Showing 15 of 247 results
| Title | Topic | Type | Date | ||
|---|---|---|---|---|---|
| Interpretation Bulletin: Danger to Safety or Health | Interpretation Bulletins | Download | Read moreExpand | ||
| This interpretation bulletin discusses the threat to safety or health exemption, as set out in section 20 of the Freedom of Information and Protection of Privacy Act (FIPPA) and section 13 of the Municipal Freedom of Information and Protection of Privacy Act (MFIPPA). It outlines factors to consider in determining whether the threat to safety or health exemption applies. |
|||||
| Interpretation Bulletin: Information Available to the Public | Interpretation Bulletins | Download | Read moreExpand | ||
| This interpretation bulletin outlines the elements to consider when determining if a record falls under the published information or information available to the public exemption, as set out in section 22 of the Freedom of Information and Protection of Privacy Act (FIPPA) and section 15 of the Municipal Freedom of Information and Protection of Privacy Act (MFIPPA). |
|||||
| Interpretation Bulletin: Solicitor-Client Privilege | Interpretation Bulletins | Download | Read moreExpand | ||
| This interpretation bulletin addresses the solicitor-client privilege exemption, as set out in section 19 of the Freedom of Information and Protection of Privacy Act (FIPPA) and section 12 of the Municipal Freedom of Information and Protection of Privacy Act (MFIPPA). This document outlines the types of records that are exempted, specifically records subject to common law solicitor-client privilege (referred to as “branch one”) and those records that fall under statutory privilege (referred to as “branch two”). |
|||||
| Code of Procedure for Appeals Under FIPPA and MFIPPA | Professional Guidelines | Download | Read moreExpand | ||
| The updated Code of Procedure for appeals under the Freedom of Information and Protection of Privacy Act and the Municipal Freedom of Information and Protection of Privacy Act took effect on September 9, 2024. The IPC has also updated its Practice Directions under the new code which also take effect on the same date. For more information, please see our Code of Procedure section. |
|||||
| Reported Breach HR23-00282 | Case of Note , Letters | Download | Read moreExpand | ||
| A prescribed person under the Personal Health Information Protection Act reported a breach to the IPC regarding a cyberattack that involved the unauthorized copying of approximately 3.4 million individuals’ personal health information from the prescribed person’s secure file transfer server. The threat actors gained unauthorized access to the server by exploiting a zero-day vulnerability in the file transfer software, MOVEit, that was installed on this server. |
|||||
| Practice Direction #7 - Sharing of Representations | Practice Directions | Download | Read moreExpand | ||
| In effect September 9, 2024. |
|||||
| Practice Direction #6 - Affidavit and Other Evidence | Practice Directions | Download | Read moreExpand | ||
| In effect September 9, 2024. |
|||||
| Practice Direction #5 - Direction to Institutions When Making Representations | Practice Directions | Download | Read moreExpand | ||
| In effect September 9, 2024. |
|||||
| Fact Sheet: Guidelines for Parties Whose Commercial or Business Information is at Issue in an Appeal | Fact Sheets | Download | Read moreExpand | ||
| Formerly Practice Direction #4. Repealed as of September 9, 2024. |
|||||
| Fact Sheet: Guidelines for Individuals Whose Personal Information is at Issue in an Appeal | Fact Sheets | Download | Read moreExpand | ||
| Formerly Practice Direction #3. Repealed as of September 9, 2024. |
|||||
| Practice Direction #2 - Participating in a Written FIPPA or MFIPPA Inquiry | Practice Directions | Download | Read moreExpand | ||
| In effect September 9, 2024. |
|||||
| Practice Direction #1 - Providing Records to the IPC During an Appeal | Practice Directions | Download | Read moreExpand | ||
| In effect September 9, 2024. |
|||||
| Cyberattack response: Duty to notify individuals under PHIPA and CYFSA | Case of Note | Read moreExpand | |||
BackgroundThe following decisions involved different cyberattacks against four different organizations. Three involved health information custodians (HICs) subject to the Personal Health Information Protection Act (PHIPA), and the fourth involved a Children’s Aid Society subject to Part X of the Child, Youth and Family Services Act (CYFSA). In all four cases, the organizations took the position that there was no duty to notify affected individuals because there was no evidence that personal health information or personal information was taken (or exfiltrated) from their systems. The Office of... |
|||||
| Ensuring health data privacy: Insights from the UTOPIAN case | Case of Note | Read moreExpand | |||
Case of Note: PHIPA Decision 243IntroductionHealth information research plays a vital role in improving medical treatments and the quality of care. To conduct health research, researchers require access to personal health information, the collection and use of which is regulated under health privacy laws. However, health researchers in Ontario, dealing with this sensitive personal health information, must ensure that they adhere to the requirements of the Personal Health Information Protection Act (PHIPA). These requirements exist to protect such health information, while also allowing... |
|||||
| Ransomware reality: Case study in health care cybersecurity and recovery | Case of Note | Read moreExpand | |||
Case of Note: PHIPA Decision 249IntroductionUnfortunately, ransomware attacks are not an uncommon occurrence, especially in this era of rapidly advancing technologies. Bad actors use ransomware attacks to extract money and cause harm to others. As these types of attacks become increasingly common, health information custodians (HICs) should ensure that they have strong preventative measures in place to help minimize and prevent the risks of cybersecurity attacks. BackgroundFollowing detection of unusual activity on its systems in December 2022, a medical imaging clinic (the clinic) determined... |
|||||