Updated May 28, 2026

📚 New here? Start with PHIPA Compliance: The Complete Guide for the plain-language overview, then use this matrix to audit your controls.

Who PHIPA applies to

PHIPA’s reach is broad — broader than most clinic owners realize. A health information custodian (HIC) under PHIPA s.3 includes:

• Health-care practitioners regulated under the Regulated Health Professions Act, 1991 — physicians, dentists, nurses, midwives, optometrists, pharmacists, physiotherapists, chiropractors, psychologists, social workers, and 18 other regulated professions.
• Operators of health-care facilities — hospitals, long-term care homes, retirement homes, community health centres, Aboriginal Health Access Centres, and independent health facilities.
• Pharmacies, ambulance services, and Community Care Access Centres.
• Centralized service organizations like Ontario Health, LHINs (now Ontario Health Teams), and shared electronic health record platforms.

If you bill OHIP, store patient records, or operate any system that touches PHI, PHIPA applies to you. Vendor agreements that involve PHI — including IT service providers, cloud platforms, and EHR vendors — are governed by the “agent” provisions in PHIPA s.17.

The five PHIPA pillars

PHIPA’s substantive requirements distill into five pillars that drive every IT-control decision:

1. Consent — collection, use, and disclosure of PHI generally require consent, with specific exceptions (s.18-20).
2. Accuracy — custodians must take reasonable steps to ensure PHI is accurate, complete, and up to date (s.11).
3. Safeguards — administrative, technical, and physical safeguards proportionate to the sensitivity of PHI (s.12).
4. Retention — written retention and destruction policies; secure disposal (s.13, O.Reg. 329/04 s.7).
5. Breach response — notification to the affected individual, the Information and Privacy Commissioner of Ontario (IPC), and applicable professional regulators (s.12(2), amended 2017).

The PHIPA IT Controls Matrix

The 14 control areas below cover the practical safeguards a custodian needs to satisfy PHIPA s.12 “reasonable steps.” Each row maps the control to its PHIPA anchor, the corresponding CIS Controls v8.1 safeguard, and the tooling pattern we deploy across our Ontario healthcare clients.

The breach-notification timeline

PHIPA s.12(2) imposes notification obligations when PHI is stolen, lost, used, or disclosed without authority. The timeline:

• To the affected individual — at the first reasonable opportunity. Notice must describe the nature of the breach, the information involved, and the steps taken to contain it.
• To the IPC — when the breach falls into one of the four classes in O.Reg. 224/17: insider snooping, theft/loss of PHI, breach with significant harm, or pattern breaches. Use the IPC’s Health Privacy Breach form.
• To the regulatory college — when an individual member’s act or omission caused the breach (e.g., a regulated nurse who inappropriately accessed a record). This is a notification to the relevant Health Profession Act college.
• Annual statistical report to the IPC — all PHIPA breaches, even those individually below the IPC-notification threshold, must be counted and reported in March of each year.

The seven most-missed controls

Across the 30+ Ontario health-custodian engagements Fusion Computing has worked on, the following seven controls are most often missing or weak at first assessment:

1. Audit logs retained but never reviewed. PHIPA s.10 requires the ability to detect inappropriate access. A log no one reads is not a control.
2. Vendor/agent agreements that predate PHIPA’s 2017 amendment. Many older IT contracts lack breach-cooperation clauses.
3. Backup systems with no documented restore test in the past 12 months. Backups that have never restored are theoretical.
4. MFA on email but not on the EHR itself. The EHR is the highest-value target.
5. BYOD devices with no MDM and no separation of PHI from personal data. A common gap in small clinics.
6. Disposal of old PCs and copiers without verified cryptographic erasure. Copier hard drives are the classic PHIPA breach vector.
7. Privacy officer named but with no training records or complaint-handling SOP. A titular role does not satisfy s.15(3).

Where to start

If you operate a small or mid-sized Ontario health-custodian organization (5 to 150 employees) and you’re not certain how your current IT controls map to PHIPA, the practical sequence is:

1. Run the 14-row matrix above as a self-assessment. Mark each row red, yellow, green.
2. Pull your audit logs from the past 90 days. Have a privacy officer review them.
3. Verify your last backup restore test. If it’s older than 6 months or doesn’t exist, schedule one this quarter.
4. Review your IT vendor agreement against PHIPA s.17 agent requirements. Most older agreements need amendment.
5. Run a tabletop breach exercise. Use a realistic scenario — ransomware on the EHR — and time the response.

About this matrix

This matrix is maintained by Mike Pearlstein, CISSP, Founder and CEO of Fusion Computing Limited. Mike has led IT and cybersecurity programs for Ontario health custodians since 2012 and holds the Certified Information Systems Security Professional designation (ISC²). Fusion Computing is a Microsoft Solutions Partner (Security, Modern Work, Infrastructure) and a CompTIA Managed Services Trustmark holder. We deploy this matrix as part of every health-custodian onboarding and re-audit annually.

If you’d like a PDF version of this matrix or want to discuss your situation, book a 30-minute consult. No obligation, no sales pitch — we’ll tell you what we’d do.