Ontario Health Privacy Law to be "Substantially Similar" to PIPEDA

Ontario's Personal Health Information Protection Act (PHIPA) came into force on November 1, 2004 (E-TIPSâ„¢, Vol 3, No 11, November 10, 2004). It regulates the collection, use and disclosure of personal health information by health information custodians within the Ontario health care system. Under paragraph 26(2)(b) of the federal Personal Information and Electronic Documents Act (PIPEDA), the Governor in Council (i.e. the federal Cabinet), on the recommendation of the Minister of Industry, may issue an order that exempts an organization, a class of organizations, an activity or a class of activities from the application of PIPEDA in respect of the collection, use and disclosure of personal information within the province, if satisfied that provincial legislation that is "substantially similar" to PIPEDA applies to that organization, class of organizations, activity or class of activities. In assessing substantial similarity, the Minister of Industry will consider whether the provincial legislation meets the intent of the PIPEDA. At a minimum, the provincial statute must incorporate the 10 'fair information principles' set forth in Schedule 1 of PIPEDA; provide for an independent and effective oversight and redress mechanism with powers to investigate; and restrict the collection, use and disclosure of personal information to legitimate or appropriate purposes as determined under PIPEDA's "reasonable person" test On the recommendation of the Minister of Industry, the Governor in Council has issued a proposed Order that would deem PHIPA as substantially similar in protection to PIPEDA. A notice has been published in the Canada Gazette announcing the request for consideration and inviting public comments (until February 20, 2005). The Order, if registered, will exempt from the federal statute, "health information custodians" subject to PHIPA. PIPEDA will also continue to apply to the collection, use and disclosure of personal information in the commercial context generally, as well as to personal health information transferred outside Ontario; personal health information collected, used or disclosed by a federal work, undertaking or business; and personal health information collected, used or disclosed in the course of commercial activity by any non-health custodian, such as a service provider or an agent. The exemption will allow for the harmonization of privacy rules within the Ontario health care system. Similar exemption orders have already been issued regarding private sector organizations subject to provincial privacy legislation in Alberta, British Columbia and Quebec. For the text of the announcement and the Order, visit: http://canadagazette.gc.ca/partI/2005/20050205/html/regle4-e.html#REFa. For Industry Canada's policy and criteria used to determine whether provincial or territorial legislation would be considered as substantially similar, see: http://canadagazette.gc.ca/partI/2002/20020803/html/notice-e.html#i10. Summary by: Clare McCurley