PHIPA Compliance Checklist for Ontario Clinics and Health Tech (2026)

A hospital privacy office sends your team a vendor questionnaire, and the fourth question asks whether you act as a health information custodian, an agent, or an electronic service provider under PHIPA. Nobody on the team is sure which box to tick, and the deal waits while someone goes looking for a PHIPA compliance checklist.

That is how most Ontario clinics and health tech companies meet this law. Not through the regulator, but through a contract, a hospital's privacy review, or a patient asking who else can see their chart. You are not behind. You are at the point where somebody needs the answer in writing.

Here is the part people get wrong

PHIPA does not give everyone the same duties. The Personal Health Information Protection Act, 2004 puts most of its obligations on the health information custodian. Section 3 lists who that is, starting with health care practitioners and the people who run a group practice, then hospitals, long-term care homes, pharmacies, laboratories and others, when they hold personal health information because of their work.

A company that handles that information for a custodian is usually something else. If it acts for the custodian and for the custodian's purposes, not its own, section 2 makes it an agent. If it supplies the technology the custodian uses, section 10(4) makes it an electronic service provider, with its own rules in O. Reg. 329/04. The two roles carry different duties.

So the first line of any PHIPA compliance checklist is not a control. It is your role. A family practice that runs its own electronic medical record is a custodian. A startup that hosts that record, builds the booking app, or runs the AI scribe is almost always working for a custodian, and its agreement with that custodian decides much of what it must do.

There is also no PHIPA certificate. No one issues one and no auditor can grant one. The test of whether you met the Act comes when the Information and Privacy Commissioner of Ontario asks to see your records.

The PHIPA compliance checklist for custodians

This part of the PHIPA compliance checklist is for clinics, practices and health organizations. Score each line implemented, partial or not started, and write beside it the record you would hand the Commissioner. If you cannot name the record, mark it not started, however good the practice is.

• A contact person: section 15 requires a custodian that is not an individual to designate one, who helps the custodian comply, informs agents of their duties, answers the public, handles access and correction requests, and receives complaints. Record: the designation and the published contact details.
• A written public statement: section 16 requires a statement, available to the public, that describes your information practices, how to reach the contact person, how to request access or correction, and how to complain to you and to the Commissioner. Record: the statement as posted, with its date.
• Information practices you actually follow: section 10 requires information practices that comply with the Act, and then requires you to comply with them. Record: the current policy set, its version history, and staff acknowledgements.
• Reasonable safeguards: section 12(1) requires steps "reasonable in the circumstances" to protect personal health information against theft, loss and unauthorized use or disclosure. Record: access lists, encryption settings, the device inventory, and the date of the last review.
• Agents under control: under section 17, you remain responsible for what your agents collect, use, disclose, keep or dispose of, and each agent must tell you at the first reasonable opportunity if information is stolen, lost, or used or disclosed without authority. Record: the agent list, signed agreements, and training records.
• Retention and secure disposal: section 13 requires records to be kept, transferred and disposed of securely, and information under an access request kept until the person has used every recourse. Record: the retention schedule and proof of disposal.
• A breach procedure with both notices in it: covered in the next section. Record: the procedure, the incident log, and copies of every notice sent.
• The annual breach statistics report: O. Reg. 329/04, section 6.4, requires a report to the Commissioner on or before March 1 each year, counting the previous calendar year's thefts, losses, and unauthorized uses and disclosures. Record: the submitted report and the internal log it came from.
• An access log, before the law makes it mandatory: section 10.1 would require custodians that use electronic systems to log everyone who viewed, handled or modified a record, and when. The e-Laws text shows it is not in force yet; it starts on a day to be named by proclamation. Keep one anyway. The IPC's guidance on unauthorized access already asks custodians to make sure every access to personal health information in electronic systems is logged, audited and monitored. Record: a sample log export and the date of the last review.

The PHIPA compliance checklist for health tech companies

This part of the PHIPA compliance checklist is for the companies that work for a custodian. Most of it ends up in your agreement with the clinic or hospital, so write it down before the questionnaire arrives.

• Your role, in writing: agent, electronic service provider, or health information network provider. Your agreement should say which, because the duties differ.
• Use the information only to provide the service: if you are a supplier and not an agent, O. Reg. 329/04, section 6(1), says you may use personal health information only as needed to provide the services, you may not disclose it, and your staff may access it only if they agree to the same limits. Record: a data flow diagram and the matching clause.
• Network provider duties, if two or more custodians share information through you: section 6(3) of the regulation adds seven duties. You notify each custodian of a breach at the first reasonable opportunity, describe your services and safeguards in plain language, publish that description and your policies, keep and provide access and transfer logs, give custodians a written threat, risk and privacy assessment, bind subcontractors to the same limits, and sign a written agreement with each custodian. Record: each one as a dated document.
• Notify the custodian fast: the custodian carries the duty to tell the patient, and it cannot do that if you tell it late. Record: the notification clause and your on call contact.
• Show where the data lives and who touches it: record the hosting region, every subprocessor and its location. See the residency question in the FAQ below.

If your product uses an AI model, for example a scribe that drafts visit notes, the same records question applies to its prompts and outputs. Our sister brand SecuritAI covers that side in its guide to AI governance in Canada.

The breach obligations most checklists get wrong

There are two notices, and they have different triggers.

The first goes to the patient. Section 12(2) requires a custodian to notify the individual at the first reasonable opportunity if their information is stolen, lost, or used or disclosed without authority, and to tell them they may complain to the Commissioner.

The second goes to the Commissioner, and only in the situations listed in O. Reg. 329/04, section 6.3. There are seven: use or disclosure by someone who knew or ought to have known it was unauthorized, theft, a further unauthorized use or disclosure after the first, a pattern of similar breaches, an event that must be reported to a regulatory College, one that would be reportable if the agent were a College member, and a significant breach judged by sensitivity, volume, the number of people affected, and whether more than one custodian or agent was involved.

Any PHIPA compliance checklist that treats these as one duty will miss half of them. A breach that does not meet the Commissioner test can still require a letter to the patient, and it still goes into the March 1 statistics. The IPC's page on reporting a privacy breach makes the same point, and its privacy breach protocol sets out the response in five steps, from implementing your protocol to investigation and remediation. For the detail of what to send, the IPC publishes Reporting a Privacy Breach to the IPC: Guidelines for the Health Sector.

The penalties are set in law, not left to guesswork. Under section 61.1 of the Act, the Commissioner can order an administrative penalty, and section 35 of O. Reg. 329/04 caps it at $50,000 for an individual and $500,000 for an organization. Separately, section 72 of the Act sets offense fines of up to $200,000 for an individual and up to $1,000,000 for an organization, and if a corporation commits an offense, every officer, member, employee or other agent who authorized it, or who could have prevented it and knowingly did not, is guilty of it too.

The fines are not the main cost. The main cost is the week your team spends rebuilding a record of who saw what, when it should have been one export.

So the gap is almost never legal

Clinics understand confidentiality better than any software vendor does. Where they get stuck is evidence. On the day a patient complains, they cannot produce the access record for that chart, the agreement with the vendor who hosts it, and the date staff last confirmed the privacy policy. PHIPA asks for reasonable steps, and the only way to show a step was reasonable is a record made at the time. A PHIPA compliance checklist is only as good as the records behind each line.

Being straight about our role

We are not auditors and we are not lawyers. We do not issue certificates, and no one can certify PHIPA compliance. What SecuritComply does is hold the controls and evidence behind this PHIPA compliance checklist in one place, next to PIPEDA compliance and the other frameworks you answer to, so the file exists before anyone asks for it. If your role under PHIPA is unclear, have a privacy lawyer confirm it first.

Built to save your team time and money: every control is tied to its evidence, so internal reviews can run shorter and your evidence is in order when a customer, insurer or regulator asks.

If you sell to clinics in the United States as well, our guide to HIPAA compliance for Canadian companies covers the American side. More checklists sit in our resources library, and you can see the PHIPA control set in a walkthrough.

Frequently asked questions

Is my health tech startup a health information custodian?

Usually not. A company that acts for a clinic or hospital, for that custodian's purposes, is its agent under section 2 of PHIPA. A company that supplies the technology is an electronic service provider under section 10(4). Your agreement and the way data flows decide which, so confirm it with counsel and write it down.

Do we have to report every privacy breach to the Commissioner?

No. The patient must be notified at the first reasonable opportunity under section 12(2). The Commissioner must be notified only in the seven situations in O. Reg. 329/04, section 6.3. Every breach still belongs in your incident log and in the annual statistics due March 1.

Does PHIPA require patient data to stay in Ontario or in Canada?

The Act has no rule that information must be stored in Ontario or in Canada. Section 50 does limit disclosing information collected in Ontario to a person outside Ontario. Whether hosting outside Ontario counts as a disclosure is a legal question, and many hospitals settle it by requiring Canadian hosting in their contracts. Check your agreement before you choose a cloud region.

Is the electronic audit log mandatory?

Not yet. Section 10.1 was added to the Act in 2020 but has not been proclaimed in force. When it is, custodians using electronic systems will need to log who viewed, handled or modified each record and when. The IPC already expects access to be logged and monitored, so most custodians keep the log now.

Is a PHIPA compliance checklist enough to prove compliance?

No. There is no PHIPA certificate, and a checklist proves nothing on its own. What the Commissioner looks at is the record behind each line: the agreement, the log, the notice, the report. Use the PHIPA compliance checklist above to find the missing records, then keep them current.

References

All links verified live and read against the cited text on October 23, 2026.

• Government of Ontario, e-Laws, Personal Health Information Protection Act, 2004, S.O. 2004, c. 3, Sched. A, sections 2, 3, 10, 10.1, 12, 13, 15, 16, 17, 50, 61.1 and 72
• Government of Ontario, e-Laws, O. Reg. 329/04, General, sections 6, 6.3, 6.4 and 35
• Information and Privacy Commissioner of Ontario, Report a privacy breach
• Information and Privacy Commissioner of Ontario, Privacy breach protocol
• Information and Privacy Commissioner of Ontario, Reporting a Privacy Breach to the IPC: Guidelines for the Health Sector
• Information and Privacy Commissioner of Ontario, Unauthorized access