4.3 Health Information Privacy (PHIPA) & Confidentiality Limits
Key Takeaways
The Personal Health Information Protection Act, 2004 (PHIPA, SO 2004, c 3, Sched A) is Ontario's dedicated health-sector privacy statute governing personal health information (PHI) across the healthcare system.
Health Information Custodians (HICs)—including doctors, hospitals, nurses, pharmacies, and clinics—owe strict statutory confidentiality duties and cannot disclose PHI to private investigators without express written consent or judicial process.
Private investigators are legally prohibited from using pretexting, impersonation, or deception to access confidential medical charts, prescription histories, or clinic appointment records.
PHIPA s. 72 offences carry fines of up to $200,000 and up to one year in jail for individuals, and up to $1,000,000 for organizations, and a conviction can support licence action under the PSISA.
In personal injury and insurance claims investigations, investigators must confine inquiries to observing and documenting functional activities in plain public view, maintaining strict boundaries against intruding into medical treatment facilities or privileged doctor-patient communications.
Core Principle: In Ontario, an individual's personal health information is subject to the highest standard of statutory protection. Private investigators have no legal entitlement to access confidential health records without express, informed consent or judicial process. Attempting to circumvent these protections through pretexting or deception is a serious provincial offence carrying catastrophic financial, professional, and criminal penalties.
Personal injury litigation, disability insurance claims, workers' compensation disputes, and wrongful death inquiries represent a substantial portion of private investigative caseloads. Because these investigations center on physical capacity and medical claims, investigators face intense pressure to obtain medical details. However, Ontario's Personal Health Information Protection Act, 2004 (PHIPA, Statutes of Ontario 2004, Chapter 3, Schedule A) establishes an unbreachable statutory wall surrounding medical confidentiality.
1. Scope of PHIPA and Definition of 'Personal Health Information'
PHIPA was enacted specifically to govern the collection, use, and disclosure of personal health information within Ontario's healthcare system. It functions as a specialized health privacy code, displacing general privacy rules where health sector data is concerned.
The Broad Definition of Personal Health Information (PHI)
Under Section 4 of PHIPA, personal health information (PHI) is defined as identifying information about an individual in oral or recorded form, if the information:
- Relates to the physical or mental health of the individual, including information regarding family medical history;
- Relates to the provision of healthcare to the individual, including the identification of a person as a provider of healthcare to the individual;
- Relates to payments, health insurance coverage, or eligibility for healthcare (including the individual's Ontario Health Insurance Plan / OHIP number);
- Relates to the donation of body parts or bodily substances, or is derived from the testing or examination of any such parts or substances;
- Relates to the individual's plan of service or treatment under home care or long-term care legislation; or
- Identifies the individual's designated substitute decision-maker.
This statutory definition encompasses far more than formal medical charts. It includes prescription dispensing logs, physiotherapy appointment schedules, diagnostic imaging appointments (e.g., MRI or CT scan bookings), billing invoices from chiropractors, and even the simple fact that an individual attended a specific medical specialist's office.
2. Health Information Custodians (HICs) and Their Statutory Duties
PHIPA imposes binding confidentiality duties on Health Information Custodians (HICs) and their authorized agents.
Who Is a Health Information Custodian?
Under Section 3(1) of the Act, a Health Information Custodian includes any person or organization that has custody or control of personal health information in connection with the delivery of healthcare, such as:
- Licensed physicians and surgeons, registered nurses, and nurse practitioners;
- Public and private hospitals, independent health facilities, and specialized clinics;
- Pharmacies and registered pharmacists;
- Psychologists, social workers, psychotherapists, and mental health counselors;
- Physiotherapists, chiropractors, occupational therapists, and massage therapists;
- Medical diagnostic laboratories and specimen collection centers;
- Ambulance services and paramedic response teams; and
- Long-term care homes, hospices, and retirement homes.
Duties of HICs and Agents
Under PHIPA, HICs and their agents (such as clinic receptionists, medical secretaries, and hospital records clerks) are legally forbidden from disclosing personal health information to any third party unless:
- The individual provides express, informed, voluntary consent; or
- The disclosure is explicitly mandated or authorized by a specific section of PHIPA or an order of a court.
Private investigators are not HICs, nor are they authorized agents under the Act. Consequently, a private investigator has zero statutory authority to demand, inspect, or obtain personal health information from any custodian.
3. Strict Rules of Access: The Only Lawful Pathways
There are only two lawful mechanisms through which a private investigator or retaining legal counsel may obtain personal health information in Ontario:
LAWFUL PATHWAYS TO HEALTH INFORMATION
│
┌─────────────────────────────┴─────────────────────────────┐
▼ ▼
Pathway 1: Express Written Consent Pathway 2: Formal Judicial Process
- Signed by subject or substitute decision-maker - Court order under Rules of Civil Procedure
- Explicitly identifies records & custodian - Subpoena to Witness (Form 53A)
- Informed, voluntary, and non-revoked - Records delivered directly to court or referee
Pathway 1: Express Written Consent
An investigator may receive medical records from a custodian only if the subject has executed a formal, legally binding Consent to Release Personal Health Information form. Under Section 18 of PHIPA, valid consent must:
- Be an express consent (implied consent is legally insufficient for disclosures to commercial third parties);
- Be given by the individual (or a substitute decision-maker authorized under PHIPA);
- Be knowledgeable (the subject understands what information will be disclosed and to whom);
- Relate specifically to the records and time periods requested; and
- Not have been obtained through deception, coercion, or misrepresentation.
Pathway 2: Formal Judicial Process (Subpoena / Court Order)
In ongoing litigation, parties may access relevant medical files through the civil discovery process under the Ontario Rules of Civil Procedure (such as Rule 30 for production of documents or Rule 33 for independent medical examinations):
- A party may serve a Summons to Witness (Form 53A) requiring a record-holder to bring documents to trial, or obtain a court order for production from a non-party (Rule 30.10), compelling a hospital or physician to produce clinical notes and records.
- Crucially, subpoenaed medical records are produced directly to the court or exchanged through formal counsel during discovery. An investigator cannot serve a subpoena and personally inspect or photocopy the records on the spot without specific judicial authorization.
4. The Absolute Prohibition Against Pretexting and Deceit
In decades past, unscrupulous investigators occasionally engaged in pretexting—fabricating false identities, impersonating insurance adjusters, posing as medical office staff, or calling pharmacies pretending to be the patient—to obtain confidential health details.
Statutory Prohibitions Under PHIPA Section 72
Section 72(1) of PHIPA makes it an offence, among other things, to:
- wilfully collect, use or disclose personal health information in contravention of the Act or its regulations (s. 72(1)(a));
- make a request under the Act, under false pretences, for access to or correction of a record of personal health information (s. 72(1)(b)); or
- assert, knowing it to be untrue, that one is a person entitled to consent to the collection, use or disclosure of another person's health information, or entitled to access their record (s. 72(1)(c)).
A pretext call in which an investigator poses as the patient or a substitute decision-maker to obtain records falls squarely within these clauses. A prosecution under s. 72 requires the consent of the Attorney General (s. 72(5)).
CONSEQUENCES OF PRETEXTING UNDER PHIPA
┌─────────────────────────────────────────────────────────────────────────────────┐
│ Statutory Fines: Up to \$200,000 for individuals; up to \$1,000,000 for agencies │
├─────────────────────────────────────────────────────────────────────────────────┤
│ Incarceration: Prison term of up to 1 year for individual offenders │
├─────────────────────────────────────────────────────────────────────────────────┤
│ Licensing Risk: Registrar may condition, suspend or revoke licences (PSISA) │
├─────────────────────────────────────────────────────────────────────────────────┤
│ Criminal Liability: Criminal Code charges for Fraud (s. 380) & Personation (s. 403)│
├─────────────────────────────────────────────────────────────────────────────────┤
│ Civil Liability: Lawsuits for Intrusion Upon Seclusion; Evidence Excluded in Court│
└─────────────────────────────────────────────────────────────────────────────────┘
Penalties and Sanctions
The statutory penalties for breaching PHIPA are among the most severe in provincial law:
- Monetary Fines for Individuals: A private investigator convicted of an offence under Section 72 of PHIPA is liable to a fine of up to $200,000, imprisonment for a term of up to one year, or both.
- Monetary Fines for Corporations: A licensed investigative agency or corporation convicted of an offence is liable to a fine of up to $1,000,000.
- Licence Consequences: Under PSISA ss. 13–15, a provincial-offence conviction or evidence of deceptive pretexting can support refusal, conditions, suspension or revocation, because it reflects on whether the licensee will act lawfully and with honesty and integrity.
- Criminal Prosecution: Pretexting healthcare staff often satisfies the elements of criminal offences under the Criminal Code of Canada, including Personation with Intent (Section 403) and Fraud (Section 380).
5. Permissible Investigation Boundaries in Insurance and Personal Injury
Given these stringent statutory walls, how does a licensed private investigator lawfully conduct personal injury and disability investigations?
The law distinguishes between unlawful intrusions into confidential medical records and lawful observation of public activities.
The Operational Divide
| Permissible Investigative Activities | Strictly Prohibited Activities Under PHIPA |
|---|---|
| Conducting discreet physical surveillance of a claimant on public streets, sidewalks, and municipal parks | Calling a medical clinic pretending to be the subject to find out their appointment date |
| Video recording a claimant performing physical tasks (carrying groceries, loading lumber) in a public store parking lot | Entering a hospital ward, clinical examination room, or therapy suite to observe treatments |
| Documenting whether a claimant uses prescribed mobility devices (canes, braces) in public view | Posing as an insurance claims manager to interview a treating physician without written consent |
| Searching public social media posts where the claimant voluntarily shares fitness updates or marathon photos | Bribing or paying a pharmacy clerk or hospital receptionist to disclose medication histories |
The Evidentiary Value of Lawful Public Observation
In personal injury litigation, the defence is entitled to test the veracity of a plaintiff's alleged functional limitations. If a claimant claims in a sworn examination for discovery that they are completely bedridden and unable to lift more than five pounds, evidence showing them lifting heavy drywall into a pickup truck in a retail parking lot is highly relevant and legally admissible.
Because the surveillance occurred entirely in a public space where the subject had no reasonable expectation of privacy, no personal health records were accessed, and PHIPA was not violated. By confining operations strictly to public observation and preserving a meticulous chain of custody, the investigator produces legally defensible, highly persuasive evidence that withstands courtroom scrutiny.
Under Section 72 of Ontario's Personal Health Information Protection Act, 2004 (PHIPA), what is the maximum fine that may be imposed upon an individual private investigator convicted of an offence, such as unlawfully obtaining health records through deceit?
$25,000
$50,000
$200,000
$1,000,000
A private investigator retained in a personal injury insurance defence case requires copies of the claimant's hospital records and physiotherapy treatment notes. What is the lawful method to obtain these records?
Obtain the claimant's express written consent, or get the records through a summons or other court process
The investigator may telephone the physiotherapy clinic posing as an assistant to the claimant's family doctor
The investigator can file a standard Freedom of Information request with the local municipality under MFIPPA
Present their private investigator licence to the hospital records department and demand immediate release
In a disability fraud inquiry, which of the following activities represents a lawful and ethically compliant investigative method under Ontario privacy laws?
Telephoning the subject's family physician while pretending to be an insurance claims adjudicator verifying a prescription
Entering the private treatment area of a physiotherapy clinic to record the subject's range-of-motion assessments
Paying an administrative employee at a diagnostic imaging laboratory to disclose the subject's MRI results
Filming the subject from a public road while they lift heavy materials into a vehicle
Sections you finish are checked off in the contents.