What PHIPA Means for a Clinic's IT, in Plain Language

PHIPA is Ontario law, not the American HIPAA

Ontario clinics are governed by the Personal Health Information Protection Act, PHIPA, which is provincial legislation overseen by the Information and Privacy Commissioner of Ontario. It is not the same statute as the American HIPAA law, and vendors who market 'HIPAA compliant' software are referencing a different jurisdiction's rules entirely. A clinic's obligations run through PHIPA and through the custodian's own professional college where applicable.

None of this is legal advice, and a real question about how PHIPA applies to a specific practice should go to a lawyer or to the IPC's own guidance, not to an IT provider.

The 'reasonable safeguards' requirement, translated

PHIPA requires custodians to protect personal health information against theft, loss, and unauthorized use with safeguards that are administrative, technical, and physical. In practice, for a clinic's IT environment, that tends to translate into a fairly consistent list of controls.

• Multi-factor authentication on every account that can reach patient information
• Encrypted devices, so a lost or stolen laptop does not expose a full patient database
• Role-based access, so front-desk staff and clinicians see only what their role requires
• Endpoint protection and monitoring on every workstation and server
• Backups that are tested and immutable, not just scheduled
• A written incident response plan naming real people and phone numbers

Access logging: knowing who looked at what

One safeguard that surprises a lot of practice owners is access logging. If a chart is accessed inappropriately, whether by a curious employee or an external attacker, the practice needs to be able to answer 'who saw this record, and when?' That answer has to come from somewhere.

Most modern EMR and practice-management platforms keep their own access logs inside the application itself, which is separate from anything the IT environment tracks. The infrastructure side, meaning file servers, VPN access, and remote desktop sessions, needs its own logging so a full picture exists if a privacy complaint or IPC inquiry ever requires one. This is a good example of the boundary between application-level controls the software vendor owns and infrastructure-level controls the IT provider is responsible for.

Breach notification, in general terms

PHIPA requires a custodian to notify affected individuals if personal health information is stolen, lost, or accessed without authorization, and in some circumstances to notify the IPC as well. The specific triggers and thresholds for notification are legal questions, and a clinic that suspects a real breach has occurred should get legal advice quickly rather than relying on general guidance like this article.

Where IT support fits into that process is narrower than people expect: identifying what happened technically, when it happened, what data was potentially exposed, and preserving evidence, so the custodian and their legal counsel have the facts needed to make the notification decision. The IT provider does not make the legal call on whether or how to notify.

Where an IT provider fits, and where it doesn't

No IT company can legitimately certify a clinic as 'PHIPA compliant'. Compliance is a legal determination that ultimately rests with the Health Information Custodian, informed by their own legal counsel. What an IT provider can do is implement and document the operational safeguards described above, so there is real evidence to point to when a College, an insurer, or the IPC asks what was in place at the time of an incident.

This distinction matters most at cyber-insurance renewal time. Insurers ask specific technical questions about MFA coverage, backup testing, and endpoint protection, and a clinic with documented answers gets through underwriting faster than one guessing at the form.

How this connects to EMR support, backups, and ransomware planning

PHIPA safeguards do not live in isolation. The workstations and network running a clinic's EMR or EHR system are covered in more detail in our article on EMR and EHR IT support for clinics, and the backup side of PHIPA safeguards is covered in dental imaging storage and backup for practices that manage large imaging files. For practices thinking through worst-case scenarios, clinic ransomware preparedness walks through downtime procedures and recovery planning specifically for small clinics.

Sources and further reading

• Information and Privacy Commissioner of Ontario, PHIPA guidance

Frequently asked questions