PHIPA compliance for Ontario
health information custodians
PHIPA governs how Ontario health information custodians collect, use, and disclose personal health information. Valdra assesses your obligations, documents your safeguards, and keeps you IPC audit-ready — and goes further, covering 8 provincial health privacy acts so multi-province providers assess once.
Based on your answers, you may need a Privacy Impact Assessment under Law 25 §12.
des PME canadiennes échouent à leur première évaluation LPRPDE
1 Sondage du CPVP sur la conformité des PME, 2024
Commencer l'évaluation gratuiteGuidance par IA à chaque étape.
À chaque question, notre IA propulsée par Claude explique l'exigence législative applicable en langage clair, évalue votre niveau de risque et propose des mesures correctives — votre équipe apprend tout en se conformant.
Demander une démoDe l'écart à la résolution, automatiquement.
Chaque écart identifié génère automatiquement une tâche priorisée avec une remédiation suggérée, assignée au bon membre de l'équipe. Suivez les taux de fermeture et démontrez l'amélioration continue à votre autorité de surveillance.
Demander une démoFonctionnalités supplémentaires
Demander une démoFull PHIPA Coverage
Assesses your obligations as a health information custodian under Ontario's Personal Health Information Protection Act — consent, circle of care, the lockbox, and limiting use to what care requires.
8 Provincial Health Acts
Goes beyond PHIPA to cover Alberta's HIA, Nova Scotia's PHIA and other provincial health privacy acts, so multi-province health providers assess once instead of law-by-law.
Breach Protocol & IPC Reporting
Builds your PHIPA breach response — when to notify the affected individual and the Information and Privacy Commissioner of Ontario (IPC) — with ready-to-send letter templates.
Safeguards Documentation
Documents the administrative, technical, and physical safeguards PHIPA requires and generates audit-ready evidence the IPC will expect to see.
Agent & Service Provider Tracking
Tracks agreements with agents and electronic service providers who handle personal health information on your behalf, as PHIPA requires.
Consent & Circle of Care
Maps implied versus express consent and circle-of-care sharing so clinical workflows stay compliant without slowing patient care.
“Nous pensions être conformes à la LPRPDE jusqu'à ce que l'évaluation de Canuckt identifie 7 lacunes critiques que nous n'avions jamais envisagées. La feuille de route de remédiation s'est rentabilisée dès la première semaine.
DCDavid ChenVP Affaires juridiques et conformité · Accord Services Financiers
Questions fréquentes
What is PHIPA compliance?
PHIPA — Ontario's Personal Health Information Protection Act — governs how health information custodians collect, use, and disclose personal health information (PHI). Compliance means having lawful consent, the right safeguards, a breach-response process, and documented agreements with anyone who handles PHI on your behalf. Valdra assesses each obligation and generates the evidence the IPC expects.
Who has to comply with PHIPA?
Health information custodians in Ontario — including hospitals, clinics, physicians, dentists, pharmacists, long-term care homes, and many digital health vendors — plus the agents and electronic service providers acting on their behalf. If you collect or handle personal health information in Ontario, PHIPA applies to you.
When do I have to report a PHIPA privacy breach?
PHIPA requires you to notify affected individuals at the first reasonable opportunity when their PHI is lost, stolen, or accessed without authority. You must also notify the Information and Privacy Commissioner of Ontario (IPC) in defined circumstances, and track statistics for annual reporting. Valdra builds the breach record, scores the risk, and generates the IPC report and notification letters.
Does Valdra cover health privacy laws outside Ontario?
Yes. Beyond PHIPA, Valdra covers 8 provincial health privacy acts — including Alberta's HIA and Nova Scotia's PHIA — so health providers operating in more than one province assess once instead of law-by-law.
En savoir plus sur Valdra
Devenez conforme et bâtissez la confiance
Rejoignez des centaines d'organisations canadiennes qui utilisent Valdra pour automatiser leurs obligations en matière de protection de la vie privée — sans consultants.
🍁 Données hébergées au Canada · Conforme LPRPDE · SOC 2 en cours