Digital Health Identifier Retention Standard
Policy Level Approval: Chief Executive Officer
Document Category: Standard
Document Number: INF-079.01-S
Document Sponsor (or Sponsors): Chief Executive Officer
Original Date of Approval: February 25, 2026
Date of Posting: February 26, 2026
Version Approval Date: February 25, 2026
- 1. Purpose, Objectives and Scope
- 2. Standard
- 3. Procedures
- 4. Responsibilities
- 5. Definitions and Acronyms
- 6. Review Cycle
- 7. References and/or Key Implementation Documents
- 8. Appendices
- 9. Standard Consultations
- 10. Policy Review History
- Appendix A: Retention Schedule (for both paper and electronic records)
1. Purpose, Objectives and Scope
1.1.1 This Standard and its procedures outline Ontario Health’s practices with respect to the retention of paper and electronic records held by Ontario Health under its authority as the Prescribed Organization (PO) under Part V.2 of the Personal Health Information Protection Act, 2004 (PHIPA), including personal health information (PHI) collected for the purposes of carrying out digital health identifier (DHI) activities.
1.2.1 This Standard and its procedures are intended to:
- enable Ontario Health to meet its obligations under PHIPA;
- enable Ontario Health to meet its obligations under any applicable manual for prescribed organizations as may be published from time to time by the Information and Privacy Commissioner of Ontario (IPC); and
- protect the privacy of individuals and the confidentiality of their PHI.
1.3.1 This Standard applies to Ontario Health when it acts under its authority as the prescribed organization for the purposes of Part V.2 of PHIPA.
1.3.2 This Standard applies to Employees, people leaders, board members, secondees, consultants, and other Ontario Health Agents.
1.3.3 This Standard applies to the retention of all records relating to Ontario Health’s digital health identifier (DHI) activities, including the following:
- Digital Health Identifier Records, meaning records of PHI that are under the custody or control of Ontario Health and are collected or used by Ontario Health under its authority as a prescribed organization for the purposes of Part V.2 of PHIPA, including the following:
- records related to a change in the identifying information used in the creation or maintenance of an individual’s My Ontario Account for Health;
- records of consents that have been given or withdrawn in relation to an individual’s My Ontario Account for Health;
- records related to validation and verification services; and
- records of the date on which an individual used the My Ontario Account for Health to access a Digital Health Tool (including My Health Record).
- Documents created and/or received in relation to inquiries or complaints regarding compliance with PHIPA and its regulations and individual requests for access to DHI Activity Records made under the PHIPA.
- Investigation of Privacy Incidents and/or security incidents relating to DHI activities.
- System-level logs, tracking logs, reports and related documents for privacy and security tasks relating to DHI activities that do not contain PHI or PI.
- Documents created, collected and retained for legal, regulatory or business purposes including:
- templates or resources developed in respect of DHI activities;
- assurance-related documents; and
- business-related documents.
1.4.1 Compliance with this Standard in its entirety is mandatory unless an exception to a specific section is approved by the Chief Privacy Officer (CPO) or delegate in writing. Failure to comply with the requirements of this Standard, without a written exception, may result in disciplinary action up to and including revocation of appointment, termination of employment or termination of contract without notice or compensation.
1.4.2 Compliance will be audited in accordance with and as per the frequency outlined in the Privacy Audit & Compliance Policy.
1.4.3 At the first reasonable opportunity upon identifying or becoming aware of a breach of this Standard, an employee or other Ontario Health Agent must notify the Privacy Office by reporting the breach to Enterprise Service Desk Phone: 1-866-250-1554; or Email: OH-servicedesk@ontariohealth.ca
1.4.4 Breaches of this Standard will be managed in accordance with the Privacy Incident Management Policy and Procedure.
1.4.5 Compliance with Ontario Health policies will be enforced in accordance with the Progressive Discipline Policy.
1.5.1 The words “include” and “including” when used are not intended to be exclusive and mean, respectively, “include, without limitation,” and “including, but not limited to”.
1.5.2 Capitalized terms in this Standard have the meanings are set out in the Definition and Acronyms section (Section 5). Acronyms are defined in-text, in parentheses, following their first use.
1.5.3 The terms “collect”, “disclose”, “health information custodian”, “health number”, “prescribed organization”, “record” and “use” have the meanings given to them in PHIPA.
2. Standard
2.1.1 Ontario Health ensures that records of PHI that are collected or used by Ontario Health under its authority as a prescribed organization for the purposes of Part V.2 of PHIPA are retained for only as long as necessary for the purpose of carrying out the DHI activities and in accordance with PHIPA.
2.1.2 Appendix A: Retention Schedule sets out the retention periods for each type of record, including Digital Health Identifier Records in both paper and electronic formats.
2.2.1 Ontario Health is committed to retaining Digital Health Identifier Records in a secure manner. Ontario Health ensures that records of PHI are retained in a secure manner in accordance with the Personal Health Information Handling Standard and industry security standards and best practices. The VP, Access Products and Services is responsible for ensuring the secure retention of these records.
2.2.2 The form (identifiable/de-identified) in which Digital Health Identifier Records are retained will be determined and implemented in accordance with the Personal Health Information Handling Standard, and in consideration of the purpose of carrying out the DHI activities.
2.2.3 The precise methods by which records of PHI in paper and electronic format are securely retained, including records retained on various media, is determined and implemented in accordance with the Personal Health Information Handling Standard, Information Classification and Handling Standard and the Information Classification and Handling Guidelines.
2.2.4 Employees and other Ontario Health Agents must take steps that are reasonable in the circumstances to ensure that retained PHI is not used or disclosed without authority and is protected against theft, loss and unauthorized use or disclosure, and that records of PHI are protected against unauthorized copying, modification or disposal.
2.2.5 The Information Security Risk Management Standard identifies the Ontario Health Agent(s) responsible for retaining the system control and audit logs, as well as where these items are retained.
2.3.1 Ontario Health must ensure that any third party it retains to assist in providing services for the purpose of carrying out DHI activities agrees to comply with the restrictions and conditions that are necessary to enable Ontario Health to comply with Part V.2 of PHIPA.
2.3.2 Should Ontario Health choose to contract or otherwise engage with a Third-Party Service Provider to retain Digital Health Identifier Records or other records that contain PHI, it must ensure that the written agreement executed with the third party service provider contains obligations, restrictions and conditions in accordance with Privacy Use and Disclosure Policy, applicable Ontario Health privacy and security policies, and PHIPA.
2.4.1 Ontario Health has in place safeguards to ensure the secure transfer and disposal of records of PHI. Accordingly, the transfer and disposal of Digital Health Identifier Records that are no longer required to fulfill the identified purpose must be handled in accordance with the Personal Health Information Handling Standard, Secure Transfer of Sensitive Information Standard, Media Destruction, Sanitization and Disposal Standard, Information Classification and Handling Standard, Information Classification and Handling Guidelines and any applicable DHI security policies.
2.4.2 Ontario Health has in place reasonable safeguards to ensure that records of PHI that have been collected for the purpose of carrying out DHI activities are securely disposed of following the expiry of the retention period set out in Appendix A: Retention
3. Procedures
3.1.1 Ontario Health ensures the records identified in this Standard are retained in accordance with the retention periods outlined in Appendix A: Retention Schedule.
3.1.2 At the end of the retention period specified in Appendix A: Retention Schedule, Ontario Health’s Cyber Security Office, in collaboration with applicable business units, ensures that such records are securely disposed of in accordance with Ontario Health ’s Media and Data Destruction, Sanitization, and Disposal Standard.
4. Responsibilities
4.1.1 Ensures compliance with PHIPA and ensures relevant Ontario Health policies and procedures are put in place.
4.1.2 Responsible for the overall accountability and the day-to-day operations of the privacy program.
4.2.1 Authors and maintains this Standard.
4.3.1 Responsible for ensuring the secure retention of Digital Health Identifier Records in compliance with this Standard.
4.4.1 Ensures that DHCAP and supporting teams operate in compliance with this Standard.
4.4.2 Oversees all activities related to the retention of Digital Health Identifier Records.
4.5.1 Responsible for secure deletion of Digital Health Identifier records.
4.6.1 Responsible for setting standards, policies and procedures for secure deletion of records.
4.7.1 Ensure compliance in accordance with the procedures set out in this Standard.
4.7.2 Support the implementation of this Standard including all activities related to retention of Digital Health Identifier Records.
5. Definitions and Acronyms
CPO: Chief Privacy Officer
DHI: Digital health Identifier
DHI Activity Records: Any of the following records:
- records related to a change in the identifying information used in the creation or maintenance of an individual’s My Ontario Account for Health;
- records of consents that have been given or withdrawn in relation to an individual’s My Ontario Account for Health;
- records related to Validation and Verification Services; and
- records of the date on which an individual used the My Ontario Account for Health to access a Digital Health Tool (including My Health Record).
Digital Health Identifier Records: Records of PHI that are under the custody or control of Ontario Health and are collected or used by Ontario Health under its authority as a prescribed organization for the purposes of Part V.2 of PHIPA.
Digital Health Tool: Any digital platform, provided by either Ontario Health or an authorized health information custodian, that may be accessed by individuals through their My Ontario Account for Health.
Employee: A person employed and compensated by Ontario Health as an Employee, and is classified as either permanent full-time, permanent part-time, temporary full-time, temporary part-time, paid student or casual, as set out in the Employee Classification Guideline. A consultant or contractor is not an Employee.
IPC: Information and Privacy Commissioner of Ontario
My Health Record: A Digital Health Tool provided by Ontario Health that provides individuals who have a My Ontario Account for Health with digital access to certain of their health records that are contained in the Ontario Laboratories Information System and the Digital Health Drug Repository, which are held in the provincial Electronic Health Record maintained by Ontario Health.
My Ontario Account for Health: The application through which an individual may validate and verify their identity and authenticate themselves to access Digital Health Tools
O.329/04: Ontario Regulation 329/04 made under PHIPA
Ontario Health Agent: A person that acts for or on behalf of Ontario Health for the purposes of Ontario Health , and not for the person’s own purposes, whether or not the person has the authority to bind Ontario Health , whether or not the person is an Employee, and whether or not the person is being remunerated.
PHI or Personal Health Information: Has the meaning set out in s. 4 of PHIPA. Specifically, it is “identifying information” in oral or recorded form about an individual that:
- relates to the physical or mental health of the individual, including information that consists of the health history of the individual’s family;
- relates to the provision of health care to the individual, including the identification of a person as a provider of health care to the individual;
- Is a plan that sets out the home and community care services for the individual to be provided by a health service provider or Ontario Health Team pursuant to funding under section 21 of the Connecting Care Act, 2019;
- relates to payments or eligibility for health care or eligibility for coverage for health care, in respect of the individual;
- relates to the donation by the individual of any body part or bodily substance of the individual or that is derived from the testing or examination of any such body part or bodily substance;
- is the individual’s health number;
- identifies an individual’s substitute decision-maker; or
- is the individual’s digital health identifier or other identifying information related to the creation of the digital health identifier.
PHI includes identifying information about an individual that is not listed above but that is contained in a record that includes PHI listed above.
Information is “identifying” when it identifies an individual or when it is reasonably foreseeable in the circumstances that it could be utilized, either alone or with other information, to identify the individual.
PHIPA: Personal Health Information Protection Act, 2004.
References to PHIPA include O. Reg. 329/04, as may be amended or replaced from time to time.
PI or Personal Information: Subject to the provisions of FIPPA, as applicable, Personal Information has the meaning set out in section 2 of FIPPA. Specifically, it means recorded information about an identifiable individual, including:
- information relating to the race, national or ethnic origin, colour, religion, age, sex, sexual orientation or marital or family status of the individual;
- information relating to the education or the medical, psychiatric, psychological, criminal or employment history of the individual or information relating to financial transactions in which the individual has been involved;
- any identifying number, symbol or other particular assigned to the individual;
- the address, telephone number, fingerprints or blood type of the individual;
- the personal opinions or views of the individual except where they relate to another individual;
- correspondence sent to an institution by the individual that is implicitly or explicitly of a private or confidential nature, and replies to that correspondence that would reveal the contents of the original correspondence;
- the views or opinions of another individual about the individual; and
- the individual’s name where it appears with other personal information relating to the individual or where the disclosure of the name would reveal other personal information about the individual.
Personal Information also includes information that is not recorded and that is otherwise defined as Personal Information when considering the manner of collection, notice to public, privacy impact assessments and safeguards. Footnote: Section 38 (1) FIPPA.
PIA: Privacy Impact Assessment
Prescribed Organization or PO: The organization prescribed in Ontario Regulation 329/04 as the organization for the purposes of PHIPA. The Prescribed Organization has the power and the duty to develop and maintain the EHR in accordance with Part V.1 of PHIPA, and the power to carry out digital health identifier activities in accordance with Part V.2 of PHIPA.
Privacy Breach: A Privacy Breach includes:
1) Privacy Breach of PHI or PI (Privacy PHI/PI Breach) means an event where:
- The Collection, Use or Disclosure of PHI or PI is not in compliance with PHIPA or its regulation, or with FIPPA or its regulations (i.e. without legal authority); and/or
- The Viewing, handling or otherwise dealing with PHI provided to Ontario Health is not in compliance with PHIPA, or its regulation;
- PHI or PI is stolen, lost or subject to unauthorized Collection, Use or Disclosure or where records of PHI or PI are subject to unauthorized copying, modification, or disposal.
Note: A Privacy PHI/PI Breach does not include a breach of De-identified Information, or Business Identity Information, if the event does involve PI or PHI.
2) Privacy Breach of Privacy Policy or Agreement (Privacy Policy/Agreement Breach) means an event where:
- There is a contravention of Ontario Health’s privacy policies, procedures or practices; and/or
- There is a contravention of a privacy-related term or condition in a:
- data sharing agreements,
- research agreements,
- confidentiality agreements, or
- agreements with third party service providers retained by Ontario Health to handle PHI or PI,
- written acknowledgements acknowledging and agreeing not to use PHI or PI which has been de-identified and/or aggregated, to identify an individual; and
- Does not include a privacy breach of PHI or PI
Note: A Privacy Policy/Agreement Breach may include a breach that involves De-identified Information or Business Identity Information, if the breach relates to privacy controls in an agreement or a privacy policy, procedure or practice related to handling of De-identified Information or Business Identity Information.
Privacy Incident: Any event where the Privacy Office is notified or becomes aware that a Privacy Breach may have occurred. This includes events that are reviewed/investigated and are:
- Confirmed to be a Privacy Breach;
- Confirmed not to be a Privacy Breach; or
- It cannot or has not been determined if a Privacy Breach occurred (Suspected Privacy Breach).
Note: Privacy Incidents include events involving PI and PHI, as well as De-identified Information and Business Identity Information as these events require investigation in accordance with this Policy to confirm if they are Privacy Breaches as defined below. Ontario Health shall investigate these incidents involving De-identified Data and Business Identity Information, considering factors such as the 1) risk of re-identification and related de-identification guidelines for De-identified Data, as well as 2) the context for handling data that Ontario Health received as Business Identity Information, to confirm that it does not constitute PI, respectively.
Third-Party Service Provider: A third-party contracted or otherwise engaged to provide services to Ontario Health, including Electronic Service Providers.
TRA: Threat Risk Assessment
Validation and Verification Services: Services provided by Ontario Health that:
- validate the health number and additional PHI from the health card provided by an individual, including by relying on a database for health cards maintained by the Minister;
- verify that an individual who is providing the health number or additional PHI, and such other identifying information as may be requested by Ontario Health, is the individual to whom the health number or PHI relates;
- rely upon the services described in clauses (a) and (b), or such other services as may be prescribed by O. Reg. 329/04, to create or renew an individual’s digital health identifier; or
- are prescribed by O. Reg. 329/04.
6. Review Cycle
This Standard is to be reviewed at least within three years of its effective date or earlier if required in accordance with the Privacy Audit and Compliance Policy.
7. References and/or Key Implementation Documents
- Personal Health Information Protection Act, 2004; Ontario Regulation, 329/04.
- Privacy Audit and Compliance Policy
- Privacy Incident Management Policy and Procedure
- Records and Information Management Policy
- Information Classification and Handling Standard
- Information Classification and Handling Guidelines
- Information Security Risk Management Standard
- Personal Health Information Handling Standard
- Media Destruction, Sanitization and Disposal Standard
- Applicable DHI security policies
8. Appendices
- Appendix A: Retention Schedule (for both paper and electronic format)
9. Standard Consultations
- Staff from the Privacy Office and other Ontario Health Agents responsible for drafting, maintaining and/or reviewing the privacy policies in reference to Ontario Health ’s privacy requirements.
10. Policy Review History
February 2026: The policy was approved on February 25, 2026, by the Ontario Health Chief Privacy Officer.
Appendix A: Retention Schedule (for both paper and electronic records)
Ontario Health must retain records identified below in accordance with the corresponding retention period and ensure that the records are disposed of in a secure manner as soon as reasonably possible after the expiration of the retention period noted below.
Record Type
Records of PHI that are collected directly from individuals for account management services and authentication services:
- Name as it appears on an individual’s Ontario health card
- Email address
- Date of birth
Retention Period
The earlier of the following:
- such time as the individual to whom the PHI relates withdraws their consent to Ontario Health’s continued use of such information; or
- two years from the date on which the individual to whom the PHI relates last used their My Ontario Account for Health.
Record Type
Records of PHI that are collected directly from individuals for Validation and Verification Services:
- Photos of Ontario photo health card (front and back), including health card number and version code
- Images of individuals (portrait “selfies”) and video and sound recordings
Retention Period
- Temporary, until verification result is achieved
Record Type
Records of PHI that are collected automatically through an individual’s use of their My Ontario Account for Health:
- records relating to a change in the identifying information used in the creation or maintenance of an individual’s My Ontario Account for Health;
- records of consents that have been given or withdrawn in relation to an individual’s My Ontario Account for Health;
- records relating to an individual’s use of the validation and verification services; and
- records of the date on which an individual used the My Ontario Account for Health to access a Digital Health Tool (including My Health Record).
(collectively, DHI Activity Records)
Retention Period
The earlier of the following:
- such time as the individual to whom the PHI relates withdraws their consent to Ontario Health’s continued use of such information; or
- two years from the date on which the individual to whom the PHI relates last used their My Ontario Account for Health.
Record Type
- Audit reports that contain PHI created and maintained for troubleshooting and other operational purposes
- Retention Period
- No longer than 60 days unless otherwise authorized by Ontario Health
Record Type
- Audit logs that are maintained in respect of all electronic records that Ontario Health is required to keep for the purpose of providing DHI activities
Retention Period
- Two years from the date on which the individual to whom the PHI relates last used their My Ontario Account for Health
Record Type
- Backups of DHI Activity Records
- Backups of audit logs and audit reports containing PHI
Retention Period
- 30 days
Record Type
Information received and/collected in relation to the following:
- Inquiries, concerns or complaints regarding compliance with PHIPA and its regulations; and
- Requests for access to Digital Health Identifier Records
Retention Period
The longer of the following:
- Two years after the request, inquiry or complaints has been closed by Ontario Health or the IPC, whichever is longer; or
- As specified in the Privacy Complaints and Inquiries Policy and Procedure, the Digital Health Identifier Privacy Inquiries and Complaints Policy and Procedure, or the Digital Health Identifier Request for Access to Personal Health Information Policy and Procedure as applicable.
Record Type
- Information created about an individual as part of an investigation related to privacy incidents and/or security incidents
Retention Period
The longer of the following:
- Two years after the privacy breach has been closed by Ontario Health or the IPC; or
- As specified in the Privacy Incident Management Policy and Procedure
Record Type
- Privacy and security training templates
- Notice for obtaining consent templates
Retention Period
- Two years
Record Type
- Privacy impact assessment recommendation (PIA) report and associated decisions and directions.
- PIA and associated decisions and directions.
- Threat and risk assessment (TRA) including TRA summaries.
Record Type
- Privacy and security readiness self-assessment and associated decisions and directions.
- Privacy and security operational self-attestation and associated decisions and directions.
Record Type
- Remediation plans and associated decisions and directions.
- Status of remediation implementation report.
Record Type
- Remediation attestation.
- Non-compliance reports and associated recommendations.
- Compliance monitoring reports.
- Audit reports and associated recommendations and decisions and directions.
Record Type
- Asset listing for DHI activities
- Risk listing of threat and vulnerability ratings for DHI activities
Record Type
- Business continuity plan
Retention Period
- 10 years for all Assurance-related documents.
Record Type
- Applicable committee meeting minutes
Retention Period
- Seven years
Record Type:
- Log of all system-level access
- Log of information system events
- Log of all activities of their information system administrators and information system operators
- Log all information system events on their identity provider services and data contribution endpoints
- Log of all activities of administrators and operators on their identity provider services and their data contribution end points
- List of all agents or Electronic Service Providers who have authorized access to identity provider technology and data contribution endpoints logs
- List of all agents or Electronic Service Providers who have authorized access to logs
- Log of the destruction of Digital Health Identifier Records
- List of vulnerability and configuration scanning tools which are approved by Ontario Health
- List of distribution of copies of paper material classified as ‘restricted’
- Logs related to responses to requests for access
- Notices and reports of Privacy Breaches/security incidents
- Privacy breach management investigation report/security incident report
- Log of Privacy Breaches
- Log of security incidents
- Privacy Breach management remediation report
- Status of Privacy Breach management remediation report
- Log of information relating to Privacy Inquiries
- Log of receipt of complaints
- Copy of response or log of responses to complaints
Retention Period
- Two years (except as otherwise specifically set out in the privacy policy governing the maintenance of such system-level logs) for all system-level logs relating to DHI activities that do not contain PHI
Last Updated: March 16, 2026
