Guidance documents for organizations

This interpretation bulletin discusses the threat to safety or health exemption, as set out in section 20 of the Freedom of Information and Protection of Privacy Act (FIPPA) and section 13 of the Municipal Freedom of Information and Protection of Privacy Act (MFIPPA). It outlines factors to consider in determining whether the threat to safety or health exemption applies.

This interpretation bulletin outlines the elements to consider when determining if a record falls under the published information or information available to the public exemption, as set out in section 22 of the Freedom of Information and Protection of Privacy Act (FIPPA) and section 15 of the Municipal Freedom of Information and Protection of Privacy Act (MFIPPA).

This interpretation bulletin addresses the solicitor-client privilege exemption, as set out in section 19 of the Freedom of Information and Protection of Privacy Act (FIPPA) and section 12 of the Municipal Freedom of Information and Protection of Privacy Act (MFIPPA). This document outlines the types of records that are exempted, specifically records subject to common law solicitor-client privilege (referred to as “branch one”) and those records that fall under statutory privilege (referred to as “branch two”). 

The updated Code of Procedure for appeals under the Freedom of Information and Protection of Privacy Act and the Municipal Freedom of Information and Protection of Privacy Act took effect on September 9, 2024. The IPC has also updated its Practice Directions under the new code which also take effect on the same date. For more information, please see our Code of Procedure section.

A prescribed person under the Personal Health Information Protection Act reported a breach to the IPC regarding a cyberattack that involved the unauthorized copying of approximately 3.4 million individuals’ personal health information from the prescribed person’s secure file transfer server. The threat actors gained unauthorized access to the server by exploiting a zero-day vulnerability in the file transfer software, MOVEit, that was installed on this server.

In effect September 9, 2024.

In effect September 9, 2024.

In effect September 9, 2024.

Formerly Practice Direction #4. Repealed as of September 9, 2024. 

Formerly Practice Direction #3. Repealed as of September 9, 2024. 

In effect September 9, 2024.

In effect September 9, 2024.

Background

The following decisions involved different cyberattacks against four different organizations. Three involved health information custodians (HICs) subject to the Personal Health Information Protection Act (PHIPA), and the fourth involved a Children’s Aid Society subject to Part X of the Child, Youth and Family Services Act (CYFSA). In all four cases, the organizations took the position that there was no duty to notify affected individuals because there was no evidence that personal health information or personal information was taken (or exfiltrated) from their systems. The Office of...

Case of Note: PHIPA Decision 243 

Introduction

Health information research plays a vital role in improving medical treatments and the quality of care. To conduct health research, researchers require access to personal health information, the collection and use of which is regulated under health privacy laws. However, health researchers in Ontario, dealing with this sensitive personal health information, must ensure that they adhere to the requirements of the Personal Health Information Protection Act (PHIPA). These requirements exist to protect such health information, while also allowing...

Case of Note: PHIPA Decision 249

Introduction

Unfortunately, ransomware attacks are not an uncommon occurrence, especially in this era of rapidly advancing technologies. Bad actors use ransomware attacks to extract money and cause harm to others. As these types of attacks become increasingly common, health information custodians (HICs) should ensure that they have strong preventative measures in place to help minimize and prevent the risks of cybersecurity attacks. 

Background

Following detection of unusual activity on its systems in December 2022, a medical imaging clinic (the clinic) determined...