Review and approval by the Information and Privacy Commissioner, mandated by PHIPA, of practices and procedures to protect the privacy of individuals whose personal health information the prescribed entity receives and to maintain the confidentiality of that information.