Personal Health Information Protection Act, 2004 (Ontario) (PHIPA)
Ontario health information custodians, such as regulated health professionals, hospitals, pharmacies and labs, plus their agents and certain electronic service providers.
This is general information, not legal advice.
Status: In force. Ontario's regulator can issue administrative penalties since January 1, 2024, and announced the first one on September 2, 2025. The statute text could not be read; this entry relies on the regulator's pages.
What to check
- Collect, use or disclose personal health information only with consent unless PHIPA permits otherwise, and only the minimum reasonably needed. Source
- Remain accountable for agents and outsourced service providers, including AI scribe vendors, and designate a privacy officer. Source
- Tell patients about any theft, loss or unauthorized use or disclosure of their personal health information. Source
- Treat entering personal health information into an unauthorized AI scribe as a privacy breach, which may require notifying people and reporting to the regulator. Source
- If you use AI scribes, have a governance framework covering policies, training, risk management, human oversight, and contractual safeguards with vendors. Source
Penalties
Administrative penalties of up to $50,000 for individuals and $500,000 for organizations; offence fines of up to $200,000 or one year in prison for individuals and up to $1,000,000 for organizations.