Regulation - LGIC
Proposed Regulations to enable individual access to personal health information held in the provincial Electronic Health Record (EHR) through Ontario Health (OH)
Regulation Number(s):
O. Reg. 329/04
Instrument Type:
Regulation - LGIC
Bill or Act:
Personal Health Information Protection Act, 2004 (PHIPA)
Summary of Decision:
Made: April 14, 2022
Filed: April 20, 2022
Published on e-Laws: April 20, 2022
Printed in The Ontario Gazette: May 7, 2022
Filed: April 20, 2022
Published on e-Laws: April 20, 2022
Printed in The Ontario Gazette: May 7, 2022
Analysis of Regulatory Impact:
Work is currently underway analyzing possible administrative and compliance costs to businesses and professionals that may result from this regulatory proposal. To inform this analysis we encourage you to provide your feedback.
Further Information:
Regulation
Proposal Number:
22-HLTC012
Posting Date:
February 4, 2022
Summary of Proposal:
The proposed amending regulation under PHIPA would provide stipulations around individual access to data held in the Electronic Health Record (EHR) upon proclamation of PHIPA s.51(5), which allows Ontario Health (OH) to respond to access requests to certain data held in the EHR as if it were a health information custodian (HIC).
Based on organizational capacity and mandate considerations (i.e. OH does not provide health care services), and the depth and breadth of data available for access, the proposed regulations aim to provide general stipulations and limitations on how OH will fulfill its responsibilities as a prescribed organization (PO) in respect to enabling individual access to data in the EHR.
Overall, the proposed regulations, which would be effective upon proclamation of PHIPA s. 51(5), would, if approved:
• Establish that OH, as the PO, will only respond to and provide access to personal health information from the EHR to the individual through digital means approved by the PO. OH would be permitted to make the digital means of access available in a phased manner provided all individuals have access by September 30, 2023.
• Establish the scope of the data available in the EHR for individual access, and the timing as to when that data will be available.
• Require public hospitals to contribute PHI for the EHR as requested by OH and in accordance with OH's interoperability specifications.
• Establish that OH is not responsible for making the determination of whether a record should be exempt from disclosure under s. 52 of PHIPA.
• Establish that OH is not responsible for correcting records in the EHR under s. 55 of PHIPA.
• Establish that OH will only provide summaries in respect to electronic audit logs of records, as well as electronic records of all instances where consent directives are made, withdrawn or modified or overridden under s. 55.7.
• Extend the scope of good faith immunity under O. Reg. 571/20 under the Connecting Care Act to include activities relating to OH's processing access requests under PHIPA.
Please note that PHIPA s.51(6) which provides a general right of access to records in the custody/control of a HIC on when an individual's PHI in the EHR has been viewed, handled or dealt with by the HIC (e.g. access logs) would also be proclaimed at the same time as s.51(5), if approved. The proposed regulations would only require that HICs provide summaries of such access logs, if available.
Based on organizational capacity and mandate considerations (i.e. OH does not provide health care services), and the depth and breadth of data available for access, the proposed regulations aim to provide general stipulations and limitations on how OH will fulfill its responsibilities as a prescribed organization (PO) in respect to enabling individual access to data in the EHR.
Overall, the proposed regulations, which would be effective upon proclamation of PHIPA s. 51(5), would, if approved:
• Establish that OH, as the PO, will only respond to and provide access to personal health information from the EHR to the individual through digital means approved by the PO. OH would be permitted to make the digital means of access available in a phased manner provided all individuals have access by September 30, 2023.
• Establish the scope of the data available in the EHR for individual access, and the timing as to when that data will be available.
• Require public hospitals to contribute PHI for the EHR as requested by OH and in accordance with OH's interoperability specifications.
• Establish that OH is not responsible for making the determination of whether a record should be exempt from disclosure under s. 52 of PHIPA.
• Establish that OH is not responsible for correcting records in the EHR under s. 55 of PHIPA.
• Establish that OH will only provide summaries in respect to electronic audit logs of records, as well as electronic records of all instances where consent directives are made, withdrawn or modified or overridden under s. 55.7.
• Extend the scope of good faith immunity under O. Reg. 571/20 under the Connecting Care Act to include activities relating to OH's processing access requests under PHIPA.
Please note that PHIPA s.51(6) which provides a general right of access to records in the custody/control of a HIC on when an individual's PHI in the EHR has been viewed, handled or dealt with by the HIC (e.g. access logs) would also be proclaimed at the same time as s.51(5), if approved. The proposed regulations would only require that HICs provide summaries of such access logs, if available.
Contact Address:
Digital Health Program Branch
Digital Health Division
Ministry of Health
1075 Bay St., 12th floor
Toronto, ON M5S 2B1
Email: digitalhealthdivision@ontario.ca
Digital Health Division
Ministry of Health
1075 Bay St., 12th floor
Toronto, ON M5S 2B1
Email: digitalhealthdivision@ontario.ca
Effective Date:
April 20, 2022
Decision:
Approved