OTN takes the privacy of health and other information it may have access to very seriously and is committed to protecting it in ways that meet privacy law and industry standards.

This Toolkit is provided for general information and consideration purposes only. These resources were largely developed to help OTN meet the requirements of the Personal Health Information Protection Act (PHIPA), S.O. 2004, and Regulation 329/04, while also supporting OTN’s commitment to transparency. Please visit OTN’s Privacy Centre for further information, tools and best practices.  The Privacy Team’s  Integrated Privacy Policy Framework as well as OTN’s Annual Privacy Report are also available for your information and learning.

Privacy Impact Assessment

A privacy impact assessment is a detailed assessment undertaken to identify the actual or potential effects that a proposed project will have on the privacy of those whose personal health information (PHI) is included in the proposed project. A privacy impact assessment also identifies ways in which privacy risks may be mitigated. Additionally, privacy impact assessments may be used to ensure alignment with Privacy by Design principles.

OTN must conduct formal privacy impact assessments (in combination with a threat and risk assessment when required) when acting in its capacity as a Health Information Network Provider (HINP) to Health Information Custodians (HIC), as required under PHIPA. OTN must comply with all privacy impact assessment requirements identified in its project funding agreements with Canada Health Infoway and other funding partners. For initiatives involving consumer-based health services, where only personal information is held by OTN, OTN will conduct a privacy impact assessment or privacy review for any new technology and/or service, or new use of personal information where it is planned for collection.

OTN will publish summaries of completed privacy impact assessments conducted for various programs it manages. OTN publishes Primary Impact Assessment (PIA) summaries to ensure transparency with its members, users, the public, and those individuals who may be the subject of the personal and/or personal health information collected, used, disclosed, retained or disposed of in relation to OTN’s products or services. OTN also publishes these summaries to ensure compliance with the requirements for health information network providers under Ontario Regulation 329/04 (s. 6(3)). Without the express written consent of OTN. the summaries or the content therein may not be copied, used, or redistributed outside of the purposes identified.

Summaries to date include: