.svg)
PHIPA, Ontario's Personal Health Information Protection Act, 2004, is the provincial law that governs how health information custodians, such as hospitals and clinics, handle personal health information. PHIPA regulates custodians directly and reaches health-tech vendors through them, in one of three vendor roles with separate duties. For a vendor, PHIPA compliance gets tested in the hospital's privacy and security review, before the contract is signed.
At a glance
PHIPA duties for health-tech vendors, in seven facts
- The law: Personal Health Information Protection Act, 2004, S.O. 2004, c. 3, Sched. A, plus the General Regulation, O. Reg. 329/04 (both current on e-Laws to October 28, 2026).
- Regulated directly: health information custodians, such as hospitals and health care practitioners.
- Vendor roles:
- agent (s. 17)
- electronic service provider (s. 10(4) and O. Reg. 329/04 s. 6(1))
- health information network provider (O. Reg. 329/04 s. 6(3))
- Breach notice: the custodian notifies affected individuals at the first reasonable opportunity (s. 12(2)) and notifies the Information and Privacy Commissioner (IPC) in prescribed circumstances. Agents must tell the custodian at the first reasonable opportunity (s. 17(4)(b)).
- Offence fines: up to $200,000 and up to one year in prison for individuals, and up to $1,000,000 for organizations (s. 72(2)).
- Administrative penalties: in force since January 1, 2024, capped at $50,000 for individuals and $500,000 for organizations, plus any economic benefit gained (O. Reg. 329/04 s. 35). The IPC issued the first two in PHIPA Decision 298 (August 2025) and a third in PHIPA Decision 334 (April 2026).
- Data location: PHIPA has no general rule that PHI be stored in Ontario or Canada. Section 50 restricts disclosure outside Ontario. A hospital's contract and policies can set where PHI is stored.
What is PHIPA, and who does PHIPA regulate?
PHIPA is Ontario's health-sector privacy statute. PHIPA regulates health information custodians: the people and organizations that have custody or control of personal health information because of the health care work they do. The section 3 list includes:
- health care practitioners
- hospitals
- long-term care homes and retirement homes
- pharmacies
- laboratories
- ambulance services
PHIPA is law and applies the moment an Ontario custodian's personal health information (PHI) is in play. No vendor opts in or out. The overview of Canadian privacy law after Bill C-27 explains how PHIPA fits next to PIPEDA and Quebec's Law 25 for companies handling health data across provinces.
A health-tech vendor is rarely a custodian. Section 17(3)(b) keeps the custodian responsible for PHI handled by the custodian's agents, whether or not the agent followed the rules. Ontario hospitals ask vendors many questions before signing because the hospital carries the responsibility.
Which PHIPA role does a health-tech vendor play: agent, electronic service provider, or network provider?
A health-tech vendor falls into one of three PHIPA roles. The role decides which duties apply and which agreement the hospital puts in front of the vendor.
| PHIPA vendor role | Legal test | Where the role is defined | Core obligations | Possible example (fact-specific) |
| Agent | Acts on behalf of the custodian in respect of PHI, for the custodian's purposes, not the agent's own | s. 2, s. 17 |
|
|
| Electronic service provider (not an agent) | Supplies services that let a custodian handle PHI by electronic means | s. 10(4) and O. Reg. 329/04 s. 6(1) |
|
Hosting where the vendor does not act on the PHI |
| Health information network provider (HINP) | Serves two or more custodians, primarily so they can disclose PHI to one another electronically | O. Reg. 329/04 s. 6(2), 6(3) | Seven additional duties, listed below | Referral or results-sharing networks between hospitals and clinics |
Under section 6(1), PHI passing between a custodian and the custodian's agent counts as a use by the custodian, not a disclosure. A hospital can put PHI into an agent's platform without a disclosure consent, so the agent agreement spells out exactly what the vendor may do with the data.
Classification is fact-based. A vendor whose support staff can read patient records to troubleshoot, or whose analytics run on PHI for the hospital, looks like an agent even when the contract calls the vendor a supplier.
What does O. Reg. 329/04 require of a health information network provider?
A health information network provider owes seven duties under section 6(3) of O. Reg. 329/04, on top of the electronic service provider restrictions in section 6(1).
| HINP duty under O. Reg. 329/04 s. 6(3) | What the provider must do |
| 1. Breach notice to custodians | Notify each affected custodian at the first reasonable opportunity of out-of-bounds use, disclosure, or disposal, or unauthorized access |
| 2. Plain-language description | Give each custodian a patient-ready description of the services and their safeguards |
| 3. Public disclosures | Publish that description, applicable policies, and a general description of security safeguards |
| 4. Access and transfer records | On request, provide an electronic record of every access to and transfer of the custodian's PHI: who, to whom, date, and time |
| 5. Threat, risk, and privacy assessment | Assess threats, vulnerabilities, and risks to the PHI and the privacy impact of the services, and give each custodian the written results |
| 6. Third-party flow-down | Bind any third party the provider retains to the conditions the provider needs to comply |
| 7. Written agreement | Sign an agreement with each custodian describing the services and safeguards and requiring PHIPA compliance |
For a vendor building a shared platform, duty 5 is a threat and risk assessment (TRA) plus a privacy impact assessment in all but name, and duty 4 is an audit logging requirement already in force.
Is PHIPA's electronic audit log requirement in force?
PHIPA's electronic audit log requirement for custodians, section 10.1, is not in force. The e-Laws consolidation current to October 28, 2026 still shows section 10.1 awaiting proclamation. Once proclaimed, section 10.1 will require a log entry for every time a PHI record is viewed, handled, or modified, recording:
- the type of information
- the date and time
- everyone who dealt with the record
- the individual the information is about
Section 12(1) already requires reasonable safeguards against unauthorized use, and access logs are how a custodian investigates snooping. A vendor without per-record access logs should expect the missing logs to come up in review.
How does PHIPA breach notification work when the vendor has the incident?
PHIPA breach notification is a chain: the vendor tells the custodian, and the custodian tells patients and, in prescribed circumstances, the IPC. An agent must notify the custodian at the first reasonable opportunity under section 17(4)(b). An HINP has the same duty under O. Reg. 329/04 s. 6(3). The custodian must then notify each affected individual at the first reasonable opportunity, and tell them they can complain to the IPC (s. 12(2)).
The custodian must also notify the IPC at the first reasonable opportunity when any of the seven circumstances in O. Reg. 329/04 s. 6.3 applies:
| IPC notification trigger (O. Reg. 329/04 s. 6.3) | Plain meaning |
| Knowing unauthorized use or disclosure | The person knew or ought to have known they lacked authority, such as staff snooping |
| Theft | PHI was stolen, including by an attacker |
| Further use or disclosure | The PHI was or will be further used or disclosed after the incident |
| Repeat incidents | The incident is one of a series of similar incidents |
| College notice | The event is, or would be if the agent were a member, reportable to a regulatory College under s. 17.1 (two triggers) |
| Significant incident | Judged by sensitivity, volume, number of individuals, and number of custodians or agents responsible |
Custodians also file an annual statistical report with the IPC by March 1 on thefts, losses, and unauthorized uses and disclosures (s. 6.4). Notice cost is only one line in a breach. The cost of a data breach in Canada breakdown also covers:
- detection
- response
- lost business
Key insight
Custodians stay responsible for PHI when a vendor is breached
In PHIPA Decision 284 (June 2025), the IPC reviewed the 2023 ransomware attack on TransForm Shared Service Organization, the shared IT provider for five hospitals and a family health team clinic. Attackers entered through three compromised administrator accounts, and the IPC found that missing privileged account management, including MFA, was likely a contributing factor. The IPC also held that hostile encryption is itself an unauthorized use and loss of PHI requiring notice to patients under s. 12(2). The IPC's first takeaway: outsourcing does not abdicate responsibility.
Ransomware is the scenario Decision 284 describes. The Canadian ransomware paradox post covers how often Canadian organizations pay and what the full cost stack looks like.
What are the PHIPA fines and administrative monetary penalties?
PHIPA has two penalty tracks: prosecuted offences with court-imposed fines, and administrative monetary penalties (AMPs) the IPC can order directly.
| PHIPA penalty track | Individuals | Organizations | Source |
| Offence (on conviction) | Fine up to $200,000, up to 1 year in prison, or both | Fine up to $1,000,000 | PHIPA s. 72(2) |
| Administrative monetary penalty | Up to $50,000 | Up to $500,000 | O. Reg. 329/04 s. 35(1) |
| Economic benefit add-on | Amount of benefit gained | Amount of benefit gained | O. Reg. 329/04 s. 35(2) |
Offences target wilful conduct, such as wilfully collecting, using, or disclosing PHI in contravention of the Act. When a corporation commits an offence, any officer, member, employee, or other agent who authorized the offence, or who had the authority to prevent the offence and knowingly refrained, is a party to the offence (s. 72(3)).
AMPs took effect on January 1, 2024, and apply to any person the IPC reviewed and found in contravention, including agents. In PHIPA Decision 298 (August 27, 2025, announced September 2, 2025), the IPC issued the first AMPs by any Canadian privacy commissioner: $5,000 against a physician who searched a shared hospital health record system for newborns to solicit private clinic business, and $7,500 against his clinic. The IPC issued a second AMP in PHIPA Decision 334 (April 2026): $2,000 against a patient services clerk who, while acting as an agent of the Children's Hospital of Eastern Ontario, accessed 436 patient records without authorization. The amounts are small, but the IPC now uses AMPs against agents as well as custodians.
PHIPA vs HIPAA: how do the two health privacy laws compare for vendors?
PHIPA and HIPAA regulate the same kind of data in different countries, and a vendor selling to both Ontario hospitals and US providers carries both sets of obligations.
| Comparison point | PHIPA (Ontario) | HIPAA (United States) |
| Legal type and scope | Ontario statute covering PHI held by health information custodians | US federal law and rules (45 CFR Parts 160 and 164) covering protected health information |
| Who is regulated directly | Health information custodians. Agents and HINPs have direct duties. | Covered entities (health plans, clearinghouses, providers who conduct standard electronic transactions) and business associates |
| Vendor role | Agent, electronic service provider, or HINP | Business associate or subcontractor |
| Required contract |
|
Business associate agreement (45 CFR 164.504(e), 164.502(e)) |
| Vendor-to-client breach notice | At the first reasonable opportunity (s. 17(4)(b) and O. Reg. 329/04 s. 6(3)) | Without unreasonable delay, no later than 60 calendar days after discovery (45 CFR 164.410) |
| Notice to individuals | At the first reasonable opportunity (s. 12(2)) | Without unreasonable delay, no later than 60 calendar days after discovery (45 CFR 164.404) |
| Notice to regulator | IPC, when an O. Reg. 329/04 s. 6.3 circumstance applies, plus an annual report | HHS: at the same time as individual notice for 500 or more individuals, annually for fewer (45 CFR 164.408) |
| Penalties | Offence fines up to $1,000,000 for organizations. AMPs up to $500,000. | Tiered civil penalties (45 CFR 160.404), inflation-adjusted yearly. Criminal penalties (42 U.S.C. 1320d-6) |
HIPAA gives a fixed 60-day outer limit, while PHIPA says first reasonable opportunity and leaves any fixed window for the hospital's agreement to define. HIPAA also names the vendor contract (the BAA), while PHIPA leaves the agent agreement to the custodian, so each Ontario hospital's paper can differ. Vendors facing US buyers too can start from the HIPAA and HITRUST Accelerator, since one set of safeguards can serve both laws.
What does an Ontario hospital's vendor privacy and security review ask for?
An Ontario hospital's vendor privacy and security review asks the vendor to prove, before signing, the safeguards the hospital will be accountable for under PHIPA. Packages vary by hospital. The items below track PHIPA duties and IPC findings.
| Review item | What the hospital looks for | Why the hospital asks (legal hook) |
| Privacy impact assessment (PIA) | For the product as deployed at that hospital:
|
Custodians must have compliant information practices (s. 10(1)). The IPC publishes PIA guidelines for PHIPA (October 2005). |
| Threat and risk assessment (TRA) | Threats, vulnerabilities, and mitigations for:
|
Reasonable safeguards (s. 12(1)). Mandatory written assessment for HINPs (O. Reg. 329/04 s. 6(3)5) |
| Agent or service agreement |
|
s. 17(1.1) conditions on agents. PHIPA Decision 284, where the IPC found a clinic's agreement with the clinic's IT provider lacked key provisions. |
| SOC 2 Type II report or ISO 27001 certificate | Independent evidence that security controls exist and operate | Supports the custodian's due diligence. PHIPA requires neither. |
| Data location and subprocessors | Where PHI is stored, processed, and supported from, and by whom | Section 50 limits on disclosure outside Ontario. The custodian's own contract and policy requirements |
| Breach notification commitment |
|
s. 17(4)(b) agent duty. Custodian duties in s. 12(2) and 12(3) |
| Audit logging | Per-record access logs the hospital can pull for investigations |
|
| Privileged access and MFA | MFA and monitoring on administrator accounts, including vendor remote access | IPC findings in PHIPA Decision 284 |
The vendor risk assessment guide shows the buyer side of a vendor review.
Watch out
A SOC 2 report does not make a vendor PHIPA compliant
PHIPA is law. SOC 2 and ISO 27001 are voluntary frameworks. A SOC 2 Type II report or an ISO 27001 certificate gives the hospital independent evidence of security controls and shortens the review. A SOC 2 report leaves out PHIPA-specific duties, such as:
- permitted uses of PHI
- the agent's breach notice to the custodian
- the HINP plain-language description
Vendors need both the evidence and the PHIPA-specific paper.
PHIPA readiness review for vendors selling into Ontario hospitals
Role classification, PIA and TRA support, agent agreement positions, and an effective security program a hospital reviewer can verify. See the privacy program service.
What should a PHIPA compliance checklist for health-tech vendors include?
PHIPA compliance for a vendor comes down to ten steps that produce the evidence a hospital review asks for.
| Step | Action | Evidence produced |
| 1 | Classify the vendor role for each product: agent, electronic service provider, or HINP | Role memo per product and customer type |
| 2 | Map PHI flows:
|
Data flow diagram and PHI inventory |
| 3 | Write a PIA for the product as a hospital will deploy the product | PIA the hospital can adapt |
| 4 | Complete a TRA covering:
|
TRA report with a risk treatment plan |
| 5 | Prepare a standard agent agreement position on:
|
Redline-ready contract positions |
| 6 | Document where PHI is stored and supported from, and list subprocessors | Data location statement and subprocessor list |
| 7 | Build per-record access logging customers can query | Sample audit log export |
| 8 | Enforce MFA and monitoring on every administrator and vendor remote-access account | Access control configuration evidence |
| 9 | Write and rehearse an incident plan with a custodian notification step, including ransomware encryption | Incident response plan and tabletop record |
| 10 | Get independent assurance, SOC 2 Type II or ISO 27001, scoped to the PHI environment | Audit report or certificate |
The SOC 2 data protection guide covers encryption at rest and key management controls that also answer TRA questions. Teams unsure where their program stands can take the SOC 2 readiness scorecard before scoping the audit.
Why does PHIPA readiness decide health-tech deals in Ontario?
PHIPA readiness decides whether a hospital deal closes on schedule. The hospital stays accountable for every record in the vendor's platform, so hospital reviewers hold the signature until the following items line up:
- the agent agreement
- the PIA and TRA
- the breach notice commitments
- the independent evidence
Vendors who assemble the package before the first procurement call spend the review answering follow-ups, not building the program under deadline.
PHIPA readiness review for vendors selling into Ontario hospitals
Truvo Cyber classifies your PHIPA role, supports the PIA and TRA, sets your agent agreement positions, and builds a security program whose evidence a hospital reviewer can verify. See the privacy program service.
Frequently asked questions about PHIPA for health-tech vendors
What is PHIPA?
PHIPA is Ontario's Personal Health Information Protection Act, 2004. PHIPA governs how health information custodians, such as hospitals, clinics, pharmacies, and health care practitioners, collect, use, disclose, and protect personal health information. The Act also places duties on the agents and technology providers that handle personal health information for custodians. Ontario's Information and Privacy Commissioner enforces PHIPA.
Does PHIPA apply to software vendors?
Yes, through the custodian. A software vendor that acts on personal health information for an Ontario hospital or clinic is usually the custodian's agent under section 17 of PHIPA. A vendor that only supplies electronic services is bound by O. Reg. 329/04 section 6(1), and a network provider serving several custodians owes the seven additional duties in section 6(3).
What is the difference between PHIPA and HIPAA?
PHIPA is an Ontario statute regulating health information custodians and their agents. HIPAA is a US federal law regulating covered entities and business associates. HIPAA requires a business associate agreement and sets a 60-day outer limit for breach notice. PHIPA leaves the agent agreement to the custodian and requires notice at the first reasonable opportunity.
Does PHIPA require data to be stored in Canada?
PHIPA has no general rule requiring personal health information to be stored in Ontario or Canada. Section 50 restricts when custodians may disclose PHI to a person outside Ontario. A hospital's own contract and policies can set where data is stored, so vendors should document where PHI is stored, processed, and supported from before the review starts.
What are the penalties for violating PHIPA?
On conviction for an offence, individuals face fines up to $200,000, up to one year in prison, or both, and organizations face fines up to $1,000,000. Since January 1, 2024, the IPC can also order administrative monetary penalties of up to $50,000 for individuals and $500,000 for organizations, plus any economic benefit gained.
Is a SOC 2 report enough for PHIPA compliance?
No. SOC 2 is a voluntary attestation that gives an Ontario hospital independent evidence of security controls and shortens the hospital's vendor review. PHIPA is law, and PHIPA vendor duties, such as permitted uses, breach notice to the custodian, and network provider disclosures, fall outside the scope of a SOC 2 report. A vendor selling to Ontario hospitals needs both.
Ready to Start Your Compliance Journey?
Get a clear, actionable roadmap with our readiness assessment.
Contact Us
Sample SOC 2 Control List
Input your email to download the list.
About the Author
Former security architect for Bank of Canada and Payments Canada. 20+ years building compliance programs for critical infrastructure.