FAQs

What does it mean to be prescribed?

What does it mean to be prescribed?
The Personal Health Information Protection Act (PHIPA), Coroners Act, and Child, Youth and Family Services Act (CYFSA) permit organizations to be prescribed so that they may collect, use, and disclose personal information and personal health information for specific purposes.

What is a prescribed entity?

What is a prescribed entity?
A prescribed entity is an organization that is authorized, under PHIPA, the Coroners Act, or the CYFSA to collect, use, and disclose personal information or personal health information. They are permitted to do this for specific reasons described under each law.

For example, prescribed entities under PHIPA may collect, use and disclose personal health information for analysis and the planning and management of the health care system. Prescribed entities under the CYFSA may collect, use, and disclose personal information for analysis and the planning and management of services for children, youth, and families.

An example of a prescribed entity under PHIPA is the Canadian Institute for Health Information – an organization that analyzes and provides comparable data on health and health care across Canada.

What is a prescribed person?

What is a prescribed person?
Prescribed persons under PHIPA are organizations that compile or maintain registries of personal health information to enable or improve the provision of health care. They can also compile registries of personal health information related to the storage or donation of body parts. For this reason, they are sometimes referred to as “prescribed registries.”

Most registries contain information about a specific disease or condition. For example, the Children’s Hospital of Eastern Ontario maintains the Better Outcomes Registry and Network (BORN) – a registry that collects, interprets, and shares data about pregnancy, birth, and childhood in the province.

What is a three-year review and approval?

What is a three-year review and approval?
Every three years, prescribed entities, persons, organizations, and units of the Ministry of Health must have their privacy practices reviewed and approved by the IPC to ensure that they continue to protect the privacy of individuals.

A person or organization may not continue to operate under its authorities as a prescribed entity, person, organization, or unit of the Ministry of Health unless it has submitted a detailed written report and accompanying sworn affidavit to the IPC and we have provided written confirmation that it continues to meet the requirements.

Learn more about the review and approval process. Access documents related to previous reviews and approvals.

Who can be prescribed?

Who can be prescribed?
Under PHIPA, the following can be prescribed:

  • entities
  • persons
  • organizations*
  • units of the Ministry of Health*

*Part V.1 of PHIPA, which allows for an organization and a unit of the Ministry of Health to be prescribed, has not been proclaimed.

Under the Coroners Act and CYFSA, only entities can be prescribed.

Who are the prescribed entities under PHIPA?

Who are the prescribed entities under PHIPA?
There are four prescribed entities under PHIPA:

  • Canadian Institute for Health Information (CIHI)
  • Cancer Care Ontario (CCO)
  • Institute for Clinical Evaluative Sciences (ICES)
  • Pediatric Oncology Group of Ontario (POGO)

Health information custodians (custodians), such as hospitals, medical laboratories, doctors, or pharmacists, can disclose personal health information to prescribed entities for analysis and compiling statistical information for planning and managing the health care system.

Prescribed entities can only use personal health information for the purpose it was provided and for research.

Prescribed entities can disclose personal health information to other prescribed persons, researchers, and other prescribed entities. They can also disclose personal health information back to the custodian who provided it, even if it has been modified, as long as it does not include any additional identifying information. Other permitted disclosures are described in Part IV of PHIPA and its regulations.

Who are the prescribed persons (or registries) under PHIPA?

Who are the prescribed persons (or registries) under PHIPA?
There are six prescribed persons under PHIPA:

  • Cardiac Care Network of Ontario (CorHealth) in respect of its registry of cardiac and vascular services
  • INSCYTE (Information System for Cytology etc.) Corporation in respect of CytoBase
  • Hamilton Health Sciences Corporation (HHSC) in respect of the Critical Care Information System (CritiCall)
  • Cancer Care Ontario in respect of the Ontario Cancer Screening Registry
  • Children’s Hospital of Eastern Ontario (CHEO) in respect of the Better Outcomes Registry and Network (BORN)
  • Ontario Institute for Cancer Research (OICR) in respect of the Ontario Tumor Bank

Custodians can disclose personal health information to prescribed persons for the purpose of compiling or maintaining their registries.

Prescribed persons can only use personal health information to compile or maintain their registries, and for research.

Prescribed persons can disclose personal health information to enable or improve the provision of health care. They can also disclose personal health information to prescribed entities and researchers. Other permitted disclosures are described in Part IV of PHIPA and its regulations.

Who are the prescribed organizations under PHIPA?

Who are the prescribed organizations under PHIPA?
There are no prescribed organizations; Part V.1 of PHIPA has not yet been proclaimed.

Once Part V.1 is proclaimed, the prescribed organization is responsible for developing and maintaining the electronic health record (EHR). The EHR is the electronic system developed by the prescribed organization to enable custodians to collect, use, and disclose personal health information.

To support those systems, the prescribed organization is required to:

  • manage and integrate the personal health information it receives from custodians
  • ensure the proper functioning of the EHR
  • ensure the accuracy and quality of the personal health information in the EHR
  • conduct analyses of the personal health information in the EHR in order to provide alerts and reminders to custodians

The Minister of Health may direct the prescribed organization to disclose personal health information from the EHR for specified purposes, such as research.

Who are the prescribed units of the Ministry of Health under PHIPA?

Who are the prescribed units of the Ministry of Health under PHIPA?
There are no prescribed units of the Ministry of Health; Part V.1 of PHIPA has not yet been proclaimed.

Once Part V.1 is proclaimed, the Minister of Health, through a prescribed unit of the Ministry of Health, may collect personal health information from the EHR developed and maintained by the prescribed organization. The minister can collect this information for funding, planning, or delivering health services, or for detecting, monitoring, or preventing fraud or inappropriate payments for health services funded by the Government of Ontario.

A prescribed unit is only allowed to keep a minimal amount of personal health information and must otherwise de-identify the information. Identifying information cannot leave the prescribed unit except in the circumstances described below.

A prescribed unit can use the personal health information collected from the EHR, on the minister’s behalf, to conduct an audit where there are reasonable grounds to believe there has been health care fraud.

The minister may disclose personal health information used in the audit if:

  • it is required by law
  • it is for the purpose of a legal proceeding
  • the audit reveals a contravention of the law and the disclosure is to law enforcement for the purpose of an investigation

Who are the prescribed entities under the Coroners Act?

Who are the prescribed entities under the Coroners Act?
There are three prescribed entities under the Coroners Act:

  • The Canadian Institute for Health Information
  • Cancer Care Ontario
  • The Institute for Clinical Evaluative Sciences

Although these entities have been prescribed, their practices and procedures have not yet been reviewed and approved by the IPC.

The Chief Coroner can disclose personal information collected under the Coroners Act to prescribed entities.

Prescribed entities may use personal information for the analysis and compilation of statistical information related to the health or safety of the public, and for research.

Prescribed entities under the Coroners Act can disclose personal information to researchers. They can also disclose personal information back to the Chief Coroner who originally provided it, even if it has been modified, as long as it does not include additional identifying information.

Who are the prescribed entities under the CYFSA?

Who are the prescribed entities under the CYFSA?
Part X of the CYFSA comes into force on January 1, 2020.

There are two prescribed entities under the CYFSA:

  • The Canadian Institute for Health Information
  • The Institute for Clinical Evaluative Sciences

Although these entities have been prescribed, their practices and procedures have not yet been reviewed and approved by the IPC.

Service providers under the CYSFA, such as children’s aid societies or group homes, can disclose personal information to prescribed entities.

Prescribed entities can use personal information for analyzing or compiling statistical information, planning and managing services for children, youth, and families, and for research.

Prescribed entities under the CYFSA can disclose personal information to other prescribed entities under the CYFSA for the purpose of planning and managing services. They can also disclose personal information to researchers.