What Is Ontario Breach Management requirements?

What Does PHIPA Require for Breach Management?

Ontario’s Personal Health Information Protection Act, 2004 (PHIPA) establishes a multi-layered framework for breach management. The obligations are found primarily in section 12 of the Act and sections 6.3 and 6.4 of Ontario Regulation 329/04. Together, they impose three distinct duties on health information custodians.

What Is the Duty to Protect Personal Health Information?

Under PHIPA s.12(1), a health information custodian must take steps that are reasonable in the circumstances to ensure that personal health information in the custodian’s custody or control is:

• Protected against theft, loss, and unauthorized use or disclosure; and
• Protected against unauthorized copying, modification, or disposal.

This is a proactive obligation. It requires custodians to have safeguards in place before a breach occurs — not merely to respond after the fact [Source 1].

What Is the Duty to Notify the Affected Individual?

Under PHIPA s.12(2), when personal health information is stolen, lost, or used or disclosed without authority, the custodian must notify the individual to whom the information relates at the first reasonable opportunity. The notification must include a statement that the individual is entitled to make a complaint to the Information and Privacy Commissioner of Ontario (IPC) [Source 1, 6].

This duty applies to every breach — accidental or deliberate, minor or significant. There is no threshold or materiality exception for patient notification.

What Is the Duty to Report to the IPC?

Under PHIPA s.12(3) and O. Reg. 329/04, s.6.3, custodians must notify the IPC at the first reasonable opportunity when a breach falls into one of seven prescribed categories. Additionally, under O. Reg. 329/04, s.6.4, custodians must submit annual breach statistics to the IPC by March 1 each year [Source 1, 3].

What Is the Breach Management Process Under PHIPA?

Effective breach management is a structured lifecycle — not a single act. The IPC’s guidance documents outline a four-stage process that every custodian should follow [Source 2, 5].

How Should a Breach Be Contained?

Step 1 Contain the breach. The immediate priority is to stop the breach and prevent further unauthorized access. Actions may include:

• Revoking or suspending the access credentials of the individual responsible.
• Recovering stolen or misdirected records (paper or electronic).
• Isolating affected systems in the case of a cyberattack.
• Securing physical areas where a break-in or theft occurred.
• Contacting recipients of misdirected information and requesting return or destruction.

How Should a Breach Be Investigated?

Step 2 Investigate and assess. Determine the facts: what happened, who was involved, what information was compromised, how many individuals were affected, and how the breach occurred. Key questions include:

• What personal health information was involved? How sensitive is it?
• Was the breach deliberate or accidental?
• Who committed the breach — an employee, agent, affiliated practitioner, or external party?
• Did the person know or should they have known that their actions were unauthorized?
• How many individuals’ records were affected?
• Is there evidence of further use or disclosure of the information?
• Is this breach part of a pattern of similar breaches?

How Should Affected Individuals and the IPC Be Notified?

Step 3 Notify. Based on the investigation findings, determine notification obligations:

• Notify the affected individual(s) at the first reasonable opportunity — this is mandatory for all breaches (see Section 5 below).
• Notify the IPC at the first reasonable opportunity if the breach falls into one of the seven prescribed categories (see Section 3 below).
• Notify the relevant health regulatory college within 30 days if the breach involves a regulated health professional and disciplinary action is taken (PHIPA s.17.1).

How Should a Breach Be Remediated?

Step 4 Remediate and prevent. Address the root cause of the breach and implement measures to prevent recurrence. This may include:

• Updating policies and procedures (e.g., access controls, fax protocols, encryption standards).
• Providing additional training to staff.
• Implementing or strengthening technical safeguards (e.g., audit logging, access monitoring).
• Taking disciplinary action against responsible individuals.
• Conducting a broader review of information practices if the breach reveals systemic issues.

When Must a Breach Be Reported to the IPC?

Under PHIPA s.12(3) and O. Reg. 329/04, s.6.3, custodians must report a breach to the IPC at the first reasonable opportunity if it falls into any of the following seven categories. The categories are not mutually exclusive — more than one may apply to a single incident [Source 2, 5].

What About Unauthorized Collection via the EHR?

Under O. Reg. 329/04, s.18.3, if personal health information is collected without authority by means of the provincial electronic health record (EHR), the custodian responsible must notify the IPC if the unauthorized collection would have been reportable had it been a use or disclosure under any of the seven categories above [Source 2, 5].

What Information Must Be Included in a Breach Report to the IPC?

The IPC’s breach report form requires custodians to describe [Source 2, 5]:

• The circumstances of the breach — how the information came to be stolen, lost, or disclosed without authority; how the breach was discovered.
• The nature of the personal health information involved.
• The number of individuals affected.
• Whether and how the custodian notified affected individuals.
• The steps taken to contain, investigate, and remediate the breach and prevent future breaches (even if some steps are still ongoing).

What Is the Annual Breach Report to the IPC?

Separate from individual breach reporting, O. Reg. 329/04, s.6.4 requires every health information custodian to submit annual breach statistics to the IPC. This is a distinct obligation from reporting individual breaches under s.6.3 [Source 3, 4].

When Is the Annual Report Due?

The annual report must be submitted by March 1 each year, covering all privacy breaches that occurred or were discovered during the previous calendar year. The report must be submitted electronically through the IPC’s Online Statistics Submission Website [Source 3, 4, 6].

What Must the Annual Report Include?

The report must set out the number of times in the previous calendar year that each of the following occurred [Source 3]:

Does the Annual Report Include All Breaches — Even Minor Ones?

Yes. The annual statistics report must include all breaches — including those that did not meet the threshold for individual reporting to the IPC under s.6.3. An accidental, isolated breach (such as a single misdirected fax) may not have been separately reported to the IPC when it occurred, but it must still be counted in the annual statistics [Source 2, 3].

Who Must File the Annual Report?

• HICs that are not FIPPA/MFIPPA institutions: Must file only if one or more breaches occurred or were discovered in the previous year.
• HICs that are FIPPA/MFIPPA institutions (e.g., public hospitals): Must file even if no breaches occurred — completing at minimum Section 1 of the report [Source 6].

What Are the Requirements for Notifying Affected Patients?

Patient notification is a standalone obligation under PHIPA s.12(2), separate from IPC reporting. It applies to every privacy breach, regardless of whether the breach is reportable to the IPC [Source 1, 2].

When Must Patients Be Notified?

The custodian must notify the affected individual at the first reasonable opportunity after a theft, loss, or unauthorized use or disclosure of their personal health information. There is no exception for minor or accidental breaches — the duty applies universally [Source 1].

What Must the Notification Include?

The notification must include:

• Information about the nature of the breach — what happened and what information was involved.
• A statement that the individual is entitled to make a complaint to the Information and Privacy Commissioner of Ontario.

How Must the Notification Be Delivered?

PHIPA does not prescribe a specific format for patient notification. The custodian may notify the individual by [Source 6]:

• Telephone
• Written letter
• In person — for example, at the patient’s next appointment
• Other means appropriate to the circumstances

The custodian should consider the sensitivity of the information that was compromised and use judgment to determine the most appropriate method. Highly sensitive breaches (e.g., mental health records, HIV status) may warrant more direct and confidential notification methods.

What About Notification When Disciplinary Action Is Taken?

When a breach leads to disciplinary action against a regulated health professional, the custodian must also report the individual to their regulatory college under PHIPA s.17.1, within 30 days. This is in addition to — not a substitute for — notifying the affected patient and (if applicable) the IPC [Source 1, 7].

How Do All the Breach Management Obligations Fit Together?