Guidance documents for organizations

Case of Note: PHIPA Decision 260

Background

A public hospital was alerted to suspicious activity on a patient chart, and initiated an investigation, which included a targeted audit. The audit revealed that nearly 4,000 patient charts had been accessed by a physician without authorization, from a remote workstation outside of work hours. None of these patients were under the physician’s care.

The physician admitted to accessing the electronic health records for educational purposes. The physician thought accessing the electronic health records of patients remotely for this purpose was permitted...

This interpretation bulletin outlines the factors for determining how to apply the exclusion for records that relate to an ongoing prosecution, under section 65(5.2) of the Freedom of Information and Protection of Privacy Act (FIPPA) and section 52(2.1) of the Municipal Freedom of Information and Protection of Privacy Act (MFIPPA).

This interpretation bulletin discusses the threat to safety or health exemption, as set out in section 20 of the Freedom of Information and Protection of Privacy Act (FIPPA) and section 13 of the Municipal Freedom of Information and Protection of Privacy Act (MFIPPA). It outlines factors to consider in determining whether the threat to safety or health exemption applies.

This interpretation bulletin outlines the elements to consider when determining if a record falls under the published information or information available to the public exemption, as set out in section 22 of the Freedom of Information and Protection of Privacy Act (FIPPA) and section 15 of the Municipal Freedom of Information and Protection of Privacy Act (MFIPPA).

This interpretation bulletin addresses the solicitor-client privilege exemption, as set out in section 19 of the Freedom of Information and Protection of Privacy Act (FIPPA) and section 12 of the Municipal Freedom of Information and Protection of Privacy Act (MFIPPA). This document outlines the types of records that are exempted, specifically records subject to common law solicitor-client privilege (referred to as “branch one”) and those records that fall under statutory privilege (referred to as “branch two”). 

The updated Code of Procedure for appeals under the Freedom of Information and Protection of Privacy Act and the Municipal Freedom of Information and Protection of Privacy Act took effect on September 9, 2024. The IPC has also updated its Practice Directions under the new code which also take effect on the same date. For more information, please see our Code of Procedure section.

A prescribed person under the Personal Health Information Protection Act reported a breach to the IPC regarding a cyberattack that involved the unauthorized copying of approximately 3.4 million individuals’ personal health information from the prescribed person’s secure file transfer server. The threat actors gained unauthorized access to the server by exploiting a zero-day vulnerability in the file transfer software, MOVEit, that was installed on this server.

In effect September 9, 2024.

In effect September 9, 2024.

In effect September 9, 2024.

Formerly Practice Direction #4. Repealed as of September 9, 2024. 

Formerly Practice Direction #3. Repealed as of September 9, 2024. 

In effect September 9, 2024.