Last verified: October 23, 2026, against the Personal Health Information Protection Act, 2004 and O. Reg. 329/04 on Ontario's e-Laws. General information, not legal advice. Provincial rules vary; confirm with your privacy officer or counsel.
PHIPA, Ontario's Personal Health Information Protection Act, 2004, decides what an Ontario clinic may do with patient information on its website, in its inbox and in its marketing. Its bluntest rule is short: no marketing with personal health information without the patient's express consent. This page turns the statute into decisions about forms, chat, email, vendors and breaches.
Ontario clinics look this up constantly. "phipa" gets about 5,400 searches a month in Canada, "phipa ontario" 1,600 and "phipa compliance" 170 (Google Ads Keyword Planner data via DataForSEO, Canada, 12-month average to Sep 2026).
Who PHIPA covers: custodians, agents and service providers
PHIPA puts duties on health information custodians. Section 3(1) lists them, starting with "a health care practitioner or a person who operates a group practice of health care practitioners." Hospitals, pharmacies, labs and long-term care homes are on the list too. Section 2 defines a health care practitioner to include members of colleges under the Regulated Health Professions Act, 1991 who provide health care, so a physician, dentist, physiotherapist or other regulated practitioner in private practice is a custodian, and so is whoever operates a group practice.
Everyone else in the chain is defined by their relationship to the custodian:
| Role | Who it usually is | What PHIPA says |
|---|---|---|
| Custodian | The practitioner or group practice operator | Responsible for PHI in its custody or control (s. 17) |
| Agent | Staff, a contracted office manager, a firm acting for the clinic | Acts for the custodian, for the custodian's purposes, "whether or not the agent is employed" or paid (s. 2) |
| Electronic service provider | A vendor whose systems let the clinic collect, store or send PHI electronically | Must follow prescribed limits (s. 10(4) and O. Reg. 329/04, s. 6) |
| Contact person | The person who answers privacy questions | Required for custodians that aren't natural persons (s. 15) |
Section 17(1) lets a custodian permit agents to handle personal health information only if the custodian itself may do so, the handling is necessary for the agent's duties, and any prescribed requirements are met.
PHIPA covers health information. A general newsletter list that holds no health information falls under the federal PIPEDA instead. The OPC lists PHIPA as substantially similar to PIPEDA for health information. Practising outside Ontario? Healthcare marketing in Canada maps each province.
Personal health information on your website
Section 4(1) defines personal health information as identifying information that relates to a person's physical or mental health or "relates to the providing of health care to the individual, including the identification of a person as a provider of health care to the individual." Identifying means the information could reasonably be used, alone or with other information, to identify someone (s. 4(2)).
That second clause is the one websites trip over. The fact that someone is your patient is personal health information, even without a diagnosis. So:
- A "request an appointment" submission with a name and phone number is PHI the moment your clinic receives it.
- A reply to an online review that confirms the reviewer was seen at your clinic discloses PHI.
- A testimonial with a patient's name or photo discloses PHI and needs consent.
Two more rules shape what your site collects. Section 30(1) says a custodian shall not collect, use or disclose PHI "if other information will serve the purpose." Section 16 requires a written public statement describing your information practices, how to reach your contact person, how to request access or correction, and how to complain to the custodian and to the Information and Privacy Commissioner of Ontario (the IPC). A privacy page on your website is the natural place for it.
Marketing and fundraising: when express consent is needed
Marketing (s. 33). "A health information custodian shall not collect, use or disclose personal health information about an individual for the purpose of marketing anything or for the purpose of market research unless the individual expressly consents." Implied consent doesn't work here, and neither does an unchecked assumption that patients want to hear from you.
O. Reg. 329/04, section 1(2), carves out one narrow case: "marketing" doesn't include a practitioner who provides OHIP-insured services telling patients about an arrangement to receive uninsured services for a block fee or set fee.
Fundraising (s. 32). Fundraising with PHI needs express consent, or implied consent where the information is only the person's name and prescribed contact details.
Elements of consent (s. 18). Consent must be the person's own, knowledgeable, related to the information, and "not obtained through deception or coercion." Knowledgeable means the person knows the purpose and that they can say no.
Illustrative example (compliant): The new-patient form for a fictional Toronto physiotherapy clinic has an unchecked box: "Send me occasional emails about new services and clinic news. You can unsubscribe at any time." Only patients who tick it go on the newsletter list.
Illustrative example (non-compliant): The same clinic exports every patient seen for knee pain from its EMR and emails them an ad for a new bracing service. That uses PHI (who is a patient, and for what) for marketing without express consent.
Express consent under PHIPA and consent under the federal anti-spam law are separate tests. A promotional email to patients usually has to pass both.
Forms, chat and email with patients
Treat every channel a patient can type into as a place PHI will arrive, whatever the form says.
- Contact and booking forms. Ask only what a callback needs. Put a plain notice of purpose beside the button (s. 18(6) lets a posted notice support a reasonable belief that people know your purposes). Keep submissions out of general marketing tools.
- Chat widgets. Say before the first message that the conversation is stored and who reads it. A chat log that names a symptom is PHI.
- Email. Replying to a patient who emailed you is a care communication; adding them to a promotional list is marketing under s. 33.
- Analytics and ad pixels. Section 18(3) requires express consent for a custodian to disclose PHI to someone who isn't a custodian. A pixel that sends an ad platform the identifiers of people who submitted an appointment request can amount to exactly that. Keep pixels and session recording off forms, booking pages and thank-you pages.
Vendors and electronic service providers
Your form tool, email platform, CRM and website host may all touch PHI. PHIPA handles them in two ways.
If a vendor acts on your behalf with PHI, it is an agent, and section 17 applies: you set the conditions, and its handling counts as yours.
If a vendor only supplies the electronic means and isn't your agent, section 10(4) and O. Reg. 329/04, section 6(1) bind it directly. It may not use PHI "except as necessary in the course of providing the services," may not disclose PHI it can access, and may not let employees or subcontractors access PHI unless they agree to the same restrictions.
Either way, put it in writing. A vendor agreement should cover where data is stored, who can access it, how you'll be told of a breach, and deletion when you leave. Section 50 limits when a custodian may disclose PHI collected in Ontario to a person outside Ontario, so ask where patient data is hosted before you sign.
Medfy's facts, without a legal label: for Canadian practices, patient information from forms, chat and the CRM is stored in a separate, encrypted Canadian database, and ad platforms never receive patient data. Medfy's patient-data safeguards covers encryption, role-based access and the audit log. If you're comparing against US vendors, HIPAA vs PHIPA explains why a US BAA isn't a PHIPA agreement.
Privacy breaches: notice and reporting to the IPC
Safeguards (s. 12(1)). Custodians must take reasonable steps to protect PHI "against theft, loss and unauthorized use or disclosure."
Notice to the patient (s. 12(2)). If PHI is stolen, lost, or used or disclosed without authority, the custodian must notify the individual "at the first reasonable opportunity" and tell them they can complain to the Commissioner.
Report to the IPC (s. 12(3) and O. Reg. 329/04, s. 6.3). You must notify the Commissioner at the first reasonable opportunity in seven situations:
- Someone used or disclosed PHI without authority knowing, or when they ought to have known, they weren't allowed.
- PHI was stolen.
- After an initial loss or unauthorized use or disclosure, the PHI was or will be further used or disclosed without authority.
- The breach is part of a pattern of similar breaches.
- You must notify a regulatory college about a related event (s. 17.1).
- You would have to notify a college if the agent involved were a member.
- The breach is significant, considering its sensitivity, volume, the number of people affected, and whether more than one custodian or agent was responsible.
Annual statistics (O. Reg. 329/04, s. 6.4). By March 1 each year, custodians report to the Commissioner the number of times in the previous calendar year that PHI was stolen, lost, used without authority or disclosed without authority.
PHIPA also allows the Commissioner to order administrative penalties (s. 61.1), and wilful contraventions are offences (s. 72).
Illustrative example: A receptionist emails a list of upcoming appointments to a personal account to work from home, and the account is later compromised. The clinic notifies each patient, reports to the IPC (the information was likely further disclosed), and counts the incident in its March 1 report.
Want to see what your public pages reveal first? A free marketing audit flags ad pixels on patient forms. Clinics with Alberta locations should also read Alberta's Health Information Act, which works differently.
This is general information, not legal advice. Confirm how it applies to your practice with a qualified advisor.
Frequently asked questions
Does PHIPA apply to private clinics in Ontario?
Yes. PHIPA's list of health information custodians starts with "a health care practitioner or a person who operates a group practice of health care practitioners," which covers private physician, dental, physiotherapy and other regulated clinics. The custodian is responsible for personal health information in its custody or control, including what staff and vendors do with it. Personal information that isn't health information, such as a general newsletter list, is covered by PIPEDA instead.
Do Ontario clinics need consent to send marketing emails to patients?
Yes. Section 33 of PHIPA bars using personal health information for marketing unless the patient expressly consents, and knowing someone is your patient counts as personal health information. Use a separate, unchecked opt-in rather than relying on implied consent. The federal anti-spam law applies on top of PHIPA, so each promotional email also needs your clinic's identification and a working unsubscribe link.
Is a clinic's website contact form covered by PHIPA?
Usually, yes. Once a custodian receives a submission that identifies someone and relates to their health or to getting care from you, such as an appointment request, it is personal health information. Collect only what a callback needs, explain the purpose next to the form, keep tracking pixels off the form and thank-you page, and store submissions in a system with access controls and a written vendor agreement.
Who do I report a PHIPA privacy breach to?
Notify each affected patient at the first reasonable opportunity and tell them they can complain to the Information and Privacy Commissioner of Ontario. Report to the Commissioner as well when the breach meets one of the seven circumstances in O. Reg. 329/04, such as theft, a pattern of breaches or a significant breach. Every breach also goes into the annual statistical report due by March 1.