Bill 138, the Plan to Build Ontario Together Act ("Bill 138"), which includes amendments to the Personal Health Information Protection Act, 2004 ("PHIPA"), was introduced by the Ontario Minister of Finance on November 6, 2019. It received Royal Assent on December 10, 2019.
Shortly after Bill 138 was introduced, the Minister of Health issued a news release about Ontario's Digital First for Health strategy (the "Digital Strategy") – which contemplates promoting and investing in virtual care options and other digital tools for health care in Ontario.
We provided a brief overview of Bill 138 and the Digital Strategy in our earlier bulletin, Introduction to the Health Sector Impacts of Bill 138. This bulletin discusses (1) the amendments to PHIPA and (2) the Digital Strategy in more detail. Both are intended to support a more integrated health system for Ontario.
Note that amendments to Bill 138 were made by the Standing Committee on Finance and Economic Affairs between second and third reading. Those amendments do not impact the changes to PHIPA, however they do change the amendments to the Health Insurance Act. Those changes will be the topic of a future bulletin, and can be found on the Ontario Legislative Assembly website.
(1) Amendments to PHIPA and its Regulations
Schedule 30 to Bill 138 enacts amendments to PHIPA, to come into effect once proclaimed. The Information and Privacy Commissioner of Ontario (the "IPC"), in comments released on December 2, 2019(PDF), described these changes as "discrete yet significant". The IPC raised general concern about the commercialization of personal health information ("PHI"), even where de-identified, and the role of Ontario Health and the provincial government in collecting PHI. Some of these concerns were raised in the debates on Bill 138 in the Legislative Assembly.
Among the amendments in Bill 138 is a new section (11.2) that will prohibit "re-identification" – that is, the use or attempted use of de-identified PHI to identify an individual. Even so, certain exceptions permit re-identification by the health information custodian ("custodian") prescribed entity, prescribed registry or other prescribed person under PHIPA, who was responsible for de-identifying the information in the first place. The amendments make it an offence to willfully contravene the new section.
The IPC expressed support for this amendment, but proposed certain changes to the language in Bill 138 to ensure that the exceptions are not interpreted more broadly than specifically contemplated in the new section. The changes were not incorporated into Bill 138. The IPC also commented that it would like to see further amendments regarding de-identification, including to establish the purposes for which PHI can be de-identified and rules applicable to recipients of de-identified PHI.
Ordering the Return or Transfer of PHI
Bill 138 also amends section 61(1)(e) of PHIPA (under "Powers of Commissioner"). Currently, that section provides that, after the IPC conducts a review, it may make an order directing any person who was reviewed to dispose of records of PHI that the Commissioner has determined were collected, used or disclosed improperly if such disposal is not reasonably expected to adversely affect the provision of health care to an individual. The amendments will allow the IPC to, in the alternative, order the PHI to be returned or transferred, rather than disposed of.
PHIPA and Health System Integration: Ontario Health and Ontario Health Teams
(a) Ontario Health
On April 18, 2019, the Connecting Care Act, 2019 (the "CCA") came into force and created Ontario Health. Pursuant to amendments in Bill 138, the Lieutenant Governor in Council ("LGIC") will be empowered to make regulations prescribing the circumstances in which Ontario Health may collect, use and disclose PHI, the conditions that apply, and when PHI can be disclosed by a custodian or other person to Ontario Health. The LGIC will also be able to make regulations setting out the powers, functions and responsibilities of Ontario Health under PHIPA.
Effective December 2, 2019, amendments were also made to Regulation 329/04 under PHIPA (the "PHIPA Regulation") to name Ontario Health as an entity to which custodians are permitted to disclose certain PHI for the purpose of planning and management of the health system. Other amendments were made to the PHIPA Regulation to support the recently announced transfers of existing health agencies to Ontario Health, including Cancer Care Ontario and eHealth Ontario.
(b) Ontario Health Teams ("OHTs")
The CCA also introduced the OHT model. The amendments under Bill 138 will allow the LGIC to make regulations that prescribe the circumstances in which an OHT may collect, use and disclose PHI, the conditions that apply, and when PHI can be disclosed by a custodian or other person to an OHT.
The IPC, in its comments on Bill 138, made note of the significant challenges posed by the new OHT model, particularly given that teams may include members that are not custodians subject to PHIPA. The IPC would like to see collection, use and disclosure restricted to custodians who are subject to PHIPA, unless a comprehensive privacy framework containing equivalent obligations is developed for non-custodians, including IPC oversight.
Bill 138 also amends PHIPA to allow the LGIC to make regulations that set out requirements for custodians when selecting and using electronic means to collect, use, modify, disclose, retain or dispose of PHI. Shared electronic medical records and safe access to digital PHI have been identified as key features of a more integrated model of care.
(2) Digital Health
Alongside amendments to PHIPA, the province is prioritizing the use of technology to improve connectivity in the health system. There is an expectation that technology and information sharing will be central to the OHT model. The Digital Health Policy Guidance Document, described below, explains that the OHT model for integrated care is supported in large part by the Digital Strategy.
The Five Pillars of the Digital Strategy and Hallway Medicine
The Minister of Health's announcement described the Digital Strategy as a means to modernize the patient experience and end hallway medicine. She set out five pillars that patients can expect:
- More virtual care options, including video visits, secure messaging and virtual care technologies for providers
- Expanded access to online appointment booking
- Greater data access for patients, including secure online access to health records
- Better, more connected tools for frontline providers, including access to patient records stored across multiple health service providers
- Data integration and predictive analytics, to allow early intervention and chronic disease management
The Minister committed to approximately 55,000 more video visits provided by physicians to patients over the next year, supported by an investment of $3 million in new funding to compensate physicians.
Hallway medicine and the strains on Ontario's health system have been identified by the government as significant challenges for the province. The Premier's Council on Improving Healthcare and Ending Hallway Medicine (the "Council") has made ten recommendations in four categories: integration, innovation, efficiency and alignment and capacity. All four can be connected to the Digital Strategy:
- Integration, including putting patients at the centre of their care and improving patients' and providers' ability to navigate the healthcare system
- Innovation, involving more options for care delivery, including virtual care, enabled with legislative and/or policy changes and incentives
- Efficiency and alignment, including using data to improve accountability and outcomes
- Capacity, including making strategic investments to address wait times for specialist and community care
Overall, the Council found that patients want more options and flexibility in access to care, including how they connect with their providers.
Digital Health Playbook and the Digital Health Privacy and Security Policy
In connection with the OHT model, the Ontario government published the Digital Health Playbook (the "Playbook") (PDF). The Playbook is intended to assist with the adoption and use of digital health solutions. A subsequent bulletin will discuss the Playbook in more detail.
The Playbook attaches the Digital Health Policy Guidance Document (the "Policy Guidance"), which incorporates a direction on digital health access, privacy and security policy (the "Privacy Direction"). The Privacy Direction acknowledges that privacy is essential to maintaining confidence in digital health. It encourages OHT participants to harmonize their privacy policies and to take steps to ensure that patients understand the information practices that relate to the operation of the OHT and how they may be different from the practices of an individual custodian. The Privacy Direction observes that a "patient-centred approach" means that patients should not have to contact each custodian in an OHT to request access to their PHI.
The Privacy Direction points to the ability, in sections 3(7) and 3(8) of PHIPA, to apply to the Minister of Health for an order permitting two or more custodians to act as a single custodian. Under these sections, the Minister of Health may make such an order if he or she is of the opinion that it is appropriate, based on (i) the public interest, (ii) the custodians' ability to provide individuals with reasonable access to their PHI and to comply with the requirements of PHIPA, and (iii) if it would enable the custodians to effectively deliver integrated health care. Nonetheless, according to the Privacy Direction, this would not alleviate the requirement to enter necessary agreements among custodians to clarify their roles and responsibilities.
If you are interested in learning about the government's plans for a more connected system, we recommend you review the Playbook and the accompanying Digital Health Service Catalogue.  We will continue to monitor the implementation of Bill 138 and the Digital Strategy, with an eye to their privacy implications.
 Referred to as the "Agency" in the CCA. See our bulletin: Ontario's Proposed Super-Agency: The Creation of Ontario Health Under Bill 74.
 Referred to as "integrated care delivery systems" in the CCA. See our bulletin: Bill 74: Integration and Accountability in Ontario's Health System under the Connecting Care Act, 2019.
 See our bulletin: Getting Connected: Digital Health and Information Sharing under Bill 74.
 We have published a series of bulletins on the work of the Council. See:
- Hallway Health Care: A Symptom of Broader Challenges Facing Ontario's Healthcare System
- Overview of the Second Report of the Premier's Council on Improving Healthcare and Ending Hallway Medicine: Part I
- Overview of the Second Report of the Premier's Council on Improving Healthcare and Ending Hallway Medicine: Part II
- Overview of the Second Report of the Premier's Council on Improving Healthcare and Ending Hallway Medicine: Part III
 The Digital Health Service Catalogue lays out digital health assets and services. These are intended to be the first resource for OHTs, to understand what is available and receive information about how to access it, and OHTs wishing to look beyond the catalogue are encouraged to consult with the Ministry of Health. OHTs are expected to use digital tools with a view to the Policy Guidance. OHTs are described in the Playbook as a unique opportunity to consider the potential for digital technologies.