Ontario Gazette Volume 157 Issue 27 | July 6 2024

Government Notices — Other

2024 Proportions of Enrolment for purposes of the Education Act, subsections 238(2) and 257.8(3)

Algoma, District of

Algoma, Unorganized Areas

Brant, County of

Brantford

Bruce, County of

Chatham-Kent, Municipality of

Cochrane, District of

Cochrane, Unorganized Areas

Dufferin, County of

Durham, Regional Municipality of

Elgin, County of

Essex, County of

Frontenac, County of

Greater Sudbury, Municipality of

Grey, County of

Haldimand County, Municipality of

Haliburton, County of

Halton, Regional Municipality of

Hamilton, Municipality of

Hastings, County of

Huron, County of

Kawartha Lakes, Municipality of

Kenora, District of

Kenora, Unorganized Areas

Lambton, County of

Lanark, County of

Leeds and Grenville, United Counties of

Lennox and Addington, County of

Manitoulin, District of

Manitoulin, Unorganized Areas

Middlesex, County of

Muskoka, District Municipality of

Niagara, Regional Municipality of

Nipissing, District of

Nipissing, Unorganized Areas

Norfolk County, Municipality of

Northumberland, County Of

Ottawa, Municipality of

Oxford, County of

Parry Sound, District of

Parry Sound, Unorganized Areas

Peel, Regional Municipality of

Perth, County of

Peterborough, County of

Prescott and Rusell, United Counties of

Price Edward County, Municipality of

Rainy River, District of

Rainy River, Unorganized Areas

Renfrew, County of

Simcoe, County of

Stormont, Dundas and Glengarry, United Counties of

Sudbury, District of

Sudbury, Unorganized Areas

Thunder Bay, District of

Thunder Bay, Unorganized Areas

Timiskaming, District of

Timiskaming, Unorganized Areas

Toronto, Municipality of

Waterloo, Regional Municipality of

Wellington, County of

York, Regional Municipality of

(157-G118E)

Ministry of Municipal Affairs and Housing

Residential Tenancies Act, 2006

section 120

guideline for 2025

notice

The Guideline applicable for the year 2025 for the purposes of the Residential Tenancies Act, 2006 is 2.5 per cent.

Dated this 26^th day of June, 2024.

Paul Calandra
Minister of Municipal Affairs and Housing

(157-G119E)

Notice of Minister of Health

Notice of Proposed Regulation

Personal Health Information Protection Act, 2004

The Minister of Health on behalf of the Government of Ontario invites public comments on two amending regulations proposed to be made under the Personal Health Information Protection Act, 2004 (“PHIPA”).

PHIPA came into force on November 1, 2004. Ontario Regulation 329/04 (General) made under PHIPA (“the PHIPA General Regulation”) also came into force on November 1, 2004. PHIPA requires that the Minister publish a notice of the proposed amending regulations and allow 60 days for public comment, after which the Minister reports to the Lieutenant Governor in Council, who may then finalize the regulations with or without changes.

Content of Proposed Amending Regulations

There are two proposed amending regulations that would be required to support better patient access to health care services and health information in Ontario. These proposed regulations would make the following amendments to the PHIPA General Regulation to provide the framework for:

1. Ontario Health’s provision of validation, verification, authentication and Ontario Health Account management services to enable the collection, use and disclosure of health card information from an individual to support access to approved Digital Health Resources, use the digital means of access through OH to certain personal health information (PHI) from the Electronic Health Record (EHR) if s. 51(5) is proclaimed and when OH acts as a prescribed person for the purposes of clause 39(1)(c) of the act.; and
2. OH to provide individual access to certain PHI in the provincial Electronic Health Record (EHR) and certain electronic audit records kept by OH, if s. 51(5) of PHIPA is proclaimed.

The proposed regulatory amendments include:

1.  Validation, Verification and Authentication Services Regulation:

If approved, this proposed amending regulation would allow OH to collect, use and disclose PHI, including from the individual’s health card, with their express consent, for the purpose of providing validation, verification and authentication services as well as Ontario Health Account management services. These services would be used to support access to approved “Digital Health Resources” (as defined in the proposed regulation).

By leveraging common government services, OH would be able to conduct the following for eligible individuals:

• Validate the health number and additional health card information provided by the individual.
• Verify the identity of the individual providing their health number and health card information, and such other identifying information as may be requested by OH.
• Create and maintain an Ontario Health Account, that the individual will be able to use to access authentication services that OH will provide to an approved HIC in respect of their approved Digital Health Resource.

Using the Ontario Health Account, individuals would be able to access approved Digital Health Resources as well as use the digital means of access through OH to certain PHI from their EHR if s. 51(5) is proclaimed, digital means of access referred to in sections 18.1.1 and 18.1.2 of this Regulation to request and receive access to a record of personal health information described in those sections, and when OH acts as a prescribed person for the purposes of clause 39(1)(c) of the act.

If approved, this proposed amending regulation would enable approved HICs to use OH’s authentication services to support individual authentication to access approved Digital Health Resources. In consultation with the Minister of Health, OH would be required to create eligibility criteria and a process for the approval of Digital Health Resources seeking to use these authentication services. The eligibility criteria and approval process will be published on OH’s website.

In addition, these proposed amendments would, among other things, require OH to:

• In consultation with the Minister of Health, develop and publish a policy about which individuals are eligible for the provision of validation, verification and authentication services as well as Ontario Health Account management services;
• Provide services that maintain an individual’s Ontario Health Account, including the confidentiality, integrity, availability, deactivation, reactivation or disposal of an individual’s Ontario Health Account;
• Require any persons that would be acting on its behalf, including an agent or service provider, to agree to comply with the restrictions and conditions that apply to OH prior to letting them access or deal with the PHI that is collected or used in the course of providing these validation, verification and authentication services or OHA management services; and
• Notify the Information and Privacy Commissioner of Ontario in certain circumstances, certain HICs and affected individuals if their PHI that was collected or used by OH in the provision of validation, verification and authentication services or OHA management services is stolen, lost, used or disclosed without authority.

2.  EHR Access Regulation:

If approved, the proposed amending regulation would revoke subsection 1(1) of O. Reg. 394/22 and add provisions to support the implementation of s. 51(5) to enable individual access to certain PHI in the provincial EHR (“EHR Records”) and certain electronic records kept by OH (“Audit Records”). This amending regulation, which would be effective upon proclamation of s. 51(5) of PHIPA, if approved, would include provisions that:

• Establish the scope of the EHR Records that would be for individual access under s. 51(5);
• Establish that Ontario Health, as the prescribed organization (PO), would provide EHR Records through a digital means of access to individuals specified by OH who have an OHA, or direct individuals to alternative means of access for individuals who are unwilling or unable to use the digital means of access;
• For EHR records, clarify that OH is not required to consider the exceptions from the right to access listed in s. 52(1) but would establish a notification process with HICs that have provided or intend to provide records to the EHR (“Contributing HICs”);
• Enable OH to deactivate access through the digital means of access to all of the affected individual’s records if a Contributing HIC has notified OH about a s. 52(1) exception applying to record(s) that the HIC has provided or intends to provide to the EHR;
• Outline OH’s responsibilities vis-à-vis Contributing HICs and individuals seeking their records upon deactivating access through the digital means of access;
• Exempt OH from the requirement in s. 52(1.1) to provide the records through the digital means of access in the electronic formats specified in that subsection;
• Exempt OH from the requirements under s. 52(4) to (7) when providing access to the records;
• Exempt OH from the requirement under s. 55 to correct EHR Records; and
• For the Audit Records (i.e., the records described in paragraph 2 of s. 51(5)), permit OH to only provide summaries of such records; provide OH with an initial period of 90 days to provide such summaries; and enable OH to only prepare summaries for the 12-month period preceding the request. These summaries would be provided via the digital means of access for individuals specified by OH who have an OHA or an alternative process for individuals who are unwilling or unable to use the digital means of access.

S. 51(6) of PHIPA which provides a general right of access to records in the custody of a HIC on when an individual’s PHI in the EHR has been viewed, handled or dealt with by the HIC (e.g., audit logs) would also be proclaimed at the same time as s.51(5), if approved. The proposed regulation would only require that HICs provide summaries of such access logs, if available.

The public is invited to provide written comments on the proposed regulation over a 60-day period, commencing on July 6, 2024 and ending on September 4, 2024.

In providing comments, please consider whether the proposed amending regulations should be made, with or without changes. Furthermore, please consider whether any other regulatory amendments should be made to the PHIPA General Regulation, or if any legislative amendments should be contemplated. Please be as specific as possible, and provide a full rationale for any suggested changes or additions.

Written comments may be addressed to:

Digital Health Program Branch
Ministry of Health
Digital and Analytics Strategy Division
222 Jarvis Street, 7^th Floor
Toronto ON M7A 0B6
Email: digitalhealthprogrambranch@ontario.ca

The text of the proposed amending regulations are set out following this notice in English and French. We welcome your input in either English or French. All comments and submissions received during the comment period will be considered during final preparation of the regulations. The content, structure and form of the proposed regulations is subject to change as a result of the consultation process and is in the discretion of the Lieutenant Governor in Council, who has the final decision on the contents of any regulation.

Information respecting PHIPA and the PHIPA General Regulation, and electronic copies of this notice, including the text of the proposed regulation, may be accessed through Ontario’s Regulatory Registry website at the following address: https://www.ontariocanada.com/registry.

Copies of PHIPA and the PHIPA General Regulation are available at www.e-laws.gov.on.ca.

Please note that all materials or comments received from organizations in response to this Notice will be considered public information and may be used and disclosed by the Ministry to assist the Ministry in evaluating and revising the proposed regulation. This may involve disclosing materials or comments, or summaries of them, to other interested parties during and after the request for public comment process. An individual who provides materials or comments and who indicates an affiliation with an organization will be considered to have submitted those comments or materials on behalf of the organization so identified. Materials or comments received from individuals who do not indicate an affiliation with an organization will not be considered public information unless expressly stated otherwise by the individual. However, materials or comments provided by individuals may be used and disclosed by the Ministry to assist in evaluating and revising the proposed regulation. Personal information of those who do not specify an organizational affiliation, such as an individual’s name and contact details, is collected by the Ministry under the authority of subsection 38(2) of the Freedom of Information and Protection of Privacy Act and subsection 74(1) of the Personal Health Information Protection Act, 2004, and will not be disclosed by the Ministry without the individual’s consent unless required by law. If you have any questions about the collection of this information, you can contact the Freedom of Information and Privacy Coordinator of the Ministry of Health at 416-327-7040.

The Honourable Sylvia Jones
Minister of Health

Caution:

This consultation draft is intended to facilitate dialogue concerning its contents. Should the decision be made to proceed with the proposal, the comments received during consultation will be considered during the final preparation of the regulation. The content, structure, form and wording of the consultation draft are subject to change as a result of the consultation process and as a result of review, editing and correction by the Office of Legislative Counsel.

consultation draft

Ontario regulation

To be made under the

personal health information protection act, 2004

Amending O. Reg. 329/04

(general)

1. Ontario Regulation 329/04 is amended by adding the following section:

Definitions for the purposes of this Regulation

1. 1. In this Regulation,

“approved digital health resource”

means a digital health resource that has been approved in accordance with subsection 25.3 (1); (“ressource numérique approuvée en matière de santé”)

“approved health information custodian”

means a health information custodian that provides one or more approved digital health resources; (“dépositaire de renseignements sur la santé approuvé”)

“authentication services”

means services that rely upon validation and verification services to seek to establish confidence in an individual’s identity; (“services d’authentification”)

“digital health resource”

means a provincially funded health resource that,

1. is provided by a health information custodian for use by individuals, and
2. enables a health information custodian to,
   1. use electronic means to collect, use, modify, disclose, transmit, maintain or dispose of personal health information for the purpose of providing health care or assisting in the provision of care, or
   2. allow individuals to access, use, disclose, maintain or otherwise manage their records of personal health information; (“ressource numérique en matière de santé”)

“Ontario Health Account”

means the account created by the Agency for an individual after validation and verification services have confirmed the identity of the individual; (“compte Santé Ontario”)

“Ontario Health Account management services”

means the services provided by the Agency that,

1. maintain the confidentiality, integrity or availability of an individual’s Ontario Health Account, or
2. manage the deactivation, reactivation or disposal of an individual’s Ontario Health Account; (“services de gestion des comptes Santé Ontario”)

“provincially funded health resource”

has the same meaning as in subsection 34 (1) of the Act; (“ressource en matière de santé subventionnée par la province”)

“validation and verification services”

means services that,

1. seek to validate the health number and additional personal health information from the health card provided by the individual, including by relying upon information stored in the Registered Persons Database or a successor database maintained by the Minister,
2. seek to verify that an individual who is providing the health number or additional personal health information, and such other identifying information as may be requested by the Agency , is the individual to whom the health number or personal health information relates, or
3. rely upon the services described in clauses (a) and (b) to create or renew an individual’s Ontario Health Account. (“services de validation et de vérification”)

2. Section 6.1.1 of the Regulation is amended by striking out “Ontario Health” wherever it appears and substituting in each case “the Agency”.
3. Section 11 of the Regulation is amended by adding the following subsection:

(0.1)  The following are prescribed persons for the purposes of clause 34 (2) (b.1) of the Act:

1. The Agency or its agents, in respect of the collection or use of health numbers for the purpose of providing validation and verification services, authentication services or Ontario Health Account management services in accordance with this Regulation.

4. Section 12 of the Regulation is amended by adding the following paragraph:

5. The Agency or its agents may disclose a health number that it has custody or control of for the purpose of providing validation and verification services or authentication services in accordance with this Regulation if,
   1. the Agency has received the individual’s express consent for the disclosure, as described in section 25.1, and
   2. the disclosure is made,
      1. to the Minister for the purpose of assisting the Agency in providing validation and verification services, or
      2. to an approved health information custodian for the purpose of providing authentication services in respect of their approved digital health resource.

5. Paragraphs 1 and 6.1 of subsection 13 (1) of the Regulation are amended by striking out “Ontario Health” wherever it appears and substituting in each case “The Agency”.
6. Paragraph 5 of subsection 18 (1) and subsections 18 (10), (11) and (12) of the Regulation are amended by striking out “Ontario Health” wherever it appears and substituting in each case “the Agency”.
7. The Regulation is amended by adding the following sections:

VVAS services — collection, use and disclosure of information

  25.1  (1)  Subject to sections 25.2 to 25.6, the Agency may, with the express consent of the individual to whom the personal health information relates, collect personal health information for the purpose of providing validation and verification services, authentication services or Ontario Health Account management services.

  (2)  Subject to sections 25.2 to 25.6, the Agency may, with the express consent of the individual to whom the personal health information relates and for the purpose of providing validation and verification services or authentication services, disclose personal health information that was collected or used under this section,

1. to the Minister for the purpose of assisting the Agency in providing validation and verification services; or
2. to an approved health information custodian for the purpose of providing authentication services in respect of their approved digital health resource.

  (3)  Subject to sections 25.2 to 25.6, the Agency may, with the express consent of the individual to whom the personal health information relates, use personal health information that was collected or used for the purpose of providing validation and verification services, authentication services or Ontario Health Account management services,

1. to provide validation and verification services;
2. for the purpose of enabling the Agency to provide authentication services to approved health information custodians in respect of their approved digital health resources;
3. to provide Ontario Health Account management services;
4. to enable the individual to use the digital means of access referred to in sections 18.1.1 and 18.1.2 of this Regulation to request and receive access to a record of personal health information described in those sections; or
5. to enable the individual to use a digital means of access made available by the Agency when the Agency acts as a prescribed person for the purposes of clause 39 (1) (c) of the Act.

  (4)  The Agency shall

1. in consultation with the Minister, develop a policy about which individuals are eligible for the direct or indirect provision of validation and verification services, authentication services or Ontario Health Account management services from the Agency; and
2. publish the policy on the Agency’s website.

  (5)&  nbsp; The Agency shall not collect personal health information from or disclose personal health information to a health information custodian for the purpose of providing validation and verification services, authentication services or Ontario Health Management services unless,

1. the health information custodian is an approved health information custodian that has entered into an agreement that complies with the requirements in paragraph 2 of subsection 25.3 (3); or
2. the health information custodian is the Minister and the disclosure is for the purpose of providing validation and verification services.

  (6)  Except as otherwise required by law, the Agency shall not, in providing validation and verification services, authentication services or Ontario Health Account management services,

1. collect, use or disclose personal health information if other information will serve the purpose of the collection, use or disclosure;
2. collect, use or disclose more personal health information than is reasonably necessary to meet the purpose of the collection, use or disclosure;
3. collect, use or disclose any personal health information, except as is reasonably necessary for the purpose of providing validation and verification services, or authentication services or Ontario Health Account Management services, as applicable, in accordance with this Regulation, or
4. use or disclose an Ontario Health Account for any purpose other than a purpose set out in this section.

VVAS services — consent

  25.2  (1)  The provisions of the Act that relate to consent apply to any consent required under section 25.1 as if the Agency were a health information custodian, subject to any necessary modifications and to the requirement that the consent must be express.

  (2)  An individual may withdraw a consent required under section 25.1 by providing notice of their withdrawal to the Agency, but the withdrawal shall not have retroactive effect.

  (3)  The Agency shall ensure that an individual’s Ontario Health Account is disposed of in a secure manner within 30 days after the date the Agency is notified of the withdrawal of the individual’s consent and shall notify the individual of the secure disposal.

  (4)  The Agency shall ensure that an Ontario Health Account that has been inactive for two or more years is disposed of in a secure manner.

VVAS services — approval

  25.3  (1)  The Agency may, in consultation with the Minister and in accordance with the eligibility criteria and approval process described in subsection (2), approve a digital health resource provided by a health information custodian.

  (2)  The Agency shall, in consultation with the Minister, create eligibility criteria and a process for the approval of digital health resources and publish them on the Agency’s website.

  (3)  The eligibility criteria and approval process described in subsection (2) must require the following:

1. The health information custodian seeking approval of the digital health resource must submit the following assessments to the Agency for review:
   1. The threats, vulnerabilities and risks to the security and integrity of personal health information that would be collected or used if the digital health resource were approved.
   2. How approving the digital health resource may affect the privacy of individuals whose information would be disclosed through the digital health resource.
2. The health information custodian seeking approval of the digital health resource must have an agreement with the Agency that includes the following:
   1. A description of the authentication services that the Agency is required to provide to the approved health information custodian through the approved digital health resource.
   2. A description of the administrative, technical and physical safeguards that the Agency will implement to preserve the confidentiality and security of any personal health information that will be disclosed by the Agency in providing authentication services.
   3. A description of the approved digital health resource and the personal health information that will be collected by the approved digital health resource.
   4. A description of the administrative, technical and physical safeguards of the digital health resource.
   5. An agreement by the health information custodian that all personal health information collected in the course of receiving authentication services from the Agency shall only be used by the health information custodian in respect of the approved digital health resource.

  (4)  An agreement described in paragraph 2 of subsection (3) with an approved health information custodian may be,

1. made in respect of one or more approved digital health resources that are provided by the custodian;
2. included as part of an agreement that addresses other matters not listed in that paragraph; and
3. amended after the agreement has been made to reflect any newly approved digital health resources.

  (5)  Every approved health information custodian that collects personal health information from the Agency through an approved digital health resource shall only use that personal health information,

1. in respect of the approved digital health resource as permitted by law; or
2. as otherwise required by law.

  (6)  An approved health information custodian may only disclose an Ontario Health Account where required by law.

  (7)  An approved health information custodian shall not permit any person acting on its behalf to access the personal health information that it collected in the course of receiving authentication services unless the person agrees to comply with the restrictions and conditions that apply to the approved health information custodian when it receives authentication services.

VVAS services — Persons acting on behalf of the Agency

  25.4  (1)  The Agency shall not permit any person acting on its behalf, including an agent or a service provider, to access or otherwise deal with the personal health information that the Agency collected or used in the course of providing validation and verification services, authentication services or Ontario Health Account management services unless the person agrees to comply with the restrictions and conditions that apply to the Agency when the Agency provides those services.

  (2)  Subject to subsection (1), the Agency may provide personal health information it collected in the course of providing validation and verification services, authentication services or Ontario Health Account management services to an agent of the Agency who may use it to provide those services on behalf of the Agency.

  (3)  Section 17 of the Act applies to the Agency and its agents as if the Agency were a health information custodian, subject to any necessary modifications.

  (4)  In this section,

“agent”

means a person that, with the authorization of the Agency, acts for or on behalf of the Agency in respect of personal health information for the purposes of the Agency, and not the agent’s own purposes, whether or not the agent has the authority to bind the Agency, whether or not the agent is employed by the Agency and whether or not the agent is being remunerated.

VVAS services — Agency privacy and security requirements

  25.5  (1)  The Agency shall take steps that are reasonable in the circumstances to ensure that,

1. the personal health information that the Agency collected or used for the purpose of providing validation and verification services, authentication services or Ontario Health Account management services is protected against theft, loss and unauthorized use or disclosure; and
2. the records containing the personal health information are protected against unauthorized copying, modification or disposal.

  (2)  If the Agency determines that personal health information collected or used by the Agency for the purpose of providing validation and verification services, authentication services or Ontario Health Account management services has been stolen, lost or used or disclosed without authority, the Agency shall, at the first reasonable opportunity, notify,

1. the individual to whom the personal health information relates, including in the notice a statement that the individual is entitled to make a complaint to the Commissioner under Part VI of the Act; and
2. any health information custodian that has collected the relevant personal health information in respect of their approved digital health resource.

  (3)  In providing validation and verification services, authentication services or Ontario Health Account management services, the Agency shall,

1. before collecting an individual’s personal health information for the purpose of creating or renewing the individual’s Ontario Health Account, provide the individual with a plain language description of the Agency’s validation and verification services, authentication services and Ontario Health Account management services, including a general description of safeguards to protect against breaches; and
2. make available to the public,
   1. a plain language description of the Agency’s validation and verification services, authentication services and Ontario Health Account management services,
   2. a description of how to contact with Agency concerning general inquiries about validation and verification services, authentication services and Ontario Health Account management services,
   3. a description of how to submit a complaint to the Agency or the Commissioner,
   4. a general description of the safeguards the Agency has implemented, and
   5. notice that an Ontario Health Account that has not been used for two years shall be deemed to be inactive and shall be securely disposed of.

  (4)  The Agency shall notify the Commissioner of the theft or loss or of the unauthorized use or disclosure of personal health information it has collected or used for the purpose of providing validation and verification services, authentication services or Ontario Health Account management services in any of the following circumstances:

1. The Agency has reasonable grounds to believe that the personal health information was used or disclosed without authority by a person who knew or ought to have known that they were using or disclosing the information without authority.
2. The Agency has reasonable grounds to believe that the personal health information was stolen.
3. The Agency has reasonable grounds to believe that, after an initial loss or unauthorized use or disclosure of the personal health information, the personal health information was or will be further used or disclosed without authority.
4. The loss or unauthorized use or disclosure of the personal health information is part of a pattern of similar losses or unauthorized uses or disclosures of personal health information in the custody or control of the Agency.
5. The Agency determines that the loss or unauthorized use or disclosure of the personal health information is significant after considering all relevant circumstances, including the following:
   1. Whether the loss or unauthorized use or disclosure involved a large volume of personal health information.
   2. Whether the loss or unauthorized use or disclosure involved many individuals’ personal health information.

  (5)  The Agency shall assess the validation and verification services, authentication services and Ontario Health Account management services it provides at the times specified in subsection (4) with respect to the following:

1. The threats, vulnerabilities and risks to the security and integrity of the personal health information collected, used and disclosed in providing the validation and verification services, authentication services and Ontario Health Account management services, as applicable.
2. How the Agency’s validation and verification services, authentication services and Ontario Health Account management services may affect the privacy of the individuals to whom the information relates.

  (6)  The Agency shall perform the assessments at the following times:

1. Before the Agency first begins to collect, use and disclose personal health information for the purpose of providing validation and verification services, authentication services and Ontario Health Account management services.
2. Before a significant change is made to the Agency’s validation and verification services, authentication services and Ontario Health Account management services.
3. Whenever a new significant threat to the Agency’s validation and verification services, authentication services and Ontario Health Account management services is identified.
4. Before the second anniversary of the day this section came into force and at least once within every two-year period after that day.

  (7)  The Agency shall audit and monitor the electronic records that it is required to keep for the purpose of providing validation and verification services or authentication services.

  (8)  The Agency shall keep an electronic record of all instances where all or part of the personal health information that it collected or used for the purpose of providing validation and verification services, authentication services or Ontario Health Account management services is viewed, handled, used, collected, disclosed or otherwise dealt with, and ensure that the record identifies the following:

1. The individual to whom the information relates.
2. The type of information that is viewed, collected, disclosed, handled or otherwise dealt with.
3. All persons who have viewed, handled, used, collected, disclosed, handled or otherwise dealt with the information.
4. The date, time and location of the viewing, collecting, disclosing, handling or dealing with of the information.

VVAS services — safeguards, practices and procedures

  25.6  (1)  The Agency shall put in place and comply with administrative, technical and physical safeguards, practices and procedures to,

1. protect both the privacy of the individuals in relation to whose personal health information it provides services and the confidentiality of such information; and
2. permit the Agency to comply with sections 25.1 to 25.5.

  (2)  The Agency may consult with the Commissioner on the safeguards, practices and procedures in a manner that the Agency and the Commissioner mutually consider appropriate in the circumstances.

Commencement

8. [Commencement]

Caution:

This consultation draft is intended to facilitate dialogue concerning its contents. Should the decision be made to proceed with the proposal, the comments received during consultation will be considered during the final preparation of the regulation. The content, structure, form and wording of the consultation draft are subject to change as a result of the consultation process and as a result of review, editing and correction by the Office of Legislative Counsel.

consultation draft

Ontario regulation

To be made under the

personal health information protection act, 2004

Amending O. Reg. 329/04

(general)

  1.  (1)  Ontario Regulation 329/04 is amended by adding the following sections:

Application of s. 51 (5) of the Act, para. 1 records

  18.1.1  (1)  This section applies to the Agency when it is acting as the prescribed organization under subsection 51 (5) of the Act with respect to the records listed in paragraph 1 of that subsection.

  (2)  The right of access for the purposes of paragraph 1 of subsection 51 (5) of the Act is limited to the following records:

1. Records that are derived from the Digital Health Drug Repository or a successor repository.
2. Records that are derived from the Ontario Laboratories Information System or a successor repository.

  (3)  The Agency shall make available a digital means of access to permit individuals specified by the Agency who have an Ontario Health Account to access the records described in subsection (2).

  (4)  The Agency shall publish instructions on the Agency’s website, or by such other means as the Agency considers advisable, to instruct persons who wish to access the records described in subsection (2) but who cannot or do not wish to use the digital means of access on how to request access to the records from the applicable health information custodian or custodians.

  (5)  The Agency,

1. shall respond to requests for access to the records described in subsection (2) through the digital means of access if the request is made by an individual specified by the Agency who has an Ontario Health Account, and shall act as if it is a health information custodian in providing access to those records through the digital means of access; and
2. is not required to respond to any other requests for access to the records.

  (6)  The Agency is not required to consider the exceptions from the right to access a record listed in clauses 52 (1) (a) to (f) of the Act, but shall,

1. ensure that the health information custodian that provided or intends to provide the personal health information to the electronic health record has been notified that the Agency may provide access to the record of personal health information pursuant to Part V of the Act; and
2. if the health information custodian does not identify an exception listed in clauses 52 (1) (a) to (f) of the Act that applies, provide access to the record in accordance with Part V of the Act and this section.

  (7)  The Agency is exempt from the requirements in subsections 52 (4) to (7) of the Act when providing access to the records.

  (8)  A health information custodian may notify the Agency if the custodian determines that an exception listed in clauses 52 (1) (a) to (f) of the Act applies to one of the records the custodian intends to provide or has provided to the electronic health record, and if it does,

1. the Agency shall deactivate access through the digital means of access to all of the affected individual’s records, whether they were provided by that health information custodian or not, including by deactivating the affected individual’s access to their Ontario Health Account; and
2. subsection 52 (2) of the Act does not apply to access to the records through the digital means of access.

  (9)  If the Agency deactivates access through the digital means of access under subsection (8), the Agency shall,

1. provide updates to the health information custodian who provided notice under subsection (8) to determine whether the exception is still applicable at least once every two weeks or in accordance with such other timeframe as the Agency and the custodian may agree to while access through the digital means of access is deactivated;
2. redirect the individual to the health information custodian or custodians that provided the applicable records so that the individual can obtain the records directly from them in accordance with Part V of the Act; and
3. reactivate the affected individual’s access through the digital means of access if,
   1. the health information custodian indicates that the deactivation is not necessary because the exceptions listed in clauses 52 (1) (a) to (f) of the Act no longer apply, and
   2. no other exceptions listed in clauses 52 (1) (a) to (f) of the Act have been identified by the Agency or by a health information custodian as applying to any of the affected individual’s records for which access would be reactivated.

  (10)  The Agency is exempt from the requirement in subsection 52 (1.1) of the Act to provide the records through the digital means of access in the electronic formats specified in that subsection.

  (11)  The Agency is exempt from the requirement in section 55 of the Act to make corrections to the records.

  (12)  For greater certainty, the Agency is entitled to rely on an assertion made in relation to this section in accordance with the rules set out in subsection 71 (4) of the Act.

  (13)  The provisions of Part III of the Act apply to the Agency, with necessary modifications, when it is carrying out its powers, functions and responsibilities under this section.

  (14)  In this section,

“electronic health record”

has the same meaning as in section 55.1 of the Act.

Application of s. 51 (5) of the Act, para. 2 records

18.1.2  (1)  This section applies to the Agency when it is acting as the prescribed organization under subsection 51 (5) of the Act with respect to the records listed in paragraph 2 of that subsection.

  (2)  Despite clause 54 (1) (a) of the Act, the Agency is only required to provide a summary of the information contained in the records described in paragraph 2 of subsection 51 (5) and is not required to provide access to the actual records.

  (3)  The Agency is not required to provide the summaries in respect of any period that is more than 12 months before the date of the access request.

  (4)  The Agency shall make available,

1. a digital means of access to permit individuals specified by the Agency who have an Ontario Health Account to access the summaries; and
2. an alternative process to permit individuals who cannot or do not wish to use the digital means of access to access the summaries.

  (5)  The Agency,

1. shall respond to requests for access to the records described in paragraph 2 of subsection 51 (5) of the Act through the digital means of access if the request is made by an individual specified by the Agency who has an Ontario Health Account, and shall act as if it is a health information custodian in providing access to those records through the digital means of access;
2. shall respond to all requests for access to the records described in paragraph 2 of subsection 51 (5) of the Act through the alternative process, and shall act as if it is a health information custodian in providing access to those records through the alternative process; and
3. is not required to respond to any other requests for access to the records.

  (6)  Despite clause (5) (a), if an individual’s access through the digital means of access has been deactivated under section 18.1.1, the Agency shall redirect the individual to the alternative process and provide access to the summaries through the alternative process.

  (7)  If the Agency determines that an exception listed in clauses 52 (1) (a) to (f) of the Act applies to one of the summaries the Agency has made available or intends to make available through the digital means of access,

1. the Agency shall deactivate access through the digital means of access to all of the affected individual’s records, including by deactivating the affected individual’s access to their Ontario Health Account; and
2. subsection 52 (2) of the Act does not apply to access to the records through the digital means of access.

  (8)  If the Agency deactivates access through the digital means of access under subsection (7), the Agency shall,

1. assess whether the exception listed in clause 52 (1) (a) to (f) of the Act continues to apply at least once every two weeks while access through the digital means of access is deactivated;
2. redirect the individual to the alternative process and provide the individual access through the alternative process to any of their summaries,
   1. that are not subject to an exception listed in clauses 52 (1) (a) to (f) of the Act, and
   2. for which access through the digital means of access has been deactivated; and
3. reactivate the affected individual’s access through the digital means of access if the Agency determines that,
   1. the deactivation is not necessary because the exceptions listed in clauses 52 (1) (a) to (f) of the Act no longer apply to the summaries, and
   2. no other exceptions listed in clauses 52 (1) (a) to (f) of the Act have been identified by the Agency or by a health information custodian as applying to any of the affected individual’s records for which access would be reactivated.

  (9)  The Agency is exempt from the requirement in subsection 52 (1.1) of the Act to provide the summaries through the digital means of access in the electronic formats specified in that subsection.

  (10)  Despite subsection 54 (2) of the Act,

1. the Agency shall respond to the request for access to the record no later than 90 days after receiving the request; and
2. subsection 54 (3) of the Act applies, with necessary modifications, and may authorize a further period of time of not more than 30 days to respond.

  (11)  The provisions of Part III of the Act apply to the Agency, with necessary modifications, when it is carrying out its powers, functions and responsibilities under this section.

  (12)  For greater certainty, the Agency is entitled to rely on an assertion made in relation to this section in accordance with the rules set out in subsection 71 (4) of the Act.

Application of s. 51 (6) of the Act

  18.1.2.1  For the purposes of applying subsection 51 (6) of the Act, a health information custodian is, despite clause 54 (1) (a) of the Act, only required to provide a summary of the information contained in the records described in that subsection, if the information is available, and is not required to provide access to the actual records.

  (2)  Subsection 18.1.1 (3) of the Regulation, as made by subsection (1), is revoked and the following substituted:

  (3)  The Agency shall make available,

1. a digital means of access to permit individuals who have an Ontario Health Account to access the records described in subsection (2); and
2. an alternative process to permit individuals who cannot or do not wish to use the digital means of access to access the records described in subsection (2).

  (3)  Subsection 18.1.1 (4) of the Regulation, as made by subsection (1), is revoked.

  (4)  Subsection 18.1.1 (5) of the Regulation, as made by subsection (1), is revoked and the following substituted:

  (5)  The Agency,

1. shall respond to requests for access to the records described in subsection (2) through the digital means of access if the request is made by an individual who has an Ontario Health Account, and shall act as if it is a health information custodian in providing access to those records through the digital means of access;
2. shall respond to all requests for access to the records described in subsection (2) through the alternative process, and shall act as if it is a health information custodian in providing access to those records through the alternative process; and
3. is not required to respond to any other requests for access to the records.

  (5)  Clause 18.1.1 (8) (a) of the Regulation, as made by subsection (1), is revoked and the following substituted:

1. the Agency shall deactivate access through the digital means of access to all of the affected individual’s records, whether they were provided by that health information custodian or not; and

  (6)  Clause 18.1.1 (9) (b) of the Regulation, as made by subsection (1), is revoked and the following substituted:

2. redirect the individual to the alternative process and provide the individual access through the alternative process to any of their records described in subsection (2),
   1. that are not subject to an exception listed in clauses 52 (1) (a) to (f) of the Act, and
   2. for which access through the digital means of access has been deactivated; and

  (7)  Clause 18.1.2 (4) (a) of the Regulation, as made by subsection (1), is amended by striking out “specified by the Agency”.

  (8)  Clause 18.1.2 (5) (a) of the Regulation, as made by subsection (1), is amended by striking out “specified by the Agency”.

  (9)  Clause 18.1.2 (7) (a) of the Regulation, as made by subsection (1), is revoked and the following substituted:

1. the Agency shall deactivate access through the digital means of access to all of the affected individual’s records; and

Revocation

  2.  Subsection 1 (1) of Ontario Regulation 394/22 is revoked.

Commencement

  3. [Commencement]

(157-G120E)

Marriage Act

certificate of permanent registration as a person authorized to solemnize marriage in Ontario have been issued to the following:

June 17, 2024 to June 23, 2024

certificates of temporary registration as person authorized to solemnize marriage in Ontario have been issued to the following:

June 17, 2024 to June 23, 2024

certificate of cancellation of registration as a person authorized to solemnize marriage in Ontario have been issued to the following:

June 17, 2024 to June 23, 2024

Ashif Damji
Deputy Registrar General

(157-G121)