Electronic Child Health Network - Ontario Laboratories Information System (OLIS) Full Production Release PIA Summary

Date of PIA Report: July 2012

Date PIA Summary Last Reviewed and Updated: December 2, 2025 (Rebranding)

The following is a summary of the above-referenced privacy impact assessment (PIA), including a brief background, key findings, and risks and recommendations as applicable. See our Privacy Contact page to find information on how to contact the Ontario Health Privacy Office should you have any questions.

Background

The Ontario Laboratories Information System (OLIS) is a cornerstone information system that connects hospitals, community laboratories, public health laboratories and health care providers (providers) to facilitate the secure electronic exchange of laboratory test orders and results. The ability to electronically share laboratory test information through OLIS supports providers in making decisions on patient care and treatment.

The electronic Child Health Network (eCHN) is a not-for-profit organization operating an electronic health record for Ontario providers serving pediatric patients (19 years of age and younger). eHealth Ontario is collaborating with eCHN to make lab results in OLIS available to providers participating in the eCHN initiative. In February, 2012, eHealth Ontario and eCHN launched a limited production release (LPR) of the OLIS-eCHN initiative (OLIS-eCHN LPR) to make the lab results in OLIS available to up to twenty-two end-user providers via eCHN’s WebChart application. While the LPR was underway, due to positive feedback from end-users, eHealth Ontario and eCHN decided to expand the OLIS-eCHN initiative as of July, 2012 to a full production release, beginning with approximately 1,500 end-users that will have access to OLIS data via eCHN’s WebChart. Providers participating in the OLIS-eCHN initiative will log into the web-based eCHN system and view the OLIS data for their pediatric patients, in addition to personal health information (PHI) contributed by other providers.

eHealth Ontario will make the OLIS data available to the end-user providers via eCHN under its authority established in O.Reg. 329/04, section 6.2. eCHN will be acting as a service provider to eHealth Ontario in maintaining the subset of OLIS data and in providing it to the end-user providers. eCHN will also be acting as a PHIPA sub-agent of the Ministry of Health and Long-Term Care (MOHLTC) in respect of individual access requests and consent management activities related to OLIS data.

OLIS includes the test results of individuals in Ontario who have had a laboratory test processed at one of the laboratories participating in OLIS. Individuals may withdraw consent to the use and disclosure of their PHI within OLIS. Withdrawal of consent may be applied to all of an individual’s lab information in OLIS, or only to tests on a specific lab order. If an individual’s consent has been withdrawn, providers may only access the individual’s lab information within OLIS, via eCHN, with the individual’s express consent. OLIS-eCHN Full Production Release Delta PIA Summary

In December 2010, the MOHLTC, a health information custodian (HIC) under the Personal Health Information Protection Act, 2024 (PHIPA) assumed custody and control of patients' laboratory test results in OLIS. The MOHLTC published a notice to inform the public that the MOHLTC was assuming custody and control of OLIS. The notice included information on how individuals can withdraw or reinstate their consent for their PHI in OLIS.

A PIA was previously completed on the OLIS initiative in the fall of 2011. Additionally, a Delta PIA was completed on the OLIS-eCHN LPR in February 2012. However, PHI in OLIS is being shared with additional end-users through eCHN, and some technological enhancements have been made to OLIS since the LPR, as a result eHealth Ontario privacy policies and O.Reg. 329/04 requires that a delta PIA of this initiative be undertaken.

Key Findings

The OLIS-eCHN Full Production Delta PIA considers the initiative as of July, 2012. Specifically, the scope of the delta PIA includes the delivery of OLIS data, via eCHN, to approximately 1500 eCHN end-users (in the first phase of the Initiative, all end-users will be providers); the purposes and processes for sharing the OLIS data with providers; and the legislative authority under which eHealth Ontario may share OLIS data with end-users, via eCHN. The PIA also considers the technical, administrative and physical safeguards which have been put in place to ensure that all flows of PHI occur in a secure and privacy-protective manner, and are in compliance with legislative requirements, relevant agreements, and best practices as represented in the Canadian Standards Association Privacy Code and eHealth Ontario’s privacy policies.

The delta PIA concludes that eHealth Ontario has the overall PHIPA authorities for operating and managing the OLIS-eCHN initiative. Additionally, eHealth Ontario and eCHN, , each have a robust infrastructure for the processing and sharing of sensitive PHI, with policies and practices to protect the privacy of Ontarians and the security of the information retained by eHealth Ontario and by eCHN.

The delta PIA recommends several measures to ensure that, for the OLIS-eCHN initiative, eHealth Ontario is in compliance with policies, procedures and privacy best practices.

Risks and Recommendations

The delta PIA provides a number of recommendations for the OLIS-eCHN Initiative as summarized below:

1. As eCHN is acting as eHealth Ontario’s service provider and as a PHIPA sub-agent to the MOHLTC in respect of OLIS, eHealth Ontario, through agreement, will ensure that the physical, administrative and technical controls that it applies to OLIS data are also applied by eCHN to the subcopy of OLIS data in the eCHN database. eHealth Ontario will establish administrative controls with the consuming sites to ensure end-users at the sites do not collect the OLIS data for purposes other than that for which it was provided (i.e., to provide or assist in the provision of health care) and to ensure sites have proper user identity management processes in place. Additionally, agreements and training materials will include direction on privacy-related matters.
2. eHealth Ontario will develop training materials for eHealth Ontario and eCHN resources responsible for carrying out privacy operations for the OLIS-eCHN initiative.
3. The parties will keep in place the short-term technical fix and implement a long-term solution to ensure consent directives are transferred to eCHN’s system in all instances.
4. eHealth Ontario and eCHN will jointly develop processes and implement technology to ensure details of access to OLIS data, including substitute decision maker (SDM) information, by eCHN users are provided to eHealth Ontario.
5. eHealth Ontario will establish a retention schedule that applies to OLIS data in eCHN’s custody.
6. Only regulated health professionals (providers) will be permitted to access OLIS data via eCHN’s WebChart until system updates are implemented.
7. eHealth Ontario will update its individual access request process, and communication materials, for the OLIS-eCHN initiative to assist the MOHLTC in responding to access requests by individuals.
8. eHealth will review the PIA completed by eCHN on the OLIS-eCHN project and work with eCHN to mitigate any remaining risks identified in their PIA.

eHealth Ontario has implemented recommendations 2 to 8 and is in the process of implementing recommendation 1, noted above.