PHIPA (Personal Health Information Protection Act)

PHIPA, the Personal Health Information Protection Act, 2004 (S.O. 2004, c. 3, Sched. A), is Ontario’s health-sector-specific privacy law. It sits alongside, and partly displaces, Canada’s federal private-sector privacy law — see our guide to PIPEDA and academic research data for how the federal and provincial regimes divide jurisdiction. Ontario’s Cabinet has designated PHIPA “substantially similar” to PIPEDA for personal health information specifically, which is why a health researcher handling clinical data in Ontario generally looks to PHIPA rather than PIPEDA for that data, even though PIPEDA remains the applicable framework for the same institution’s general commercial personal information.

Who PHIPA Applies To

PHIPA regulates “health information custodians” — a defined term covering hospitals, independent health facilities, physicians and other regulated health professionals, pharmacies, laboratories, and similar organizations or individuals that have custody or control of personal health information as part of providing health care. A university department or research unit that is not itself providing health care is not usually a custodian in its own right; in practice, research access to clinical data flows through an agreement with the custodian (a hospital or health authority) that holds it, not through the researcher’s own institution.

The Research Provision (Section 44)

PHIPA’s research provision, generally cited as section 44, sets out a specific no-consent pathway for research use of personal health information — distinct from, and stricter than, PHIPA’s general rules for using data for direct patient care. To disclose personal health information to a researcher without the patient’s consent under this pathway, a custodian must confirm that:

• The researcher has submitted a written application, including a research plan that sets out the objectives of the research, the public or scientific benefit reasonably expected, the personal health information needed and why less identifiable information will not serve the purpose, and how the information will be safeguarded.
• The research plan has been reviewed and approved by a research ethics board (REB) — see our term on the Research Ethics Board (REB) for what that review generally covers.
• The researcher and the custodian have entered into a written research agreement that binds the researcher to the terms of the approved research plan, restricts further use or disclosure of the data, and sets requirements for security safeguards and for returning or securely destroying the data once the research concludes.

This is a use-and-disclosure mechanism, not a substitute for research ethics review generally — a study relying on the section 44 pathway still needs REB approval on the same footing as any other human-participant or human-data research conducted in Ontario; PHIPA does not create a separate, lower ethics bar. Where a study instead collects new information directly from participants with informed consent, the section 44 no-consent pathway is not the applicable mechanism at all — consent-based collection proceeds under PHIPA’s general rules, not its research-specific exception.

PHIPA Is Ontario-Specific

PHIPA applies only to health information custodians operating in Ontario. Other provinces have their own, differently-worded health-privacy statutes — New Brunswick’s Personal Health Information Privacy and Access Act, Newfoundland and Labrador’s Personal Health Information Act, and Nova Scotia’s Personal Health Information Act among them — and a multi-jurisdictional study spanning several provinces needs to identify the correct custodian-level statute for each site rather than assuming PHIPA’s research pathway applies everywhere. A province without health-information-specific legislation typically leaves health data governed by its general private-sector law (or by PIPEDA directly), which will have its own, often less research-specific, consent and disclosure rules.

Frequently Asked Questions

Does PHIPA apply outside Ontario?
No. PHIPA is Ontario provincial legislation. Other provinces have their own health-privacy statutes, and a multi-site study needs to check the applicable law at each participating institution rather than assuming PHIPA’s rules travel with the data.

Does PHIPA’s research provision replace the need for REB approval?
No. REB approval of the research plan is one of the explicit requirements for using PHIPA’s no-consent research disclosure pathway, not an alternative to it.

Who counts as a health information custodian under PHIPA?
Hospitals, physicians and other regulated health professionals, pharmacies, laboratories, and similar bodies with custody or control of personal health information gathered in the course of providing health care. A university research office is not typically a custodian in its own right; access to custodian-held clinical data for research runs through an agreement with the custodian.