Three-year review and approval FAQs

The Personal Health Information Protection Act (PHIPA), Coroners Act, and Child, Youth and Family Services Act (CYFSA) permit entities, persons, and/or organizations to be prescribed (named in regulations under each Act) so that they may collect, use, and disclose personal information or personal health information for specific purposes.

A prescribed entity is authorized to collect, use, and disclose personal information or personal health information for specific purposes described in PHIPA, the Coroners Act, or the CYFSA. Purposes for which a prescribed entity may collect, use and disclose personal information or personal health information are summarized below.

Under PHIPA, prescribed entities may collect personal health information ^a without individuals’ consent from health information custodians (custodians) and use that information for analysis and compiling statistics in relation to the planning, management, allocation of resources to, and evaluation or monitoring of the health care system. Custodians, such as hospitals, medical laboratories, doctors, or pharmacists, can disclose personal health information to prescribed entities for this purpose. Prescribed entities can use personal health information only for the purpose it was provided, for research, or as required by law. Prescribed entities under PHIPA can generally only disclose personal health information to researchers, other prescribed entities under PHIPA, prescribed persons under PHIPA, or as required by law. Other permitted disclosures are set out in the regulations to PHIPA.

Under the Coroners Act, prescribed entities may collect personal information without individuals’ consent from the Chief Coroner and use it for the purpose of research, analysis, or the compilation of statistics related to the health or safety of the public, or any segment of the public. The Chief Coroner can disclose personal information collected under the Coroners Act to prescribed entities. Prescribed entities can use personal information only for the purpose it was provided, for research, or as required by law. Prescribed entities under the Coroners Act can disclose personal information to researchers or as required by law. They can also disclose personal information back to the Chief Coroner who originally provided it, even if it has been modified, as long as it does not include additional identifying information.

Under the CYFSA, prescribed entities may collect personal information^b without individuals’ consent from service providers and use that personal information for analysis and compiling statistics in relation to the planning, management, allocation of resources to, and evaluation or monitoring of services for children, youth, and families. Service providers under the CYFSA, such as children’s aid societies or Indigenous child and family well-being agencies, can disclose personal information to prescribed entities for this purpose.^c The Ministry of Children, Community and Social Services can also require a service provider to disclose personal information to a prescribed entity. Prescribed entities can use personal information only for the purpose it was provided, for research, or as required by law. Prescribed entities under the CYFSA can disclose personal information to researchers, other prescribed entities under the CYFSA, or as required by law.

Prescribed persons under PHIPA compile or maintain registries of personal health information to enable or improve the provision of health care. They can also compile or maintain registries of personal health information related to the storage or donation of body parts or bodily substances. Because they compile or maintain registries, prescribed persons are sometimes referred to as “prescribed registries.”

Most registries contain information about a specific disease or condition. For example, the Children’s Hospital of Eastern Ontario – Ottawa Children’s Treatment Centre maintains the Better Outcomes Registry and Network (BORN) – a registry that collects, interprets, and shares data about pregnancy, birth, and childhood in the province.

Custodians can disclose personal health information without individuals’ consent to prescribed persons for the purpose of compiling or maintaining their registries. Prescribed persons can use personal health information to compile or maintain their registries and for research.

Prescribed persons can disclose personal health information to enable or improve the provision of health care or for purposes related to the storage or donation of body parts or bodily substances. They can also disclose personal health information to researchers and prescribed entities. Other permitted disclosures are described in Part IV of PHIPA and its regulations.

A prescribed organization is responsible for developing and maintaining the provincial electronic health record (EHR). The EHR is the electronic systems developed and maintained by the prescribed organization to enable custodians to collect, use, and disclose personal health information.

To support those systems, the prescribed organization is required to:

• manage and integrate the personal health information it receives from custodians;
• ensure the proper functioning of the EHR;
• ensure the accuracy and quality of the personal health information in the EHR; and
• conduct analyses of the personal health information in the EHR in order to provide alerts and reminders to custodians for use in the provision of health care.

The Minister of Health may direct the prescribed organization to disclose personal health information from the EHR for specified purposes, such as research. Other permitted disclosures are described in Part V.1 of PHIPA and its regulations.

An entity or person interested in being a prescribed entity or prescribed person should contact the ministry responsible for the legislation under which they wish to be prescribed:

• The Ministry of Health is responsible for PHIPA.
• The Ministry of the Solicitor General is responsible for the Coroners Act.
• The Ministry of Children, Community and Social Services is responsible for the CYFSA.

An entity or person must be prescribed under the law before they can have their practices and procedures reviewed and approved by the IPC.

Contact the Ministry of Health for more information.

Prescribed entities, persons, and organizations must have their practices and procedures reviewed and approved by the IPC, initially and every three years thereafter. Prescribed entities, persons, and organizations seeking initial approval must submit their practices and procedures to the IPC for its review. The IPC reviews the practices and procedures to ensure that the prescribed entities, persons and organizations protect the privacy of individuals whose information they receive and maintain the confidentiality of that information.

After receiving the initial approval of the IPC, prescribed entities, persons, and organizations must have their practices and procedures reviewed and approved every three years, by the IPC to ensure that they continue to protect the privacy of individuals.

In the three-year review, the prescribed entity, person, or organization submits detailed documentation to the IPC reflecting its practices and procedures and compliance with applicable requirements. If the Commissioner approves, the IPC provides written confirmation that the entity, person, or organization continues to meet the requirements. If the Commissioner does not approve, the entity, person, or organization may not continue to operate under its authority as a prescribed entity, person, or organization.

Learn more about the review and approval process. Access documents related to previous reviews and approvals.

There are four prescribed entities under PHIPA:

• Canadian Institute for Health Information (CIHI);
• Institute for Clinical Evaluative Sciences (ICES);
• Ontario Health (in its role as the successor to Cancer Care Ontario); and
• Pediatric Oncology Group of Ontario (POGO).

There are five prescribed persons under PHIPA:

• Children’s Hospital of Eastern Ontario (CHEO) — Ottawa Children’s Treatment Centre in respect of the Better Outcomes Registry and Network (BORN);
• Hamilton Health Sciences Corporation (HHSC) in respect of the Critical Care Information System (CCIS);
• Inscyte (Information System for Cytology etc.) Corporation in respect of CytoBase;
• Ontario Health:
  • in respect of the Ontario Cancer Screening Registry (in its role as the successor to Cancer Care Ontario); and
  • in respect of its registry of cardiac and vascular services (in its role as the successor to CorHealth Ontario); and
• and
• Ontario Institute for Cancer Research (OICR) in respect of the Ontario Tumour Bank.

There is one prescribed organization under PHIPA: Ontario Health.

There are three prescribed entities under the Coroners Act:

• Canadian Institute for Health Information (CIHI);
• Cancer Care Ontario^d; and
• Institute for Clinical Evaluative Sciences (ICES).

Although these three entities have been prescribed, only ICES has initiated and completed a review under this Act. As of January 1, 2020, a prescribed entity under the Coroners Act may not collect personal information under its authority as a prescribed entity unless the Chief Coroner has entered into an agreement with the prescribed entity, and the prescribed entity has in place practices and procedures approved by the IPC.

There are two prescribed entities under the CYFSA:

• Canadian Institute for Health Information (CIHI); and
• Institute for Clinical Evaluative Sciences (ICES).

Although these entities have been prescribed, they have not initiated a review under the CYFSA. As of January 1, 2021, a prescribed entity under the CYFSA may not collect personal information under its authority as a prescribed entity unless it has in place practices and procedures approved by the IPC.