PHIPA compliance for Ontario
health information custodians
PHIPA governs how Ontario health information custodians collect, use, and disclose personal health information. Valdra assesses your obligations, documents your safeguards, and keeps you IPC audit-ready — and goes further, covering 8 provincial health privacy acts so multi-province providers assess once.
Based on your answers, you may need a Privacy Impact Assessment under Law 25 §12.
of Canadian SMBs fail their first PIPEDA assessment
1 OPC SMB Compliance Survey, 2024
Start Free AssessmentAI guidance at every step.
As you answer each question, our Claude-powered AI explains the relevant statutory requirement in plain English, flags your risk level, and suggests remediation steps — so your team learns while they comply.
Request a demoFrom gap to resolved, automatically.
Every identified gap automatically creates a prioritized task with suggested remediation, assigned to the right team member. Track closure rates and demonstrate continuous improvement to your regulator.
Request a demoAdditional features
Request a demoFull PHIPA Coverage
Assesses your obligations as a health information custodian under Ontario's Personal Health Information Protection Act — consent, circle of care, the lockbox, and limiting use to what care requires.
8 Provincial Health Acts
Goes beyond PHIPA to cover Alberta's HIA, Nova Scotia's PHIA and other provincial health privacy acts, so multi-province health providers assess once instead of law-by-law.
Breach Protocol & IPC Reporting
Builds your PHIPA breach response — when to notify the affected individual and the Information and Privacy Commissioner of Ontario (IPC) — with ready-to-send letter templates.
Safeguards Documentation
Documents the administrative, technical, and physical safeguards PHIPA requires and generates audit-ready evidence the IPC will expect to see.
Agent & Service Provider Tracking
Tracks agreements with agents and electronic service providers who handle personal health information on your behalf, as PHIPA requires.
Consent & Circle of Care
Maps implied versus express consent and circle-of-care sharing so clinical workflows stay compliant without slowing patient care.
“We thought we were PIPEDA compliant until Canuckt's assessment found 7 critical gaps we'd never considered. The remediation roadmap paid for itself in the first week.
DCDavid ChenVP Legal & Compliance · Accord Financial Services
Frequently asked questions
What is PHIPA compliance?
PHIPA — Ontario's Personal Health Information Protection Act — governs how health information custodians collect, use, and disclose personal health information (PHI). Compliance means having lawful consent, the right safeguards, a breach-response process, and documented agreements with anyone who handles PHI on your behalf. Valdra assesses each obligation and generates the evidence the IPC expects.
Who has to comply with PHIPA?
Health information custodians in Ontario — including hospitals, clinics, physicians, dentists, pharmacists, long-term care homes, and many digital health vendors — plus the agents and electronic service providers acting on their behalf. If you collect or handle personal health information in Ontario, PHIPA applies to you.
When do I have to report a PHIPA privacy breach?
PHIPA requires you to notify affected individuals at the first reasonable opportunity when their PHI is lost, stolen, or accessed without authority. You must also notify the Information and Privacy Commissioner of Ontario (IPC) in defined circumstances, and track statistics for annual reporting. Valdra builds the breach record, scores the risk, and generates the IPC report and notification letters.
Does Valdra cover health privacy laws outside Ontario?
Yes. Beyond PHIPA, Valdra covers 8 provincial health privacy acts — including Alberta's HIA and Nova Scotia's PHIA — so health providers operating in more than one province assess once instead of law-by-law.
Learn more about Valdra
Get compliant and build trust
Join hundreds of Canadian organizations using Valdra to automate their privacy obligations — no consultants required.
🍁 Canadian data residency · PIPEDA compliant · SOC 2 in progress