PHIPA compliance for developers building health apps in Ontario

Who PHIPA applies to

Ontario's Personal Health Information Protection Act, 2004 (PHIPA) is built around three roles. Which one you are decides your obligations.

• Health information custodian: the clinic, hospital, pharmacy, lab or practitioner that has custody or control of the information. Custodians carry the main duties, including security and breach notification.
• Agent: a person or company acting for the custodian, such as staff or a contractor who handles information on its behalf.
• Electronic service provider: a company that supplies services so a custodian can collect, use, modify, disclose, retain or dispose of information electronically. Most software vendors and hosting platforms sit here.

Whether a vendor is an agent or a service provider depends on the facts, so confirm your role with counsel before you sign a custodian contract.

What PHIPA requires of software providers

Under section 10(4) of PHIPA and section 6(1) of its general regulation, a company providing electronic services to a custodian must follow three rules:

• Do not use the health information except as necessary to provide the services.
• Do not disclose the health information.
• Do not let employees or anyone acting for you access the information unless they agree to the same restrictions.

If you connect two or more custodians

A health information network provider serves two or more custodians, mainly so they can share information with each other electronically. Section 6(3) of the regulation adds seven duties:

• Tell every affected custodian at the first reasonable opportunity if the provider misused the information or an unauthorized person accessed it.
• Give each custodian a plain-language description of the services and safeguards, suitable for sharing with patients.
• Publish that description, the policies that apply to the services, and a general description of the safeguards.
• On request, provide records of every access to the information (who and when) and every transfer (who, to whom, and when).
• Assess threats, vulnerabilities and risks to the information, and the privacy impact of the services, and give each custodian the written results.
• Make sure any third party helping deliver the services agrees to the same restrictions.
• Sign a written agreement with each custodian describing the services and the administrative, technical and physical safeguards.

Even if you are not a network provider, custodians increasingly ask for the same things in procurement. They make a sensible baseline for any health product.

Does PHIPA require data to stay in Canada?

No. The Information and Privacy Commissioner of Ontario (IPC) says so in its PHIPA FAQ:

"PHIPA does not require that personal health information be retained and stored in Ontario or Canada."

That is not the end of the question. Under section 12(1), the custodian must take reasonable steps to protect the information against theft, loss and unauthorized use or disclosure, and that duty follows the data to every vendor. Information held by a US company can also be compelled under US law. Our explainer onwhether the US CLOUD Act applies to data hosted in Canadacovers that risk.

Breach notification under PHIPA

If health information is stolen, lost, or used or disclosed without authority, section 12(2) requires the custodian to notify each affected person at the first reasonable opportunity, and to tell them they can complain to the IPC.

When the IPC must also be told

Section 6.3 of the regulation requires notice to the IPC when any of these apply:

• Someone used or disclosed the information knowing, or when they ought to have known, that they had no authority to.
• The information was stolen.
• After an initial breach, the information was or will be further used or disclosed without authority.
• The breach is part of a pattern of similar breaches.
• The breach must be, or would have to be, reported to a regulated health professional College.
• The breach is significant, considering sensitivity, volume, the number of people affected, and whether more than one custodian or agent was responsible.

Custodians also send the IPC an annual report of breach statistics by March 1 each year.

Ransomware counts, even without data theft

In PHIPA Decision 284, a ransomware attack on a shared technology provider hit five hospitals and a clinic. The custodians argued that encrypted, unstolen records did not need patient notices. The IPC disagreed: attackers encrypting health records is an unauthorized use and loss of the information, so patients must be notified. The IPC also stressed that custodians remain responsible for strong safeguards when they rely on third-party providers.

For a vendor, the lesson is practical: your incident plan must tell custodians quickly, with enough detail for them to meet their own notice duties.

Penalties

Offences include wilfully collecting, using or disclosing health information in breach of the Act. When a corporation commits an offence, officers and employees who authorized it, or could have stopped it and knowingly did not, can be convicted too.

Passed but not yet in force

Two 2020 amendments are law on paper but, according to Ontario e-Laws on October 1, 2026, not in force. Plan for them anyway.

• Electronic audit logs (s. 10.1): custodians using electronic systems will have to keep a log of every time a record is viewed, handled or modified, with the type of information, date and time, who accessed it, and whose information it was.
• Consumer electronic service providers (s. 54.1): rules for apps that individuals use to access and manage their own health information.

If your product already records who touched which record and when, the audit log rule will not catch you out.

A PHIPA checklist for developers

• Use patient data only to provide the service, and never disclose it.
• Bind every employee and contractor with access to the same limits, in writing.
• Encrypt data in transit and at rest, and decide who holds the keys.
• Enforce access control per user and per record, ideally in the database itself.
• Log every access to and transfer of health records: who, what, when, and to whom.
• Have a breach response plan that tells the custodian at the first reasonable opportunity, including for ransomware.
• Run a threat and risk assessment and a privacy impact assessment, and share the results with your customers.
• Keep a current list of subprocessors and where each one stores or processes data.
• Put it all in a written agreement with each custodian.

Frequently asked questions

Does PHIPA apply to my app?

If your software handles personal health information for an Ontario health information custodian, such as a clinic, hospital, pharmacy or practitioner, then yes: the custodian is bound by PHIPA and you are bound by the rules for providers. If individuals use your app on their own, outside any custodian relationship, the custodian rules generally do not apply, though federal privacy law may.

Can I store PHIPA data in a US cloud?

PHIPA itself allows it; it has no rule that data must stay in Ontario or Canada. The custodian is still responsible for protecting the information, and data held by a US company can be reached under US law such as the CLOUD Act. Many custodians weigh that risk in procurement.

Is PHIPA the same as HIPAA?

No. HIPAA is US federal law built around covered entities and business associates. PHIPA is Ontario law built around health information custodians, their agents and electronic service providers. Being HIPAA compliant does not make a product PHIPA compliant.

How does PHIPA relate to PIPEDA?

The federal government recognized PHIPA as substantially similar to PIPEDA, so for health information custodians in Ontario, PHIPA applies in place of PIPEDA for the collection, use and disclosure of personal health information within the province.

Is a ransomware attack a PHIPA breach if no data was stolen?

Yes. In PHIPA Decision 284, the IPC found that attackers encrypting health records is an unauthorized use and loss of the information, so patients must be notified even when nothing was exfiltrated.