Electronic Child Health Network - Ontario Laboratories Information System (OLIS) Limited Production Release PIA Summary

Date of PIA Report: February 2012

Date PIA Summary Last Reviewed and Updated: December 2, 2025 (Rebranding)

The following is a summary of the above-referenced privacy impact assessment (PIA), including a brief background, key findings, and risks and recommendations as applicable. See our Privacy Contact page to find information on how to contact the Ontario Health Privacy Office should you have any questions.

Background

The Ontario Laboratories Information System (OLIS) is a cornerstone information system that connects hospitals, community laboratories, public health laboratories and health care providers to facilitate the secure electronic exchange of laboratory test orders and results. The ability to electronically share laboratory test information through OLIS supports providers in making decisions on patient care and treatment.

The electronic Child Health Network (eCHN) is a not-for-profit organization operating an electronic health record for Ontario providers serving paediatric patients (18 years of age and younger). eHealth Ontario is collaborating with eCHN, in 2012, to conduct a Limited Production Release (LPR)), making lab results in OLIS available to providers participating in the eCHN initiative. Providers participating in the LPR will log into the web-based eCHN system and view the OLIS data for their paediatric patients, in addition to personal health information (PHI) contributed by other providers.

eHealth Ontario will make the OLIS data available to the end-user providers via eCHN under its authority established in O.Reg. 329/04, section 6.2. eCHN will be acting as a service provider to eHealth Ontario in maintaining the subset of OLIS data and in providing it to the end-user providers.

OLIS includes the test results of individuals in Ontario who have had a laboratory test processed at one of the laboratories participating in OLIS. Individuals may withdraw consent to the use and disclosure of their PHI within OLIS. Withdrawal of consent may be applied to all of an individual’s lab information in OLIS, or only to tests on a specific lab order. If an individual’s consent has been withdrawn, providers may only access the individual’s lab information within OLIS, via eCHN, with the individual’s express consent.

In December 2010, the Ministry of Health and Long-Term Care (MOHLTC), a health information custodian (HIC) under the Personal Health Information Protection Act, 2004 (PHIPA) assumed custody and control of patients' laboratory test results in OLIS. The MOHLTC published a notice to inform the public that the MOHLTC was assuming custody and control of OLIS. The notice included information on how individuals can withdraw or reinstate their consent for their PHI in OLIS.

A PIA was already completed on the OLIS initiative in the fall of 2011. However, because PHI in OLIS is being shared with end-user providers, through eCHN, eHealth Ontario policies and O.Reg. 329/04 require that a delta PIA of the initiative be undertaken.

Key Findings

The eCHN-OLIS LPR delta PIA considers the initiative as of February, 2012. Specifically, the scope of the delta PIA includes the delivery of OLIS data, via eCHN, to the twenty providers participating in the LPR; the purposes and processes for sharing the OLIS data with providers; and the legislative authority under which eHealth Ontario may share OLIS data with providers, via eCHN. The PIA also considers the technical, administrative and physical safeguards which have been put in place to ensure that all flows of PHI occur in a secure and privacy-protective manner, and are in compliance with legislative requirements, relevant agreements, best practices as represented in the Canadian Standards Association Privacy Code and eHealth Ontario’s privacy policies. The delta PIA concludes that eHealth Ontario has the overall PHIPA authorities for operating and managing the eCHN-OLIS LPR. Additionally, eHealth Ontario and eCHN, its service provider, each have a robust infrastructure for the processing and sharing of sensitive PHI, with policies and practices to protect the privacy of Ontarians and the security of the information retained by eHealth Ontario and by eCHN.

The delta PIA recommends several measures to ensure that, for the eCHN-OLIS LPR, eHealth Ontario is in compliance with policies, procedures and privacy best practices.

Risks and Recommendations

The delta PIA provides a number of recommendations for the eCHN-OLIS LPR, as summarized below:

1. As eCHN is acting as eHealth Ontario’s service provider, eHealth Ontario will ensure that the administrative and technical controls that it applies to OLIS data are also applied by eCHN to the OLIS data in the eCHN database. This ensures that patients receive the same level of privacy protection regardless of whether their lab results are in the OLIS database or in eCHN’s system. eHealth Ontario will flow privacy and security obligations to eCHN through an agreement between the parties, and ensure it conducts appropriate assurance on eCHN’s privacy posture.
2. eHealth Ontario will be making the OLIS data available to end-user providers under O. Reg. 329/04, section 6.2. eHealth Ontario will need to establish administrative controls with the end-user providers to ensure they do not collect the OLIS data for purposes other than that for which it was provided (i.e., to provide or assist in the provision of health care). Training and/or materials for end-user providers will include direction on privacy-related matters.
3. eHealth Ontario will work with eCHN to ensure processes are in place to identify, notify, and investigate potential incidents with respect to the OLIS data.
4. The parties will implement a technical fix to ensure consent directives are transferred to eCHN’s system in all instances.
5. eHealth Ontario will establish a retention schedule that applies to OLIS data in eCHN. Should the project not continue after the pilot, eCHN will destroy the OLIS data, and return the audit logs to eHealth Ontario.
6. eHealth Ontario and eCHN will jointly develop processes for ensuring details of access to OLIS data by eCHN users are provided to eHealth Ontario.
7. eHealth Ontario will augment its access request process for the eCHN-OLIS initiative to assist the MOHLTC in responding to access requests by individuals. Additionally, eHealth Ontario will update its communication materials to instruct eCHN and end-users on the individual access request process for OLIS data.
8. eHealth Ontario will obligate eCHN, through an agreement, to report complaints or inquiries in respect of OLIS data, to eHealth Ontario, and work with eHealth Ontario to investigate and respond to any complaints that may arise.

eHealth Ontario is currently in the process of implementing each of the recommendations identified in the 2012 eCHN-OLIS LPR delta PIA.