Privacy Impact Assessment Summaries

A Privacy Impact Assessment (PIA) is a risk management tool used by Ontario Health to assess a technology, program or information system’s privacy risks and its compliance with provincial and federal legislations, fair information principles, Ontario Health’s privacy policies and standards, contractual obligations and industry best practices. A PIA may also detail mitigating strategies through recommendations and an action plan. A critical element of the PIA process is the implementation of those recommendations detailed in the assessment. 

PIA summaries are published to ensure:

• transparency for everyone, including individuals whose personal and/or personal health information is collected, used, disclosed, retained or disposed of in relation to our programs, products or services
• compliance with the requirements for health information network providers outlined in Ontario Regulation 329/04 (s. 6(3)) under Personal Health Information Protection Act, 2004 (PHIPA).
• privacy considerations inform policy decision-making and system design choices
• communicating confidence that privacy requirements are being met and risks mitigated

A Privacy Impact Assessment is meant to be used and expanded over the cycle of the initiative’s development and implementation, to continuously identify and address risks that impact or have the potential to impact the confidentiality, integrity and accessibility of personal health information held or handled by Ontario Health and, or its partners. 

Without the express written consent of Ontario Health, the summaries or the content therein may not be copied, used, or redistributed outside of the purposes identified above.

For additional OTNhub Privacy Impact Assessment Summaries visit OTNhub Privacy Impact Assessment Summaries.

For additional Electronic Health Record (EHR) Privacy Impact Assessment Summaries visit eHealth Privacy Impact Assessments.

For additional information on PIA Summaries for Client Health & Related Information System (CHRIS) and related systems please contact the privacy office and a copy will be made available.