PHIPA Compliance for Healthcare Practices in Ontario: IT Safeguards You Can Prove

PHIPA makes your practice, as a health information custodian, responsible for protecting personal health information against theft, loss and unauthorized use or disclosure. Most of that protection now lives in IT: logins, devices, email, backups and the records that prove it all works.

The obligations above come from the Ontario Medical Association’s summary of privacy breach reporting requirements and the Information and Privacy Commissioner of Ontario’s guidance. Your privacy lead owns the policies and decisions. ACT360 owns the technical safeguards and the evidence behind them. We’re not a law firm and we won’t hand you a legal opinion, but we will make sure the answer to “was that laptop encrypted?” takes 2 minutes, not 2 days. For a plain-language overview of the Act itself, read our guide to what PHIPA asks of clinic IT.

Because it decides whether a stolen device has to be reported to the IPC. According to the OMA’s summary of the rules, stolen personal health information must be reported to the IPC if it was not de-identified or encrypted.

Think about the laptop left in a car outside a home visit, or the phone that goes missing at a conference. With full-disk encryption and a device you can wipe remotely, that’s an inconvenience and a replacement order. Without it, the practice may be notifying the IPC and writing to patients. Patients still have to be told about any theft, loss or unauthorized use or disclosure at the first reasonable opportunity, so encryption doesn’t erase every obligation, and your privacy lead should confirm each case. It does change the size of the problem.

Encryption only helps if you can prove it was on. That’s why we keep encryption status for every managed laptop and phone on record, alongside who it belongs to.

Notification work, possibly an IPC review and, in more serious cases, penalties. Since January 1, 2024, the IPC can issue administrative monetary penalties of up to $50,000 for individuals and $500,000 for organizations.

The IPC’s page on the potential consequences of a breach under PHIPA adds that penalties aren’t its default response and are used for more severe violations. Offences under the Act carry fines of up to $200,000 for an individual and $1,000,000 for an organization. For most clinics, though, the bigger cost is the week the practice can’t see patients properly while it works out what happened.

That risk isn’t theoretical. The Canadian Centre for Cyber Security’s National Cyber Threat Assessment 2025-2026 reports a 75% increase in ransomware incidents affecting Canada’s healthcare sector from 2022 to 2023, and notes that 5 hospitals in Southern Ontario were hit by a single ransomware group in October 2023. Clinics hold the same kind of data with far fewer people watching it.

The technical safeguards PHIPA expects, kept in place and documented every month, not set up once and forgotten. Each one leaves a record you can show your privacy lead, an insurer or the IPC.

• A login for every person, with MFA. Microsoft reports that MFA plus blocking legacy sign-ins stops more than 99.9% of common identity attacks.
• Onboarding and offboarding that run the same way every time. New hires get the right access on day one; leavers lose it the day they go, with a record of both.
• Encryption and device management on every laptop and phone that touches patient data, with remote wipe if one goes missing.
• Encrypted, versioned backups of the EMR data you hold and your patient files, with restores tested on a schedule and the results kept.
• Endpoint protection, monitoring and patching for workstations, laptops and Microsoft 365, scheduled outside clinic hours.
• An incident plan that says who calls whom when something goes wrong, so your privacy lead has the facts for patient notices and IPC reports.
• Quarterly reviews of access, devices and backups, so drift gets caught before an incident finds it.

Many practices also want to get rid of the clipboard. PHIPA-compliant digital intake forms and secure document upload are project work through our custom web applications team, scoped on their own.

Three parties share the work, and gaps appear where nobody has written down who owns what. Your practice stays accountable under PHIPA; the EMR vendor secures its platform; your IT partner secures everything around it.

We put this split in writing during onboarding, so there’s no argument about whose job it was on the day it matters.

A controlled route for patient information. For a healthcare organization handling sensitive patient data, ACT360 built a secure file upload system to give those files one secure way in.

The full story is in our secure file upload case study. We also helped an Ontario physiotherapy organization cut administrative workload with a custom solution. The pattern in both is the one we bring to PHIPA work: find where patient information actually travels, then give it one controlled route.

PHIPA safeguards are part of an ACT360 Managed IT agreement, priced per user per month. If several safeguards are missing today, closing those gaps is scoped and priced at the assessment, before you sign anything.

Microsoft 365 licences and your EMR subscription are billed separately. For pricing by practice size and what pushes a quote up, see IT support costs for healthcare providers. ACT360 Managed IT agreements include a 90-day exit clause, so you can judge the work before you’re committed to it. Backups and recovery are covered in more depth on our business continuity and disaster recovery page, and our wider security work on cybersecurity services.