If you are a regulated practitioner in Ontario providing health care, the statute treats you as a health information custodian in your own right — not as an employee of one. Its definition of "health care practitioner" covers "a person who is a member within the meaning of the Regulated Health Professions Act, 1991 and who provides health care" and "a person who is a member of the Ontario College of Social Workers and Social Service Workers and who provides health care" (PHIPA, s. 2). Section 3 then places "a health care practitioner or a person who operates a group practice of health care practitioners" first on the list of custodians.

Being a custodian sounds heavier than it is in a one-person practice. The obligations that actually bite are a short list, and most solo practitioners are already doing four of the six without calling them anything.

What follows is the statute's own language. It is not advice about your situation, and where it is unclear how a section applies to you, your College's practice advisory service and your liability insurer are the right places to ask.

Have information practices, and follow them

"A health information custodian that has custody or control of personal health information shall have in place information practices that comply with the requirements of this Act and its regulations," and "shall comply with its information practices" (s. 10(1)–(2)).

"Information practices" is defined in section 2 as the custodian's policy for "when, how and the purposes for which the custodian routinely collects, uses, modifies, discloses, retains or disposes of personal health information" plus the safeguards in place.

In a solo practice this is a written page, not a manual. The requirement that catches people is the second half: having a policy you do not follow is worse than the shape of the policy itself.

Publish a statement people can read

"A health information custodian shall, in a manner that is practical in the circumstances, make available to the public a written statement that... provides a general description of the custodian's information practices," describes how to contact you, describes how someone may "obtain access to or request correction of a record," and "describes how to make a complaint to the custodian and to the Commissioner" (s. 16(1)).

This is where the privacy page on a practice website comes from. Four elements, plainly stated.

Be the contact person, or name one

A custodian who is a natural person "may designate a contact person." One who does not "shall perform on his or her own" the functions of informing agents of their duties, responding to public inquiries, handling access and correction requests, and receiving complaints (s. 15).

For a solo practice that generally means you are it, which is fine — it just means the contact details on your privacy statement are yours.

Safeguard the information

"A health information custodian shall take steps that are reasonable in the circumstances to ensure that personal health information in the custodian's custody or control is protected against theft, loss and unauthorized use or disclosure and to ensure that the records containing the information are protected against unauthorized copying, modification or disposal" (s. 12(1)).

"Reasonable in the circumstances" is doing the work in that sentence. It scales to a one-room practice; it does not excuse an unlocked laptop.

Answer access and correction requests

An individual "has a right of access to a record of personal health information about the individual that is in the custody or under the control of a health information custodian," subject to listed exceptions (s. 52).

Correction requests carry a clock: "no later than 30 days after receiving a request for a correction," the custodian shall "grant or refuse the individual's request or extend the deadline for replying for a period of not more than 30 days" in the circumstances the section describes (s. 55(3)).

Notify when something goes wrong

If information "is stolen or lost or if it is used or disclosed without authority," the custodian shall "notify the individual at the first reasonable opportunity" and "include in the notice a statement that the individual is entitled to make a complaint to the Commissioner" (s. 12(2)).

Notification to the Commissioner is required only in the circumstances the regulation prescribes — seven of them, listed at O. Reg. 329/04, s. 6.3. There is also an annual count: "On or before March 1 in each year," a custodian "shall provide the Commissioner with a report setting out the number of times in the previous calendar year" that information was stolen, lost, or used or disclosed without authority (s. 6.4). The report is required whether or not the number is zero.

That last one surprises almost everybody. See what to do if you have a privacy breach.

When you use someone else's software

Section 17 makes you responsible for what your agents do with client information, and requires you to "take steps that are reasonable in the circumstances" to ensure they handle it properly, and to "remain responsible" for it regardless (s. 17(3)).

Whether a given vendor is your agent or an outside service provider changes which rules apply to them, and the regulation sets requirements for both. That distinction is worked through in what a data processing agreement is for.

What is not in force yet

The statute contains an electronic audit log provision, section 10.1, requiring a custodian using electronic means to maintain and monitor a log of every access. The consolidated text marks it "not in force." Worth knowing about; not yet something to comply with.

What "reasonable" means for a practice of one

That word carries most of the weight in the sections above, and the commissioner has said out loud that it scales:

"Note that the steps that are reasonable for a large hospital, with many agents sharing multiple health record systems, may differ from what is reasonable for a small community practice with one or two health care practitioners using one electronic medical record system."

— IPC, Avoiding Abandoned Health Records

That is the sentence most solo practitioners are looking for and rarely find in the regulator's own words. It is not permission to do less than you reasonably can. It is a statement that the standard is proportionate to the practice.

One thing it does not soften. Destruction stays an act rather than a lapse: "You must securely dispose of health records. For example, you should shred, rather than recycle, health records. When disposing of health records, ensure that it is not reasonably possible to reconstruct them. You also must adhere to any applicable retention periods before secure disposal."

Reading the sections yourself

The statute and its regulation are published in full by the province. If a section above matters to a decision you are making, open it and read the subsections around it — the exceptions are where the detail lives, and they are longer than the rules.

For how a section applies to your particular situation, your College's practice advisory service and your liability insurer are the two places that will answer. Neither charges for the call.

About Rivet

Rivet is a Canadian practice line built for therapists — a separate number for calls, texts and voicemail, with video sessions and clinical tools in the same place. Your data stays in Canada, and transcription runs on Rivet's own hardware rather than a third-party AI service.

One plan, $65 CAD a month, everything included. Fourteen-day trial, no card.

See what's included · Start the trial