Personal Health Information Protection Act
Ontario legislation established in 2004
The Personal Health Information Protection Act, 2004 (French: Loi de 2004 sur la protection des renseignements personnels sur la santé), also known as PHIPA, is Ontario legislation established in November 2004. PHIPA is one of two components of the Health Information Protection Act 2004.
The Health Information Protection Act, also established in 2004, comprises two schedules: PHIPA (Schedule A) and the Quality of Care Information Protection Act (Schedule B). The PHIPA replaced the Health Cards and Numbers Control Act (SO 1991, c 1).
PHIPA provides a set of rules for the collection, use and disclosure of personal health information by a "Health Information Custodian" (HIC), and includes the following provisions:
Consent is required for the collection, use and disclosure of personal health information, with few exceptions
HICs are required to treat all personal health information as confidential and maintain its security
Individuals have a right to access their personal health information, as well as the right to correct errors
Individuals have the right to instruct HICs not to share their personal health information with others
Rules are provided for the use of personal health information for fundraising or marketing purposes
Guidelines are set for the use and disclosure of personal health information as a secondary use such as research, quality improvement or education
Accountability is ensured by granting an individual the right to complain if they have identified an error in their personal health information
Remedies are established for breaches of the legislation
History
December 17, 2003: The Health Information Protection Act (Bill 31) was introduced by the first McGuinty government
January 26, 2004: Public hearing at Standing Committee on General Government held in Toronto
February 2, 2004: Public hearing at Standing Committee on General Government held in Sault Ste. Marie, Kingston and London
February 9, 2004: and April 28, 2004 Clause-by-clause consideration of the Bill resulting in various amendments
May 17, 2004: Bill 31 passed third and final reading with unanimous support in the legislature
May 20, 2004: Bill 31 received Royal Assent
July 3 - September 3, 2004: Public consultation on regulations
November 1, 2004: Schedules A and B of the Health Information Protection Act come into force
May 18, 2016: passage by the first Wynne government of the Health Information Protection Act 2016, S.O. 2016, c. 6 - Bill 119, to amend the Personal Health Information Protection Act, 2004, to make related amendments, to introduce the idea of an "ELECTRONIC HEALTH RECORD", to repeal and replace the Quality of Care Information Protection Act 2004 with the Quality of Care Information Protection Act 2016, and to amend the Regulated Health Professions Act, 1991
Application
PHIPA applies to individuals and organizations involved in the delivery of healthcare services. Under the Act, they are referred to as HICs, "prescribed organizations", or "agencies", each with various function.
Health information custodians
A HIC can be any number of individuals or organizations who have custody or control of personal health information. To elaborate, some examples of an HIC include:
Healthcare providers such as doctors, nurses, social workers, dentists, psychologists, paramedics, optometrists, physiotherapists, occupational therapists, chiropractors, massage therapists, dieticians, naturopaths and acupuncturists
Hospitals
Long-term care homes and homes for special care
Community Care Access Centres
Pharmacies
Medical laboratories
Local medical officers of health
Ambulance services
Community mental health programs
Ministry of Health and Long-Term Care
Agents of health information custodians
An “agent” of an HIC includes anyone who is authorized by the HIC to do anything on behalf of the HIC with respect to personal health information.
This brief starts where responsible research should: with the source description of “Personal Health Information Protection Act” as ontario legislation established in 2004. Everything that follows is an evidence route, not borrowed authority.
Why this record matters
The subject matters to the general reference register because the source frames it as ontario legislation established in 2004. Its deeper value depends on whether names, dates, institutions and citations support that framing.
Named sources, stable identifiers and responsible institutions provide the strongest route from overview to verifiable evidence. The source revision retrieved here is dated Nov 9, 2025. The linked authority identifier is Q7170513. VIAF identifies the subject as 646154387508930970007. None of the 1 selected statements returned an explicit reference. The first chronological checks are 2004, 1991, 2003 and 2016.
Overview language is designed for orientation and should not be treated as a substitute for the evidence cited beneath it. The source lead contains qualifying language; that uncertainty should survive quotation, summary and reuse. Authority statements aid reconciliation but still require their own references, qualifiers and ranks to be checked.
How to read it
Use the entry as an orientation point, then follow its citations and revision history. Names, dates and institutional relationships should be checked against the original record.
- Subject orientation
- Search vocabulary
- Locating named sources
The closest primary source, responsible institution and strongest cited specialist reference.
Three-step research path
- Establish the record: confirm the title “Personal Health Information Protection Act”, its source revision and the description used here.
- Expand the search: follow Personal Health Information Protection Act primary sources, Personal Health Information Protection Act archive and Personal research across catalogues and specialist indexes.
- Test the account: compare the strongest cited source with the responsible institution’s current record and note any disagreement.
Questions for further research
- Which source most directly establishes the central claim about “Personal Health Information Protection Act”?
- Which institution is responsible for the underlying evidence?
- Which cited source is closest to the event, object or claim?
Search terms from this dossier
This entry incorporates text from “Personal Health Information Protection Act” on English Wikipedia. Contributors are listed in the page history. Text is available under the Creative Commons Attribution-ShareAlike 4.0 License. Selected authority identifiers and statements are retrieved from Wikidata under CC0; their references and qualifiers remain part of the verification path.