Debate continues on Ontario health privacy breach law

A bill proposing to double the fines for violations of Ontario’s Personal Health Information Protection Act was a subject of debate Tuesday at Queen’s Park in Toronto.

Bill 119, the Health Information Protection Act, was tabled Sept. 16 by Liberal Health Minister Eric Hoskins.

Among other things, Bill 119, if passed into law, would double the maximum fines for offences, under the Personal Health Information Protection Act, from $50,000 to $100,000 for individuals and from $250,000 to $500,000 for organizations,” said Indira Naidoo-Harris Liberal MPP for Halton and parliamentary assistant to Hoskins, at Queen’s Park Tuesday.

Other changes proposed in Bill 119 “include making it mandatory to report privacy breaches as defined in regulation,” Naidoo-Harris added.

“Anyone who is considering doing something that would be contrary to the legislation knows that the bill makes it mandatory, if someone is aware that a breach has taken place, that it must be reported,” said John Yakabuski, Progressive Conservative MPP for Renfrew-Nipissing-Pembroke.

“Somebody is not going to commit a breach and it’s going to be, ‘Listen, bud, you were wrong. You breached the act, and you shouldn’t have done that,'” Yakabuski said. “No, it goes much further now. It’s going to ensure that there is a mandatory reporting provision in the bill, so it can’t just end in a conversation over the water cooler, ‘Don’t let that happen again.’ No, it moves up a level to the privacy commissioner and to any relevant regulatory college. If that person is a member of the College of Physicians and Surgeons, it would be elevated to that college.

Related: Legislation doubling fines for medical privacy breaches before Ontario legislature

With Bill 119, the government proposes to add a new section of Personal Health Information Protection Act requiring health information “custodians” to take “reasonable steps to ensure that personal health information is not collected without authority.” Those custodians would also be required to inform the professional colleges of self-regulating health professions, if a health professional “has committed or is suspected of having committed an unauthorized collection, use, disclosure, retention or disposal of personal health information and if, as a result of such unauthorized action, the custodian takes disciplinary action with respect to the member’s employment, privileges or affiliation.”

During a debate this past November, Hoskins explained how prosecutions would change if Bill 119 is passed into law.

“Currently, there is a six-month limitation period from when a breach is alleged to have occurred to when a prosecution must commence,” Hoskins told the legislature Nov. 19. “This has often left very little time to conduct a proper investigation. We are proposing an amendment that, if passed, will remove that six-month limitation period, which will give us more time to investigate the circumstances surrounding privacy breaches that could lead to successful prosecutions.”