PHIPA roles and privacy
EDFlow under Ontario's PHIPA: the hospital as custodian, the vendor as agent and electronic service provider, voluntary HINP duties, minimum necessary, consent for family sharing, patient access, breach notification, and PIA and TRA support.
Roles
| Party | PHIPA role | Notes |
|---|---|---|
| The hospital | Health information custodian | Accountable for the handling of personal health information |
| The vendor of EDFlow | Agent and electronic service provider (PHIPA s. 17, O. Reg. 329/04 s. 6(1)) | Uses PHI only as the hospital directs, under a written agent/ESP agreement with a privacy and security schedule |
| Health information network provider (s. 6(2)–(3)) | Not applicable by design: each hospital is an isolated tenant | The HINP duties are met voluntarily: a written TRA and privacy assessment summary for each custodian, an electronic log of all access available on request, breach notice at the first reasonable opportunity, and flow-down terms for sub-processors |
| The patient's family | Recipients of a disclosure made with the patient's express consent | The consent record keeps who, when, what scope and how it was sent. Withdrawn by stopping sharing |
Minimum necessary (s. 30)
- The EHR sends only what the service needs; prohibited fields are rejected.
- Each audience sees an allow-listed projection. Family never see tests, results, requests or location. Patients never see CTAS or anything from the chart.
- Staff reads of a patient are recorded before the read.
- Analytics use de-identified facts after the operational window.
Consent
- Service: patients choose to activate by scanning their card.
- Family sharing: express consent on a dedicated screen, with a "They'll see / They won't see" list; revocable any time.
- Texts: phone numbers confirmed with a 6-digit code and deleted when access ends.
- Research: a separate, optional consent where a site runs a study.
Individual access (ss. 52–54)
The privacy office can export a visit record (timeline, care-team names, tests and steps, requests, tasks, the going-home summary, family-link activity, the access log and safety records), with a second privacy officer's approval. The EHR remains the official record.
Access logging (s. 10.1)
Every view, handling or change of a patient's information by staff, and every patient and family access, is logged now, ahead of the section coming into force: what, when, who and whose record. See Audit logging.
Breach management
- The vendor notifies the custodian's privacy office within 24 hours of discovering a suspected breach involving the custodian's data, by phone and email; a preliminary written report within 72 hours; a final report with root cause and corrective actions within 30 days.
- The admin includes a privacy incident register with scoping, automatic legal holds, a notification timeline and annual IPC statistics, and a site-wide emergency revoke.
Retention and destruction (s. 13)
Identifiable operational data is de-identified 30 days after departure by default (site range 7 to 90). Safety records follow the hospital's records schedule. On termination, the hospital receives an export within 30 days and data is destroyed within 60 days after confirmation, with a certificate. See Access requests and retention.
Safeguards (s. 12(1))
Administrative (agreements, training, access reviews), technical (see Controls) and physical (AWS data centres in Canada).
PIA and TRA support
The security package includes data-flow diagrams per ingestion path, the data inventory, the legal-authority analysis for the privacy office to confirm, the agent agreement terms, patient notice text in English and French, the handling of minors and substitute decision-makers, the sub-processor table, breach management, and a TRA checklist (STRIDE per flow, identity, cryptography, application security, logging, resilience, supply chain).
Other obligations
- Health Canada SaMD: administrative support, clinical communication and patient access to their own information are outside the device definition. EDFlow doesn't interpret results, triage patients or give clinical advice.
- Accessibility (AODA): WCAG 2.2 AA. See Accessibility.
- French: the product ships in English and French.
Related
Dernière mise à jour le
Cette page vous a-t-elle été utile?
Data flow
How data moves from the EHR to the patient's screen in EDFlow, what crosses each boundary and what never does, and the data inventory by privacy class with retention.
Controls
The EDFlow controls matrix: authentication and MFA, server-side authorization and projections, token hashing, encryption, rate limits, audit, log redaction, security headers and CSP, supply chain, vulnerability management and penetration testing.