PHIPA DECISION 266

A source contacted the Information and Privacy Commissioner of Ontario to report that a multi-disciplinary health clinic was disposing of records of personal health information in an unsecured manner in contravention of the Personal Health Information Protection Act, 2004 (the Act or PHIPA). The investigator finds that the clinic, as the health information custodian in this matter, was not in compliance with sections 10(1) (Information practices) and (2) (Duty to follow practices), 12(1) (Security) and 13(1) (Handling of records) of the Act. However, considering the measures applied in response to the breach, including the creation and implementation of privacy and security policies, practices, procedures and training, the investigator finds that an order is not warranted.