OTNhub Statement of Information Practices
Ontario Health’s mandate is set out in the Connecting Care Act, 2019. It includes implementation of health system strategies developed by the Ministry of Health, through various information technology and data management services.
Description of Services
Ontario Health's OTNhub offers an integrated suite of services that support virtual care activity for clinical, education and administrative purposes for use by the health care community in Ontario. These services include videoconferencing (via room-based systems, personal computer or on mobile devices), eConsult, directory access to health care professionals and sites, scheduling, secure messaging. For complete descriptions of OTNhub services and the safeguards implemented by Ontario Health in relation to each service, please visit Health Information Network Provider Services.
Authority to Collect, Use and Disclose Personal Information and Personal Health Information
Ontario Health's authority to collect, use and disclose of personal information (PI) and personal health information (PHI) comes from provincial privacy laws, primarily the Personal Health Information Protection Act, 2004, including enabling regulations (PHIPA), and the Freedom of Information and Protection of Privacy Act, including enabling regulations (FIPPA). PHIPA governs the management of PHI to ensure the confidentiality and privacy of that information, while facilitating the effective delivery of health care services.
Role(s) under PHIPA
The following outlines the PHIPA roles that Ontario Health assumes and the associated requirements when delivering OTNhub services.
Agent
The term “Agent” is defined in PHIPA as follows:
“agent”, in relation to a health information custodian (HIC), means a person that, with the authorization of the custodian, acts for or on behalf of the custodian in respect of personal health information for the purposes of the custodian, and not the agent’s own purposes, whether or not the agent has the authority to bind the custodian, whether or not the agent is employed by the custodian, and whether or not the agent is being remunerated.
In accordance with PHIPA, and subject to any exceptions that may be prescribed, an Agent of a health information custodian (“HIC”) may collect, use, disclose, retain or dispose of personal health information (“PHI”) only if:
- the collection, use, disclosure, retention or disposal of the PHI, as the case may be,
- is permitted by the HIC in accordance with PHIPA,
- is necessary for the purpose of carrying out duties as agent of the HIC,
- is not contrary to PHIPA or another law, and
- complies with any conditions or restrictions that the HIC has imposed; and
- the prescribed requirements, if any, are met.
eService Provider
An electronic service provider (“eService Provider” or “eSP”) is in PHIPA pursuant to s. 6(1) of the Regulation as follows:
“a person who supplies services for the purpose of enabling a health information custodian to use electronic means to collect, use, modify, disclose, retain or dispose of personal health information,” and who is not an agent of the custodian [emphasis added].
Where Ontario Health is acting as an eService Provider, and is not an agent of the HIC, Ontario Health must comply with the following requirements:
Requirement 1
Ontario Health cannot use any PHI to which it has access in the course of providing the services for the HIC except as necessary in the course of providing the services.
Requirement 2
Ontario Health cannot disclose any PHI to which it has access in the course of providing the services for the HIC.
Requirement 3
Ontario Health cannot permit its employees or any person acting on its behalf to be able to have access to the PHI unless the employee or person acting on its behalf agrees to comply with the restrictions that apply to Ontario Health as an eService Provider.
Health Information Network Provider
A health information network provider (“HINP”) is defined in PHIPA pursuant to s. 6(2) of O. Reg. 329/04 (the “Regulation”) as follows:
“health information network provider” or “provider” means a person who provides services to two or more health information custodians where the services are provided primarily to custodians to enable the custodians to use electronic means to disclose personal health information to one another, whether or not the person is an agent of any of the custodians.
Where acting as a HINP, Ontario Health is required to comply with the following prescribed requirements in the course of providing services to enable a HIC to use electronic means to collect, use, disclose, retain or dispose of PHI:
Requirement 1
Ontario Health will notify every applicable HIC at the first reasonable opportunity of any privacy breach related to the unauthorized or inappropriate access, use, disclosure, modification, copying, disposal or retention of PHI managed by Ontario Health in the course of delivering its programs or services.
Requirement 2
Ontario Health will provide every applicable HIC with a plain-language description of the services that it provides to HICs that is appropriate for sharing with the individuals to whom the PHI relates, including a general description of the safeguards in place to protect against unauthorized use and disclosure, and to protect the integrity of the information.
Requirement 3
Ontario Health will make available to the public a plain-language description of its services and the safeguards implemented in relation to the security and confidentiality of PHI, as well as any directives, guidelines and policies of Ontario Health that apply to the services.
Requirement 4
To the extent reasonably practical, and in a manner that is reasonably practical, Ontario Health will keep and make available to the applicable HIC, upon request from that HIC, an electronic record of:
- all accesses to all or part of the PHI associated with the HIC being held in equipment controlled by Ontario Health (as the provider), which identifies the person who accessed the information and the date and time of the access, and
- all transfers of all or part of the PHI associated with the HIC by means of equipment controlled by the provider, which identifies the person who transferred the information and the person or address to whom it was sent, and the date and time it was sent.
Requirement 5
Ontario Health will perform a privacy impact assessment and threat and risk assessment of the services provided and will provide to each applicable HIC a written summary of the results of the assessments.
Requirement 6
Ontario Health will ensure that any third parties it retains to assist in the provision of the services to a HIC agrees to comply with the privacy and security restrictions and conditions that are necessary to enable Ontario Health (as the provider) and applicable the HICs to comply with their obligations under PHIPA.
Requirement 7
Ontario Health will enter into a written agreement with each HIC concerning the services provided to that HIC. The agreement will describe the services provided to the HIC, the administrative, technical and physical safeguards related to the confidentiality and security of any PHI, and the requirements under PHIPA and the Regulation with which Ontario Health must comply as a result of providing the services.
PHIPA Roles by OTNhub Program and Service
Program or Service: OTNhub eVisit
Associate PHIPA Role(s): Agent, eService Provider, and Health Information Network Provider
Description of Roles and Responsibilities:
Agent: Where Ontario Health schedules OTNhub eVisit events (in accessing and handling PHI) on behalf of Member Organizations and/or health care providers.
Where Ontario Health accesses PHI and/or personal information (PI) if required to perform a function that the HIC cannot do or where it delegates this function to OH.
eService Provider: In managing the eVisits between health care providers and patients. Where Ontario Health provides the videoconferencing technology and IT services to enable a custodian to connect directly with a patient.
Where Ontario Health provides the technology and IT services (e.g., scheduling tools, data centers, servers and technical support) to enable health care organizations and health care providers to schedule their own eVisits.
Health Information Network Provider: Where Ontario Health provides the videoconferencing technology and IT services to enable two or more custodians to share PHI.
Where Ontario Health provides iPhone iOS Operating System and Android video apps and IT services to enable two or more custodian to share PHI.
Program or Service: OTNhub eConsult
Associate PHIPA Role(s): eService Provider and Health Information Network Provider
Description of Roles and Responsibilities:
eService Provider: Where Ontario Health is providing the application programming interface libraries to integrate eConsult with provincial electronic medical records.
Health Information Network Provider: Where Ontario Health provides the technological means and IT services to enable two or more custodians to share PHI for a consultation.
Program or Service: Teledermatology
Associate PHIPA Role(s): eService Provider and Health Information Network Provider
Description of Roles and Responsibilities:
eService Provider: Where Ontario Health provides the means to allow integration with clinical management systems.
Health Information Network Provider: Where Ontario Health provides the technological means and IT services to enable two or more custodians to share PHI for a consultation.
Program or Service: Teleophthalmology (Please Note: This service is not offered through the OTNhub; however, all reports are accessed through a dashboard available through the OTNhub.)
Associate PHIPA Role(s): Agent, eService Provider and Health Information Network Provider
Description of Roles and Responsibilities:
Agent: The HICs have responsibility, among others, to evaluate, monitor (“reporting”) the Teleophthalmology service. The HICs have assigned the reporting role to Ontario Health, as the agent to the HICs. Ontario Health makes a free web-based Dashboard available to the HICs. The Dashboard allows HICs to access their own data, the data of other clinics and the overall totals for the service since the outset of the Retina implementation.
eService Provider: Ontario Health provides the technology and IT services to enable HICs to conduct retinal screening, assessment and the development of a treatment plan. Ontario Health has contracted a third-party service provider, RetinaLabs, to assist in providing this service.
Health Information Network Provider: Ontario Health provides the technology and IT services to enable HICs to share PHI for the purpose of retinal screening, assessment referral and the development of a treatment plan. Ontario Health has contracted a third-party service provider, RetinaLabs, to assist in providing this HINP service.
Program or Service: TeleSensi (Tele-Stethoscope)
Associate PHIPA Role(s): eService Provider and Health Information Network Provider
Description of Roles and Responsibilities:
eService Provider: When Ontario Health is operating and facilitating the TeleSensi technical solution to enable a Health Information Custodian to perform a medical consultation.
Health Information Network Provider: When Ontario Health is operating and facilitating the TeleSensi technical solution to enable HICs to share PHI for a consultation.
Ontario Health has contracted a third-party service provider, Stone Three, to assist in providing the Tele-Stethoscope service, TeleSensi.
As Ontario Health’s roles and obligations under PHIPA may at times change on a transaction-by-transaction basis and may change or evolve based on a new program, service mandate or use case. Ontario Health will ensure it meets all PHIPA role obligations for all its OTNhub program and service offerings.
Collection of Personal Information and Personal Health Information
OTNhub collects, uses, retains and communicates certain personal information about its employees, members, virtual care users, consultants, students, volunteers and vendors.
OTNhub will collect only the personal information that is strictly necessary for the authorized purposes.
Use of Personal Information and Personal Health Information
Information collected by OTNhub is used exclusively for the following purposes:
- Ontario Health's day-to-day operations, including human resources and financial operations, as well as contact and account management.
- Adoption and integration of OTNhub programs and services (customer service, utilization etc.)
- Enabling OHIP billing
- User authentication and authorization
- Directory listings
- Delivery of training resources
- Service optimization
- Meeting reporting and program evaluation obligations
- Occupational health and safety
- Procurement and contract management
- Complying with legal and regulatory requirements
- Research and evaluation (with express consent)
From time to time, OTNhub may update the purposes for which it collects, uses, retains and communicates personal information. You will be notified of such changes via updates to this document. If you do not agree to such modifications, please contact us.
Disclosure of Personal Information and Personal Health Information
Ontario Health does not disclose personal information or personal health information unless the individual consents and it is necessary for a lawful purpose or where it is permitted or required by law.
Safeguards for the Protection of Personal Information and Personal Health Information
Ontario Health has general safeguards in place for the protection of personal information and personal health information. For information, visit Ontario Health Safeguards for the Protection Of Personal Information and Personal Health Information.
For information on safeguards for specific OTNhub programs and services, visit our Privacy Resources to review the Description of HINP Services for that program/service.
Your Privacy Rights
Access or Correction of Personal Information and Personal Health Information
You may access or correct your personal information that we collect and maintain by contacting the Ontario Health Privacy Office. For more information on how to contact the Ontario Health Privacy Office, see our Privacy Contact Page.
You can correct factual errors in your personal information by sending us a request that credibly shows the error.
To protect your privacy and security, we will also take reasonable steps to verify your identity before granting access or making corrections to your information.
Contact Us
See our Privacy Contact Page to find information on how to contact the Ontario Health Privacy Office.
More Like This
Last Updated: April 08, 2026
