PHIPA Changes in 2026: What Ontario Health Practices Actually Need to Know

I've had the same conversation three times this month. A clinic owner or office manager calls us, a little uneasy, and asks some version of: "Did PHIPA just change? Do we need to do something?"

The honest answer is yes, it changed, and no, you don't need to panic. But a few of these changes land squarely on the people who run IT in Ontario health practices, and I'd rather you hear about them from someone who works on clinic networks every day than find out during an audit.

Quick note before we start: I'm an IT guy, not a lawyer. This is my plain-English read of the public record, with links to the sources. For legal advice on your specific situation, talk to your privacy counsel.

The short answer: what changed in PHIPA?

Ontario's Personal Health Information Protection Act, 2004 (PHIPA) was amended by Schedule 6 of the More Convenient Care Act, 2025 (Bill 11). Most of those amendments came into force on January 1, 2026. The big pieces are:

• A new Digital Health Identifier (DHI) framework (new Part V.2 of PHIPA), letting Ontarians verify their identity online and access their own records in the provincial Electronic Health Record.
• Ontario Health gets new powers and duties as the "prescribed organization," including breach notification and privacy practice obligations for DHI activities.
• A new offence for disposing of health records with the intent to dodge an access request.
• More regulations on the way, including a proposed amendment published in August 2026 to expand the digital services patients can reach with their DHI.

If you only read one section of this post, that was it. The rest is what it means in practice.

Timeline of recent PHIPA changes

What is the Digital Health Identifier?

Think of it as a digital key. Ontario Health creates a unique identifier for a person, confirms that they are who they say they are, and then that person can use it to open their own health records online. Bill 11's explanatory note describes it as a unique identifier "that can be used to confirm the identity of an individual."

For patients, that's genuinely good news. For clinics, it means more patients will arrive having already seen their lab results, imaging reports or visit history online. Expect more questions, more correction requests and, frankly, more people noticing when something in their chart looks wrong.

The IPC has been supportive of the goal but pointed about the details. In its 2024 submission on the earlier version of this bill, the Commissioner called the initial regulatory proposal "rushed, problematic and incomplete." That doesn't mean the current law is broken, but it tells you the regulator is watching this area closely.

Does this change my obligations as a clinic?

Most of the new Part V.2 duties fall on Ontario Health, not on your dental office or physio clinic. Your core obligations as a health information custodian haven't been rewritten. You still need to:

• Take reasonable steps to protect personal health information against theft, loss and unauthorized use (section 12).
• Notify patients, and in many cases the IPC, when information is lost, stolen or accessed without authority.
• Give patients access to their records and correct them when asked.
• Have a contact person and a written public statement about your information practices.

What has changed is the environment around you. Patients have a new front door into the system. The IPC's 2026 to 2030 strategic plan talks about being "a modern and effective regulator with real-world impact." And the IPC has had the power to issue administrative monetary penalties under PHIPA since 2024. Put those together and "we'll fix it later" stops being a safe plan.

The new offence: don't shred your way out of an access request

This one is short but worth flagging. Section 72 now makes it an offence to dispose of records of personal health information under Part V with the intent to evade an access request.

From an IT point of view, I'd translate that into one practical habit: have a written retention and deletion schedule, and follow it every time. If your deletions are routine, documented and automated, nobody can mistake them for a cover-up. If someone is clearing out an old file server the week after a patient asked for their chart, you've got a problem, even if the timing was innocent.

What about AI scribes?

Not a legislative change, but closely related. In early 2026 the IPC released AI Scribes: Key Considerations for the Health Sector plus a checklist. I bring it up because AI scribes are the single most common "is this okay?" question I get from clinics right now.

My short version: an AI scribe is a vendor processing your patients' health information. Treat it like any other system that touches PHI. Know where the data is stored, whether it's used to train models, how long it's kept, and who at the vendor can see it. If the vendor can't answer those questions in writing, that's your answer.

A practical PHIPA checklist for 2026

Here's what I'd actually do this quarter if I ran a small or mid-sized practice in Ontario:

1. Turn on multi-factor authentication everywhere. EMR, email, remote access, billing portals. This is still the cheapest breach prevention there is.
2. Check your audit logs. Can you tell who opened a patient's chart, and when? If a patient sees something odd through their DHI and complains, you'll need that trail.
3. Write down your retention schedule and make deletions automatic where you can.
4. Review every vendor that touches PHI, especially AI tools and cloud apps staff signed up for on their own.
5. Rehearse a breach. Know who calls the IPC, who notifies patients and how fast you can find out what was exposed.
6. Update your public privacy statement so it reflects the tools you really use today.
7. Train your front desk. They'll get the first wave of "I saw this in my online record" questions.

The IPC's Privacy Management Handbook for Small Health Care Organizations is a solid, free starting point if you don't have a formal privacy program yet.

Frequently asked questions

When did the latest PHIPA amendments take effect?

Most of the PHIPA amendments in Schedule 6 of the More Convenient Care Act, 2025 came into force on January 1, 2026, under Order in Council 1649/2025.

Who does the Digital Health Identifier apply to?

The new Part V.2 rules mainly govern Ontario Health as the prescribed organization that runs DHI activities. Patients use the DHI voluntarily to access their own records. Clinics remain bound by their existing custodian duties.

Can the IPC fine my clinic under PHIPA?

Yes. The IPC has been able to issue administrative monetary penalties for PHIPA contraventions since 2024, and offences can also be prosecuted in court.

Is deleting old patient records now illegal?

No. Routine deletion under a proper retention schedule is fine. What's now an offence is destroying records with the intent to avoid an access request.

Are AI scribes allowed under PHIPA?

PHIPA doesn't ban them, but custodians stay responsible for the information. The IPC's 2026 AI scribe guidance and checklist explain what to evaluate before you deploy one.

Where we fit in

At OIT we look after the networks, devices, email and backups for health practices across Ontario, from Burlington and Hamilton to Toronto and beyond. Most of the checklist above is technical work: MFA, logging, backups, vendor reviews, breach response. That's what we do every day.

If you want a second set of eyes, book a free 30-minute IT health check with the OITC team or contact us. We'll tell you plainly where you stand, and you can read more about our compliance and risk management services and healthcare IT support.

Sources

• Bill 11, More Convenient Care Act, 2025 (Legislative Assembly of Ontario)
• Order in Council 1649/2025
• O. Reg. 195/25
• Ontario Gazette, August 22, 2026: proposed PHIPA regulation
• IPC 2025 Annual Report: Trust in Digital Health
• IPC submission on Schedule 6 of Bill 231 (December 2024)
• Personal Health Information Protection Act, 2004