For practices in Canada

PHIPA Compliance for Private Health Practices in Ontario: A Plain Checklist

If you're a regulated practitioner running a private practice in Ontario, the Personal Health Information Protection Act, 2004 (PHIPA) almost certainly applies to you. Complying doesn't take special software. It takes a short list of duties, done properly and written down. This post is that list, with links to the Information and Privacy Commissioner of Ontario (IPC), the regulatory colleges and the legislation behind each point.

This is a practical guide, not legal advice. PHIPA, its regulations and IPC guidance change, and your college may set stricter rules, so check anything you're unsure about with the IPC, your college or a health lawyer.

The PHIPA compliance checklist

1. Know whether you're the health information custodian, and who your agents are.
2. Name a contact person for privacy.
3. Publish a written statement of your information practices.
4. Get the right kind of consent: implied for care, express for most other disclosures.
5. Put reasonable administrative, technical and physical safeguards in place.
6. Have a breach plan: contain, notify the patient, report to the IPC and your college when required, and log every breach for the annual report.
7. Answer access and correction requests within 30 days.
8. Keep records for the period your college sets, then destroy them securely, and plan for what happens to them if you close.

The rest of this post explains each one.

Are you a health information custodian?

PHIPA puts its duties on the health information custodian: the person or organization with custody or control of personal health information. A "health care practitioner" who provides health care is a custodian, and that includes members of the colleges under the Regulated Health Professions Act, such as physiotherapists, occupational therapists, registered psychotherapists, psychologists, dietitians, kinesiologists, chiropractors, massage therapists and speech-language pathologists. Registered social workers are covered too. So is a person who operates a group practice of health care practitioners.

What matters in a shared clinic is who is the custodian and who is an agent acting on the custodian's behalf. Employees, reception and billing staff, and often associates, are agents. They can only collect, use and disclose information as the custodian permits, and the custodian stays responsible for what they do.

For a solo practitioner the answer is simple: you're the custodian. For a group practice, an owner who isn't a practitioner, or a clinic with independent contractors, write down who the custodian is in your contracts and policies. Colleges see disputes over records when a practitioner leaves a clinic, and they usually come down to this question never having been answered.

Name a contact person and publish a written statement

Every custodian must designate a contact person: someone who makes sure agents follow the rules, answers questions from the public, handles access and correction requests and deals with complaints. In a solo practice that's you. In a larger clinic it's often the practice manager or owner, but someone has to be named.

You also need a written public statement that's available to patients. It must give a general description of your information practices, say how to reach your contact person, explain how to request access to or correction of a record, and say how to complain to you and to the IPC.

Put it on your website, in your waiting room and in your intake paperwork. Keep it short and specific to your practice: a page saying what you collect, why, who you share it with in the course of care, how you protect it, and who to contact.

Consent under PHIPA

PHIPA consent has to be knowledgeable: the patient knows why you're collecting, using or disclosing their information, and that they can give or withhold consent. Posting your written statement where patients will see it is the usual way to meet this for routine care.

When implied consent is enough

You can rely on implied consent to collect, use and disclose information to other custodians for the purpose of providing health care, sometimes called the "circle of care". Sending a progress update to the referring family doctor is the classic example, unless the patient has told you not to.

When you need express consent

You generally need express consent, verbal or written, to disclose to someone who isn't a custodian, or to a custodian for a purpose other than care. That includes:

• An employer or a return-to-work coordinator
• An insurer, including extended health benefits providers asking for clinical notes
• A lawyer, school or sports team
• Family members, in most situations
• Marketing and testimonials

Record express consent in the chart: who consented, to what, for whom and when. If it's on a form, keep the signed form with the record.

The "lockbox"

Patients can withhold or withdraw consent to specific information being shared, even with other providers in the circle of care. If you're asked to share for care but can't include everything because of the patient's instruction, and you think the missing information matters, you must tell the recipient that some information has been withheld.

Email and text

The IPC accepts that practices communicate with patients by email, but its guidance expects encryption where possible, a written policy, and the patient's informed consent before you use unencrypted email. Ask about contact preferences at intake and record the answer.

Safeguards

PHIPA requires you to take steps that are reasonable in the circumstances to protect personal health information against theft, loss and unauthorized use or disclosure, and to keep it secure when it's copied, modified or disposed of. "Reasonable" depends on your size, but every practice should cover these:

Administrative

• A written privacy policy that matches what you actually do.
• Privacy training for everyone at the start of their role, then at least once a year, with a signed confidentiality agreement.
• Written agreements with vendors that handle your records, such as your practice software, IT support and transcription, covering security, access and what happens to the data when the contract ends.

Technical

• Each person has their own login, and nobody shares passwords.
• Role-based access, so reception sees schedules and billing, not clinical notes.
• Multi-factor authentication on anything that holds patient information, including email.
• Encryption on laptops, phones and USB drives. Theft of properly encrypted information falls outside the IPC's theft reporting category; theft of an unencrypted laptop doesn't.
• A way to see who opened which record, and someone who actually checks. Unauthorized browsing ("snooping") is the breach the IPC takes most seriously. PHIPA amendments from 2020 (section 10.1) add a duty to keep and audit electronic audit logs. As of November 2026 that section isn't yet in force, but the IPC already expects custodians to log and monitor access to records.

Physical

• Paper files locked away, screens out of the waiting room's line of sight, and phone calls about patients taken where they can't be overheard.
• A shredder or a secure shredding service. Never put patient paperwork in the recycling.

Caspen's security covers several of the technical points for you: role-based user permissions, multi-factor authentication, encryption in transit and at rest, automatic logout, and a client access history showing which staff viewed or changed a record. It doesn't replace your policies or training, but it gives you the access controls and the log to check.

Privacy breaches: what to do and who to tell

A privacy breach is any collection, use or disclosure that PHIPA doesn't allow, or any theft or loss of personal health information. A fax to the wrong number, an email to the wrong patient, a stolen laptop and a staff member reading a neighbour's file are all breaches. Work through these steps, in order:

1. Contain it. Retrieve or get confirmation of deletion of misdirected information, lock compromised accounts and change passwords.
2. Notify the patient at the first reasonable opportunity. Tell them what happened and that they're entitled to complain to the IPC.
3. Report to the IPC if the breach falls into any of the seven situations in section 6.3 of the PHIPA regulation:
   • Use or disclosure by someone who knew or ought to have known it wasn't permitted, such as snooping
   • Theft of information (encrypted or de-identified information excluded)
   • Further use or disclosure after the initial breach, or reason to believe it will happen
   • A pattern of similar breaches, even if each one is minor
   • Disciplinary action against a college member, or their resignation, connected to the breach
   • The same for an employee or agent who isn't a college member
   • A significant breach, judged by the sensitivity and volume of the information, the number of people affected and how many agents were involved
4. Report to the college when you terminate, suspend or discipline a regulated professional because of a breach, or they resign or give up privileges in connection with one. The report goes in writing within 30 days. The College of Dietitians of Ontario explains this duty alongside the seven IPC categories.
5. Log every breach, including the ones you didn't report. Custodians submit annual breach statistics to the IPC through its online portal by March 1 for the previous calendar year.

The IPC's guidance on when to report a breach gives examples for each category. If you're unsure whether a breach is reportable, contact the IPC and ask.

Access and correction requests

Patients have a right to see and get a copy of their own record. You must respond as soon as possible and no later than 30 days after receiving the request. You can extend once, by up to 30 more days, if meeting the deadline would unreasonably interfere with your operations or you need to consult someone, but you have to tell the patient in writing, with the length of the extension and the reason. If you don't respond in time, PHIPA treats that as a refusal, which the patient can complain to the IPC about.

The grounds for refusing access are narrow, such as a risk of serious harm to the patient or someone else, or information collected for a legal proceeding that hasn't finished. If you refuse any part, explain why in writing and tell the patient they can complain to the IPC.

On fees, you can charge no more than "reasonable cost recovery", and you must give an estimate first. You can also waive the fee. No fee is set in the regulations, but in its decisions the IPC has used $30 for the first 20 pages and 25 cents a page after that as the benchmark, and has reduced fees above it. The IPC's access and correction guidance covers the details.

Patients can also ask you to correct their record. You must respond within 30 days and correct it if they show it's inaccurate or incomplete. You don't have to change a professional opinion or observation you made in good faith, but if you refuse, the patient can attach a statement of disagreement to the record.

When a patient asks for their record, keep it for as long as they need to exhaust any recourse, even if it's past your usual retention period.

Record retention and disposal

PHIPA requires you to keep, transfer and dispose of records securely, but how long you keep them is set by your college. Many Ontario colleges use a 10-year minimum, with an extension for children:

• Physiotherapists: the College of Physiotherapists of Ontario's documentation standard requires clinical and financial records to be kept for at least 10 years from the later of the last patient encounter or the date the patient turned, or would have turned, 18. It notes that legal claims can be brought up to 15 years after an event, so you may want to keep records longer.
• Occupational therapists: the College of Occupational Therapists of Ontario sets at least 10 years from the last entry, or 10 years after the client's 18th birthday, whichever is later.
• Other professions: check your own college's record-keeping standard. Retention periods and how they handle minors differ between colleges.

When the period ends, destroy records so they can't be reconstructed: cross-cut shredding for paper, and secure wiping or physical destruction for drives. Keep a log of what you destroyed and when.

Plan for the records outliving your practice. If you close, retire or sell, your patients still need to be able to get their records for the full retention period. If a custodian dies, their estate trustee becomes the custodian until the records pass to someone else. Name a successor custodian in writing, and tell your patients and your college what happens to records when you close.

What happens if you get PHIPA wrong

Patients can complain to the IPC, which can investigate and issue orders. Since January 1, 2024 the IPC can also issue administrative monetary penalties of up to $50,000 for an individual and $500,000 for an organization, though it has said these are aimed at serious contraventions like deliberate snooping, not one-off mistakes. Offences under PHIPA carry fines of up to $200,000 for individuals and $1,000,000 for organizations. The IPC sets these out in its page on the potential consequences of a breach.

Separately, your college can treat a breach of confidentiality as professional misconduct.

Where to find official PHIPA guidelines

• The Personal Health Information Protection Act, 2004 and its general regulation, O. Reg. 329/04 on e-Laws
• The IPC's guidance for health organizations, including the breach and access pages linked above
• Your college's privacy and record-keeping standards. The College of Occupational Therapists of Ontario's guide to PHIPA is a readable overview for any regulated practitioner

PHIPA compliance in a private practice comes down to having the paperwork (a contact person, a written statement, a privacy policy and vendor agreements), doing the habits (consent, access controls, training) and knowing what to do on the bad day (a breach). Review your checklist once a year, and again whenever you hire, change software or move premises.

If you want access controls and a record of who viewed each client file without setting them up yourself, try Caspen free.