Three-year review and approval by the Information and Privacy Commissioner/Ontario, mandated by the Personal Health Information Protection Act, 2004, of the practices and procedures implemented by the prescribed person to protect the privacy of individuals whose personal health information the prescribed person receives and to maintain the confidentiality of that information

PHIPA
39(1)(c)
Regulation 329/04 s. 13(2)