Statement of Information Practices
On April 12, 2020, the Ontario government announced that it was taking steps to leverage safe and secure health data to better detect, plan, and respond to the COVID-19 pandemic in Ontario. A time-limited, two-year regulation under Personal Health Information Protection Act, 2004 (329/04) was established on July 31, 2020 for two main purposes:
- researching, analyzing, investigating, preventing, responding to, or alleviating COVID-19 or its effects; or
- evaluating or monitoring the impact of COVID-19 on the management of, the allocation of resources to or planning for all or part of the health system.
This regulation permitted the collection of PHI data sets
The Ministry of Health (Ministry) is a health information custodian (HIC) under the Personal Health Information Protection Act, 2004 (PHIPA) for the purposes of Ontario’s Health Data Platform (OHDP) that leverages safe and secure personal health information (PHI) data sets to better detect, plan, and respond to the COVID-19 pandemic. The Ministry has implemented privacy practices to protect PHI data sets from theft, loss, unauthorized access, copying, modification, use, disclosure, and disposal.
For a list of the datasets that the Ministry of Health collects, please click here. To read the Minister's letter to OH, please click here, and to read the memorandum of understanding (MOU) between MOH and OH, please click here.
Collection of Personal Health Information
The Ontario Health Data Platform (OHDP) is a safe, secure, high performance data platform for COVID-19 research. The PHI data sets collected include extracted information from:
- clinical information systems and registries, and public health, hospital, laboratory, and diagnostic imaging information systems;
- discharge summaries, hospital stays and emergency department visits;
- physician claims submitted to the Ontario Health Insurance Plan;
- medical drug claims submitted to the Ontario Drug Benefit Program; and
- claims submitted for home care and long-term care.
Learn more about PHI data sets collected on Research Data Sets.
Use of Personal Health Information
OHDP links large PHI data sets from a variety of sources that allows researchers to help with:
- increased detection of COVID-19;
- discovery of risk factors for vulnerable populations;
- prediction of when and where outbreaks may happen;
- evaluation of how preventative and treatment measures are working;
- identification of where to allocate equipment and other resources; and
- improved decision-making for health care and aiding in efforts to beat COVID-19.
Learn more about Health Research Priorities.
Limiting Disclosure of Personal Health Information
The Ministry discloses PHI data sets to authorized researchers in Ontario while conforming to the limiting principle that only PHI data sets necessary for the purpose are provided. The Ministry works with researchers who have submitted an application in writing that includes a research plan to ensure that:
- PHI data sets requested for the research have been reviewed and approved by a REB; and
- Required agreements with researchers regarding confidentiality and security are in place.
Privacy and Security Safeguards
PHI data sets are protected by physical, technical and administrative safeguards that adhere to industry best practices.
- A privacy program implemented to protect PHI data sets from theft, loss, unauthorized access, copying, modification, use, disclosure, and disposal.
- Audits to monitor and manage privacy compliance.
- Cybersecurity and privacy-protective mechanisms implemented to ensure PHI of Ontarians remain secure within OHDP at all times.
- Privacy-protective measures to reduce the risk of re-identification of an individual through data masking, limiting to view only access, and implementation of integrated, multi-layer security technologies and processes, including a security incident management tool.
Access and Correction:
Access requests can be directed to the Ministry’s Access and Privacy Office here.
Questions or Concerns:
Questions, or concerns about the privacy policies and procedures for OHDP may also be sent to the OHDP Privacy Lead by email or in writing as follows:
OHDP Privacy Office
99 University Avenue
Kingston, ON K7L 3N6
Individuals may make a complaint regarding compliance to the Personal Health Information Protection Act, 2004 and its regulation to the Information and Privacy Commissioner of Ontario who can be reached as follows:
Information and Privacy Commissioner
2 Bloor Street East, Suite 1400
Toronto, ON M4W 1A8
Phone: 416-326-3333 or 1-800-387-0073
Date modified: 2021-01-15