Sector Capacity and Performance Electronic Canadian Triage and Acuity Scale (eCTAS) PIA Summary
Date of PIA Report: September 28, 2016
Date PIA Summary Last Reviewed and Updated: May 26, 2025
The following is a summary of the above-referenced Privacy Impact Assessment (PIA), including a brief background, key findings, and risks and recommendations as applicable. See our Contact page to find information on how to contact the Ontario Health Privacy Office should you have any questions.
Background
Ontario Health (Cancer Care Ontario) Access to Care (ATC) program is leading the eCTAS initiative at Ontario Health. ATC has been tasked by the Ministry of Health and Long-Term Care (MOHLTC) with developing an electronic, intelligent Canadian Triage and Acuity Scale (CTAS) system to support Emergency Department (ED) triage in Ontario. The CTAS Guideline was developed in 1995 to enable ED nurses and physicians to:
- triage patients according to the type and severity of their presenting signs and symptoms;
- ensure that the sickest patients are seen first when ED capacity has been exceeded due to visit rates or reduced access to other services; and
- ensure that a patient's need for care is reassessed while in the ED.
The use of the CTAS Guideline is an Accreditation Canada “Required Organizational Practice” in all Canadian EDs. The CTAS triage level assigned to each ED patient is also a mandatory data element for reporting to the Canadian Institute for Health Information (CIHI).
The eCTAS initiative includes the following overall goals:
- to develop an eCTAS system that supports triage nurses to assess and prioritize patients requiring urgent care in a standardized manner according to the CTAS guidelines;
- to deliver a solution to hospitals so that eCTAS is highly available and accessible to ED sites over the Internet;
- to ensure that the solution is available to participating hospitals in Ontario;
- to establish a provincial database of clinical triage data to enable reporting and quality monitoring of triage assessments sourced from a provincial repository, as well as the sharing of patient visit information across EDs to support triage nurses with patient assessments;
- to ensure triage performed electronically is responsive and efficient for nurses; and
- to support multiple triage workflows and promote interoperability with various health information systems.
For Phase 1 & 2 of the project, approximately 110 hospitals will participate in the implementation and testing of eCTAS models.
Although there are three integration options available to participating hospitals, the PIA considered only the Web Application option since it will involve the greatest number of collections, uses and disclosure of data. The other two integration options, Web Service and Certification Site, will only involve some of the collections, uses and disclosures of data described in the PIA.
There are three parts to the data flow for the Web Application option. All data in each of these three parts is stored in Canada via Microsoft’s Azure service.
- In Part 1 (Previous ED Visit - Patient Search), a triage nurse will upload patient personal health information (PHI) to the eCTAS system in real-time. The uploaded PHI will be used as an automated search query to identify patient triage record summaries in the eCTAS database from the previous 10 days (i.e., recent visits by the patient to any participating hospital ED). If there is a complete match, those records of previous ER visits will be available through an alert for review by the triage nurse. The triage nurse can then consider those recent ED visits when generating a CTAS score for the current ED visit.
- In Part 2 (CTAS Score), the triage nurse enters additional patient PHI into the eCTAS application in real-time to document the clinical assessment, and to determine a CTAS score. The hospital's information systems captures that PHI and the resulting CTAS score. CCO retains that PHI (including the resulting CTAS score) in the form of a patient triage record summary and stores it in the eCTAS database. Following its creation, that triage record summary will be accessible via the eCTAS database to the ED that created it.
- In Part 3 (eCTAS Reporting), the patient triage records captured in Part 2, together with the CTAS scores, are stored in the eCTAS database for ongoing use by CCO in generating aggregate reports for the MOHLTC and other stakeholders. These reports do not contain PHI.
Key Findings
The PIA concludes that Ontario Health has two main roles in the collection, use and disclosure of PHI as part of the eCTAS initiative:
- “Service Provider / Health Information Network Provider (HINP) Role” - in providing PHI-related services to participating hospitals; and
- “Prescribed Entity Role” - in collecting patient triage record summaries for the purposes of health system planning and resource allocation.
Ontario Health’s authority for these roles is found in agreements between the MOHLTC and Ontario Health; in the Personal Health Information Protection Act, 2004 (PHIPA); and in agreements between Ontario Health and participating hospitals.
- “Service Provider / HINP Role” - Ontario Health's authority is derived from a Memorandum of Understanding (2009) between CCO and the MOHLTC and supplemented by an Accountability Agreement (2014-2017) between CCO and the MOHLTC; a Master Data Sharing Agreement (MDSA) with all participating hospitals; and the provider / HINP requirements under subsection 10(4) of PHIPA and section 6 of the Regulation to PHIPA.
- “Prescribed Entity Role” - CCO has authority as a prescribed entity under section 45 of PHIPA.
Risks & Recommendations
In summary, the following risks have been identified by the PIA and are currently being mitigated.
- Ontario Health has not developed a plain language description of the HINP-related services that meets PHIPA's HINP requirements. Such a description must be provided to participating hospitals and made available to the public.
- Ontario Health has not developed a process for making audit logs available to participating hospitals upon request. Audit logs capture information related to:
- the individuals who have accessed a hospital's triage record summaries, including time and date of access;
- who initiated a disclosure of that hospital's patient triage record summaries to another participating hospital (e.g., the user at the hospital that conducted the search for recent ED visits);
- what hospital received a copy of the patient triage record summaries; and
- the date and time of the disclosure.
- Ontario Health's public disclosure channels may not discuss or address the eCTAS initiative. This may result in complaints or challenges as to Ontario Health's openness in its handling of PHI.
Last Updated: June 18, 2025