ConnectingOntario PIA Summary

Date of PIA Report: June 15, 2017

Date PIA Summary Last Reviewed and Updated: December 2, 2025 (Rebranding)

The following is a summary of the above-referenced privacy impact assessment (PIA), including a brief background, key findings, and risks and recommendations as applicable. See our Privacy Contact page to find information on how to contact the Ontario Health Privacy Office should you have any questions.

Background

ConnectingOntario improves the patient and health care provider experience by providing point-of-care access to digital patient data from across the care continuum. This allows timely initiation of treatment and increased coordination amongst individual health care providers.

Currently, ConnectingOntario is on Release 9.1, which involves the integration of the ConnectingOntario solution with the Digital Health Drug Repository (DHDR), which will make DHDR data available through the Medications component of the ClinicalViewer. DHDR data currently includes records relating to publicly funded drugs, monitored drugs and pharmacy services which are held by the Ministry of Health and Ministry of Long-Term Care. Release 9.1 also includes patient privacy enhancements and better custom clinical views.

Key Findings

The privacy impact assessment concludes that the Ministry of Health and Ministry of Long-Term Care rely on section 6.2 of O.Reg. 329/04 to provide DHDR data to eHealth Ontario for the purpose of creating and maintaining medications data in an electronic health record.

The privacy impact assessment provides recommendations to ensure that the data received and utilized by eHealth Ontario, complies with PHIPA as well as eHealth Ontario policies, procedures and privacy best practices.

Risks and Recommendations

Four risks have been identified, and a risk treatment plan has been established with associated mitigation activities.

Three of the risks are carried over from historic assessments and relate to the use of an interim client registry which contains patient demographic data used to accurately identify patients. As an interim asset, this data set is not as fulsome as the Provincial Client Registry which contains more accurate and up-to-date patient demographic information. The long-term mitigation strategy, expected to be completed by the end of 2017, is to transition to the permanent Provincial Client Registry.

The fourth risk relates to the development of audit reports. As access to ConnectingOntario expands, the demand for audit reports increases placing a challenge on certain manual processes employed currently. Recommendations to streamline the reporting process including transitioning to an automated reporting solution have been defined and are included in the risk treatment plan.