PHIPA

In June, 2025, the Information and Privacy Commissioner (IPC) issued PHIPA Decision 284, which clarifies enforcement expectations under the Personal Health Information Protection Act (PHIPA). PHIPA governs all Ontario Healthcare providers and their outsourced third-party IT providers, including Outsource IT. This message contains details on the decision and outlines Outsource IT's commitment to supporting its clients in the healthcare sector.

Decision 284 resulted from a significant ransomware attack that occurred in October 2023 on multiple healthcare entities (not related to Outsource IT). This decision established a precedent that makes Health Information Custodians, such as doctors, pharmacists, and hospitals, fully responsible for protecting patients' personal health information (PHI), even if they outsource IT services to third-party providers such as Outsource IT. As a result, there is an increased need for Electronic Service Providers (ESPs), such as Outsource IT, to assist their clients in maintaining compliance.

Outsource IT will not:
(a) Use any personal health information accessed during service provision except as necessary to provide the specific services described in this agreement;
(b) Disclose any personal health information under any circumstances;
(c) Permit employees or agents to access personal health information unless they have agreed to comply with these same restrictions.

Outsource IT maintains policies and procedures for:
- Workforce security and access management
- Security awareness training for all personnel
- Incident response and breach notification procedures
- Regular evaluation of PHIPA compliance measures
- Designation of a privacy officer responsible for PHIPA compliance

Outsource IT implements:
- Access controls and user authentication systems
- Audit logging and monitoring capabilities
- Data integrity verification measures
- Encryption for data storage and transmission
- Network security controls including firewalls and intrusion detection

Outsource IT maintains:
- Controlled facility access with appropriate identification requirements
- Workstation security policies and device controls
- Secure storage and disposal procedures for any physical media
- Environmental controls for server and network equipment

Outsource IT ensures any third parties retained to assist in providing services agree to comply with restrictions necessary to enable Service Provider's PHIPA compliance, including the same use and disclosure restrictions that apply to Outsource IT.

Outsource IT will notify clients immediately upon becoming aware of any unauthorized access, use, disclosure, or disposal of personal health information, or any other privacy incident that may affect Client's personal health information.

Clients may audit Outsource IT's PHIPA compliance measures upon reasonable notice. Outsource IT will provide documentation of compliance activities upon the client's request.

Upon termination of any agreement, Outsource IT will securely return or destroy all personal health information in its possession and certify in writing that no copies have been retained.