The ‘Personal Health Information Protection Act’ (PHIPA) Comes Into Force

But Are Canadian Corporations Ready…? Ogilvy Renault examines PHIPA’s impact on business, and provides advice on the basic requirements and immediate to-do’s for Canadian corporations. Effective November 1, 2004, the provincial government will enforce the Personal Health Information Protection Act (PHIPA), which will impact the vast majority of Canadian companies and organizations with business operations in Ontario — in both the private and public sectors. The purpose of PHIPA is to protect the privacy of individuals and to maintain confidentiality and security of personal health information. PHIPA establishes a set of rules concerning the way in which individuals’ personal health information may be collected, used and disclosed by organizations, companies and their employees. An item of particular significance with PHIPA, is that individuals within an organization can be personally liable for a breach of the regulations. Penalties can be severe, with substantial fines. Individuals may face fines of up to $50,000, and corporations may face fines of up to $250,000. Most corporations come into contact with employees‚ personal health information, whether it’s on a day-to-day basis or just periodically or inadvertently. Consequently, the PHIPA will have wide implications for businesses in Ontario. In practical terms, PHIPA requires that all companies must be careful in dealing with all health-related information. The Act must be followed when, for example, dealing with the collection and distribution of employee health information in relation to an organization’s private health care insurance policy, or in relation to a doctor’s note to confirm the reason for absenteeism. However, the PHIPA regulations will have a significant impact on the day-to-day conduct of businesses and organizations within the healthcare sector that have dealings with sensitive health-related information, including; health insurance companies; pharmaceutical and research establishments; hospitals; care homes; medical practitioners; as well as private and public medical service providers. “PHIPA will affect most companies across Ontario, but its actual level of impact will obviously differ according to a company’s particular business operations, and the extent it deals with individual’s health information”, stated Russel Zinn, Ottawa-based Partner, Labour and Employment Law Group, Ogilvy Renault. “All organizations need to review their privacy policies and processes now to ensure they are compliant with the new regulations. But in particular, individuals and organizations within the healthcare sector will be required to undertake major process reviews to ensure they remain compliant with the PHIPA requirements on an on-going basis,” continued Mr. Zinn. PHIPA prohibits businesses from wilfully collecting, using or disclosing health information in contravention of the PHIPA guidelines: Obtaining or attempting to obtain health information under false pretensesKnowingly disposing of health records to avoid proving accessMisusing Ontario health card numbersObstructing the office of the Ontario Privacy Commissioner (or its delegates) in the performance of its oversight functionsDisciplining or harassing an individual who has alerted the Commissioner of an alleged contraventionFailing to comply with an order of the Commissioner Ogilvy Renault outlined some practical guidelines for all Ontario-based organizations to help them ensure they are compliant with the PHIPA regulations. The listed guidelines are applicable to all businesses and organizations with operations in Ontario. (Organizations within the healthcare sector are subject to additional regulations regarding the collection of health information). When using or disclosing any health-related information protected by the Act, organizations need to ensure: Consent is obtained from an individual before using or disclosing personal health information.The purpose of using or disclosing the personal information is explained to customers/employees before seeking consent.The information is then used or disclosed only for purposes that were agreed upon.Controls have been implemented to ensure that personal information is as accurate, complete and up-to-date as necessary for the purpose for which it is to be used.Information is not shared with other parties (including verbally), without appropriate consent.Notification is given to an individual at the first reasonable opportunity if information is stolen, lost or accessed by an unauthorized person.Effective implementation of the organization’s privacy policy is executed and reviewed regularly. In conclusion, Mr. Zinn commented, “PHIPA impacts organizations across Ontario, with serious penalties for organizations and individuals who fail to adhere to the regulations. To manage this risk, organizations immediately need to establish, implement and monitor information policies and procedures with the help of expert advice, which force the business to meet its obligations under PHIPA on a continued basis.”

COVID-19 Information Hub

The ‘Personal Health Information Protection Act’ (PHIPA) Comes Into Force

By:

Kelly Pickett

But Are Canadian Corporations Ready…?

Get your FREE trial now!

Already a subscriber?

Written By

Kelly Pickett

Share

Related Posts

Why Exit Interviews Matter

COVID-19 Vaccination and the Workplace

Strategies that Improve Staffing While Increasing Wellness

Get Started

About

© 2020 Your Workplace. All rights reserved. Your Workplace is a registered trademark of 1427509 Ontario Inc.

Whoa! Don't Go Yet