FAQs
What does it mean to be prescribed?
The Personal Health Information Protection Act (PHIPA), Coroners Act, and Child, Youth and Family Services Act (CYFSA) permit entities, persons, and/or organizations to be prescribed (named in regulations under each Act) so that they may collect, use, and disclose personal information or personal health information for specific purposes.
What is a prescribed entity? A prescribed entity is authorized under PHIPA, the Coroners Act, or the CYFSA to collect, use, and disclose personal information or personal health information. They are permitted to do this for specific reasons described under each law. Under PHIPA, prescribed entities may collect personal health information without individuals’ consent from health information custodians (custodians) and use that information for analysis and compiling statistics in relation to the planning and management of the health care system. Custodians, such as hospitals, medical laboratories, doctors, or pharmacists, can disclose personal health information to prescribed entities for this purpose. Prescribed entities can use personal health information only for the purpose it was provided, for research, or as required by law. Prescribed entities can disclose personal health information to prescribed persons, researchers, and other prescribed entities. They can also disclose personal health information back to the custodian who provided it, even if it has been modified, as long as it does not include any additional identifying information. Prescribed entities can also disclose personal health information as required by law. Other permitted disclosures are described in Part IV of PHIPA and its regulations. Under the CYFSA, prescribed entities may collect personal information without individuals’ consent from service providers and use that personal information for analysis and compiling statistics in relation to the planning and management of services for children, youth, and families. Service providers under the CYSFA, such as children’s aid societies or group homes, can disclose personal information to prescribed entities for this purpose. Prescribed entities can use personal information only for the purpose it was provided, for research, or as required by law. Prescribed entities under the CYFSA can disclose personal information to other prescribed entities under the CYFSA for the purpose of planning and managing services. They can also disclose personal information to researchers or as required by law. Under the Coroners Act, prescribed entities may collect personal information without individuals’ consent from the Chief Coroner and use it for the purpose of research, analysis, or the compilation of statistics related to the health or safety of the public, or any segment of the public. The Chief Coroner can disclose personal information collected under the Coroners Act to prescribed entities. Prescribed entities can use personal information only for the purpose it was provided, for research, or as required by law. Prescribed entities under the Coroners Act can disclose personal information to researchers or as required by law. They can also disclose personal information back to the Chief Coroner who originally provided it, even if it has been modified, as long as it does not include additional identifying information.
What is a prescribed person? Prescribed persons under PHIPA compile or maintain registries of personal health information to enable or improve the provision of health care. They can also compile or maintain registries of personal health information related to the storage or donation of body parts or bodily substances. Because they compile or maintain registries, prescribed persons are sometimes referred to as “prescribed registries.” Most registries contain information about a specific disease or condition. For example, the Children’s Hospital of Eastern Ontario – Ottawa Children’s Treatment Centre maintains the Better Outcomes Registry and Network (BORN) – a registry that collects, interprets, and shares data about pregnancy, birth, and childhood in the province. Custodians can disclose personal health information to prescribed persons for the purpose of compiling or maintaining their registries. Prescribed persons can use personal health information to compile or maintain their registries and for research. Prescribed persons can disclose personal health information to enable or improve the provision of health care. They can also disclose personal health information to prescribed entities and researchers. Other permitted disclosures are described in Part IV of PHIPA and its regulations.
What is a prescribed organization? A prescribed organization is responsible for developing and maintaining the electronic health record (EHR). The EHR is the electronic systems developed and maintained by the prescribed organization to enable custodians to collect, use, and disclose personal health information. To support those systems, the prescribed organization is required to: The Minister of Health may direct the prescribed organization to disclose personal health information from the EHR for specified purposes, such as research. Other permitted disclosures are described in Part V.1 of PHIPA and its regulations.
How does an entity or person become a prescribed entity or prescribed person? An entity or person interested in being a prescribed entity or prescribed person should contact the ministry responsible for the legislation: An entity or person must be prescribed under the law before they can have their practices and procedures reviewed and approved by the IPC.
How does an organization become a prescribed organization? Contact the Ministry of Health for more information.
What is a three-year review and approval? Every three years, prescribed entities, persons, and organizations must have their practices and procedures reviewed and approved by the IPC to ensure that they continue to protect the privacy of individuals. In the three-year review, the prescribed entity, person, or organization submits a detailed written report and accompanying affidavit to the IPC. If we approve, we provide written confirmation that the entity, person, or organization continues to meet the requirements. If we do not approve, the entity, person, or organization may not continue to operate under its authorities as a prescribed entity, person, or organization. Learn more about the review and approval process. Access documents related to previous reviews and approvals.
Who are the prescribed entities under PHIPA? There are four prescribed entities under PHIPA:
Who are the prescribed persons (or registries) under PHIPA? There are six prescribed persons under PHIPA:
Who are the prescribed organizations under PHIPA? There is one prescribed organization under PHIPA: Ontario Health.
Who are the prescribed entities under the Coroners Act? There are three prescribed entities under the Coroners Act: Although these entities have been prescribed, their practices and procedures have not yet been approved by the IPC.
Who are the prescribed entities under the CYFSA? There are two prescribed entities under the CYFSA: Although these entities have been prescribed, their practices and procedures have not yet been reviewed and approved by the IPC. Until January 1, 2021, prescribed entities may collect personal information under their authority as prescribed entities, even if the IPC has not yet approved their practices and procedures. On and after January 1, 2021, prescribed entities may not collect personal information under their authority as prescribed entities unless the IPC has approved their practices and procedures.
