Applications Now Closed

Privacy Policy Ontario Health Data Platform

About the Ontario Health Data Platform

The Ministry of Health is a designated health information custodian pursuant to subsection 3(1)7 of the Personal Health Information Protection Act, 2004 and is the executive sponsor of the Ontario Health Data Platform.

On July 30, 2020, section 18 of O. Reg. 329/04 under the Personal Health Information Protection Act, 2004 was amended in order to require the Institute for Clinical Evaluative Sciences and Ontario Health as Prescribed Entities under the Personal Health Information Protection Act, 2004 to disclose personal health information to the Ministry of Health for the purposes of the Ontario Health Data Platform. The amendments provide:

  • 18(11) Despite subsection 45(6) and subject to subsection 12, the Institute for Clinical Evaluative Sciences and Ontario Health shall, upon the request of the Minister, disclose personal health information to the Minister where the Minister has determined that such disclosure is necessary for the purposes of,
  • (a) researching, analyzing, investigating, preventing, responding to, or alleviating COVID-19 or its effects; or
  • (b) evaluating or monitoring the impact of COVID-19 on the management of, the allocation of resources to or planning for all or part of the health system.
  • 18(12) The Institute for Clinical Evaluative Sciences and Ontario Health are not required to disclose personal health information under subsection (11) if the disclosure is otherwise prohibited by law or by the terms of an agreement to which the Institute for Clinical Evaluative Sciences or Ontario Health, as applicable, is a party.

The amendments to the regulation are temporary and are scheduled to be revoked July 30, 2022.

What is Personal Health Information?

Ontario’s Personal Health Information Protection Act, 2004 states that “personal health information” is identifying information about an individual in oral or recorded form, if the information,

  1. Relates to the physical or mental health of the individual, including information that consists of the health history of the individual’s family,
  2. Relates to the providing of health care to the individual, including the identification of a person as a provider of health care to the individual,
  3. Is a plan of service within the meaning of the Long-Term Care Act, 1994 for the individual,
  4. Relates to payments or eligibility for health care in respect of the individual,
  5. Relates to the donation by the individual of any body part or bodily substance of the individual or is derived from the testing or examination of any such body part or bodily substance,
  6. Is the individual’s health number, or
  7. Identifies an individual’s substitute decision-maker.

About this Policy

This policy describes the principles and practices relating to the collection, use, disclosure and protection of personal health information for Ontario’s Health Data Platform.

The principles and policies set forth in this policy are guided by the ten principles articulated by the Canadian Standards Association in its Model Code for the Protection of Personal Information. The principles are:

  1. Accountability
  2. Identifying Purposes
  3. Consent
  4. Limiting Collection
  5. Limited Use, Disclosure, and Retention
  6. Accuracy
  7. Safeguards
  8. Openness
  9. Individual Access
  10. Challenging Compliance

This policy discusses each of these principles individually as they apply to personal health information under the custody or control of the Ministry of Health for the Ontario Health Data Platform.

Principles & Practices

Principle 1 - Accountability

The Ministry of Health is responsible for all personal health information under its custody or control that is collected, used and disclosed for the purposes of the Ontario Health Data Platform. Persons or organizations to which the Ministry of Health discloses personal health information in accordance with the provisions of the Personal Health Information Protection Act, 2004, are responsible for maintaining the privacy and confidentiality of the disclosed personal health information.

The Ministry of Health uses written contractual agreements and confidentiality agreements to ensure that personal health information that is used by or disclosed to persons or organizations in accordance with the provisions of the Personal Health Information Protection Act, 2004, is protected in a manner consistent with these principles and policies.

The Ministry of Health is responsible for ensuring that the activities of the Ontario Health Data Platform are conducted in accordance with these principles and policies and in accordance with the Personal Health Information Protection Act, 2004. The Ministry of Health is accountable to the Minister of Health and to the Information and Privacy Commissioner of Ontario with respect to matters of privacy for the Ontario Health Data Platform. The Ministry of Health has designated a person to act as Privacy Officer to oversee the compliance with these principles and policies for the Ontario Health Data Platform and with the Personal Health Information Protection Act, 2004.

The Ministry of Health may designate a third party to act as Agent for the Ministry in carrying out day-to-day work with respect to operating and maintaining the Ontario Health Data Platform. In this case the Agent is required to execute a written contractual agreement with the Ministry of Health that sets out the terms and conditions of the agency and includes the requirement that the Agent and the Agent’s personnel abide by these principles and policies and with the obligations imposed by the Personal Health Information Protection Act, 2004.

The Ministry of Health ensures that policies and procedures are in place to give effect to the principles of:

  1. Protection of personal health information
  2. Orientation and training with respect to the policies and procedures, as well as reinforcing awareness of privacy and confidentiality issues on a regular basis
  3. Receiving and responding to complaints and inquiries
  4. Developing and disseminating clear and accurate information regarding the policies and procedures for the Ontario Health Data Platform

Principle 2 - Identifying Purposes

The Ministry of Health identifies the purposes for which it collects and uses personal health information before the personal health information is collected and ensures that such collections are permitted by the Personal Health Information Protection Act, 2004.

The Ministry of Health collects personal health information from the Institute for Clinical Evaluative Sciences and/or Ontario Health, prescribed entities under section 18 of O. Reg. 329/04 in accordance with section 18(11) of O. Regulation 329/04 under the Personal Health Information Protection Act, 2004.

The personal health information is used for the purposes of O. Reg. 329/04 under the Personal Health Information Protection Act for (a) researching, analyzing, investigating, preventing, responding to or alleviating COVID-19 or its effects; or (b) evaluating or monitoring the impact of COVID-19 on the management of, the allocation of resources to or planning for all or part of the health system.

Any other purpose for the use of personal health information shall be identified and described and a determination shall be made that the use is permitted by the Personal Health Information Protection Act, 2004, prior to using personal health information for the new purpose.

The Ministry of Health publishes information regarding the use of personal health information for the purpose of the Ontario Health Data Platform on the public website at ohdp.ca and provides printed material upon request.

Principle 3 - Consent

In accordance with the temporary regulation under the Personal Health Information Protection Act, 2004, the Ministry of Health is not required to obtain individual patient consent for the collection of personal health information or for the use and disclosure of personal health information for the purposes under section 18(11) of Ontario Reg. 329/04.

In the event that personal health information is disclosed for research purposes, the disclosure shall be made in accordance with the provisions of section 44 of the Personal Health Information Protection Act, 2004 and section 16 of O. Reg. 329/04.

The Ministry of Health acknowledges that individuals whose personal health information is collected through the Ontario Health Data Platform are entitled to receive notice about the types of personal health information collected, the purposes for which it is used and how it is disclosed. The Ministry of Health publishes this information on a public website at ohdp.ca and provides printed materials upon request.

Principle 4 - Limiting Collection

The Ministry of Health limits the amount and types of personal health information that it collects for the purposes of the Ontario Health Data Platform to that which is necessary to fulfill its stated purposes.

The Ministry of Health will not collect personal health information that is outside of its stated purposes unless the new purpose is permitted or required by law.

Principle 5 - Limiting Use, Disclosure, and Retention

The Ministry of Health limits the use, disclosure and retention of the personal health information in its custody or control for the purposes of the Ontario Health Data Platform to that which is necessary to fulfill its stated purposes.

Use

The use of personal health information is limited to the purposes stated in Principle 2. If a new use or purpose for the personal health information is identified, the provisions of Principle 2 and Principle 3 shall apply.

Individual personnel of the Ministry of Health and its Agents who use personal health information are required to execute written agreements including confidentiality, research and privacy that clearly describes their obligations with respect to protecting patient privacy and protecting the confidentiality of personal health information and stipulates the penalties for breach. These agreements must be executed prior to the use of the personal health information.

Disclosure

The disclosure of personal health information is limited to the purposes stated in Principle 2. Personal health information is only disclosed where the disclosure of the personal health information is permitted or required by law, including where permitted or required by the Personal Health Information Protection Act, 2004.

In general, prior to the disclosure of personal health information, the Ministry of Health requires a written Research and Privacy Agreement to be executed between the Minister of Health and the person or organization to which the personal health information will be disclosed.

The Ministry of Health discloses personal health information for research purposes in accordance with Section 44 of the Personal Health Information Protection Act, 2004 and subject to the provisions of section 16 of Ontario Regulation 329/04. This includes:

  1. Obtaining a written research application.
  2. Obtaining a written research plan that has been prepared in accordance with the requirements of the Personal Health Information Protection Act, 2004 and Ontario Regulation 329/04.
  3. Obtaining a copy of the decision of the research ethics board approving the research plan; and
  4. Entering into an agreement with the researcher in accordance with section 44 of the Personal Health Information Protection Act, 2004.

The Ministry of Health discloses full datasets that have had data minimization techniques applied to the personal health information such that it is pseudonymized data that is disclosed. The data minimization techniques applied include:

  • health card number replaced with a unique random token number.
  • directly identifying information removed such as patient name, residential address, telephone numbers and medical record number.
  • indirect identifiers are pseudonymized such as date of birth changed to year of birth, date of death to year of death, full postal code changed to first three characters.

The Ministry of Health requires all researcher interactions to be performed within the computing environment of the Ontario Health Data Platform such that pseudonymized data is never removed. Researchers must adhere to the compliance requirements set out in section 44(6) of the Personal Health Information Protection Act, 2004.

If the Ministry of Health receives a concern or complaint by any person, that a recipient of personal health information has made false or misleading statements in the request for personal health information or has violated one or more conditions of a signed agreement, the Ministry of Health will investigate. When the concern or complaint is substantiated, the Ministry of Health will impose sanctions, which may include:

  1. A written complaint to the individual and/or organization;
  2. Recovery of personal health information disclosed by the Ministry;
  3. Report to an authority having jurisdiction over the individual or organization including, where appropriate, the Information and Privacy Commissioner/Ontario;
  4. Refusal to disclose personal health information in future; or
  5. Legal Action

Retention

Personal health information in the custody or control of the Ministry of Health for Ontario’s Health Data Platform is in electronic format only. The personal health information is retained for as long as is necessary to fulfill the stated purposes for which it was collected. Thereafter, the personal health information in electronic format, will be destroyed in such a manner that reconstruction is not reasonably foreseeable in the circumstances.

The Ministry of Health has formal procedures for the secure retention, destruction, and data minimization of personal health information.

Principle 6 - Accuracy

The personal health information in the custody or control of the Ministry of Health for the Ontario Health Data Platform is as accurate, complete, and up to date as is necessary to fulfill its stated purposes. The Prescribed Entities that provide personal health information to the Ministry of Health are required to ensure that the personal health information being provided meets with the Ministry of Health’s requirements relating to timeliness of submission, completeness, format and accuracy.

Principle 7 - Safeguards

The Ministry of Health considers all personal health information in its custody to be highly sensitive and implements appropriate safeguards to protect the personal health information against theft, loss and unauthorized access, use, disclosure, copying, modification or disposal.

The safeguards in place include:

  1. Physical Security Controls: e.g. locked data centre with tracked card access, restricted access to data centre and external video monitoring of data centre.
  2. Organizational Security Controls; e.g. employee confidentiality agreements, research and privacy agreements and security system audit procedures.
  3. Technical Security Controls; e.g. password/account user authentication, role-based restrictions, network encryption, audit trails, intrusion detection, fault tolerance, backup and recovery procedures.

The Ministry of Health also has procedures in place for data minimization, secure disposal and secure destruction of personal health information to prevent unauthorized parties from gaining access to the personal health information.

Principle 8 - Openness

The Ministry of Health makes information about the policies and practices with respect to the handling and protection of personal health information for the Ontario Health Data Platform readily available on a public website at ohdp.ca and in printed format upon request.

The information available includes:

  1. Contact information for the person that is accountable for the policies and practices for the Ontario Health Data Platform and to whom complaints or inquiries can be forwarded.
  2. Answers to frequently asked questions about privacy practices.
  3. A description of the nature of the personal health information held by the Ministry of Health for the Ontario Health Data Platform.
  4. A description of the purposes for which the personal health information is collected and the prescribed entities from which personal health information is obtained.
  5. This Privacy Policy.
  6. Procedures for requesting information about the existence, use and disclosure of personal health information held by the Ministry of Health for the Ontario Health Data Platform.
  7. Procedures for challenging compliance with this Privacy Policy.

Principle 9 - Individual Access

The Ministry of Health will provide information to an individual about the existence, use, and disclosure of the personal health information held on the Ontario Health Data Platform.

An individual can challenge the accuracy and completeness of their personal health information and have it corrected as appropriate. Since the Ministry of Health does not collect the personal health information that it received directly from individuals or health information, such challenges will be referred for resolution to the health information custodian from which the personal health information was originally collected.

Principle 10 - Challenging Compliance

An individual will be able to address a challenge concerning compliance with the above principles and policies to the designated individual accountable for the Ministry of Health’s compliance for the Ontario Health Data Platform. This individual is the Privacy Officer who can be contacted at:

The Ministry of Health will investigate all complaints and will inform individuals who make inquiries or lodge complaints of the relevant complaint resolution process.

If a complaint is deemed justified, the Ministry of Health will take appropriate measures including, if necessary, amending its policies and procedures.

Last updated: September 1, 2022