PHIPA

The Personal Health Information Protection Act, 2004 (PHIPA) is Ontario's provincial health privacy law, cited as S.O. 2004, Chapter 3, Schedule A. It was assented to on May 20, 2004 and commenced on November 1, 2004. PHIPA establishes consistent rules for how the health sector collects, uses, and discloses personal health information, with the goal of keeping that information confidential and secure while still allowing effective delivery of care. The Information and Privacy Commissioner of Ontario (IPC) is responsible for ensuring compliance.

Who it binds: health information custodians

PHIPA applies to a health information custodian (HIC) — any individual or organization with custody or control of personal health information. That includes doctors, hospitals, pharmacies, long-term care homes, and the Ministry of Health. Most ordinary businesses, including a Bitcoin mining operation, are not custodians. But if you build or host systems for clinics, or process health data on a custodian's behalf, PHIPA's obligations flow to you as an agent or service provider.

Why a sovereignty audience should care

PHIPA is a leading example of sector-specific Canadian privacy law that is stricter than the general baseline. It feeds directly into data-residency thinking: custodians are expected to keep tight control over where health records are stored and who can access them, which is one reason healthcare workloads often demand on-premise or Canada-resident infrastructure rather than foreign cloud. It sits alongside the federal regime, not in place of it.

This is general information, not legal advice — consult a qualified professional or the IPC before handling health information. For the broader Canadian context see digital sovereignty in Canada and how foreign-law exposure interacts with hosting in the CLOUD Act and Canadian data.