Your health privacy rights in Ontario

A heath information custodian (“custodian”) is a person or organization described in the Personal Health Information Protection Act (PHIPA) that has custody or control of your personal health information. Health information custodians can include:

• a health care practitioner (e.g., a physician) or a person who operates a group practice of health care practitioners
• long-term care homes
• Local Health Integration Networks, including those functions previously performed by community care access centres
• hospitals, including psychiatric facilities
• specimen collection centres, laboratories, independent health facilities
• pharmacies
• ambulance services
• Ontario Agency for Health Protection and Promotion

Health information custodians do not include:

• health care practitioners and other persons or organizations that provide health care as agents of a custodian
• someone who evaluates or assesses capacity under the Health Care Consent Act or Substitute Decisions Act
• a health care practitioner who acts for or on behalf of a person who is not a custodian, if the scope of duties of the practitioner do not include the provision of health care (e.g., a physician examining a person for the purpose of providing a fitness report to an insurance company or employer)
• an aboriginal healer who provides traditional healing services to aboriginal persons or members of an aboriginal community
• an aboriginal midwife who provides traditional midwifery services to aboriginal persons or members of an aboriginal community
• a person who provides treatment solely by spiritual means or by prayer

Health information custodians who have custody or control of your personal health information are required to:

• have in place information practices that comply with PHIPA and to act in a way that complies with those information practices;
• designate or take on the role of a contact person to:
  • help the custodian to comply with their obligations under PHIPA,
  • ensure that agents of the custodian are appropriately informed of their duties,
  • respond to inquiries from the public about their information practices,
  • respond to your requests for access and corrections to your information,
  • receive complaints about alleged breaches of PHIPA;
  • the information practices of the custodian,
  • how to contact the custodian or their contact person,
  • how an individual may obtain access to or request corrections to records of personal health information,
  • how to make a complaint to the custodian and to the Commissioner under PHIPA;