Ontario Personal Health Information Protection Act (PHIPA)
Ontario's Personal Health Information Protection Act (PHIPA, S.O. 2004, c. 3, Schedule A) governs personal health information processing in Ontario. PHIPA displaces PIPEDA for personal health information processed by health information custodians (HICs) in Ontario. For ITAD covering Ontario healthcare engagements (hospitals, clinics, laboratories, health information networks), PHIPA imposes specific obligations on PHI destruction at retirement.
PHIPA scope and HIC definition
PHIPA applies to health information custodians in Ontario — hospitals, clinics, laboratories, pharmacies, health information network providers, individual health professionals. Most Ontario healthcare IT engagements bring Maxicom into scope as the disposition vendor for an HIC.
PHI destruction under PHIPA
PHIPA requires HICs to ensure personal health information is securely destroyed when no longer required. The Information and Privacy Commissioner of Ontario (IPC) interprets this to require destruction methods aligned to recognised standards (NIST 800-88 / IEEE 2883). Maxicom certificates explicitly cite both.
Imaging system retirement
PACS/RIS imaging systems retire alongside hospital storage. Engagement model: coordination with radiology informatics; PHI-grade chain of custody; per-imaging-system certificate.
Ontario Health and the Centre of Excellence engagements
Ontario Health (formerly LHIN/CCO consolidation) and similar provincial-scale healthcare IT entities operate at high-sensitivity protocols. Engagement profile: programme-level master service agreements, witness destruction standard, provincial-data-residency requirements.
Références faisant autorité
Sources primaires pour les normes citées sur cette page.
Questions fréquentes
Does PHIPA require physical destruction of all PHI-bearing media?
No — PHIPA is method-neutral but the IPC of Ontario interprets it to require recognised standards. Most engagements use Purge for non-restricted PHI and Destroy for top-classified.
What about IPC inspection?
IPC can inspect HIC operations including ITAD vendor relationships. Maxicom certificates are designed for IPC inspection.
How long do certificates retain under PHIPA?
10 years typical for healthcare records destruction certificates; longer where specific health-record retention rules apply (some pediatric records to age of majority + 10 years).
Related practices, regulators & markets
Server Buyback
Servers
→AMD EPYC Server Buyback
AMD server buyback
→Fortinet & Juniper Buyback
Fortinet/Juniper
→Manufacturing & Industrial IT Buyback
Industrial IT
→HPE Server Rental
HPE rental
→Higher Education
Higher education
→Lease End-of-Term
Lease end
→IT disposal in Ottawa
Ottawa
→Multi-Vendor ITAD
Multi-vendor ITAD
→Envoyez la liste d'actifs. Nous enverrons le chiffre.
Une photo du rack fonctionne. Un tableur fonctionne mieux. Règlement en CAD, contre bon de commande.