When an Ontario clinic must report a privacy breach

YPK TECH · Published 16 September 2026

PHIPA, not PIPEDA

An Ontario clinic is a health information custodian under the Personal Health Information Protection Act. That is a different and stricter regime than PIPEDA, which covers commercial organisations generally, and it answers to the Information and Privacy Commissioner of Ontario. Compliance advice written for a general business will not cover what a custodian owes.

The patient is always told

On any theft, loss, or unauthorised use or disclosure of personal health information, the affected individual must be notified at the first reasonable opportunity, and the notice must tell them they may complain to the Commissioner. That duty does not depend on whether the incident also has to be reported to the IPC.

When the Commissioner must be told

Reporting to the IPC is mandatory in a defined set of circumstances rather than at your discretion:

• Information was stolen and was neither de-identified nor encrypted, which includes ransomware
• Someone used or disclosed information when they knew or should have known it was not permitted
• Information is further used or disclosed after the first incident
• There is a pattern of similar breaches, even where each one on its own looks minor
• A regulated professional is terminated, suspended, disciplined or resigns in connection with the breach
• The same happens to someone who is not a college member
• The breach is significant, judged on sensitivity, volume, how many people are affected, and whether more than one custodian is involved

Where a regulated health professional is disciplined or resigns in connection with a breach, their college must also be notified within 30 days.

The March 1 filing most clinics miss

Every custodian that had breaches in a calendar year must file breach statistics with the IPC by March 1 of the following year. The filing covers every incident, including ones that never met the threshold for immediate notification.

That obligation has a practical consequence that catches people out: you need a log of every privacy incident, however small, kept through the year. A clinic that only records the serious ones has nothing to file from.

What this means for your systems

Each of these duties assumes you can establish facts after the event. Which chart was opened, by which unique user, at what time, and whether the record was altered. That is an audit trail question, an access control question and a backup question before it is a legal one.

• A unique login per user, with no shared credentials, which the CPSO requires in its own right
• An audit trail that preserves the original content when a record is changed and can be printed separately
• Automatic backup with a copy held somewhere separate from the original, proven by an actual restore
• A written incident log covering every event, not only reportable ones
• A runbook that walks an incident against the seven triggers, so the reporting decision is evidenced

None of that is exotic. It is the ordinary standard of a well run clinic network, written down.

Talk this through with us