Ontario Laboratories Information System (OLIS) PIA Summary

Date of PIA Report: October 2011

Date PIA Summary Last Reviewed and Updated: December 2, 2025 (Rebranding)

The following is a summary of the above-referenced privacy impact assessment (PIA), including a brief background, key findings, and risks and recommendations as applicable. See our Privacy Contact page to find information on how to contact the Ontario Health Privacy Office should you have any questions.

Background

One of eHealth Ontario’s priorities is to lead the implementation of the Ontario Laboratories Information System (OLIS) initiative across the province. OLIS is a cornerstone information system that connects hospitals, community laboratories, public health laboratories and practitioners to facilitate the secure electronic exchange of laboratory test orders and results.

As a province-wide, integrated repository of tests and results, OLIS will contribute to fundamental improvements in patient care by providing practitioners with timely access to information that is needed at the time of clinical decision-making. The ability to electronically share laboratory test information through OLIS supports health care providers in making decisions on patient care and treatment.

OLIS includes the test results of individuals in Ontario who have had a laboratory test processed at one of the laboratories participating in OLIS. Individuals may withdraw consent to the use and disclosure of their personal health information (PHI) within OLIS. Withdrawal of consent may be applied to all of an individual’s lab information in OLIS, or only to tests on a specific lab order. If an individual’s consent has been withdrawn, only the health care provider(s) identified on the lab order(s) can access the applicable lab test information.

In December 2010, the Ministry of Health and Long-Term Care (MOHLTC), a health information custodian (HIC) under the Personal Health Information Protection Act, 2004 (PHIPA) assumed custody and control of patients laboratory test results in OLIS. The MOHLTC published a notice to inform the public that the MOHLTC was assuming custody and control of OLIS. The notice included information on how individuals can withdraw or reinstate their consent for their PHI in OLIS. Because OLIS contains PHI as defined by PHIPA, eHealth Ontario policies and O.Reg. 329/04 require that a PIA of the initiative be undertaken.

Key Findings

The OLIS Physical PIA considers the OLIS initiative as of August, 2011. Specifically, the scope of the OLIS PIA includes the flow of information to, within, and from OLIS to connected systems, the purposes and processes for using OLIS data and the legislative authority under which eHealth Ontario may operate and manage OLIS. The PIA also considers the technical, administrative and physical safeguards which have been put in place to ensure that all flows of PHI occur in a secure and privacy-protective manner, and are in compliance with legislative requirements, relevant agreements, best practices as represented in the Canadian Standards Association Privacy Code and eHealth Ontario’s privacy policies.

The PIA concludes that eHealth Ontario has the overall PHIPA authorities for operating and managing OLIS, as an agent to the MOHLTC, and for the purpose of creating or maintaining one or more electronic health records under s.6.2 of O.Reg. 329/04. Additionally, eHealth Ontario has a robust infrastructure for the processing of sensitive PHI, with policies and practices to protect the privacy of Ontarians and the security of the information retained by eHealth Ontario.

The PIA recommends several measures to ensure that, for the OLIS initiative, eHealth Ontario is in compliance with PHIPA and O.Reg. 329/04, as well as eHealth Ontario policies, procedures and privacy best practices.

Risks and Recommendations

The Physical PIA provides a number of recommendations associated with the OLIS initiative, as summarized below:

1. eHealth Ontario to work with MOHLTC to ensure that the ministry’s OLIS public notice is posted at all points of service (i.e., participating laboratories) and on the eHealth Ontario and MOHLTC websites.
2. OLIS to be modified to improve notice to the Practitioners named on a lab order regarding consent directives. Additionally, communication materials to be provided to physician practices to advise Practitioners collecting information from OLIS to ensure that they are aware of their patient’s consent directives.
3. Patients to be informed that withdrawing their consent to participate in OLIS may impact the availability of one or more of their lab results in the Chronic Disease Management System for Diabetes.
4. MOHLTC and eHealth Ontario should integrate OLIS with the enterprise master patient index, a repository of patient demographic information that will assist in reconciling multiple patient identifiers in OLIS.
5. eHealth Ontario to develop and implement a data retention policy for any data stored within eHealth Ontario repositories, including OLIS.
6. eHealth Ontario to develop and deliver role-based privacy training for eHealth Ontario staff that require access to PHI in OLIS.

eHealth Ontario is currently in the process of implementing each of the recommendations identified in the 2011 OLIS Physical PIA.