FAQs
What does it mean to be prescribed?
The Personal Health Information Protection Act (PHIPA), Coroners Act, and Child, Youth and Family Services Act (CYFSA) permit organizations to be prescribed so that they may collect, use, and disclose personal information and personal health information for specific purposes.
What is a prescribed entity? For example, prescribed entities under PHIPA may collect, use and disclose personal health information for analysis and the planning and management of the health care system. Prescribed entities under the CYFSA may collect, use, and disclose personal information for analysis and the planning and management of services for children, youth, and families. An example of a prescribed entity under PHIPA is the Canadian Institute for Health Information – an organization that analyzes and provides comparable data on health and health care across Canada.
A prescribed entity is an organization that is authorized, under PHIPA, the Coroners Act, or the CYFSA to collect, use, and disclose personal information or personal health information. They are permitted to do this for specific reasons described under each law.
What is a prescribed person? Most registries contain information about a specific disease or condition. For example, the Children’s Hospital of Eastern Ontario maintains the Better Outcomes Registry and Network (BORN) – a registry that collects, interprets, and shares data about pregnancy, birth, and childhood in the province.
Prescribed persons under PHIPA are organizations that compile or maintain registries of personal health information to enable or improve the provision of health care. They can also compile registries of personal health information related to the storage or donation of body parts. For this reason, they are sometimes referred to as “prescribed registries.”
What is a three-year review and approval? A person or organization may not continue to operate under its authorities as a prescribed entity, person, organization, or unit of the Ministry of Health unless it has submitted a detailed written report and accompanying sworn affidavit to the IPC and we have provided written confirmation that it continues to meet the requirements. Learn more about the review and approval process. Access documents related to previous reviews and approvals.
Every three years, prescribed entities, persons, organizations, and units of the Ministry of Health must have their privacy practices reviewed and approved by the IPC to ensure that they continue to protect the privacy of individuals.
Who can be prescribed? *Part V.1 of PHIPA, which allows for an organization and a unit of the Ministry of Health to be prescribed, has not been proclaimed. Under the Coroners Act and CYFSA, only entities can be prescribed.
Under PHIPA, the following can be prescribed:
Who are the prescribed entities under PHIPA? Health information custodians (custodians), such as hospitals, medical laboratories, doctors, or pharmacists, can disclose personal health information to prescribed entities for analysis and compiling statistical information for planning and managing the health care system. Prescribed entities can only use personal health information for the purpose it was provided and for research. Prescribed entities can disclose personal health information to other prescribed persons, researchers, and other prescribed entities. They can also disclose personal health information back to the custodian who provided it, even if it has been modified, as long as it does not include any additional identifying information. Other permitted disclosures are described in Part IV of PHIPA and its regulations.
There are four prescribed entities under PHIPA:
Who are the prescribed persons (or registries) under PHIPA? Custodians can disclose personal health information to prescribed persons for the purpose of compiling or maintaining their registries. Prescribed persons can only use personal health information to compile or maintain their registries, and for research. Prescribed persons can disclose personal health information to enable or improve the provision of health care. They can also disclose personal health information to prescribed entities and researchers. Other permitted disclosures are described in Part IV of PHIPA and its regulations.
There are six prescribed persons under PHIPA:
Who are the prescribed organizations under PHIPA? Once Part V.1 is proclaimed, the prescribed organization is responsible for developing and maintaining the electronic health record (EHR). The EHR is the electronic system developed by the prescribed organization to enable custodians to collect, use, and disclose personal health information. To support those systems, the prescribed organization is required to: The Minister of Health may direct the prescribed organization to disclose personal health information from the EHR for specified purposes, such as research.
There are no prescribed organizations; Part V.1 of PHIPA has not yet been proclaimed.
Who are the prescribed units of the Ministry of Health under PHIPA? Once Part V.1 is proclaimed, the Minister of Health, through a prescribed unit of the Ministry of Health, may collect personal health information from the EHR developed and maintained by the prescribed organization. The minister can collect this information for funding, planning, or delivering health services, or for detecting, monitoring, or preventing fraud or inappropriate payments for health services funded by the Government of Ontario. A prescribed unit is only allowed to keep a minimal amount of personal health information and must otherwise de-identify the information. Identifying information cannot leave the prescribed unit except in the circumstances described below. A prescribed unit can use the personal health information collected from the EHR, on the minister’s behalf, to conduct an audit where there are reasonable grounds to believe there has been health care fraud. The minister may disclose personal health information used in the audit if:
There are no prescribed units of the Ministry of Health; Part V.1 of PHIPA has not yet been proclaimed.
Who are the prescribed entities under the Coroners Act? Although these entities have been prescribed, their practices and procedures have not yet been reviewed and approved by the IPC. The Chief Coroner can disclose personal information collected under the Coroners Act to prescribed entities. Prescribed entities may use personal information for the analysis and compilation of statistical information related to the health or safety of the public, and for research. Prescribed entities under the Coroners Act can disclose personal information to researchers. They can also disclose personal information back to the Chief Coroner who originally provided it, even if it has been modified, as long as it does not include additional identifying information.
There are three prescribed entities under the Coroners Act:
Who are the prescribed entities under the CYFSA? There are two prescribed entities under the CYFSA: Although these entities have been prescribed, their practices and procedures have not yet been reviewed and approved by the IPC. Service providers under the CYSFA, such as children’s aid societies or group homes, can disclose personal information to prescribed entities. Prescribed entities can use personal information for analyzing or compiling statistical information, planning and managing services for children, youth, and families, and for research. Prescribed entities under the CYFSA can disclose personal information to other prescribed entities under the CYFSA for the purpose of planning and managing services. They can also disclose personal information to researchers.
Part X of the CYFSA comes into force on January 1, 2020.
