capable of being the subject of a recommendation of the advisory committee; and (g) any other matter referred to the advisory committee by the Minister. 2016, c. 6, Sched. 1, s. 1 (21). Terms of reference (2) Subject to the other provisions of this Part, the Minister shall determine the terms of reference of the advisory committee, including terms of reference with respect to conflicts of interest, the membership of the committee and the organization and governance of the committee. 2016, c. 6, Sched. 1, s. 1 (21). Appointments (3) The Minister shall appoint the members of the advisory committee in accordance with the requirements, if any, prescribed in the regulations. 2016, c. 6, Sched. 1, s. 1 (21). Support by Ministry (4) The Ministry, (a) shall provide administrative support for the advisory committee; (b) shall have custody and control of the records of the advisory committee for the purposes of the Freedom of Information and Protection of Privacy Act; and (c) is responsible for compliance with the Archives and Recordkeeping Act, 2006, in connection with records created by or supplied to the advisory committee. 2016, c. 6, Sched. 1, s. 1 (21). Section Amendments with date in force (d/m/y) 2016, c. 6, Sched. 1, s. 1 (21) - 01/10/2020 Practices and procedures review 55.12 (1) The Commissioner shall review the practices and procedures of the prescribed organization referred to in paragraph 14 of section 55.3 every three years after they are first approved or reviewed, as the case may be, to determine if the practices and procedures continue to meet the requirements of subparagraph 14 i of section 55.3 and, after the review, the Commissioner may renew the approval. 2020, c. 5, Sched. 6, s. 13. Notice by Commissioner (2) The Commissioner shall advise health information custodians of the results of a review conducted under subsection (1). 2016, c. 6, Sched. 1, s. 1 (22). Section Amendments with date in force (d/m/y) 2016, c. 6, Sched. 1, s. 1 (22) - 01/10/2020 2020, c. 5, Sched. 6, s. 13 - 01/10/2020 Protection from liability for health information custodian 55.13 A health information custodian who, acting in good faith, provides personal health information to the prescribed organization by means of the electronic health record is not liable for damages resulting from, (a) any unauthorized viewing or handling of the provided information, or any unauthorized dealing with the provided information, by the prescribed organization, its employees or any other person acting on its behalf; or (b) any unauthorized collection of the provided information by another health information custodian. 2016, c. 6, Sched. 1, s. 1 (23). Section Amendments with date in force (d/m/y) 2016, c. 6, Sched. 1, s. 1 (23) - 01/10/2020 Regulations 55.14 (1) The Lieutenant Governor in Council may make regulations for carrying out the purposes and provisions of this Part. 2016, c. 6, Sched. 1, s. 1 (24). Same (2) Without limiting the generality of subsection (1), the Lieutenant Governor in Council may make regulations, (a), (b) Repealed: 2025, c. 7, Sched. 6, s. 7 (1). (c) prescribing additional requirements with which the prescribed organization must comply in developing or maintaining the electronic health record; (d) specifying data elements collected, used or disclosed by a health information custodian under subsection 55.5 (2) that may not be made subject to a consent directive provided by an individual under subsection 55.6 (1); (e) governing the notices that are required under section 55.7 and requiring notices under other circumstances and governing such notices; (f) prescribing the level of specificity at which personal health information may be made subject to a consent directive, including whose collection, use and disclosure of the information may be restricted; (g) Repealed: 2020, c. 5, Sched. 6, s. 14. (h) requiring classes of health information custodians or specific health information custodians to provide personal health information to the prescribed organization under this Part and specifying what personal health information they are required to provide; (i) respecting the provision of services related to the electronic health record by the prescribed organization directly to individuals; (j) providing for anything that under this Part may or must be provided for or prescribed by the regulations. 2016, c. 6, Sched. 1, s. 1 (24); 2020, c. 5, Sched. 6, s. 14; 2025, c. 7, Sched. 6, s. 7 (1). (3) Repealed: 2025, c. 7, Sched. 6, s. 7 (2). Review (4) The Minister shall review every regulation made under the authority of clause (2) (f) at least once in every three-year period. 2016, c. 6, Sched. 1, s. 1 (24). Public consultation (5) Section 74 applies, with necessary modification, to the making of a regulation under this section. 2016, c. 6, Sched. 1, s. 1 (24). Section Amendments with date in force (d/m/y) 2016, c. 6, Sched. 1, s. 1 (24) - 03/06/2016 2020, c. 5, Sched. 6, s. 14 - 25/03/2020 2025, c. 7, Sched. 6, s. 7 (1, 2) - 01/01/2026 PART V.2 DIGITAL HEALTH IDENTIFIER ACTIVITIES Interpretation Interpretation 55.15 In this Part, “agent”, in relation to the prescribed organization, means a person that, with the authorization of the prescribed organization, acts for or on behalf of the prescribed organization in respect of personal health information for the purposes of the prescribed organization, and not the agent’s own purposes, whether or not the agent has the authority to bind the prescribed organization, whether or not the agent is employed by the prescribed organization and whether or not the agent is being remunerated. 2025, c. 7, Sched. 6, s. 8. Section Amendments with date in force (d/m/y) 2025, c. 7, Sched. 6, s. 8 - 01/01/2026 Power and Duty of Prescribed Organization Digital health identifier activities 55.16 The prescribed organization may, in accordance with this Part and the regulations, carry out digital health identifier activities. 2025, c. 7, Sched. 6, s. 8. Section Amendments with date in force (d/m/y) 2025, c. 7, Sched. 6, s. 8 - 01/01/2026 Collection, Use and Disclosure of Personal Health Information Personal health information for digital health identifier activities 55.17 (1) The prescribed organization may, with the express consent of the individual to whom the personal health information relates, collect or use personal health information for the purpose of carrying out digital health identifier activities. 2025, c. 7, Sched. 6, s. 8. Disclosure by prescribed organization (2) The prescribed organization may, with the express consent of the individual to whom the personal health information relates, disclose personal health information to the Minister for the purpose of carrying out validation and verification services. 2025, c. 7, Sched. 6, s. 8. Limitation (3) Except as otherwise required by law, the prescribed organization shall not, in carrying out digital health identifier activities, (a) collect, use or disclose personal health information if other information will serve the purpose of the collection, use or disclosure; (b) collect, use or disclose more personal health information than is reasonably necessary to meet the purpose of the collection, use or disclosure; or (c) collect, use or disclose any personal health information, except as is reasonably necessary for the purpose of carrying out digital health identifier activities, as applicable, in accordance with this Act or as may be permitted in the regulations. 2025, c. 7, Sched. 6, s. 8. Section Amendments with date in force (d/m/y) 2025, c. 7, Sched. 6, s. 8 - 01/01/2026 Application of Part III 55.18 (1) Part III applies to the prescribed organization when it acts under this Part as if it were a health information custodian, subject to any necessary modifications and to any exceptions or modifications set out in the regulations. 2025, c. 7, Sched. 6, s. 8. Regulations (2) Despite subsection (1), the regulations may modify or exclude the application of all or part of Part III to the prescribed organization when it acts under this Part or may provide that, despite any requirement in this Act, consent of the individual to whom the personal health information relates is not required for specified activities. 2025, c. 7, Sched. 6, s. 8. Withdrawal of consent (3) An individual may withdraw a consent required under this Part by providing notice of their withdrawal to the prescribed organization, but the withdrawal shall not have retroactive effect. 2025, c. 7, Sched. 6, s. 8. Section Amendments with date in force (d/m/y) 2025, c. 7, Sched. 6, s. 8 - 01/01/2026 Administration Practices and procedures 55.19 (1) On and after the first anniversary of the day this section comes into force, the prescribed organization shall have in place and comply with practices and procedures, (a) that are for the purpose of protecting the privacy of the individuals whose personal health information is in the digital health identifier records and for maintaining the confidentiality of the information; and (b) that are approved by the Commissioner. 2025, c. 7, Sched. 6, s. 8. Commissioner’s review (2) The Commissioner shall review the practices and procedures referred to in subsection (1) three years after they are first approved and every three years thereafter, or at such other frequency as may be prescribed, to determine if the practices and procedures continue to meet the requirements of this section, the regulations and any applicable directive of the Minister. 2025, c. 7, Sched. 6, s. 8. Renewal (3) After the review, the Commissioner may renew the approval. 2025, c. 7, Sched. 6, s. 8. Notice (4) The Commissioner shall advise the Minister and the prescribed organization of the results of their review. 2025, c. 7, Sched. 6, s. 8. Publication (5) The prescribed organization shall publish a summary of the practices and procedures on its website as soon as possible after the practices and procedures have been approved by the Commissioner or after the approval has been renewed. 2025, c. 7, Sched. 6, s. 8. Section Amendments with date in force (d/m/y) 2025, c. 7, Sched. 6, s. 8 - 01/01/2026 Description to public 55.20 The prescribed organization shall make available to the public, (a) a plain language description of the activities or services it provides under this Part, including a general description of the technical, administrative and physical safeguards in place; and (b) such other information as may be prescribed. 2025, c. 7, Sched. 6, s. 8. Section Amendments with date in force (d/m/y) 2025, c. 7, Sched. 6, s. 8 - 01/01/2026 Protection of information 55.21 The prescribed organization shall take steps that are reasonable in the circumstances to ensure that digital health identifier records are protected against theft, loss and unauthorized use or disclosure and to ensure that the records containing the information are protected against unauthorized copying, modification or disposal. 2025, c. 7, Sched. 6, s. 8. Section Amendments with date in force (d/m/y) 2025, c. 7, Sched. 6, s. 8 - 01/01/2026 Disposal of inactive digital health identifier 55.22 The prescribed organization shall ensure that a digital health identifier that has been inactive for two or more years is disposed of in a secure manner. 2025, c. 7, Sched. 6, s. 8. Section Amendments with date in force (d/m/y) 2025, c. 7, Sched. 6, s. 8 - 01/01/2026 Persons acting on prescribed organization’s behalf 55.23 (1) The prescribed organization shall not permit any person acting on its behalf to collect, use, disclose, retain or dispose of digital health identifier records unless the person agrees to comply with the restrictions and conditions that apply to the prescribed organization when the prescribed organization carries out those activities. 2025, c. 7, Sched. 6, s. 8. Provision to agent (2) Subject to subsection (1), the prescribed organization may provide digital health identifier records to an agent of the prescribed organization, who may use the information to carry out digital health identifier activities on behalf of the prescribed organization. 2025, c. 7, Sched. 6, s. 8. Same (3) For the purposes of this Part, the providing of personal health information between the prescribed organization and an agent of the prescribed organization, (a) is a use by the prescribed organization; and (b) is not a disclosure by the prescribed organization or a collection by the person to whom the information is provided. 2025, c. 7, Sched. 6, s. 8. Application of s. 17 (4) Section 17 applies to the prescribed organization and its agents as if the prescribed organization were a health information custodian, subject to any necessary modifications. 2025, c. 7, Sched. 6, s. 8. Section Amendments with date in force (d/m/y) 2025, c. 7, Sched. 6, s. 8 - 01/01/2026 Breach notification 55.24 (1) If the prescribed organization determines that digital health identifier records have been stolen, lost or used or disclosed without authority, the prescribed organization shall, at the first reasonable opportunity, notify the individual to whom the personal health information relates. 2025, c. 7, Sched. 6, s. 8. Contents (2) The notice must include a statement that the individual is entitled to make a complaint to the Commissioner under Part VI. 2025, c. 7, Sched. 6, s. 8. Same, notice to Commissioner (3) The prescribed organization shall, in accordance with the regulations, if any, notify the Commissioner of a theft or loss of or an unauthorized use or disclosure of digital health identifier records if the circumstances surrounding the theft, loss or unauthorized use or disclosure meet the prescribed requirements. 2025, c. 7, Sched. 6, s. 8. Section Amendments with date in force (d/m/y) 2025, c. 7, Sched. 6, s. 8 - 01/01/2026 Prescribed organization’s assessment 55.25 (1) The prescribed organization shall perform, in relation to the digital health identifier activities it carries out, an assessment with respect to, (a) threats, vulnerabilities and risks to the security and integrity of digital health identifier records; and (b) how the activities may affect the privacy of the individuals to whom the information relates. 2025, c. 7, Sched. 6, s. 8. Regulations (2) The assessments shall be performed in accordance with the additional requirements, if any, that are prescribed. 2025, c. 7, Sched. 6, s. 8. Section Amendments with date in force (d/m/y) 2025, c. 7, Sched. 6, s. 8 - 01/01/2026 Directives 55.26 (1) The Minister may issue directives to the prescribed organization related to digital health identifiers and digital health identifier activities, including directives related to, (a) the eligibility of individuals or groups of individuals to receive digital health identifier activities; (b) requiring the prescribed organization to undertake additional privacy or security measures, which may include entering into agreements and conducting assessments; (c) audit log and auditing requirements; or (d) changes in technologies that relate to the digital health identifier activities. 2025, c. 7, Sched. 6, s. 8. Consultation (2) Before making a directive under subsection (1), the Minister shall, (a) submit a draft of the directive to the Commissioner and the prescribed organization for the purpose of reviewing and making recommendations on the draft directive; (b) publicly post a draft of the directive in English and French for the purpose of receiving public comment and review; and (c) consider the recommendations or comments, if any, made by the Commissioner, the prescribed organization and members of the public and amend the directive if the Minister considers it appropriate to do so. 2025, c. 7, Sched. 6, s. 8. Consultation period (3) The Minister shall allow the Commissioner, the prescribed organization and the public a period of at least 45 days after the draft is submitted or posted publicly for the purposes of review and recommendation under subsection (2). 2025, c. 7, Sched. 6, s. 8. Compliance (4) The prescribed organization shall carry out every directive issued under subsection (1). 2025, c. 7, Sched. 6, s. 8. Publication (5) The Minister shall ensure that every directive issued under subsection (1) is made available to the public in both French and English. 2025, c. 7, Sched. 6, s. 8. Non-application of Legislation Act, 2006 (6) Part III (Regulations) of the Legislation Act, 2006 does not apply to directives issued under this section. 2025, c. 7, Sched. 6, s. 8. Conflict (7) For greater certainty, in the event of a conflict between a directive issued under this section and another requirement under this Act, a provision of any applicable Act or rule of any applicable law, the requirement, Act or rule prevails. 2025, c. 7, Sched. 6, s. 8. General or particular (8) A directive of the Minister may be general or particular in its application. 2025, c. 7, Sched. 6, s. 8. Section Amendments with date in force (d/m/y) 2025, c. 7, Sched. 6, s. 8 - 01/01/2026 Regulations Regulations 55.27 (1) The Lieutenant Governor in Council may make regulations for carrying out the purposes and provisions of this Part. 2025, c. 7, Sched. 6, s. 8. Same (2) Without limiting the generality of subsection (1), the Lieutenant Governor in Council may make regulations, (a) prescribing additional circumstances in which the prescribed organization may collect, use and disclose personal health information for purposes related to digital health identifiers and digital health identifier activities; (b) establishing and governing conditions or restrictions that apply to the collection, use and disclosure of personal health information by the prescribed organization; (c) prescribing and governing disclosures of personal health information that may be made by a health information custodian or other person to the prescribed organization for purposes related to digital health identifier activities; (d) prescribing additional conditions or restrictions that apply to health information custodians and other persons who use digital health identifiers, who seek to use digital health identifiers or who otherwise receive or seek to receive authentication services from the prescribed organization; (e) prescribing additional conditions or restrictions that apply to the prescribed organization when it carries out digital health identifier activities; (f) specifying provisions in this Act that apply to the prescribed organization as if it were a health information custodian when the prescribed organization carries out digital health identifier activities; (g) respecting the type of personal health information that is required for validation and verification services; (h) governing the application of Part III with respect to the prescribed organization, which may include excluding or modifying the application of the provisions in that Part or providing that, despite anything in this Act, consent is not required for specified activities; (i) governing the privacy and security of personal health information under this Part; (j) governing the circumstances in which particular types of personal health information may or may not be collected, used or disclosed in relation to digital health identifier activities; (k) governing the modifications to the requirements of this Act described in subsection 55.23 (4); (l) governing notices of theft, loss or unauthorized use or disclosure that must be provided under subsection 55.24 (3); (m) prescribing additional persons who may collect, use or disclose personal health information for purposes related to digital health identifiers or digital health identifier activities; (n) governing any conditions or restrictions that apply to that collection, use or disclosure of personal health information by an additional person prescribed under clause (m), which may include providing that specified provisions in Part III apply or do not apply to consents that are required for the collection, use or disclosure, subject to any specified modifications or exclusions; (o) clarifying or creating exceptions from the definitions of “account management services”, “authentication services”, “digital health identifier activities” and “validation and verification services”. 2025, c. 7, Sched. 6, s. 8. Public consultation (3) Section 74 applies, with necessary modification, to the making of a regulation under this section. 2025, c. 7, Sched. 6, s. 8. Section Amendments with date in force (d/m/y) 2025, c. 7, Sched. 6, s. 8 - 01/01/2026 PART VI ADMINISTRATION AND ENFORCEMENT Complaints, Reviews and Inspections Complaint to Commissioner 56 (1) A person who has reasonable grounds to believe that another person has contravened or is about to contravene a provision of this Act or its regulations may make a complaint to the Commissioner. 2004, c. 3, Sched. A, s. 56 (1). Time for complaint (2) A complaint that a person makes under subsection (1) must be in writing and must be filed within, (a) one year after the subject-matter of the complaint first came to the attention of the complainant or should reasonably have come to the attention of the complainant, whichever is the shorter; or (b) whatever longer period of time that the Commissioner permits if the Commissioner is satisfied that it does not result in any prejudice to any person. 2004, c. 3, Sched. A, s. 56 (2); 2009, c. 33, Sched. 18, s. 25 (6). Same, refusal of request (3) A complaint that an individual makes under subsection 54 (8) or 55 (7) or (12) shall be in writing and shall be filed within six months from the time at which the health information custodian refuses or is deemed to have refused the individual’s request mentioned in the applicable subsection. 2004, c. 3, Sched. A, s. 56 (3). Non-application (4) The Ombudsman Act does not apply to any matter in respect of which a complaint may be made to the Commissioner under this Act or to the Commissioner or his or her employees or delegates acting under this Act. 2004, c. 3, Sched. A, s. 56 (4). Application to prescribed organization (5) Subject to any exceptions and additional requirements, if any, that are prescribed, this Part applies to the prescribed organization as if it were a health information custodian with respect to, (a) records described in subsection 51 (5) or (6), as if the prescribed organization has custody or control of the records; and (b) records described in subsection 51 (7). 2025, c. 7, Sched. 6, s. 9 (2, 3). Section Amendments with date in force (d/m/y) 2009, c. 33, Sched. 18, s. 25 (6) - 15/12/2009 2025, c. 7, Sched. 6, s. 9 (1-3) - 01/01/2026 Response of Commissioner 57 (1) Upon receiving a complaint made under this Act, the Commissioner may inform the person about whom the complaint is made of the nature of the complaint and, (a) inquire as to what means, other than the complaint, that the complainant is using or has used to resolve the subject-matter of the complaint; (b) require the complainant to try to effect a settlement, within the time period that the Commissioner specifies, with the person about which the complaint is made; or (c) authorize a mediator to review the complaint and to try to effect a settlement, within the time period that the Commissioner specifies, between the complainant and the person about which the complaint is made. 2004, c. 3, Sched. A, s. 57 (1). Dealings without prejudice (2) If the Commissioner takes an action described in clause (1) (b) or (c) but no settlement is effected within the time period specified, (a) none of the dealings between the parties to the attempted settlement shall prejudice the rights and duties of the parties under this Act; (b) none of the information disclosed in the course of trying to effect a settlement shall prejudice the rights and duties of the parties under this Act; and (c) none of the information disclosed in the course of trying to effect a settlement and that is subject to mediation privilege shall be used or disclosed outside the attempted settlement, including in a review of a complaint under this section or in an inspection under section 60, unless all parties expressly consent. 2004, c. 3, Sched. A, s. 57 (2). Commissioner’s review (3) If the Commissioner does not take an action described in clause (1) (b) or (c) or if the Commissioner takes an action described in one of those clauses but no settlement is effected within the time period specified, the Commissioner may review the subject-matter of a complaint made under this Act if satisfied that there are reasonable grounds to do so. 2004, c. 3, Sched. A, s. 57 (3). No review (4) The Commissioner may decide not to review the subject-matter of the complaint for whatever reason the Commissioner considers proper, including if satisfied that, (a) the person about which the complaint is made has responded adequately to the complaint; (b) the complaint has been or could be more appropriately dealt with, initially or completely, by means of a procedure, other than a complaint under this Act; (c) the length of time that has elapsed between the date when the subject-matter of the complaint arose and the date the complaint was made is such that a review under this section would likely result in undue prejudice to any person; (d) the complainant does not have a sufficient personal interest in the subject-matter of the complaint; or (e) the complaint is frivolous or vexatious or is made in bad faith. 2004, c. 3, Sched. A, s. 57 (4). Notice (5) Upon deciding not to review the subject-matter of a complaint, the Commissioner shall give notice of the decision to the complainant and shall specify in the notice the reason for the decision. 2004, c. 3, Sched. A, s. 57 (5). Same (6) Upon deciding to review the subject-matter of a complaint, the Commissioner shall give notice of the decision to the person about whom the complaint is made. 2004, c. 3, Sched. A, s. 57 (6). Commissioner’s self-initiated review 58 (1) The Commissioner may, on his or her own initiative, conduct a review of any matter if the Commissioner has reasonable grounds to believe that a person has contravened or is about to contravene a provision of this Act or its regulations and that the subject-matter of the review relates to the contravention. 2004, c. 3, Sched. A, s. 58 (1). Notice (2) Upon deciding to conduct a review under this section, the Commissioner shall give notice of the decision to every person whose activities are being reviewed. 2004, c. 3, Sched. A, s. 58 (2). Conduct of Commissioner’s review 59 (1) In conducting a review under section 57 or 58, the Commissioner may make the rules of procedure that the Commissioner considers necessary and the Statutory Powers Procedure Act does not apply to the review. 2004, c. 3, Sched. A, s. 59 (1). Evidence (2) In conducting a review under section 57 or 58, the Commissioner may receive and accept any evidence and other information that the Commissioner sees fit, whether on oath or by affidavit or otherwise and whether or not it is or would be admissible in a court of law. 2004, c. 3, Sched. A, s. 59 (2). Inspection powers 60 (1) In conducting a review under section 57 or 58, the Commissioner may, without a warrant or court order, enter and inspect any premises in accordance with this section if, (a) the Commissioner has reasonable grounds to believe that, (i) the person about whom the complaint was made or the person whose activities are being reviewed is using the premises for a purpose related to the subject-matter of the complaint or the review, as the case may be, and (ii) the premises contains books, records or other documents relevant to the subject-matter of the complaint or the review, as the case may be; and (b) the Commissioner is conducting the inspection for the purpose of determining whether the person has contravened or is about to contravene a provision of this Act or its regulations. (c) Revoked : 2016, c. 6, Sched. 1, s. 1 (25). 2004, c. 3, Sched. A, s. 60 (1); 2016, c. 6, Sched. 1, s. 1 (25). Review powers (2) In conducting a review under section 57 or 58, the Commissioner may, (a) demand the production of any books, records or other documents relevant to the subject-matter of the review or copies of extracts from the books, records or other documents; (b) inquire into all information, records, information practices of a health information custodian and other matters that are relevant to the subject-matter of the review; (c) demand the production for inspection of anything described in clause (b); (d) use any data storage, processing or retrieval device or system belonging to the person being investigated in order to produce a record in readable form of any books, records or other documents relevant to the subject-matter of the review; or (e) on the premises that the Commissioner has entered, review or copy any books, records or documents that a person produces to the Commissioner, if the Commissioner pays the reasonable cost recovery fee that the health information custodian or person being reviewed may charge. 2004, c. 3, Sched. A, s. 60 (2). Entry to dwellings (3) The Commissioner shall not, without the consent of the occupier, exercise a power to enter a place that is being used as a dwelling, except under the authority of a search warrant issued under subsection (4). 2004, c. 3, Sched. A, s. 60 (3). Search warrants (4) Where a justice of the peace is satisfied by evidence upon oath or affirmation that there is reasonable ground to believe it is necessary to enter a place that is being used as a dwelling to investigate a complaint that is the subject of a review under section 57, he or she may issue a warrant authorizing the entry by a person named in the warrant. 2004, c. 3, Sched. A, s. 60 (4). Time and manner for entry (5) The Commissioner shall exercise the power to enter premises under this section only during reasonable hours for the premises and only in such a manner so as not to interfere with health care that is being provided to any person on the premises at the time of entry. 2004, c. 3, Sched. A, s. 60 (5). No obstruction (6) No person shall obstruct the Commissioner who is exercising powers under this section or provide the Commissioner with false or misleading information. 2004, c. 3, Sched. A, s. 60 (6). Written demand (7) A demand for books, records or documents or copies of extracts from them under subsection (2) must be in writing and must include a statement of the nature of the things that are required to be produced. 2004, c. 3, Sched. A, s. 60 (7). Obligation to assist (8) If the Commissioner makes a demand for any thing under subsection (2), the person having custody of the thing shall produce it to the Commissioner and, at the request of the Commissioner, shall provide whatever assistance is reasonably necessary, including using any data storage, processing or retrieval device or system to produce a record in readable form, if the demand is for a document. 2004, c. 3, Sched. A, s. 60 (8). Removal of documents (9) If a person produces books, records and other documents to the Commissioner, other than those needed for the current health care of any person, the Commissioner may, on issuing a written receipt, remove them and may review or copy any of them if the Commissioner is not able to review and copy them on the premises that the Commissioner has entered. 2004, c. 3, Sched. A, s. 60 (9). Return of documents (10) The Commissioner shall carry out any reviewing or copying of documents with reasonable dispatch, and shall forthwith after the reviewing or copying return the documents to the person who produced them. 2004, c. 3, Sched. A, s. 60 (10). Admissibility of copies (11) A copy certified by the Commissioner as a copy is admissible in evidence to the same extent, and has the same evidentiary value, as the thing copied. 2004, c. 3, Sched. A, s. 60 (11). Answers under oath (12) In conducting a review under section 57 or 58, the Commissioner may, by summons, in the same manner and to the same extent as a superior court of record, require the appearance of any person before the Commissioner and compel them to give oral or written evidence on oath or affirmation. 2004, c. 3, Sched. A, s. 60 (12). Inspection of record without consent (12.1) Despite subsections (2) and (12), the Commissioner shall not inspect a record of, require evidence of, or inquire into personal health information without the consent of the individual to whom it relates except in the circumstances referred to in subsections (13) and (14.1). 2020, c. 5, Sched. 6, s. 15 (1). Same, public interest (13) The Commissioner may inspect a record of, require evidence of, or inquire into personal health information without the consent of the individual to whom it relates if, (a) the Commissioner first determines that it is reasonably necessary to do so, subject to any conditions or restrictions that the Commissioner specifies, which shall include a time limitation, in order to carry out the review and that the public interest in carrying out the review justifies dispensing with obtaining the individual's consent in the circumstances; and (b) the Commissioner provides a statement to the person who has custody or control of the record to be inspected, or the evidence or information to be inquired into, setting out the Commissioner’s determination under clause (a) together with brief written reasons and any restrictions and conditions that the Commissioner has specified. 2004, c. 3, Sched. A, s. 60 (13); 2020, c. 5, Sched. 6, s. 15 (2). Limitation on delegation (14) Despite subsection 67 (1), the power to make a determination under clause (13) (a) and to approve the brief written reasons under clause (13) (b) may not be delegated except to the Assistant Commissioner. 2004, c. 3, Sched. A, s. 60 (14). Inspection of record without consent, abandoned records (14.1) The Commissioner may inspect a record of, require evidence of, or inquire into personal health information without the consent of the individual to whom it relates if the Commissioner determines or has reasonable grounds to suspect that the record of personal health information has been abandoned. 2020, c. 5, Sched. 6, s. 15 (3). Document privileged (15) A document or thing produced by a person in the course of a review is privileged in the same manner as if the review were a proceeding in a court. 2007, c. 10, Sched. H, s. 22. Protection (16) Except on the trial of a person for perjury in respect of his or her sworn testimony, no statement made or answer given by that or any other person in the course of a review by the Commissioner is admissible in evidence in any court or at any inquiry or in any other proceedings, and no evidence in respect of proceedings before the Commissioner shall be given against any person. 2004, c. 3, Sched. A, s. 60 (16).

Protection under federal Act (17) The Commissioner shall inform a person giving a statement or answer in the course of a review by the Commissioner of the person’s right to object to answer any question under section 5 of the Canada Evidence Act. 2004, c. 3, Sched. A, s. 60 (17). Representations (18) The Commissioner shall give the person who made the complaint, the person about whom the complaint is made and any other affected person an opportunity to make representations to the Commissioner. 2004, c. 3, Sched. A, s. 60 (18). Representative (19) A person who is given an opportunity to make representations to the Commissioner may be represented by counsel or another person. 2004, c. 3, Sched. A, s. 60 (19). Access to representations (20) The Commissioner may permit a person to be present during the representations that another person makes to the Commissioner or to have access to them unless doing so would reveal, (a) the substance of a record of personal health information, for which a health information custodian claims to be entitled to refuse a request for access made under section 53; or (b) personal health information to which an individual is not entitled to request access under section 53. 2004, c. 3, Sched. A, s. 60 (20). Proof of appointment (21) If the Commissioner or Assistant Commissioner has delegated his or her powers under this section to an officer or employee of the Commissioner, the officer or employee who exercises the powers shall, upon request, produce the certificate of delegation signed by the Commissioner or Assistant Commissioner, as the case may be. 2004, c. 3, Sched. A, s. 60 (21). Section Amendments with date in force (d/m/y) 2007, c. 10, Sched. H, s. 22 - 04/06/2007 2016, c. 6, Sched. 1, s. 1 (25) - 03/06/2016 2020, c. 5, Sched. 6, s. 15 (1-3) - 25/03/2020 Powers of Commissioner 61 (1) After conducting a review under section 57 or 58, the Commissioner may, (a) if the review relates to a complaint into a request by an individual under subsection 53 (1) for access to a record of personal health information, make an order directing the health information custodian about whom the complaint was made to grant the individual access to the requested record; (a.1) if the review relates to a complaint into a request by an individual under subsection 53 (1) for access to a record of personal health information that is described in subsection 51 (5), (6) or (7) and in the custody or control of the prescribed organization, or that is or that is described in this Act as being treated as if it were in the custody or control of the prescribed organization, make an order directing the prescribed organization to grant the individual access to the requested record; (b) if the review relates to a complaint into a request by an individual under subsection 55 (1) for correction of a record of personal health information, make an order directing the health information custodian about whom a complaint was made to make the requested correction; (c) make an order directing any person whose activities the Commissioner reviewed to perform a duty imposed by this Act or its regulations; (d) make an order directing any person whose activities the Commissioner reviewed to cease collecting, using or disclosing personal health information if the Commissioner determines that the person is collecting, using or disclosing the information, as the case may be, or is about to do so in contravention of this Act, its regulations or an agreement entered into under this Act; (e) make an order directing any person whose activities the Commissioner reviewed to return, transfer or dispose of records of personal health information that the Commissioner determines the person collected, used or disclosed in contravention of this Act, its regulations, or an agreement entered into under this Act but only if the return, transfer or disposal of the records is not reasonably expected to adversely affect the provision of health care to an individual. (f) make an order directing any health information custodian whose activities the Commissioner reviewed to change, cease or not commence an information practice specified by the Commissioner, if the Commissioner determines that the information practice contravenes this Act or its regulations; (f.1) make an order requiring a health information custodian or a class of health information custodians to cease providing personal health information to a consumer electronic service provider; (f.2) make an order directing the prescribed organization to change its practices and procedures under Part V.2, if the Commissioner determines that the practices and procedures contravene this Act or its regulations; (g) make an order directing any health information custodian whose activities the Commissioner reviewed to implement an information practice specified by the Commissioner, if the Commissioner determines that the information practice is reasonably necessary in order to achieve compliance with this Act and its regulations; (h) make an order directing any person who is an agent of a health information custodian, whose activities the Commissioner reviewed and that an order made under any of clauses (a) to (g) directs to take any action or to refrain from taking any action, to take the action or to refrain from taking the action if the Commissioner considers that it is necessary to make the order against the agent to ensure that the custodian will comply with the order made against the custodian; (h.0.1) make an order directing any person who is an agent of the prescribed organization acting under Part V or V.2 and whose activities the Commissioner reviewed and that an order made under any of clauses (a.1), (c), (d), or (e) directs to take any action or to refrain from taking any action, to take the action or to refrain from taking the action if the Commissioner considers that it is necessary to make the order against the agent to ensure that the prescribed organization will comply with the order made against the prescribed organization; (h.1) make an order in accordance with section 61.1 requiring any person whose activities the Commissioner reviewed to pay an administrative penalty in the amount set out in the order if the Commissioner is of the opinion that the person has contravened this Act or its regulations; or (i) make comments and recommendations on the privacy implications of any matter that is the subject of the review. 2004, c. 3, Sched. A, s. 61 (1); 2019, c. 15, Sched. 30, s. 6; 2020, c. 5, Sched. 6, s. 16; 2025, c. 7, Sched. 6, s. 10. Terms of order (2) An order that the Commissioner makes under subsection (1) may contain the terms that the Commissioner considers appropriate. 2004, c. 3, Sched. A, s. 61 (2). Copy of order, etc. (3) Upon making comments, recommendations or an order under subsection (1), the Commissioner shall provide a copy of them, including reasons for any order made, to, (a) the complainant and the person about whom the complaint was made, if the Commissioner made the comments, recommendations or order after conducting a review under section 57 of a complaint; (b) the person whose activities the Commissioner reviewed, if the Commissioner made the comments, recommendations or order after conducting a review under section 58; (c) all other persons to whom the order is directed; (d) the body or bodies that are legally entitled to regulate or review the activities of a health information custodian directed in the order or to whom the comments or recommendations relate; and (e) any other person whom the Commissioner considers appropriate. 2004, c. 3, Sched. A, s. 61 (3). No order (4) If, after conducting a review under section 57 or 58, the Commissioner does not make an order under subsection (1), the Commissioner shall give the complainant, if any, and the person whose activities the Commissioner reviewed a notice that sets out the Commissioner’s reasons for not making an order. 2004, c. 3, Sched. A, s. 61 (4). Section Amendments with date in force (d/m/y) 2019, c. 15, Sched. 30, s. 6 - 31/07/2020 2020, c. 5, Sched. 6, s. 16 (1, 2) - 25/03/2020 2025, c. 7, Sched. 6, s. 10 (1-3) - 01/01/2026; 2025, c. 7, Sched. 6, s. 10 (4) - 05/06/2025 Administrative penalties 61.1 (1) An order requiring a person to pay an administrative penalty may be issued under clause 61 (1) (h.1) for the purposes of, (a) encouraging compliance with this Act and its regulations; or (b) preventing a person from deriving, directly or indirectly, any economic benefit as a result of a contravention of this Act or its regulations. 2020, c. 5, Sched. 6, s. 17. Amount of administrative penalty (2) The amount of an administrative penalty for a contravention shall, (a) reflect the purposes referred to in subsection (1); and (b) be determined by the Commissioner in accordance with the regulations made under this Act. 2020, c. 5, Sched. 6, s. 17. Two-year limitation (3) An order requiring a person to pay an administrative penalty shall not be issued under this section more than two years after the day the most recent contravention on which the order is based first came to the knowledge of the Commissioner. 2020, c. 5, Sched. 6, s. 17. Content of order of administrative penalty (4) An order requiring a person to pay an administrative penalty shall, (a) contain or be accompanied by a description of the contravention; and (b) set out the amount of the penalty to be paid and specify the time and manner of the payment. 2020, c. 5, Sched. 6, s. 17. Payment to Minister of Finance (5) A person who is required to pay an administrative penalty shall pay the penalty to the Minister of Finance. 2020, c. 5, Sched. 6, s. 17. Section Amendments with date in force (d/m/y) 2020, c. 5, Sched. 6, s. 17 - 25/03/2020 Appeal of order 62 (1) A person affected by an order of the Commissioner made under any of clauses 61 (1) (c) to (h.1) may appeal the order to the Divisional Court on a question of law in accordance with the rules of court by filing a notice of appeal within 30 days after receiving the copy of the order. 2004, c. 3, Sched. A, s. 62 (1); 2020, c. 5, Sched. 6, s. 18. Certificate of Commissioner (2) In an appeal under this section, the Commissioner shall certify to the Divisional Court, (a) the order and a statement of the Commissioner’s reasons for making the order; (b) the record of all hearings that the Commissioner has held in conducting the review on which the order is based; (c) all written representations that the Commissioner received before making the order; and (d) all other material that the Commissioner considers is relevant to the appeal. 2004, c. 3, Sched. A, s. 62 (2). Confidentiality of information (3) In an appeal under this section, the court may take precautions to avoid the disclosure by the court or any person of any personal health information about an individual, including, where appropriate, receiving representations without notice, conducting hearings in private or sealing the court files. 2004, c. 3, Sched. A, s. 62 (3). Court order (4) On hearing an appeal under this section, the court may, by order, (a) direct the Commissioner to make the decisions and to do the acts that the Commissioner is authorized to do under this Act and that the court considers proper; and (b) if necessary, vary or set aside the Commissioner’s order. 2004, c. 3, Sched. A, s. 62 (4). Compliance by Commissioner (5) The Commissioner shall comply with the court’s order. 2004, c. 3, Sched. A, s. 62 (5). Section Amendments with date in force (d/m/y) 2020, c. 5, Sched. 6, s. 18 - 25/03/2020 Enforcement of order 63 (1) An order made by the Commissioner under this Act that has become final as a result of there being no further right of appeal may be filed with the Superior Court of Justice and on filing becomes and is enforceable as a judgment or order of the Superior Court of Justice to the same effect. 2004, c. 3, Sched. A, s. 63. Interest (2) Section 129 of the Courts of Justice Act applies in respect of an order requiring a person to pay an administrative penalty under clause 61 (1) (h.1) and, for the purpose, the date on which the order is filed under subsection (1) is deemed to be the date of the order that is referred to in section 129 of the Courts of Justice Act. 2020, c. 5, Sched. 6, s. 19. Debt due to the Crown (3) An administrative penalty imposed under clause 61 (1) (h.1) that is not paid in accordance with the terms of the order is a debt due to the Crown, and the Crown may recover the debt by action or by any other remedy or procedure available by law to the Crown for the collection of debts owed to the Crown. 2020, c. 5, Sched. 6, s. 19. Section Amendments with date in force (d/m/y) 2020, c. 5, Sched. 6, s. 19 - 25/03/2020 Further order of Commissioner 64 (1) After conducting a review under section 57 or 58 and making an order under subsection 61 (1), the Commissioner may rescind or vary the order or may make a further order under that subsection if new facts relating to the subject-matter of the review come to the Commissioner’s attention or if there is a material change in the circumstances relating to the subject-matter of the review. 2004, c. 3, Sched. A, s. 64 (1). Circumstances (2) The Commissioner may exercise the powers described in subsection (1) even if the order that the Commissioner rescinds or varies has been filed with the Superior Court of Justice under section 63. 2004, c. 3, Sched. A, s. 64 (2). Copy of order, etc. (3) Upon making a further order under subsection (1), the Commissioner shall provide a copy of it to the persons described in clauses 61 (3) (a) to (e) and shall include with the copy a notice setting out, (a) the Commissioner’s reasons for making the order; and (b) if the order was made under any of clauses 61 (1) (c) to (h.1), a statement that the persons affected by the order have the right to appeal described in subsection (4). 2004, c. 3, Sched. A, s. 64 (3); 2020, c. 5, Sched. 6, s. 20 (1). Appeal (4) A person affected by an order that the Commissioner rescinds, varies or makes under any of clauses 61 (1) (c) to (h.1) may appeal the order to the Divisional Court on a question of law in accordance with the rules of court by filing a notice of appeal within 30 days after receiving the copy of the order and subsections 62 (2) to (5) apply to the appeal. 2004, c. 3, Sched. A, s. 64 (4); 2020, c. 5, Sched. 6, s. 20 (2). Section Amendments with date in force (d/m/y) 2020, c. 5, Sched. 6, s. 20 (1, 2) - 25/03/2020 Damages for breach of privacy 65 (1) If the Commissioner has made an order under this Act that has become final as the result of there being no further right of appeal, a person affected by the order may commence a proceeding in the Superior Court of Justice for damages for actual harm that the person has suffered as a result of a contravention of this Act or its regulations. 2004, c. 3, Sched. A, s. 65 (1). Same (2) If a person has been convicted of an offence under this Act and the conviction has become final as a result of there being no further right of appeal, a person affected by the conduct that gave rise to the offence may commence a proceeding in the Superior Court of Justice for damages for actual harm that the person has suffered as a result of the conduct. 2004, c. 3, Sched. A, s. 65 (2). Damages for mental anguish (3) If, in a proceeding described in subsection (1) or (2), the Superior Court of Justice determines that the harm suffered by the plaintiff was caused by a contravention or offence, as the case may be, that the defendants engaged in wilfully or recklessly, the court may include in its award of damages an award, not exceeding $10,000, for mental anguish. 2004, c. 3, Sched. A, s. 65 (3). Enforcement measures 65.1 The use of an enforcement measure provided for in this Act in respect of a contravention of this Act or its regulations does not prohibit the use, at the same time or different times, of any other enforcement measure or remedy provided for in this Act or otherwise available in law in respect of the same contravention. 2020, c. 5, Sched. 6, s. 21. Section Amendments with date in force (d/m/y) 2020, c. 5, Sched. 6, s. 21 - 25/03/2020 Commissioner General powers 66 The Commissioner may, (a) engage in or commission research into matters affecting the carrying out of the purposes of this Act; (b) conduct public education programs and provide information concerning this Act and the Commissioner’s role and activities; (c) receive representations from the public concerning the operation of this Act; (d) on the request of a health information custodian, offer comments on the custodian’s actual or proposed information practices; (e) assist in investigations and similar procedures conducted by a person who performs similar functions to the Commissioner under the laws of Canada, except that in providing assistance, the Commissioner shall not use or disclose information collected by or for the Commissioner under this Act; (f) in appropriate circumstances, authorize the collection of personal health information about an individual in a manner other than directly from the individual. 2004, c. 3, Sched. A, s. 66. Delegation 67 (1) The Commissioner may in writing delegate any of the Commissioner’s powers, duties or functions under this Act, including the power to make orders, to the Assistant Commissioner or to an officer or employee of the Commissioner. 2004, c. 3, Sched. A, s. 67 (1). Subdelegation by Assistant Commissioner (2) The Assistant Commissioner may in writing delegate any of the powers, duties or functions delegated to him or her under subsection (1) to any other officers or employees of the Commissioner, subject to the conditions and restrictions that the Assistant Commissioner specifies in the delegation. 2004, c. 3, Sched. A, s. 67 (2). Limitations re personal health information 68 (1) The Commissioner and any person acting under his or her authority may collect, use or retain personal health information in the course of carrying out any functions under this Part solely if no other information will serve the purpose of the collection, use or retention of the personal health information and in no other circumstances. 2004, c. 3, Sched. A, s. 68 (1). Extent of information (2) The Commissioner and any person acting under his or her authority shall not in the course of carrying out any functions under this Part collect, use or retain more personal health information than is reasonably necessary to enable the Commissioner to perform his or her functions relating to the administration of this Act or for a proceeding under it. 2004, c. 3, Sched. A, s. 68 (2). Confidentiality (3) The Commissioner, the Assistant Commissioner and persons acting on behalf of or under the direction of either of them shall not disclose any information that comes to their knowledge in the course of exercising their functions under this Act unless, (a) the disclosure is required for the purpose of exercising those functions; (b) the information relates to a health information custodian, the disclosure is made to a body that is legally entitled to regulate or review the activities of the custodian and the Commissioner or the Assistant Commissioner is of the opinion that the disclosure is justified; (c) the Commissioner obtained the information under subsection 60 (12) and the disclosure is required in a prosecution for an offence under section 131 of the Criminal Code (Canada) in respect of sworn testimony; or (d) the disclosure is made to the Attorney General, the information relates to the commission of an offence against an Act or an Act of Canada and the Commissioner is of the view that there is evidence of such an offence. 2004, c. 3, Sched. A, s. 68 (3). Same (4) Despite anything in subsection (3), the Commissioner, the Assistant Commissioner and persons acting on behalf of or under the direction of either of them shall not disclose, (a) any quality of care information that comes to their knowledge in the course of exercising their functions under this Act; or (b) the identity of a person, other than a complainant under subsection 56 (1), who has provided information to the Commissioner and who has requested the Commissioner to keep the person’s identity confidential. 2004, c. 3, Sched. A, s. 68 (4). Information in review or proceeding (5) The Commissioner in a review under section 57 or 58 and a court, tribunal or other person, including the Commissioner, in a proceeding mentioned in section 65 or this section shall take every reasonable precaution, including, when appropriate, receiving representations without notice and conducting hearings that are closed to the public, to avoid the disclosure of any information for which a health information custodian is entitled to refuse a request for access made under section 53. 2004, c. 3, Sched. A, s. 68 (5). Not compellable witness (6) The Commissioner, the Assistant Commissioner and persons acting on behalf of or under the direction of either of them shall not be required to give evidence in a court or in a proceeding of a judicial nature concerning anything coming to their knowledge in the exercise of their functions under this Act that they are prohibited from disclosing under subsection (3) or (4). 2004, c. 3, Sched. A, s. 68 (6). Immunity 69 No action or other proceeding for damages may be instituted against the Commissioner, the Assistant Commissioner or any person acting on behalf of or under the direction of either of them for, (a) anything done, reported or said in good faith and in the exercise or intended exercise of any of their powers or duties under this Act; or (b) any alleged neglect or default in the exercise in good faith of any of their powers or duties under this Act. 2004, c. 3, Sched. A, s. 69. PART VII GENERAL Non-retaliation 70 No one shall dismiss, suspend, demote, discipline, harass or otherwise disadvantage a person by reason that, (a) the person, acting in good faith and on the basis of reasonable belief, has disclosed to the Commissioner that any other person has contravened or is about to contravene a provision of this Act or its regulations; (b) the person, acting in good faith and on the basis of reasonable belief, has done or stated an intention of doing anything that is required to be done in order to avoid having any person contravene a provision of this Act or its regulations; (c) the person, acting in good faith and on the basis of reasonable belief, has refused to do or stated an intention of refusing to do anything that is in contravention of a provision of this Act or its regulations; or (d) any person believes that the person will do anything described in clause (a), (b) or (c). 2004, c. 3, Sched. A, s. 70. Immunity 71 (1) No action or other proceeding for damages may be instituted against a health information custodian or any other person for, (a) anything done, reported or said, both in good faith and reasonably in the circumstances, in the exercise or intended exercise of any of their powers or duties under this Act; or (b) any alleged neglect or default that was reasonable in the circumstances in the exercise in good faith of any of their powers or duties under this Act. 2004, c. 3, Sched. A, s. 71 (1). Crown liability (2) Despite subsection 8 (3) of the Crown Liability and Proceedings Act, 2019, subsection (1) does not relieve the Crown of liability in respect of a tort committed by a person mentioned in subsection (1) to which it would otherwise be subject. 2004, c. 3, Sched. A, s. 71 (2); 2019, c. 7, Sched. 17, s. 139. Substitute decision-maker (3) A person who, on behalf of or in the place of an individual, gives or refuses consent to a collection, use or disclosure of personal health information about the individual, makes a request, gives an instruction or takes a step is not liable for damages for doing so if the person acts reasonably in the circumstances, in good faith and in accordance with this Act and its regulations. 2004, c. 3, Sched. A, s. 71 (3). Reliance on assertion (4) Unless it is not reasonable to do so in the circumstances, a person is entitled to rely on the accuracy of an assertion made by another person, in connection with a collection, use or disclosure of, or access to, the information under this Act, to the effect that the other person, (a) is a person who is authorized to request access to a record of personal health information under section 53; (b) is a person who is entitled under section 5 or 23 or subsection 26 (1) to consent to the collection, use or disclosure of personal health information about another individual; (c) meets the requirement of clauses 26 (2) (b) and (c); or (d) holds the beliefs described in subsection 26 (5). 2004, c. 3, Sched. A, s. 71 (4). Application to prescribed organization (5) Subsection (4) applies to the prescribed organization and its agents as if the prescribed organization were a health information custodian. 2025, c. 7, Sched. 6, s. 11. Section Amendments with date in force (d/m/y) 2019, c. 7, Sched. 17, s. 139 - 01/07/2019 2025, c. 7, Sched. 6, s. 11 - 01/01/2026 Production order 71.1 (1) On application without notice by a provincial offences officer, a justice may issue a production order to a person, other than a person under investigation for an offence, requiring the person to, (a) produce documents or copies of documents, certified by affidavit to be true copies, or produce data; or (b) prepare a document based on documents or data already in existence and produce it. 2020, c. 5, Sched. 6, s. 22. Contents of order (2) A production order must stipulate when, where and how the documents or data are to be produced, and to whom they are to be produced. 2020, c. 5, Sched. 6, s. 22. Grounds (3) A justice may make a production order if satisfied by information given under oath or affirmation that there are reasonable grounds to believe that, (a) an offence under this Act has been or is being committed; (b) the document or data will provide evidence respecting the offence or suspected offence; and (c) the person who is subject to the order has possession or control of the document or data. 2020, c. 5, Sched. 6, s. 22. Conditions (4) A production order may contain any conditions the justice considers advisable. 2020, c. 5, Sched. 6, s. 22. Evidence (5) A copy of a document or data produced under this section, on proof by affidavit that it is a true copy, is admissible in evidence in proceedings under this Act and has the same probative force as the original document or data would have if it had been proved in the ordinary way. 2020, c. 5, Sched. 6, s. 22. No return of copies (6) Copies of documents or data produced under this section are not required to be returned to the person who provided them. 2020, c. 5, Sched. 6, s. 22. Compliance required (7) A person to whom a production order is directed shall comply with the order according to its terms. 2020, c. 5, Sched. 6, s. 22. Definitions (8) In this section, “justice” and “provincial offences officer” have the same meanings as in the Provincial Offences Act. 2020, c. 5, Sched. 6, s. 22. Section Amendments with date in force (d/m/y) 2020, c. 5, Sched. 6, s. 22 - 25/03/2020 Offences 72 (1) A person is guilty of an offence if the person, (a) wilfully collects, uses or discloses personal health information in contravention of this Act or its regulations; (b) makes a request under this Act, under false pretences, for access to or correction of a record of personal health information; (b.1) wilfully contravenes section 11.2; (c) in connection with the collection, use or disclosure of personal health information or access to a record of personal health information, makes an assertion, knowing that it is untrue, to the effect that the person, (i) is a person who is entitled to consent to the collection, use or disclosure of personal health information about another individual, (ii) meets the requirement of clauses 26 (2) (b) and (c), (iii) holds the beliefs described in subsection 26 (5), or (iv) is a person entitled to access to a record of personal health information under section 52; (d) disposes of a record of personal health information in the custody or under the control of the custodian with an intent to evade a request for access to the record that the custodian has received under subsection 53 (1); (d.1) disposes of a record of personal health information in the custody or under the control of the prescribed organization when it acts under Part V, or that is described in this Act as being treated as if it is in the custody or under the control of the prescribed organization when it acts under Part V, with an intent to evade a request for access to the record that the prescribed organization has received under subsection 53 (1); (e) wilfully disposes of a record of personal health information in contravention of section 13; (f) contravenes subsection 34 (2), (3) or (4) or clause 47 (15) (a), (e) or (f); (g) wilfully obstructs the Commissioner or a person known to be acting under the authority of the Commissioner in the performance of his or her functions under this Act; (h) wilfully makes a false statement to mislead or attempt to mislead the Commissioner or a person known to be acting under the authority of the Commissioner in the performance of his or her functions under this Act; (i) wilfully fails to comply with an order made by the Commissioner or a person known to be acting under the authority of the Commissioner under this Act; or (j) contravenes section 70. 2004, c. 3, Sched. A, s. 72 (1); 2019, c. 15, Sched. 30, s. 7 (1); 2025, c. 7, Sched. 6, s. 12. Penalty (2) A person who is guilty of an offence under subsection (1) is liable, on conviction, (a) if the person is a natural person, to a fine of not more than $200,000 or to a term of imprisonment of not more than 1 year, or to both; or (b) if the person is not a natural person, to a fine of not more than $1,000,000. 2004, c. 3, Sched. A, s. 72 (2); 2016, c. 6, Sched. 1, s. 1 (26); 2020, c. 5, Sched. 6, s. 23. Officers, etc. (3) If a corporation commits an offence under this Act, every officer, member, employee or other agent of the corporation who authorized the offence, or who had the authority to prevent the offence from being committed but knowingly refrained from doing so, is a party to and guilty of the offence and is liable, on conviction, to the penalty for the offence, whether or not the corporation has been prosecuted or convicted. 2004, c. 3, Sched. A, s. 72 (3). No prosecution (4) No person is liable to prosecution for an offence against this or any other Act by reason of complying with a requirement of the Commissioner under this Act. 2004, c. 3, Sched. A, s. 72 (4). Consent of Attorney General (5) A prosecution shall not be commenced under subsection (1) without the consent of the Attorney General or his or her agent. 2016, c. 6, Sched. 1, s. 1 (27); 2019, c. 15, Sched. 30, s. 7 (2). Presiding judge (6) The Crown may, by notice to the clerk of the Ontario Court of Justice, require that a provincial judge preside over a proceeding in respect of an offence under subsection (1). 2016, c. 6, Sched. 1, s. 1 (27). Protection of information (7) In a prosecution for an offence under subsection (1) or where documents or materials are filed with a court under sections 158 to 160 of the Provincial Offences Act in relation to an investigation into an offence under this Act, the court may, at any time, take precautions to avoid the disclosure by the court or any person of any personal health information about an individual, including, where appropriate, (a) removing the identifying information of any person whose personal health information is referred to in any documents or materials; (b) receiving representations without notice; (c) conducting hearings or parts of hearings in private; or (d) sealing all or part of the court files. 2016, c. 6, Sched. 1, s. 1 (27). No limitation (8) Section 76 of the Provincial Offences Act does not apply to a prosecution under this Act. 2016, c. 6, Sched. 1, s. 1 (27). Section Amendments with date in force (d/m/y) 2006, c. 21, Sched. C, s. 128 - 01/05/2007 2016, c. 6, Sched. 1, s. 1 (26, 27) - 03/06/2016 2019, c. 15, Sched. 30, s. 7 (1, 2) - 31/07/2020 2020, c. 5, Sched. 6, s. 23 - 25/03/2020 2025, c. 7, Sched. 6, s. 12 - 01/01/2026 Regulations 73 (1) Subject to section 74, the Lieutenant Governor in Council may make regulations, (a) prescribing or specifying anything that this Act describes as being prescribed, specified, described, provided for, authorized or required in the regulations made under this Act; (b) exempting persons or classes of persons from the persons described in clause (d) of the definition of “health care practitioner” in section 2; (c) specifying persons or classes of persons who shall not be included in the definition of “health information custodian” in subsection 3 (1); (d) specifying that certain types of information shall or shall not be included in the definition of “personal health information” in subsection 4 (1); (d.1) prescribing an organization as the prescribed organization for the purposes of this Act and respecting the purposes for which the organization is prescribed, subject to subsection (4.1); (d.2) prescribing additional powers, duties and functions of the prescribed organization; (d.3) establishing and governing reporting requirements that apply to the prescribed organization; (d.4) prescribing provisions of the Freedom of Information and Protection of Privacy Act that apply, subject to any specified conditions or modifications, to personal health information, (i) in the custody or under the control of the prescribed organization, or (ii) that is described in this Act as being treated as if it were in the custody or under the control of the prescribed organization; (d.5) specifying provisions in this Act that apply to the prescribed organization as if it were a health information custodian when the prescribed organization carries out specified activities under this Act, subject to any conditions or modifications that may be prescribed; (d.6) specifying requirements or provisions in this Act that apply to agents of the prescribed organization when they carry out activities on behalf of the prescribed organization; (d.7) governing the application of Part III of this Act with respect to the prescribed organization, which may include excluding or modifying the application of the provisions in that Part; (d.8) prescribing under what circumstances the prescribed organization may collect, use and disclose personal health information, the conditions that apply to the collection, use and disclosure of personal health information by the prescribed organization and disclosures of personal health information that may be made by a health information custodian or other person to the prescribed organization; (d.9) prescribing conditions and restrictions that apply to a person who provides goods or services for the purpose of enabling the prescribed organization to use electronic means to collect, use, modify, disclose, retain or dispose of personal health information; (e) defining, for the purposes of this Act and its regulations, any word or expression used in this Act that has not already been expressly defined in this Act; (f) making any provision of this Act or its regulations, that applies to some but not all health information custodians, applicable to a prescribed person mentioned in paragraph 8 of the definition of “health information custodian” in subsection 3 (1) or a member of a prescribed class of persons mentioned in that paragraph; (g) specifying requirements with respect to information practices for the purposes of subsection 10 (1), including conditions that a health information custodian is required to comply with when collecting, using or disclosing personal health information or classes of personal health information, or specifying procedural processes or requirements for setting requirements with respect to information practices for the purposes of that subsection; (h) specifying requirements, or a process for setting requirements, for the purposes of subsection 10 (3) with which a health information custodian is required to comply when using electronic means to collect, use, modify, disclose, retain or dispose of personal health information, including standards for transactions, data elements for transactions, code sets for data elements and procedures for the transmission and authentication of electronic signatures; (i) specifying requirements for the purposes of subsection 17 (1), including requiring that a health information custodian and its agent enter into an agreement that complies with the regulations made under clause (k) before the custodian provides personal health information to the agent; (j) specifying requirements that an agreement entered into under this Act or its regulations must contain; (k) specifying requirements, restrictions or prohibitions with respect to the collection, use or disclosure of any class of personal health information by any person in addition to the requirements, restrictions or prohibitions set out in this Act; (l) specifying requirements that an express instruction mentioned in clause 37 (1) (a), 38 (1) (a) or 50 (1) (e) must meet; (l.1) prescribing circumstances in which a person who compiles or maintains a registry of personal health information referred to in clause 39 (1) (c) may use or disclose personal health information; (m) permitting notices, statements or any other things, that under this Act are required to be provided in writing, to be provided in electronic or other form instead, subject to the conditions or restrictions that are specified by the regulations made under this Act; (m.0.1) authorizing the Agency to specify electronic formats for the purposes of subsection 52 (1.1), which may include requirements, conditions, restrictions or exceptions that apply to the authorization; Note: On a day to be named by proclamation of the Lieutenant Governor, subsection 73 (1) of the Act is amended by adding the following clause: (See: 2020, c. 5, Sched. 6, s. 24 (2)) (m.1) governing the services provided by consumer electronic service providers within the meaning of section 54.1, including their collection, use and disclosure of personal health information, the use of those services by health information custodians as well as by individuals and the rights of those individuals with regard to the services; (m.2) prescribing exceptions or additional requirements that apply with respect to the prescribed organization and the records described in subsection 51 (5), (6) or (7), which may include excluding, (i) classes of records from the application of those subsections, or (ii) classes of persons from access to those records in a prescribed form or manner; (m.3) governing the application of section 52 to records in the custody or control of the prescribed organization, or that are described in this Act as being treated as if they were in the custody or control of the prescribed organization, which may include prescribing exceptions in subsection 52 (1) that do not apply or permitting or requiring another person to be responsible for identifying whether an exception applies to the records; (m.4) establishing and governing pilot programs with respect to records described in subsection 51 (5), including allowing the prescribed organization to specify the eligibility of individuals or groups of individuals to receive records in a specified format or manner; (m.5) prescribing the format or manner in which records described in subsection 51 (5), (6) or (7) shall be made available; (m.6) authorizing the prescribed organization to deactivate digital health identifiers or block an individual’s access to the records described in subsection 51 (5), (6) or (7) and governing the conditions and process for reactivating the digital health identifier or access to records; (m.7) requiring the prescribed organization to provide summaries of records in addition to the records described in subsection 51 (6) or (7), and governing the circumstances when a summary shall be provided; (m.8) authorizing a health information custodian to provide summaries in response to a request for access instead of the complete record described in subsection 51 (8) in specified circumstances, subject to any conditions; (n) prescribing under what circumstances the Canadian Blood Services may collect, use and disclose personal health information, the conditions that apply to the collection, use and disclosure of personal health information by the Canadian Blood Services and disclosures that may be made by a health information custodian to the Canadian Blood Services; (n.1) requiring health information custodians to provide information to the Commissioner and specifying the type of information to be provided and the time at which and manner in which it is to be provided; (n.2) prescribing under what circumstances the Agency may collect, use and disclose personal health information, the conditions that apply to the collection, use and disclosure of personal health information by the Agency and disclosures of personal health information that may be made by a health information custodian or other person to the Agency; (n.3) governing (i) under what circumstances a person or entity, or group of persons or entities, described in subsection (1.1) may collect, use and disclose personal health information, (ii) conditions that apply to the collection, use and disclosure of personal health information by a person, entity or group mentioned in subclause (i), (iii) security requirements, records retention, information practices and rules for access and correction for personal health information held by a person, entity or group mentioned in subclause (i), (iv) disclosures of personal health information that may be made by a health information custodian or other person to a person, entity or group mentioned in subclause (i), (v) any requirements with respect to the collection, use and disclosure of personal health information that a person, entity or group must comply with if they used to fall under the description in subsection (1.1) but no longer fall under that description; (n.4) providing for and governing powers, functions and responsibilities of the Agency for the purposes of this Act and the regulations; (n.5) respecting requirements with which a health information custodian is required to comply when selecting and using electronic means to collect, use, modify, disclose, retain or dispose of personal health information, including the process for setting, monitoring and enforcing such requirements; (o) specifying information relating to the administration or enforcement of this Act that is required to be contained in a report made under subsection 58 (1) of the Freedom of Information and Protection of Privacy Act; (o.1) governing administrative penalties imposed by the Commissioner under clause 61 (1) (h.1) and all matters necessary and incidental to the administration of a system of administrative penalties under this Act; (o.2) governing the de-identification of personal health information and the collection, use and disclosure of de-identified information by health information custodians and any other persons; (p) respecting any matter necessary or advisable to carry out effectively the purposes of this Act. 2004, c. 3, Sched. A, s. 73 (1); 2016, c. 6, Sched. 1, s. 1 (28); 2019, c. 15, Sched. 30, s. 8 (1); 2020, c. 5, Sched. 6, s. 24 (1, 3); 2022, c. 11, Sched. 4, s. 2 (1, 2); 2025, c. 7, Sched. 6, s. 13 (1, 2). Application (1.1) Subclause (1) (n.3) (i) applies with respect to the following persons or entities, or groups of persons or entities, that comply with the prescribed conditions, if any: 1. Persons or entities, or groups of persons or entities, designated under subsection 29 (1) of the Connecting Care Act, 2019 as an Ontario Health Team. 2. Persons or entities, or groups of persons or entities, that have not yet been designated as an Ontario Health Team under subsection 29 (1) of the Connecting Care Act, 2019 but that have received written authorization from the Minister approving them to, i. use the title “Ontario Health Team”, and ii. collect, use and disclose personal health information in accordance with the conditions and other requirements made under clause (1) (n.3). 2022, c. 11, Sched. 4, s. 2 (3). General or specific application (2) A regulation made under this Act may be of general application or specific to any person or persons or class or classes in its application. 2004, c. 3, Sched. A, s. 73 (2). Classes (3) A class described in the regulations made under this Act may be described according to any characteristic or combination of characteristics and may be described to include or exclude any specified member, whether or not with the same characteristics. 2004, c. 3, Sched. A, s. 73 (3). Rolling incorporation by reference (4) If a regulation adopts by reference any code, standard, guideline or similar document, the regulation may require compliance with the code, standard, guideline or document as amended from time to time, whether the amendment was made before or after the regulation was made. 2019, c. 15, Sched. 30, s. 8 (2). Two or more organizations prescribed (4.1) A regulation made under clause (1) (d.1) may prescribe more than one organization to act as the prescribed organization for the purposes of this Act and may provide for the respective powers, duties and functions of each organization under this Act. 2025, c. 7, Sched. 6, s. 13 (3). Regulations respecting administrative penalties (5) Without limiting the generality of clause (1) (o.1), regulations made under that clause may prescribe specific amounts of administrative penalties or provide that the amounts of administrative penalties be based on the type of the contravention in question, on the contravention history of the person required to pay the administrative penalty or on whether the person is or is not a natural person. 2020, c. 5, Sched. 6, s. 24 (4). Section Amendments with date in force (d/m/y) 2016, c. 6, Sched. 1, s. 1 (28) - 03/06/2016 2019, c. 15, Sched. 30, s. 8 (1, 2) - 31/07/2020 2020, c. 5, Sched. 6, s. 24 (1, 3, 4) - 25/03/2020; 2020, c. 5, Sched. 6, s. 24 (2) - not in force 2022, c. 11, Sched. 4, s. 2 (1-3) - 14/04/2022 2025, c. 7, Sched. 6, s. 13 (1-3) - 01/01/2026 Public consultation before making regulations 74 (1) Subject to subsection (7), the Lieutenant Governor in Council shall not make any regulation under section 73 unless, (a) the Minister has published a notice of the proposed regulation in The Ontario Gazette and given notice of the proposed regulation by all other means that the Minister considers appropriate for the purpose of providing notice to the persons who may be affected by the proposed regulation; (b) the notice complies with the requirements of this section; (c) the time periods specified in the notice, during which members of the public may exercise a right described in clause (2) (b) or (c), have expired; and (d) the Minister has considered whatever comments and submissions that members of the public have made on the proposed regulation in accordance with clause (2) (b) or (c) and has reported to the Lieutenant Governor in Council on what, if any, changes to the proposed regulation the Minister considers appropriate. 2004, c. 3, Sched. A, s. 74 (1). Contents of notice (2) The notice mentioned in clause (1) (a) shall contain, (a) a description of the proposed regulation and the text of it; (b) a statement of the time period during which members of the public may submit written comments on the proposed regulation to the Minister and the manner in which and the address to which the comments must be submitted;

(c) a description of whatever other rights, in addition to the right described in clause (b), that members of the public have to make submissions on the proposed regulation and the manner in which and the time period during which those rights must be exercised; (d) a statement of where and when members of the public may review written information about the proposed regulation; (e) all prescribed information; and (f) all other information that the Minister considers appropriate. 2004, c. 3, Sched. A, s. 74 (2). Time period for comments (3) The time period mentioned in clauses (2) (b) and (c) shall be at least 60 days after the Minister gives the notice mentioned in clause (1) (a) unless the Minister shortens the time period in accordance with subsection (4). 2004, c. 3, Sched. A, s. 74 (3). Shorter time period for comments (4) The Minister may shorten the time period if, in the Minister’s opinion, (a) the urgency of the situation requires it; (b) the proposed regulation clarifies the intent or operation of this Act or the regulations; or (c) the proposed regulation is of a minor or technical nature. 2004, c. 3, Sched. A, s. 74 (4). Discretion to make regulations (5) Upon receiving the Minister’s report mentioned in clause (1) (d), the Lieutenant Governor in Council, without further notice under subsection (1), may make the proposed regulation with the changes that the Lieutenant Governor in Council considers appropriate, whether or not those changes are mentioned in the Minister’s report. 2004, c. 3, Sched. A, s. 74 (5). No public consultation (6) The Minister may decide that subsections (1) to (5) should not apply to the power of the Lieutenant Governor in Council to make a regulation under section 73 if, in the Minister’s opinion, (a) the urgency of the situation requires it; (b) the proposed regulation clarifies the intent or operation of this Act or the regulations; or (c) the proposed regulation is of a minor or technical nature. 2004, c. 3, Sched. A, s. 74 (6). Same (7) If the Minister decides that subsections (1) to (5) should not apply to the power of the Lieutenant Governor in Council to make a regulation under section 73, (a) those subsections do not apply to the power of the Lieutenant Governor in Council to make the regulation; and (b) the Minister shall give notice of the decision to the public and to the Commissioner as soon as is reasonably possible after making the decision. 2004, c. 3, Sched. A, s. 74 (7). Contents of notice (8) The notice mentioned in clause (7) (b) shall include a statement of the Minister’s reasons for making the decision and all other information that the Minister considers appropriate. 2004, c. 3, Sched. A, s. 74 (8). Publication of notice (9) The Minister shall publish the notice mentioned in clause (7) (b) in The Ontario Gazette and give the notice by all other means that the Minister considers appropriate. 2004, c. 3, Sched. A, s. 74 (9). Temporary regulation (10) If the Minister decides that subsections (1) to (5) should not apply to the power of the Lieutenant Governor in Council to make a regulation under section 73 because the Minister is of the opinion that the urgency of the situation requires it, the regulation shall, (a) be identified as a temporary regulation in the text of the regulation; and (b) unless it is revoked before its expiry, expire at a time specified in the regulation, which shall not be after the second anniversary of the day on which the regulation comes into force. 2004, c. 3, Sched. A, s. 74 (10). No review (11) Subject to subsection (12), neither a court, nor the Commissioner shall review any action, decision, failure to take action or failure to make a decision by the Lieutenant Governor in Council or the Minister under this section. 2004, c. 3, Sched. A, s. 74 (11). Exception (12) Any person resident in Ontario may make an application for judicial review under the Judicial Review Procedure Act on the grounds that the Minister has not taken a step required by this section. 2004, c. 3, Sched. A, s. 74 (12). Time for application (13) No person shall make an application under subsection (12) with respect to a regulation later than 21 days after the day on which, (a) the Minister publishes a notice with respect to the regulation under clause (1) (a) or subsection (9), where applicable; or (b) the regulation is filed, if it is a regulation described in subsection (10). 2004, c. 3, Sched. A, s. 74 (13). Review of Act 75 A committee of the Legislative Assembly shall, (a) begin a comprehensive review of this Act not later than the third anniversary of the day on which this section comes into force; and (b) within one year after beginning that review, make recommendations to the Assembly concerning amendments to this Act. 2004, c. 3, Sched. A, s. 75. 76.-98 Omitted (amends or repeals other Acts). 2004, c. 3, Sched. A, ss. 76-98. 99 Omitted (provides for coming into force of provisions of this Act). 2004, c. 3, Sched. A, s. 99. 100 Omitted (enacts short title of this Act). 2004, c. 3, Sched. A, s. 100. ______________