Electronic Health Record and Digital Health Identifier: Privacy Information

Electronic Health Record (EHR) Privacy Information 

Electronic Health Record

The electronic health record (EHR) contains a secure digital record of individuals’ personal health information contributed by authorized health information custodians. It is updated in near real time and available electronically to authorized health information custodians so that they can quickly collect, use, and disclose critical personal health information, thereby improving quality of care. Examples of health information custodians include: health care practitioners (including physicians, and nurses), hospitals, long-term care homes, retirement homes, pharmacies, laboratories, ambulance services, medical officers of health of boards of health and the Minister of Health.

Our Electronic Health Record Description and List of Repositories provides more information about the EHR and the kinds of information that it includes.

Ontario Health's role with the EHR

Ontario Health is prescribed as the organization which develops and maintains the EHR, (“the Prescribed Organization”) in accordance with Part V.1 of the Personal Health Information Protection Act, 2004 (PHIPA) and its associated regulation (Ontario Regulation 329/04). 

As a prescribed organization, Ontario Health:

• manages and integrates the personal health information it receives from health information custodians;
• ensures the proper functioning of the EHR;
• ensures the accuracy and quality of the personal health information in the EHR;
• conducts analyses of the personal health information in the EHR in order to provide alerts and reminders to health information custodians for their use in the provision of health care; and
• carries out other powers, duties or functions as prescribed.

For more information on the Prescribed Organization status and associated functions, duties and responsibilities when it comes to the EHR, please refer to the Prescribed Organization Statement of Information Practices.

Health Care Organizations and Providers Contributing Clinical Records to the EHR

Information on contributing organizations and data types can be found through ConnectingOntario. 

Who Can View Records in the EHR

In general, health information custodians will only be permitted to access the EHR to provide or assist in the provision of health care to an individual, or if the health information custodian has reasonable grounds to believe it is necessary to eliminate or reduce a significant risk of harm to a person, or group of persons.

Ontario Health may also provide personal health information that is held within the EHR to a coroner, the Chief Medical Officer of Health (CMOH), or a medical officer of health for purposes related to their duties under applicable laws. The Minister of Health may also direct Ontario Health as the Prescribed Organization to share personal health information for specified purposes, such as research, and Ontario Health must do so in accordance with the conditions of the PHIPA. Ontario Health also supports individuals who seek access or wish to make a consent directive in respect to their records of personal health information held in the EHR.

Our Electronic Health Record Description and List of Repositories provides more information on the EHR.

Access to EHR records 

An individual, or their substitute decision maker, can request access to their personal health information held within the EHR. You can request access to: 

• clinical records that are held in the EHR; 
• specified EHR audit records, including EHR access and transmission logs, EHR consent directive logs, and EHR consent override logs.

For information on how to request access to EHR records, please refer to Accessing Your Information - Electronic Health Record (EHR) and Digital Health Identifier (DHI).

Substitute Decision-maker (SDM)

A substitute decision-maker in relation to an individual means, unless the context requires otherwise, a person who is authorized under the Personal Health Information Protection Act, 2004 (PHIPA) to consent on behalf of the individual to the collection, use or disclosure of personal health information about the individual.

Request an Update After Completing an EHR Request for Access or Correction of Personal Health Information Form to Receive Printed Copies of My EHR Clinical Records

When you submit the EHR Request for Access or Correction of Personal Health Information Form to Ontario Health, Ontario Health assists health care providers in responding to your access requests for EHR clinical records. You will receive a response from the health care provider(s) that contributed the records to the EHR no later than 30 days from the date Ontario Health received your completed access request form. If additional time is needed to fulfill your access request, you will be notified by these health care providers who will advise you that they require an extension.

No Records Were Found in Response to an EHR Request for Access or Correction of Personal Health Information Form 

When you submit the EHR Request for Access or Correction of Personal Health Information Form to Ontario Health, Ontario Health provides the EHR clinical records to the health care provider(s) that contributed the records to the EHR. The EHR does not include all clinical records, because not all health care organizations and health care providers contribute to the EHR, and contributors to the EHR do not necessarily provide all of their clinical records to the EHR. If no records were found by Ontario Health, then it means the records you were looking for do not exist in the EHR. If you wish to obtain any clinical records that do not exist in the EHR, please contact your health care provider directly.

Obtain a Copy of Your Medical Claims History

A Personal Claims History (PCH) is a computer record of claims paid by the Ontario Health Insurance Plan (OHIP) under an individual health card number. To obtain a copy of your Personal Claims History, please contact the Ministry of Health.

Obtain your Clinical Records from a Retired Doctor

Please contact the College of Physicians and Surgeons of Ontario (CPSO) to seek assistance in locating such records. 

Transfer your Clinical Records from Your Former Health Care Provider to Your New Health Care Provider

Ontario Health cannot transfer records on behalf of health care providers. Please contact either your new or former health care provider.

Correct Personal Health Information Held Within the EHR 

An individual, or their substitute decision maker, can request correction of their personal health information held within the EHR if it is believed to be inaccurate or incomplete following an access request. Ontario Health facilitates correction requests on behalf of health information custodians who provide clinical records to the EHR. To request a health information custodian make a correction to personal health information in the EHR, please see Accessing Your Information - Electronic Health Record (EHR) and Digital Health Identifier (DHI).

Restrict Access to Personal Health Information in the EHR

A consent directive gives patients - or their substitute decision makers - the option to restrict access to personal health information in the EHR. If you - or your substitute decision maker - do not want to share health information with members of your health care team, you can restrict access by requesting a consent directive be added to your EHR. If a consent directive is in place and a clinician tries to access your record, a notification that your record is blocked will appear.

Restricting access doesn’t stop your records from being updated – new information will continue to be added by your health care providers throughout your health care journey. You can choose to unblock your record at any time by submitting a new request. Once the consent directive has been applied or removed, you will receive a confirmation letter.

Consent Overrides

In accordance with PHIPA, there are certain circumstances where a health information custodian may access information in the EHR which is subject to a consent directive. This is known as a consent override. The Electronic Health Record Consent Directive and Consent Override Policy outlines the circumstances where an override is permitted. The policy is available at Electronic Health Record Consent Directive and Consent Override Policy | Ontario Health.

Place a Consent Directive on your EHR Data

For information on how to make, modify, or withdraw a consent directive, see Managing Access to Your Electronic Health Record | Ontario Health.

Concerns About Access to Your EHR Records

As part of maintaining the privacy and security of the EHR and your EHR records, access is audited and monitored in accordance with the EHR Auditing and Monitoring Policy. If you have concerns about access to your EHR data or suspect someone has inappropriately accessed your EHR data, please contact your health care provider, your health care provider’s organization, or the Information and Privacy Commissioner of Ontario.

Ontario Health Protects EHR Records

Ontario Health has general safeguards in place for the protection of personal information and personal health information. For information, visit Safeguards for the Protection of Personal Information and Personal Health Information | Ontario Health. Ontario Health has also implemented administrative, technical and physical safeguards to:

• protect against theft, loss and unauthorized collection, use or disclosure of the personal health information accessible by means of the EHR;
• protect the personal health information accessible by means of the EHR against unauthorized copying, modification or disposal; and
• protect the integrity, security and confidentiality of the personal health information accessible by means of the EHR.

For more information about the EHR safeguards in place at Ontario Health please refer to the Electronic Health Record Description and List of Repositories | Ontario Health.

Digital Health Identifier (DHI) Privacy Information

Digital Health Identifier (DHI)

Ontario Health provides services for individuals to confirm their identity and create a Digital Health Identifier (DHI) in order to securely connect with specified digital health tools. For more information, please visit our Digital Health Identifier: Description of Activities page.

My Ontario Account for Health (MOAH)

My Ontario Account for Health is a service from Ontario Health. It helps you prove who you are using your Ontario health card, so you can safely see your health records and use other online health tools from the Government of Ontario. For more information, please refer to MOAH FAQ.

Registered Persons Database

This is a database maintained by the Ministry of Health, containing information on persons registered under the Ontario Health Insurance Plan (OHIP) and who are eligible for the Ontario Drug Program. For more information, please refer to the Registered Persons Database (RPDB) - Dataset - Ontario Data Catalogue.

Ontario Health's Role with Digital Health Identifiers

Ontario Health is prescribed as the organization with the power to carry out digital health identifier activities in accordance with Part V.2 of PHIPA and its associated regulation (Ontario Regulation 329/04).

As the prescribed organization in respect to digital health identifier activities, Ontario Health:

• provides services to validate and verify an individual’s identity, which involves:
  • validating the individual’s health card number and other personal health information from the individual’s health card by verifying it against the Registered Persons Database that is maintained by the Ministry of Health;
  • verifying that the individual who is providing the health card is who they say they are; and
  • using the results of the identity validation and verification process to create or renew an individual’s digital health identifier.
• provides services to authenticate an individual’s identity each time they use their digital health identifier to access a digital health tool. This involves confirming that it is the right individual accessing the right account for that digital health tool.
• provides account management services, which involves:
  • maintaining the confidentiality, integrity and availability of an individual’s digital health identifier and related personal health information; and
  • managing the activation, deactivation, reactivation or disposal of an individual’s digital health identifier and related personal health information.
• carries out other powers, duties or functions as prescribed.

Find more information at Digital Health Identifier: Description of Activities | Ontario Health.

Access to DHI Records 

An individual, or their substitute decision maker, can request access to their digital health identifier activity records, including records: 

• related to changes in the identifying information used in the creation or maintenance of the DHI;
• of consents that have been given or withdrawn in relation to the DHI, 
• related to validation and verification services; and 
• of the date on which a DHI was used to access My Health Record. 

Please note, such records are generated when an individual creates a My Ontario Account for Health. If you have not created a My Ontario Account for Health, Ontario Health will not have any records of this sort to provide to you. If you have created a My Ontario Account for Health, DHI activity records can be found under “Account Activity”.

For information on how to request access to DHI activity records, please refer to Accessing Your Information: Electronic Health Record (EHR) and Digital Health Identifier (DHI) | Ontario Health

Correction to Your DHI Records from Ontario Health

In accordance with the Personal Health Information Protection Act, 2004, individuals are not entitled to request a correction be made by Ontario Health for DHI records.

Concerns About Access to Your DHI Records

As part of maintaining the privacy and security of the DHI and DHI records, access is audited and monitored. If you have concerns about access to your DHI or suspect someone has inappropriately accessed your DHI records, please contact Ontario Health.

Ontario Health Protects Your DHI Records

Ontario Health has general safeguards in place for the protection of personal information and personal health information. For information, visit Safeguards for the Protection of Personal Information and Personal Health Information | Ontario Health. Ontario Health has also implemented administrative, technical and physical safeguards to:

• protect against theft, loss and unauthorized collection, use or disclosure of digital health identifiers; Protect digital health identifiers against unauthorized copying, modification or disposal; and 

• protect the integrity, security and confidentiality of digital health identifiers.

For more information about the DHI safeguards in place at Ontario Health please refer to the Digital Health Identifier: Description of Activities | Ontario Health.

Ontario Health Manages the Privacy of your EHR and DHI Records

In order to oversee, manage, and promote trust in the privacy of your EHR data, the privacy office at Ontario Health has established a privacy program, including privacy policies and information handling practices that apply throughout Ontario Health. The focus of this privacy program is to follow the relevant legislation and regulation, including the Personal Health Information Protection Act, 2004 (PHIPA), and to embed protection of your EHR data in all products, services, policies, procedures, and processes developed.

The Ontario Health Prescribed Organization Statement of Information Practices provides more information on the information practices, legislative authorities, and roles of Ontario Health when it comes to personal health information and personal information. The Privacy Resources for Programs and Services page is where you can find copies of privacy policies and more information about the Ontario Health privacy program.

Contact information to learn more about the privacy program and information practices of Ontario Health

For information on how to contact the Ontario Health Privacy Office, please visit our Privacy: Contact Us page. 

For questions related to the Ontario Laboratory Information System (OLIS) and Drug and Pharmacy Service Information (DHDR), not about the privacy practices of Ontario Health, please contact ServiceOntario at:

Toll Free: 1-800-291-1405

TTY: 1-800-387-5559

Contact information for concerns or complaints about the privacy practices of Ontario Health

If you have any concerns or complaints about these privacy practices, please contact the Ontario Health Privacy Office.

For inquiries or complaints not about the privacy practices of Ontario Health specifically related to the Ontario Laboratory Information System (OLIS) and Drug and Pharmacy Service Information (DHDR), please contact ServiceOntario at:

Toll Free: 1-800-291-1405

TTY: 1-800-387-5559