Digital Health Identifier: Description of Activities

The Personal Health Information Protection Act, 2004 (the “Act”) is a privacy law which primarily governs the collection, use and disclosure of personal health information. The Act sets out requirements for persons and organizations who manage personal health information to protect individuals’ privacy and their rights with respect to their personal health information. The Act permits organizations to be prescribed so that they can collect, use or disclose personal health information for specific purposes. Ontario Health is prescribed as the organization with the power and duty to carry out digital health identifier activities in accordance with Part V.2 of the Act and its associated regulation (Ontario Regulation 329/04).

As the prescribed organization in respect of digital health identifier activities, Ontario Health:

• provides services to validate and verify an individual’s identity, which involves:
  • validating the individual’s health card number and other personal health information from the individual’s health card by verifying it against the Registered Persons Database that is maintained by the Ministry of Health;
  • verifying that the individual who is providing the health card is who they say they are; and
  • using the results of the identity validation and verification process to create or renew an individual’s digital health identifier.
• provides services to authenticate an individual’s identity each time they use their digital health identifier to access a digital health tool. This involves confirming that it is the right individual accessing the right account for that digital health tool.
• provides account management services, which involves:
  • maintaining the confidentiality, integrity and availability of an individual’s digital health identifier and related personal health information; and
  • managing the activation, deactivation, reactivation or disposal of an individual’s digital health identifier and related personal health information.
• carries out other powers, duties or functions as prescribed.

Eligibility criteria

An individual can create a digital health identifier by signing up for a My Ontario Account for Health if they meet the following eligibility criteria:

• Must be an Ontario resident;
• Must have a valid (not expired) Ontario photo health card;
• Must be sixteen years of age or older;
• Must be able to use a mobile device with internet access to create an account; and
• Must have received an invitation from Ontario Health to sign up for a My Ontario Account for Health.

An individual can use their My Ontario Account for Health to securely access the digital health tool(s) listed below:

My Health Record

Digital Health Tool Owner: Ontario Health

Description: A secure online portal that provides Ontarians with access to their personal health information contained in the provincial Electronic Health Record.

Overview of administrative, technical and physical safeguards

Ontario Health has implemented administrative, technical and physical safeguards in an effort to:

• Protect against theft, loss and unauthorized collection, use or disclosure of an individual’s digital health identifier and related personal health information;
• Protect an individual’s digital health identifier and related personal health information against unauthorized copying, modification or disposal; and
• Protect the integrity, security and confidentiality of an individual’s digital health identifier and related personal health information.

For more information about Ontario Health’s safeguards in respect of digital health identifier activities, please refer to the Safeguards for the Protection of Personal Information and Personal Health Information.

For more information about Ontario Health’s general privacy practices, please refer to the Ontario Health Statement of Information Practices.

For more information about Ontario Health’s privacy practices in respect of the My Ontario Account for Health, please refer to Ontario Health’s My Ontario Account for Health Privacy Statement.