PHIPA Compliant Software Development in Ontario: What It Really Means

PHIPA compliant software development starts with one fact that surprises many buyers: there is no such thing as PHIPA certified software. PHIPA is Ontario's Personal Health Information Protection Act. It places duties on the organizations that hold health records, and on the people and vendors who handle those records for them. Software cannot meet PHIPA by itself. What software can do is make those duties easy to meet and easy to prove. Here is what that means in practice, and what to ask a development firm before it starts.

Who PHIPA applies to

PHIPA is written around health information custodians. These include hospitals, doctors and other health practitioners, pharmacies, labs, long-term care homes and other health care providers in Ontario. The custodian stays responsible for the records, even when a vendor stores or processes them.

Vendors are covered too. A company that acts for a custodian is its agent. It must follow the custodian's rules and tell the custodian quickly if health information is stolen, lost or accessed without authority. A company that supplies the electronic systems a custodian uses to collect, store or share health information has its own limits under the PHIPA regulation. It may only use the information to provide the service, it may not disclose it, and its staff must agree to the same limits. A company whose service lets two or more custodians share health information with each other has extra duties. It must tell custodians about privacy breaches, keep a record of every access to the information and share it with custodians on request, assess the privacy and security risks of its service, and have a written agreement with each custodian.

So if you build or sell software that holds Ontario health records, your customer will ask how your software helps them meet PHIPA. Your answer has to be backed by the software itself.

What PHIPA means for the software

PHIPA does not list technical requirements the way a security standard does. It requires custodians to take reasonable steps to protect health information against theft, loss and unauthorized use or disclosure. In practice, Ontario hospitals and clinics expect these features before they sign:

1. Role-based access, so staff see only the records they need for their work.
2. An audit log of who viewed, changed or shared each record, and when.
3. Encryption of health information in storage and in transit, including on laptops and phones.
4. A way to record and enforce a patient's request to block certain people or providers from seeing part of their record, often called the lockbox, and to flag that some information was withheld.
5. A way to find, export and correct everything held about one patient, because patients have a right to see their records and ask for corrections, and custodians must usually answer within 30 days.
6. Logs and reports that help the custodian spot a breach and work out who was affected.
7. Clear rules for how long records are kept and how they are destroyed.

The audit log matters most. Snooping by staff is one of the breaches the Information and Privacy Commissioner of Ontario takes most seriously, and reported snooping cases have risen in recent years. When it happens, the custodian has to show who looked at a record. A 2020 amendment will add a specific duty for custodians to keep and monitor electronic audit logs, but it is not yet in force. Ontario hospitals expect strong logging anyway, and a system without good logs leaves your customer unable to answer.

Breaches and penalties

When health information is stolen, lost, or used or disclosed without authority, the custodian must tell the affected patients at the first reasonable opportunity. In many cases it must also report the breach to the Information and Privacy Commissioner of Ontario, and it reports yearly breach numbers as well. Your software decides whether the custodian can work out what happened in hours or in weeks.

The stakes are real. Since January 1, 2024, the Commissioner can issue administrative penalties of up to $50,000 for individuals and $500,000 for organizations. On conviction for an offence, fines can reach $200,000 for individuals and $1,000,000 for organizations.

Does PHIPA require Canadian hosting?

No. PHIPA does not say health information must be stored in Canada. Many Ontario hospitals, health agencies and clinics still require it in their contracts or policies, and some public bodies have their own rules. In practice, plan to host in Canada if you sell to Ontario health organizations. Then the question does not slow down a sale.

If you use a cloud provider, check which region your data and your backups sit in, and where the provider's support staff can access it from.

PHIPA, PIPEDA and HIPAA

Health software teams often sell in more than one market. Here is the short version:

1. PHIPA covers personal health information handled by custodians in Ontario and the people and vendors who act for them.
2. PIPEDA is Canada's federal privacy law for private-sector organizations. It covers most private-sector commercial activity in Ontario, and data that crosses provincial or national borders. Ontario custodians handling health information in Ontario follow PHIPA instead, but PIPEDA can still apply to a health software company's own business.
3. HIPAA is a United States law. Being HIPAA ready does not mean you meet PHIPA, although the access, logging and encryption work overlaps a lot.

Other provinces have their own health privacy laws. If you sell outside Ontario, check each one.

Ten questions to ask a development firm

1. Have you built software that holds Ontario health records? For what kind of custodian?
2. How does the system decide who can see which record?
3. What does the audit log record, and can a privacy officer search it without a developer?
4. How would the system enforce a patient's lockbox request?
5. How do we find, export and correct everything we hold about one patient?
6. Where will the data and backups be hosted, and who can access them during development?
7. Will developers ever work with real patient data? If so, under what controls?
8. How is health information encrypted, and who manages the keys?
9. What documents do we receive to support a privacy impact assessment or a threat risk assessment?
10. What would you change if a hospital's privacy office sent us a questionnaire next month?

A firm with real experience will answer in plain words and show you examples. If it promises a "PHIPA certificate", keep looking.

How we approach it

NorthSight Technologies is a software development company in Ontario, Canada. We build health and education software for teams whose customers ask hard questions about privacy and security. Senior engineers scope the work and write the code. We build access controls, audit logs, encryption and patient record export into the software from the start, and we prepare the technical records a privacy officer will ask to see. We do not give legal advice, and we work alongside your privacy officer or lawyer.

If you are planning PHIPA compliant software development and want a straight answer on what your project needs, we offer a free 20-minute call. You can read how we work and book the call on our software development and compliance page.

Also published on LinkedIn →