Health Privacy Breach Statistical Report FAQ

Yes, if you are both a health information custodian and a FIPPA/MFIPPA institution whether you have experienced health breaches or not.

Yes, if you are a health information custodian and have experienced health breaches.

No, if you are a health information custodian and have experienced 0 (zero) breaches.

Note for coroners to whom Ontario Health provides personal health information that is accessible by means of the electronic health record: the requirement to submit a health privacy breach statistics report applies, with any necessary modification, to such coroners as if they were health information custodians.

You must submit your report online at https://statistics.ipc.on.ca.

Use the workbook and guide posted on the statistics website. It has all the instructions for submitting your health privacy breach statistics.

• Also see: How to Register and Submit Your Annual Health Information Breach Statistics

All reports must be submitted by Friday, March 1, 2024.

No. Fax or mailed copies will not be accepted. The questionnaire must be filled out online at statistics.ipc.on.ca.

Visit our Registration for Statistical Reporting page to set up an account and get a login id and a password. You will need to include:

• the name of your organization
• the name and e-mail address of the head of the organization
• the name, mailing address, e-mail address, and telephone number of the person responsible for completing the report (the primary contact)
• your language preference (English or Français)

Once you have started the questionnaire, you can log off the system at any time and it will remember where you left when you log on the next time. This means you do not have to complete and submit your questionnaire all in one session as long as you complete and submit it on or before Friday, March 1, 2024.

Not necessarily.

You have three options for logging in:

1. Use a single login id and password to submit your FIPPA/MFIPPA report, your PHIPA access report, and your PHIPA privacy breach statistics report. Having a single login id and password is convenient if the same person will be submitting all three reports.
2. One login id and password for FIPPA/MFIPPA and a second login id and password for the two PHIPA reports.
3. Separate logins and passwords for each of the three reports.

The option you choose all depends on the structure of your institution and how you assign statistics reporting. Please indicate in your email to the IPC whether you want a single login id set or two or three separate ones.

No. If a health information custodian is only subject to PHIPA and has no breaches to report, then it doesn’t need to submit a breach statistics report.

Yes, however in this case you only need to complete part one of the breach statistics report.

That depends on who is the health information custodian. If your institution is the health information custodian, then the institution submits the report. Alternatively, if the health care practitioner is the custodian, then they would have to submit a report separately, but only if they have experienced one or more breaches.

You would report the breach once, under the category that best fits the circumstances of the breach.

No, you do not have to report on those kinds of incidents in the annual statistics report.

As a rule of thumb, anything that required notice to a patient under subsection 12(2) or clause 55.5(7)(a) of PHIPA (or for coroners, clause 18.10(4)(a) of the Regulation) should be included in the statistical report, even if you did not need to report it to the IPC under the Regulation.

The IPC does not release a preview of its annual report to institutions or health information custodians before it is published.

No. The IPC’s annual report will only include statistics related to categories of institutions and health information custodians and types and numbers of health privacy breaches.

If you have any questions, please email @email or call 416-326-3333 (Toronto) or toll-free at 1-800-387-0073.