Virtual Visits Verification FAQ
Find answers related to:
Virtual Visits Verification Program
The purpose of the program is to support health service (HSP) providers to make informed decisions about the virtual care solutions they use and by ensuring that solutions meet a provincial standard for privacy, security, technology, accessibility and functionality. HSPs must still perform their own due diligence on privacy and security risks and confirm the compliance of their solution with relevant applicable laws, such as the Personal Health Information Protection Act, 2004 (PHIPA) and the Freedom of Information and Protection of Privacy Act (FIPPA), which govern the collection, use, and disclosure of personal health information (PHI) and personal information (PI).
Physicians should refer to their contractual requirement under which they receive remuneration to determine the details of remuneration related to virtual care and if verification status is a recommendation or required. Further remuneration questions should be directed to the funder through standard channels, such as the Ministry of Health’s Service Support Contact Centre at 1-800-262-6524.
HSPs benefit in multiple ways:
- The Virtual Visits Verification Standard (Standard) helps HSPs make informed decisions about the procurement of virtual care solutions. Compliance with this Standard ensures that HSPs use safe, secure and interoperable platforms for patient to provider video and secure messaging.
- Safeguarding of PHI enables HSPs to comply with their legislative and regulatory obligations.
- Alignment with provincial initiatives in which use of an Ontario Health verified virtual care solution is a recommendation or a requirement.
Program scope currently includes video and secure messaging. Solution providers may submit to become verified for video, secure messaging, or for both video and secure messaging.
No. Solution providers may submit to become verified at any time. However, in cases where a solution was withdrawn from the program, Solution Providers may submit their solution to become re-verified no sooner than six months from the date the solution was moved from the Verified Solutions List to the Withdrawn Solutions List.
Solutions in the process of withdrawing from the program are identified on the Verified Solutions List for 60 days before they are withdrawn in order for HSPs to change to an alternative solution that has been verified by Ontario Health. Once a solution is moved to the Withdrawn Solutions List, it is no longer considered an Ontario Health verified solution and thus no longer meets the terms of any contractual requirements to use an Ontario Health verified solution that users may be subject to (e.g. Ontario Health Insurance Plan (OHIP). Withdrawn solutions remain on the Withdrawn Solutions List for a period of six months.
Solution Providers must submit documentation demonstrating compliance with the Standard and program requirements. Ontario Health performs the verification function, starting with an orientation session and overview of the verification process. Verification involves the review and assessment of the documents submitted and the subsequent testing of the solution to validate compliance. Solution Providers offering more than one solution must verify each solution independently. Each solution will be separately listed on the Verified Solutions List.
Solutions are required to undergo validation testing and to submit substantiation materials to meet program requirements. OntarioMD performs the validation testing function, which begins with an orientation session and overview of the validation process. Validation involves the testing of functionalities and submission of documentation as may be required (i.e. certifications, audit logs, data tables, etc.).
Yes, however, verification does not replace the procurement process. HSPs (buyers) are still required to follow all applicable broader public sector procurement guidelines. Providers and organizations are advised to conduct their own due diligence to ensure that any solution they procure aligns with their specific needs and requirements.
It is the Solution Provider’s responsibility to notify Ontario Health of any material change to their software or platform that could impact the Solution Provider’s ability to meet all mandatory requirements. A material change may include updates to core functionality, data handling processes, integrations with other systems, or any modifications that could affect compliance, performance, patient safety, or security of the software including user access, data flow, etc. Timely communication ensures continued alignment with Ontario Health’s Virtual Visits Verification Standard and supports effective oversight. If a Solution Provider is unsure whether a change made, or planned to be made, is material, contact the program at verification@ontariohealth.ca to discuss.
HSPs should encourage their Solution Providers to visit Ontario Health’s Virtual Visits Verification Standard page, where information about the program is published. If you are an HSP that is participating in an innovative pilot, project or program, you are encouraged to email verification@ontariohealth.ca to request a meeting to discuss options available to verify your solution.
Yes. Requirements will evolve over time. Ontario Health will publish updated versions of the standard on the Virtual Visits Verification Standard page. Verified Solution Providers will be notified of changes made to the requirements to which they have already attested to meeting. Where a requirement has changed and a Solution Provider is no longer able to meet its compliance obligation, a remediation process will be initiated to ensure that the Solution Provider has sufficient time to comply with the updated version of the requirements.
The Virtual Visits Verification Program Terms and Conditions govern the overarching relationship between Ontario Health and solution providers.
The Virtual Visits Verification Standard outlines mandatory requirements that virtual care solutions must demonstrate to be verified by Ontario Health’s Virtual Visits Verification Program.
Additional information regarding the program and submission criteria are described at the Ontario Health Virtual Visits Verification Standard page.
Solution Providers that are interested in becoming verified are required to request from Ontario Health a submission package via email at verification@ontariohealth.ca.
Verification Process
To become verified, solution providers must meet all mandatory requirements as specified in the Virtual Visits Verification Standard, and all program requirements as specified in the Virtual Visits Verification Program Terms and Conditions. Recommended requirements are not required to be met to become verified. Ontario Health recommends that Solution Providers work towards meeting recommended requirements as they may become mandatory in a future version of the Standard.
Submissions are processed on a first-come, first-served basis. While turnaround times are dependent upon the volume of submissions received, Ontario Health aims to return to Solution Providers with feedback on their submission within five (5) business days. Submissions that are found to be complete and in good order and that have successfully validated are published on the Verified Solutions. Remediations can vary from minor to significant and as such can range in timeline from immediate term corrections to major remediations that can take months. Ontario Health’s review of submissions can be expedited when Solution Providers submit documentation that conforms to program requirements, such as the Virtual Visits Privacy Guidance and Reference Library that is published on the Ontario Health website.
A key program objective is to provide HSPs with the freedom to choose virtual care solutions best suited to their needs, while still meeting the provincial standards for privacy, security, accessibility, and functionality.
Program Status
Solution Providers are required to sign and complete an Attestation Package that affirms that their solution meets all mandatory requirements and binds them to program Terms and Conditions. Up-to-date Privacy Impact Assessment (PIA) and security assurance documentation are required to be submitted. Refer to requirements 2.3.7 and 2.3.8 in the standard for specifications.
Privacy Guidance has been published to support Solution Providers in understanding their obligations. Further information is provided in the submission package that Ontario Health shares with Solution Providers upon their confirmed interest in participating in the program.
Yes. There are four statuses that solutions can fall into:
- Verified: Solution Provider has successfully demonstrated that all mandatory requirements have been met.
- Under Review: Solution Provider has agreed to a final remediation timeline that, if not met, will lead to withdrawal from the program.
- Withdrawn: when Solution Providers elect to remove their solutions from the program.
- Verified with Variance: HSP Innovator granted a time limited Variance where there was justification for an exemption to one or more mandatory requirements. Refer to Section 5 of Terms and Conditions for further information.
Program Compliance
No. Responsible privacy and security professionals may be employees, contractors, or third-party consultants. Refer to section 2.3.7 of the standard for further details on requirements for privacy professionals, and requirement 2.3.8 for further details on requirements for security professionals. All assessments of solutions must be approved by the Solution Provider’s authorized leadership.
Privacy Impact Assessments (PIAs) must be refreshed every three years or when there has been a material change to the solution, legislation, policy, or business operations that may have an impact on privacy of health information or to privacy rights. Ontario Health collects PIA Summaries and not the full PIA. SOC 2 Type 2 audits must be refreshed annually. ISO 27001 certification is required to be refreshed every three years, OMD Certification every two years, and HiTrust Certification every two years.
SOC 2 Type 2 audits must be refreshed annually. ISO 27001 certification is required to be refreshed every three years, OMD Certification every two years, and HiTrust Certification every two years.
No. Mitigation timelines depend on the risk level:
- High risks must be fully mitigated by the date of submission.
- Risk identified as medium must have a clear mitigation plan with timelines for closure within six (6) months of the date the privacy or security assessment, audit, or certification was submitted.
- Low risks may be mitigated at the Solution Provider’s discretion.
The effective date of the privacy or security assessment is the date on which each assessment is finalized. Ontario Health uses these effective dates to monitor risk remediation and compliance timelines.
The date of submission refers to the date the vendor submits its application for verification. At the time of submission, the privacy or security assessment must accurately reflect the current version of the solution being submitted for program consideration.
Solution Selection and Procurement
Solution Providers that do not meet all mandatory requirements will be notified and invited to re-submit if/when they are ready and able to comply. Ontario Health can work with Solution Providers and assist them with completion of required documentation
Pricing is part of a commercial relationship between the buyer (HSP) and the supplier (Solution Provider). The Virtual Visits Verification Program will never be involved in pricing discussions.
Yes, EMRs that have been certified by OntarioMD do need to become separately verified by Ontario Health. OntarioMD Certification meets requirement 2.3.8 (Security Controls Assurance).
Contact Us
If you have questions or comments about this program, please email using our contact form.
More Like This
Last Updated: March 25, 2026
