Privacy and vaccination status

Your vaccination status is considered to be personal health information under Ontario’s health privacy law, the Personal Health Information Protection Act, 2004 (PHIPA).

Our office was consulted on the Ontario Ministry of Health’s proposal to contact unvaccinated individuals to provide general information on COVID-19 vaccines and assist them in booking vaccination appointments if they request it.

PHIPA permits health information custodians, including the Ministry of Health, to use personal health information to plan or deliver programs or services that it provides or funds. The ministry has indicated that it is using personal health information to plan and deliver the COVID-19 vaccination program in accordance with its permissions and responsibilities under PHIPA. 

When an organization consults with the IPC about a proposal, we discuss potential risks to privacy and security related to the new proposal and give guidance about best practices to protect information and appropriately safeguard it to prevent breaches. Our goal is to help organizations understand their responsibilities under applicable privacy laws and address questions about complying with statutory access to information requirements or enhancing access to information.

While the Ministry of Health is authorized to use personal health information for planning or delivering the COVID-19 provincial vaccination program, ministry and public health staff must adhere to strict data minimization and security standards. For example, they should not leave a voicemail or message for someone containing personal health information.

Concerned individuals should seek additional information from the Ministry of Health about the specific steps it is taking to mitigate any privacy concerns while reaching out to individuals.

If an individual believes their personal health information has been handled improperly, they should call our office at 416-326-3333, submit a complaint online using our online complaint forms, or mail a complaint to our office.

The IPC oversees Ontario’s access and privacy laws. These laws establish the rules for how Ontario’s public institutions, health care providers, children’s aid societies, and other child and family service providers collect, use, and disclose personal information or personal health information. However, our oversight generally does not extend to employee/employer relationships of organizations that are subject to these laws. Also, the IPC does not have a mandate to oversee privacy in private sector employment relationships.

The Government of Ontario requires organizations operating in certain high-risk settings to have COVID-19 vaccination policies. These settings include public hospitals, home and community care services, and ambulance services. Employees, staff, contractors, volunteers and students in these settings must, at a minimum, either provide proof that they're fully vaccinated, provide written proof of a medical reason for non-vaccination, or complete a vaccination education session. Individuals who do not provide proof of full vaccination against COVID-19 will be required to undertake regular testing.

Many other employers are also implementing vaccination policies to encourage their employees to become vaccinated to protect their health and the health of the general public. While the policies vary, they generally require employees to disclose their vaccination status.

Implementing a mandatory vaccination policy to protect the health and safety of staff and the general public can affect individual privacy rights and have effects on civil liberties and labour and employment rights.

Employees who have concerns about a vaccination policy imposed at their workplace should seek the advice of legal counsel since, in some situations, the vaccination policy may be justified in the circumstances and the consequences of refusing to comply may be significant.

The Ontario government recently consulted on a potential private sector privacy law that could provide protections to employees of provincially regulated companies who have very little protection under the current privacy laws. The IPC was encouraged to see the government’s proposal for a law that would cover employees of provincially regulated businesses, as well as unions, charitable organizations, and professional associations whose non-commercial activities are currently unregulated.

The Ontario government has indicated that the Covid-19 vaccine will not be added to the list of mandatory immunizations for students at the present time.

However, during the current health crisis, the urgency of limiting the spread of the COVID-19 virus is a significant challenge for government and public health authorities and disclosure of a student’s vaccination status may be justified, for example, under the Reopening Ontario (A Flexible Response to COVID-19) Act, 2020 and its regulations, as well as other education and public health legislation.

Determining which students attending Ontario’s schools have been vaccinated against COVID-19 could allow public health officials to better support COVID-19 case, contact, and outbreak management, contributing to the safe return to schools and minimizing the spread of the virus in the community. To manage possible COVID-19 cases and outbreaks in schools, some school boards are collecting the vaccination status of students for specific health screening purposes. We also understand that some public health authorities are recommending mandatory vaccination status disclosure for secondary school students in the near future.

However, the possible effects on students’ privacy also need to be fully addressed. Any collection, use, and disclosure of personal health information must be subject to strong technical and administrative safeguards and comply with the Municipal Freedom of Information and Protection of Privacy Act (MFIPPA).

If an individual believes their personal information has been handled improperly, they can call our office at 416-326-3333, submit a complaint online using our online complaint forms, or mail a complaint to our office.