p44 s1 bill 11 b011ra e.pdf

Ontario — Bills

1ST SESSION, 44TH LEGISLATURE, ONTARIO 3 CHARLES III, 2025 Bill 11 (Chapter 7 of the Statutes of Ontario, 2025)

An Act to enact or amend various Acts related to health care The Hon. S. Jones Minister of Health 1st Reading May 5, 2025 2nd Reading May 29, 2025 3rd Reading June 3, 2025 Royal Assent June 5, 2025

EXPLANATORY NOTE This Explanatory Note was written as a reader’s aid to Bill 11 and does not form part of the law. Bill 11 has been enacted as

Chapter 7 of the Statutes of Ontario, 2025.

SCHEDULE 1 CITY OF HAMILTON ACT, 1999

Section 11 of the City of Hamilton Act, 1999 is re-enacted to establish a board of health for the City. Currently the City itself has the powers, rights and duties of a board of health under the Health Protection and Promotion Act.

SCHEDULE 2 CONNECTING CARE ACT, 2019 The

Schedule amends the Connecting Care Act, 2019 to provide for the application of the French Language Services Act to the Service Organization.

SCHEDULE 3 HEALTH CARE STAFFING AGENCY REPORTING ACT, 2025 The

Schedule enacts the Health Care Staffing Agency Reporting Act, 2025. The major elements of the Act are described below.

Section 2 requires health care facility staffing agencies to submit reports to the Minister containing aggregate administrati ve, billing or pay rate information for health care facilities to which the agency assigns prescribed persons.

Section 3 requires health care facility staffing agencies to comply with specified record maintenance requirements.

Section 4 authorizes the Minister of Health to publish certain information contained in the reports submitted under

section 2 . Sections 5 and 6 describe elements of the Crown’s liability and state that no person is entitled to compensation as a result of the enactment of the Act or other specified actions.

Section 7 provides that the Act and the regulations prevail over any agreement to the contrary.

Section 8 provides that contraventions of the Act or the regulations are an offence and sets out the penalty for those offenc es.

Section 9 sets out regulation-making authorities for the Lieutenant Governor in Council.

SCHEDULE 4 HEALTH PROTECTION AND PROMOTION ACT The Health Protection and Promotion Act is amended to require medical officers of health to notify the Chief Medical Officer of Health and to receive the Chief Medical Officer of Health’s written approval before issuing a class order.

SCHEDULE 5 MANDATORY BLOOD TESTING ACT, 2006 The Mandatory Blood Testing Act, 2006 is amended to allow nurse practitioners to perform many of the functions in the Act that must currently be performed by physicians.

SCHEDULE 6 PERSONAL HEALTH INFORMATION PROTECTION ACT, 2004 The

Schedule amends the Personal Health Information Protection Act, 2004 and makes a related amendment to the Health Information Protection Act, 2016. The major elements of the

Schedule are set out below. The Act currently provides for an organization to be prescribed as the “prescribed organization” for the purposes of

Part V.1 of the Act. The Act is amended to allow the prescribed organization to be prescribed for the purposes of the Act. The prescribed organization is provided with new duties and powers for the purposes of

Part V, the new

Part V.2 and

Part VI, which are described below. Currently,

Part V of the Act is set to be amended by the Health Information Protection Act, 2016 , which would have added subsections 51 (5) and (6). Those amendments are repealed and re -enacted with modifications in this Schedule. The new amendments provide that

Part V applies to the prescribed organization as if it were a health information custodian in respect of specified types of information. They also remake what would have been subsection 51 (6) as a new subsection 51 (8). New

Part V.2 is added to the Act to govern digital health identifier activities. These are defined activities that are all re lated to digital health identifiers, which are unique identifiers created by the prescribed organization that can be used to confir m the identity of an individual.

Part V.2 authorizes the prescribed organization to carry out digital health identifier activities and describes how personal health information may be collected, used and disclosed in relation to these activities. The presc ribed organization is required to have in place privacy practices and procedures, describe their activities under the Part to the public, take specified steps to protect digital health identifier records and notify individuals in the event of privacy breac hes. The Part also sets out the rules that apply to persons acting on the prescribed organization’s behalf. The Minister is given the power to

ii issue directives to the prescribed organization related to digital health identifiers and digital health identifier activitie s. New regulation-making powers allow the Lieutenant Governor in Council to make various regulations related to the prescribed organization and digital health identifier activities, including the power to modify or exclude the application of

Part III of th e Act.

Part VI of the Act is amended to add a new provision providing that the Part applies to the prescribed organization as if it were a health information custodian with respect to certain records.

Section 61 is amended to give the Commissioner new powers with respect to certain records related to the prescribed organization.

Section 72 is amended to add a new offence for disposing of records of personal health information under

Part V of the Act with an intent to evade a request for access to the record.

Section 73 is amended to add new regulation-making powers related to the prescribed organization. These include prescribing additional powers, duties and functions of the prescribed organization, specifying provisions in the Act that apply to the prescribed organization as if it were a health information custodian and governing the application of specified provisions in the Act to records related to the prescribed organization.

Bill 11 2025

An Act to enact or amend various Acts related to health care CONTENTS

Preamble 1. Contents of this Act 2. Commencement 3.

Short title

Schedule 1 City of Hamilton Act, 1999

Schedule 2 Connecting Care Act, 2019

Schedule 3 Health Care Staffing Agency Reporting Act, 2025

Schedule 4 Health Protection and Promotion Act

Schedule 5 Mandatory Blood Testing Act, 2006

Schedule 6 Personal Health Information Protection Act, 2004

Preamble The Government of Ontario: Is building a more connected and convenient health -care system that provides more people with access to the right publicly funded care, in the right place. Is innovating to build a modern, integrated health -care system that better meets the needs of patients by making it easier to conveniently access their health information and records online and by providing better access to key services like primary care.

Is building healthier communities by strengthening governance and oversight of public health and institutions and improving transparency to provide people consistent care across the province. Acknowledges the importance of advancing initiatives to enhance and support health human resources to bolster the province’s health-care workforce today and in the future. Therefore, His Majesty, by and with the advice and consent of the Legislative Assembly of the Province of Ontario, enacts as follows: Contents of this Act 1 This Act consists of this section, sections 2 and 3 and the Schedules to this Act. Commencement 2

(1) Except as otherwise provided in this section, this Act comes into force on the day it receives Royal Assent.

(2) The Schedules to this Act come into force as provided in each Schedule.

(3) If a

Schedule to this Act provides that any of its provisions are to come into force on a day to be named by order of the Lieutenant Governor in Council, an order may apply to one or more of those provisions, and orders may be issued at different times with respect to any of those provisions.

Short title 3 The

short title of this Act is the More Convenient Care Act, 2025.

SCHEDULE 1 CITY OF HAMILTON ACT, 1999 1

Section 11 of the City of Hamilton Act, 1999 is repealed and the following substituted: BOARD OF HEALTH Board of health 11

(1) The board of health for the city is established and it is deemed to be a board of health established under the Health Protection and Promotion Act. Composition

(2) The city shall, by by -law, establish the board’s size in accordance with subsection 49 (2) of the Health Protection and Promotion Act. Appointment

(3) Despite subsections 49 (1) and (3) of the Health Protection and Promotion Act , all of the members of the board shall be appointed by the city. Area of jurisdiction

(4) The board’s area of jurisdiction is the city. Duty of the city

(5) Despite the Health Protection and Promotion Act , the city shall provide to the board the public health employees that the city considers necessary to enable the board to carry out its functions, and those employees are employees of the city. Functions of the city

(6) Despite the Health Protection and Promotion Act, the city has the functions that the board would otherwise have in respect of the appointment, reappointment and dismissal of its medical officer of health, its associate medical officers of health and its auditor. Additional functions of the board

(7) In addition to its duties and responsibilities under the Health Protection and Promotion Act, the board shall do the following things at the request of the city: 1. Make recommendations on any issues within the city’s jurisdiction that involve public health considerations. 2. Make an annual report to the city on the board’s operations. Continued effect of approvals, etc.

(8) On the day that the board is established by subsection (1), every approval, by -law and resolution of the city made under the Health Protection and Promotion Act that was in force immediately before that day is deemed to have been made by the board and it remains in force until it expires or is revoked or amended to provide otherwise. Commencement 2 This

Schedule comes into force on the day the More Convenient Care Act, 2025 receives Royal Assent.

SCHEDULE 2 CONNECTING CARE ACT, 2019 1

Section 27.5 of the Connecting Care Act, 2019 is amended by adding the following subsection: French Language Services Act

(5) The French Language Services Act applies to the Service Organization as though it were a government agency under that Act. Commencement 2 This

Schedule comes into force on the day the More Convenient Care Act, 2025 receives Royal Assent.

SCHEDULE 3 HEALTH CARE STAFFING AGENCY REPORTING ACT, 2025 CONTENTS 1.

Definitions 2. Reports 3. Record maintenance 4. Publication 5. Crown liability 6. No compensation 7. Conflicts 8. Offences 9. Regulations 10. Commencement 11.

Short title

Definitions 1 In this Act, “health care facility” means a public hospital, the University of Ottawa Heart Institute / Institut de cardiologie de l’Unive rsité d’Ottawa, a long-term care home or any other prescribed facility or prescribed provider; (“établissement de soins de santé”) "health care facility staffing agency" means a temporary help agency, within the meaning of the Employment Standards Act, 2000, that assigns any prescribed persons to perform work in or for a health care facility; (“agence de placement de personnel dans les établissements de soins de santé”) “long-term care home” means a long-term care home within the meaning of the Fixing Long-Term Care Act, 2021; (“foyer de soins de longue durée”) “Minister” means the Minister of Health or such other member of the Executive Council to whom the administration of this Act is assigned under the Executive Council Act; (“ministre”) “prescribed” means prescribed by the regulations; (“prescrit”) “public hospital” means a hospital within the meaning of the Public Hospitals Act; (“hôpital public”) “regulations” means the regulations made under this Act. (“règlements”) Reports 2

(1) A health care facility staffing agency shall, at least every six months or within such other time as may be prescribed, submit a report to the Minister that contains the prescribed aggregate administrative, billing or pay rate information for he alth care facilities to which the agency assigns prescribed persons. Submission

(2) A report required under subsection (1) shall be submitted in the prescribed form and manner and within the prescribed timeline. Record maintenance 3 A health care facility staffing agency shall comply with the following record maintenance requirements: 1. A true copy of any contract to assign prescribed employees to a health care facility that was entered into or amended or modified on or after the day this

section comes into force must be retained until three years after the day the contract expires. 2. A true copy of any invoice relating to prescribed administrative, billing or pay rate information that was issued on or after the day the information it contains was prescribed for the purposes of subsection 2 (1) must be retained until three years after the day it was issued. Publication 4 The Minister may publish, in the prescribed form and manner and within the prescribed timeline, any information contained in the reports submitted under

section 2 that is prescribed. Crown liability No personal liability 5

(1) No cause of action arises against any current or former member of the Executive Council, an employee or agent of the Crown for any act done in good faith in the exercise or performance, or intended exercise or performance, of the person’s

5 powers, duties or functions under this Act or for any alleged neglect, default or other omission in the exercise or performan ce in good faith of those powers, duties or functions. Crown remains vicariously liable

(2) Despite subsection 8 (3) of the Crown Liability and Proceedings Act, 2019 , subsection (1) does not relieve the Crown of liability to which it would otherwise be subject as a result of the acts or omissions of a person specified in subsection (1) . Proceedings barred

(3) No proceeding shall be commenced against any person specified in subsection (1) in respect of a matter referred to in that subsection.

Same (4) Subsection (3) does not apply with respect to an application for judicial review, but does apply with respect to any other court, administrative or arbitral proceeding claiming any remedy or relief, including specific performance, an injunction, declaratory relief, a remedy in contract, restitution, unjust enrichment or tort, a remedy for breach of trust or fiduciary obligation or any equitable remedy, enforcement of a judgment, order or award made outside Ontario or any form of compensation or damages including loss of revenue or profit. Proceedings by Crown not prevented

(5) This

section does not apply with respect to proceedings brought by the Crown. No compensation 6 No person is entitled to compensation as a result of the enactment of this Act, the filing of any regulation or the collectio n, use, disclosure or publication of any information as authorized under this Act. Conflicts 7 This Act and the regulations prevail over any agreement to the contrary, including any agreement entered into before the day this Act came into force. Offences 8 Every person who contravenes this Act or the regulations is guilty of an offence and on conviction is liable to a fine, (

a) not exceeding $10,000, in the case of an individual; and (

b) not exceeding $25,000, in the case of a corporation. Regulations 9

(1) The Lieutenant Governor in Council may make regulations, (

a) prescribing anything that is referred to in this Act as being prescribed; (

b) governing the reports required under

section 2, including governing the form and manner of the reports and the timing of submission; (

c) governing the publication of information under

section 4, including governing the form and manner in which the information is published and the timing of publication; (

d) exempting any person or class of persons from any provision of this Act and attaching conditions to the exemption; (

e) respecting any matter considered necessary or advisable to carry out effectively the purpose of this Act. Application to existing agreements

(2) A regulation made under subsection (1) may, if it so provides, specify that it applies to an agreement that was entered into before the day the regulation is filed, including an agreement that was entered into before the day this Act came into force. Commencement 10 The Act set out in this

Schedule comes into force on a day to be named by order of the Lieutenant Governor in Council.

Short title 11 The

short title of the Act set out in this

Schedule is the Health Care Staffing Agency Reporting Act, 2025.

SCHEDULE 4 HEALTH PROTECTION AND PROMOTION ACT 1 Subsection 22 (5.0.1) of the Health Protection and Promotion Act is repealed and the following substituted: Class orders (5.0.1) An order under this

section may be directed to a class of persons who reside or are present in the health unit served by the medical officer of health only if, (

a) the medical officer of health gives notice of the proposed class order to the Chief Medical Officer of Health; and (

b) the Chief Medical Officer of Health approves the proposed class order in writing. Commencement 2 This

Schedule comes into force on the day the More Convenient Care Act, 2025 receives Royal Assent.

SCHEDULE 5 MANDATORY BLOOD TESTING ACT, 2006 1

Section 1 of the Mandatory Blood Testing Act, 2006 is amended by adding the following

definitions: “nurse practitioner” means a registered nurse who holds an extended certificate of registration under the Nursing Act, 1991 ; (“infirmière praticienne ou infirmier praticien”) “reporting physician or nurse practitioner” means, in respect of an applicant, the physician or nurse practitioner who made t he report required by clause 5 (1) (e); (“médecin rapporteur ou infirmière praticienne rapporteuse ou infirmier praticien rapporteur”) 2 (1) Clause 5 (1) (

e) of the Act is amended by striking out “physician report” and substituting “physician report or nurse practitioner report”. (2) Clause 5 (1) (

f) of the Act is amended by striking out “physician report” and substituting “physician report or nurse practitioner report”. (3) Subsection 5 (2) of the Act is repealed and the following substituted: Order

(2) If the Board decides that the respondent should be ordered to provide a blood sample for analysis, the Board shall, at the same time as it makes its decision, make an order, (

a) requiring the respondent to allow a physician, a nurse practitioner or a person belonging to a prescribed class of persons to take a blood sample from the respondent within two business days after the order is provided to the respondent or the respondent’s counsel or agent; (

b) requiring the physician, nurse practitioner or other person to whom the respondent goes for the taking of a blood sample to take the blood sample and to deal with it in the manner specified in the regulations and the order, including to deliver it to an analyst; and (

c) requiring the analyst to whom the sample is delivered, (

i) to analyse the blood sample and report on the results of the analysis in accordance with the regulations and the requirements specified in the order, (ii) to make reasonable attempts to deliver the report on the results of the analysis to the reporting physician or nurse practitioner, (iii) to make reasonable attempts to deliver the report on the results of the analysis to the respondent’s physician or nurse practitioner, if requested by the respondent, (iv) to make reasonable attempts to deliver to the applicant, (

A) a notice that the analyst delivered the report on the results of the analysis to the reporting physician or nurse practitioner or made reasonable attempts to do so, and (

B) a recommendation that the applicant consult the reporting physician or nurse practitioner for a proper

interpretation of the results of the analysis, and (

v) if the respondent requested that the report on the results of the analysis be delivered to their physician or nurse practitioner, to make reasonable attempts to deliver to the respondent, (

A) a notice that the analyst delivered the report on the results of the analysis to the respondent’s physician or nurse practitioner or made reasonable attempts to do so, and (

B) a recommendation that the respondent consult their physician or nurse practitioner for a proper

interpretation of the results of the analysis. 3 Clause 6 (2) (

a) of the Act is amended by striking out “a physician or a person belonging to a prescribed class” and substituting “a physician, a nurse practitioner or a person belonging to a prescribed class”. 4 Subsection 9 (5) of the Act is amended by striking out “a physician report” and substituting “a physician report or nurse practitioner report”. 5 Clause 11 (1) (

h) of the Act is repealed and the following substituted: (

h) governing the physician reports or nurse practitioner reports required by clause 5 (1) (e), including, (

i) prescribing the classes of physicians or nurse practitioners, or the qualifications of physicians or nurse practitioners, who may prepare the reports, (ii) prescribing the examination and testing, including base line testing, and counselling and treatment, that the physicians or nurse practitioners must or may conduct to prepare the reports, and

8 (iii) prescribing the information that the reports must or may contain; 6

Section 12 of the Act is amended by striking out “physician reports” and substituting “physician reports, nurse practitioner reports”. Commencement 7 This

Schedule comes into force on the later of July 1, 2025 and the day the More Convenient Care Act, 2025 receives Royal Assent.

SCHEDULE 6 PERSONAL HEALTH INFORMATION PROTECTION ACT, 2004 1

(1) Section 2 of the Personal Health Information Protection Act, 2004 is amended by adding the following

definitions: “account management services” means the services provided by the prescribed organization that, (

a) maintain the confidentiality, integrity or availability of an individual’s digital health identifier or related personal health information, (

b) relate to the maintenance of an individual’s digital health identifier or related personal health information, (

c) manage the activation, deactivation, reactivation or disposal of an individual’s digital health identifier or related personal health information, or (

d) are prescribed; (“services de gestion des comptes”) “authentication services” means, (

a) services that rely upon validation and verification services to establish confidence in an individual’s identity, or (

b) any other prescribed services; (“services d’authentification”) “digital health identifier” means the unique identifier created by the prescribed organization for an individual through validation and verification services that confirm the identity of the individual; (“identifiant Santé numérique”) “digital health identifier activities” means, (

a) account management services, (

b) authentication services, (

c) validation and verification services, (

d) any other activities reasonably necessary for providing digital health identifiers to persons, including activities to improve or maintain the quality or efficacy of these activities, or (

e) any other prescribed activities; (“activités liées aux identifiants Santé numériques”) “digital health identifier records” means records of personal health information that, (

a) are in the prescribed organization’s custody or under its control, and (

b) are collected or used by the prescribed organization under

Part V.2; (“dossiers liés aux identifiants Santé numériques”) “validation and verification services” means services that, (

a) validate the health number and additional personal health information from the health card provided by the individual, including by relying on a database for health cards maintained by the Minister, (

b) verify that an individual who is providing the health number or additional personal health information, and such other identifying information as may be requested by the prescribed organization, is the individual to whom the health number or personal health information relates, (

c) rely upon the services described in clauses (

a) and (b), or such other services as may be prescribed, to create or renew an individual’s digital health identifier, or (

d) are prescribed. (“services de validation et de vérification”)

(2) The definition of “prescribed organization” in

section 2 of the Act is amended by striking out “for the purposes of

Part V.1” and substituting “under clause 73 (1) (d.1)”. 2 The definition of “personal health information” in subsection 4 (1) of the Act is amended by striking out “or” at the end of clause (f), by adding “or” at the end of clause (

g) and by adding the following clause: (

h) is the individual’s digital health identifier or other identifying information related to the creation of the digital health identifier. 3

Section 8 of the Act is amended by adding the following subsection: Prescribed organization

(4.1) The Freedom of Information and Protection of Privacy Act does not apply to personal health information in the custody or under the control of the prescribed organization, or to personal health information that is described in this Act as being treated as if it were in the custody or under the control of the prescribed organization, unless this Act or the regulations provide otherwise.

10 4 Subsection 34 (2) of the Act is amended by striking out “or” at the end of clause (d), by adding “or” at the end of clause (

e) and by adding the following clause: (

f) if the prescribed organization or any other prescribed person is collecting or using the health number, as the case may be, for prescribed purposes related to digital health identifier activities in accordance with any additional prescribed requirements. 5

(1) Section 51 of the Act is amended by adding the following subsection: Application to prescribed organization

(5) Subject to any exceptions and additional requirements, if any, that are prescribed, this Part applies to the prescribed organization as if it were a health information custodian and as if it had custody or control of a record of personal health information that is accessible to health information custodians by means of the electronic health record developed and maintained by the prescribed organization.

(2) Section 51 of the Act is amended by adding the following subsection: Same

(6) Subject to any exceptions and additional requirements, if any, that are prescribed, this Part applies to the prescribed organization as if it were a health information custodian and as if it had custody or control of an electronic record kept by the prescribed organization under paragraphs 4, 5 and 6 of

section 55.3.

(3) Section 51 of the Act is amended by adding the following subsection: Same

(7) Subject to any exceptions and additional requirements, if any, that are prescribed, this Part applies to the prescribed organization as if it were a health information custodian with respect to digital health identifier records.

(4) Section 51 of the Act is amended by adding the following subsection: Application to record of a custodian

(8) Subject to any exceptions and additional requirements, if any, that are prescribed, this Part applies to a record in the custody or control of a health information custodian respecting all instances where all or part of the personal health information of the individual that is accessible by means of the electronic health record developed and maintained by the prescribed organizatio n is viewed, handled or otherwise dealt with by the custodian. 6

(1) Section 55 of the Act is amended by adding the following subsection: Exception

(1.1) Despite subsection (1), an individual is not entitled to request a correction by the prescribed organization when it acts as if it were a health information custodian with respect to the records described in subsection 51 (5). (2) Subsection 55 (1.1) of the Act, as enacted by subsection (1), is amended by striking out “subsection 51 (5)” at the end and substituting “subsection 51 (5) or (7)”. (3) Subsection 55 (1.1) of the Act, as amended by subsection (2), is amended by striking out “subsection 51 (5) or (7)” at the end and substituting “subsection 51 (5), (6) or (7)”.

(4) Section 55 of the Act is amended by adding the following subsection: Same

(1.2) Despite subsection (1), an individual is not entitled to request a correction by a health information custodian with respect to the records described in subsection 51 (8). 7

(1) Clauses 55.14 (2) (

a) and (

b) of the Act are repealed.

(2) Subsection 55.14 (3) of the Act is repealed. 8 The Act is amended by adding the following Part:

PART V.2 DIGITAL HEALTH IDENTIFIER ACTIVITIES

INTERPRETATION

Interpretation 55.15 In this Part, “agent”, in relation to the prescribed organization, means a person that, with the authorization of the prescribed organizati on, acts for or on behalf of the prescribed organization in respect of personal health information for the purposes of the prescribed

11 organization, and not the agent’s own purposes, whether or not the agent has the authority to bind the prescribed organization, whether or not the agent is employed by the prescribed organization and whether or not the agent is being remunerated. POWER AND DUTY OF PRESCRIBED ORGANIZATION Digital health identifier activities 55.16 The prescribed organization may, in accordance with this Part and the regulations, carry out digital health identifier activities. COLLECTION, USE AND DISCLOSURE OF PERSONAL HEALTH INFORMATION Personal health information for digital health identifier activities 55.17

(1) The prescribed organization may, with the express consent of the individual to whom the personal health information relates, collect or use personal health information for the purpose of carrying out digital health identifier activities. Disclosure by prescribed organization

(2) The prescribed organization may, with the express consent of the individual to whom the personal health information relates, disclose personal health information to the Minister for the purpose of carrying out validation and verification services. Limitation

(3) Except as otherwise required by law, the prescribed organization shall not, in carrying out digital health identifier activities, (

a) collect, use or disclose personal health information if other information will serve the purpose of the collection, use or disclosure; (

b) collect, use or disclose more personal health information than is reasonably necessary to meet the purpose of the collection, use or disclosure; or (

c) collect, use or disclose any personal health information, except as is reasonably necessary for the purpose of carrying out digital health identifier activities, as applicable, in accordance with this Act or as may be permitted in the regulations. Application of

Part III 55.18

(1) Part III applies to the prescribed organization when it acts under this Part as if it were a health information custodian, subject to any necessary modifications and to any exceptions or modifications set out in the regulations. Regulations

(2) Despite subsection (1), the regulations may modify or exclude the application of all or part of

Part III to the prescribed organization when it acts under this Part or may provide that, despite any requirement in this Act, consent of the individual to whom the personal health information relates is not required for specified activities. Withdrawal of consent

(3) An individual may withdraw a consent required under this Part by providing notice of their withdrawal to the prescribed organization, but the withdrawal shall not have retroactive effect. ADMINISTRATION Practices and procedures 55.19

(1) On and after the first anniversary of the day this

section comes into force, the prescribed organization shall have in place and comply with practices and procedures, (

a) that are for the purpose of protecting the privacy of the individuals whose personal health information is in the digital health identifier records and for maintaining the confidentiality of the information; and (

b) that are approved by the Commissioner. Commissioner’s review

(2) The Commissioner shall review the practices and procedures referred to in subsection (1) three years after they are first approved and every three years thereafter, or at such other frequency as may be prescribed, to determine if the practices and procedures continue to meet the requirements of this section, the regulations and any applicable directive of the Minister. Renewal

(3) After the review, the Commissioner may renew the approval. Notice

(4) The Commissioner shall advise the Minister and the prescribed organization of the results of their review.

12 Publication

(5) The prescribed organization shall publish a

summary of the practices and procedures on its website as soon as possible after the practices and procedures have been approved by the Commissioner or after the approval has been renewed. Description to public 55.20 The prescribed organization shall make available to the public, (

a) a plain language description of the activities or services it provides under this Part, including a general description of the technical, administrative and physical safeguards in place; and (

b) such other information as may be prescribed. Protection of information 55.21 The prescribed organization shall take steps that are reasonable in the circumstances to ensure that digital health identifier records are protected against theft, loss and unauthorized use or disclosure and to ensure that the records containing the information are protected against unauthorized copying, modification or disposal. Disposal of inactive digital health identifier 55.22 The prescribed organization shall ensure that a digital health identifier that has been inactive for two or more years is disposed of in a secure manner. Persons acting on prescribed organization’s behalf 55.23

(1) The prescribed organization shall not permit any person acting on its behalf to collect, use, disclose, retain or dispose of digital health identifier records unless the person agrees to comply with the restrictions and conditions that apply to th e prescribed organization when the prescribed organization carries out those activities. Provision to agent

(2) Subject to subsection (1), the prescribed organization may provide digital health identifier records to an agent of the prescribed organization, who may use the information to carry out digital health identifier activities on behalf of the prescribed organization. Same

(3) For the purposes of this Part, the providing of personal health information between the prescribed organization and an agent of the prescribed organization, (

a) is a use by the prescribed organization; and (

b) is not a disclosure by the prescribed organization or a collection by the person to whom the information is provided. Application of s. 17

(4) Section 17 applies to the prescribed organization and its agents as if the prescribed organization were a health information custodian, subject to any necessary modifications. Breach notification 55.24

(1) If the prescribed organization determines that digital health identifier records have been stolen, lost or used or disclosed without authority, the prescribed organization shall, at the first reasonable opportunity, notify the individual to whom the personal health information relates. Contents

(2) The notice must include a statement that the individual is entitled to make a complaint to the Commissioner under

Part VI. Same, notice to Commissioner

(3) The prescribed organization shall, in accordance with the regulations, if any, notify the Commissioner of a theft or loss of or an unauthorized use or disclosure of digital health identifier records if the circumstances surrounding the theft, loss or unauthorized use or disclosure meet the prescribed requirements. Prescribed organization’s assessment 55.25

(1) The prescribed organization shall perform, in relation to the digital health identifier activities it carries out, an assessment with respect to, (

a) threats, vulnerabilities and risks to the security and integrity of digital health identifier records; and (

b) how the activities may affect the privacy of the individuals to whom the information relates. Regulations

(2) The assessments shall be performed in accordance with the additional requirements, if any, that are prescribed.

13 Directives 55.26

(1) The Minister may issue directives to the prescribed organization related to digital health identifiers and digital health identifier activities, including directives related to, (

a) the eligibility of individuals or groups of individuals to receive digital health identifier activities; (

b) requiring the prescribed organization to undertake additional privacy or security measures, which may include entering into agreements and conducting assessments; (

c) audit log and auditing requirements; or (

d) changes in technologies that relate to the digital health identifier activities. Consultation

(2) Before making a directive under subsection (1), the Minister shall, (

a) submit a draft of the directive to the Commissioner and the prescribed organization for the purpose of reviewing and making recommendations on the draft directive; (

b) publicly post a draft of the directive in English and French for the purpose of receiving public comment and review; and (

c) consider the recommendations or comments, if any, made by the Commissioner, the prescribed organization and members of the public and amend the directive if the Minister considers it appropriate to do so. Consultation period

(3) The Minister shall allow the Commissioner, the prescribed organization and the public a period of at least 45 days after the draft is submitted or posted publicly for the purposes of review and recommendation under subsection (2). Compliance

(4) The prescribed organization shall carry out every directive issued under subsection (1). Publication

(5) The Minister shall ensure that every directive issued under subsection (1) is made available to the public in both French and English. Non-application of Legislation Act, 2006

(6) Part III (Regulations) of the Legislation Act, 2006 does not apply to directives issued under this section. Conflict

(7) For greater certainty, in the event of a conflict between a directive issued under this

section and another requirement under this Act, a provision of any applicable Act or rule of any applicable law, the requirement, Act or rule prevails. General or particular

(8) A directive of the Minister may be general or particular in its application. REGULATIONS Regulations 55.27

(1) The Lieutenant Governor in Council may make regulations for carrying out the purposes and provisions of this Part. Same

(2) Without limiting the generality of subsection (1), the Lieutenant Governor in Council may make regulations, (

a) prescribing additional circumstances in which the prescribed organization may collect, use and disclose personal health information for purposes related to digital health identifiers and digital health identifier activities; (

b) establishing and governing conditions or restrictions that apply to the collection, use and disclosure of personal health information by the prescribed organization; (

c) prescribing and governing disclosures of personal health information that may be made by a health information custodian or other person to the prescribed organization for purposes related to digital health identifier activities; (

d) prescribing additional conditions or restrictions that apply to health information custodians and other persons who use digital health identifiers, who seek to use digital health identifiers or who otherwise receive or seek to receive authentication services from the prescribed organization; (

e) prescribing additional conditions or restrictions that apply to the prescribed organization when it carries out digital health identifier activities;

14 (

f) specifying provisions in this Act that apply to the prescribed organization as if it were a health information custodian when the prescribed organization carries out digital health identifier activities; (

g) respecting the type of personal health information that is required for validation and verification services; (

h) governing the application of

Part III with respect to the prescribed organization, which may include excluding or modifying the application of the provisions in that Part or providing that, despite anything in this Act, consent is not required for specified activities; (

i) governing the privacy and security of personal health information under this Part; (

j) governing the circumstances in which particular types of personal health information may or may not be collected, used or disclosed in relation to digital health identifier activities; (

k) governing the modifications to the requirements of this Act described in subsection 55.23 (4); (

l) governing notices of theft, loss or unauthorized use or disclosure that must be provided under subsection 55.24 (3); (

m) prescribing additional persons who may collect, use or disclose personal health information for purposes related to digital health identifiers or digital health identifier activities; (

n) governing any conditions or restrictions that apply to that collection, use or disclosure of personal health information by an additional person prescribed under clause (m), which may include providing that specified provisions in

Part III apply or do not apply to consents that are required for the collection, use or disclosure, subject to any specified modifications or exclusions; (

o) clarifying or creating exceptions from the

definitions of “account management services”, “authentication services”, “digital health identifier activities” and “validation and verification services”. Public consultation

(3) Section 74 applies, with necessary modification, to the making of a regulation under this section. 9

(1) Section 56 of the Act is amended by adding the following subsection: Application to prescribed organization

(5) Subject to any exceptions and additional requirements, if any, that are prescribed, this Part applies to the prescribed organization as if it were a health information custodian with respect to records described in subsection 51 (5) as if the prescribed organization has custody or control of the records. (2) Subsection 56 (5) of the Act, as enacted by subsection (1), is repealed and the following substituted: Application to prescribed organization

(5) Subject to any exceptions and additional requirements, if any, that are prescribed, this Part applies to the prescribed organization as if it were a health information custodian with respect to, (

a) records described in subsection 51 (5), as if the prescribed organization has custody or control of the records; and (

b) records described in subsection 51 (7). (3) Clause 56 (5) (

a) of the Act, as enacted by subsection (2), is amended by striking out “subsection 51 (5)” and substituting “subsection 51 (5) or (6)”. 10 (1) Subsection 61 (1) of the Act is amended by adding the following clause: (a.1) if the review relates to a complaint into a request by an individual under subsection 53 (1) for access to a record of personal health information that is described in subsection 51 (5), (6) or (7) and in the custody or control of the prescribed organization, or that is or that is described in this Act as being treated as if it were in the custody or control of the prescribed organization, make an order directing the prescribed organization to grant the individual access to the requested record; (2) Subsection 61 (1) of the Act is amended by adding the following clause: (f.2) make an order directing the prescribed organization to change its practices and procedures under

Part V.2, if the Commissioner determines that the practices and procedures contravene this Act or its regulations; (3) Subsection 61 (1) of the Act is amended by adding the following clause: (h.0.1) make an order directing any person who is an agent of the prescribed organization acting under

Part V or V.2 and whose activities the Commissioner reviewed and that an order made under any of clauses (a.1), (c), (d), or (

e) directs to take any action or to refrain from taking any action, to take the action or to refrain from taking the action if the Commissioner considers that it is necessary to make the order against the agent to ensure that the prescribed organization will comply with the order made against the prescribed organization;

(4) Section 61 of the Act is amended by striking out “or” at the end of clause (

h) and by adding “or” at the end of clause (h.1). 11

Section 71 of the Act is amended by adding the following subsection: Application to prescribed organization (5) Subsection (4) applies to the prescribed organization and its agents as if the prescribed organization were a health information custodian. 12 Subsection 72 (1) of the Act is amended by adding the following clause: (d.1) disposes of a record of personal health information in the custody or under the control of the prescribed organization when it acts under

Part V, or that is described in this Act as being treated as if it is in the custody or under the control of the prescribed organization when it acts under

Part V, with an intent to evade a request for access to the record that the prescribed organization has received under subsection 53 (1); 13 (1) Subsection 73 (1) of the Act is amended by adding the following clauses: (d.1) prescribing an organization as the prescribed organization for the purposes of this Act and respecting the purposes for which the organization is prescribed, subject to subsection (4.1); (d.2) prescribing additional powers, duties and functions of the prescribed organization; (d.3) establishing and governing reporting requirements that apply to the prescribed organization; (d.4) prescribing provisions of the Freedom of Information and Protection of Privacy Act that apply, subject to any specified conditions or modifications, to personal health information, (

i) in the custody or under the control of the prescribed organization, or (ii) that is described in this Act as being treated as if it were in the custody or under the control of the prescribed organization; (d.5) specifying provisions in this Act that apply to the prescribed organization as if it were a health information custodian when the prescribed organization carries out specified activities under this Act, subject to any conditions or modifications that may be prescribed; (d.6) specifying requirements or provisions in this Act that apply to agents of the prescribed organization when they carry out activities on behalf of the prescribed organization; (d.7) governing the application of

Part III of this Act with respect to the prescribed organization, which may include excluding or modifying the application of the provisions in that Part; (d.8) prescribing under what circumstances the prescribed organization may collect, use and disclose personal health information, the conditions that apply to the collection, use and disclosure of personal health information by the prescribed organization and di sclosures of personal health information that may be made by a health information custodian or other person to the prescribed organization; (d.9) prescribing conditions and restrictions that apply to a person who provides goods or services for the purpose of enabling the prescribed organization to use electronic means to collect, use, modify, disclose, retain or dispose of personal health information; (2) Subsection 73 (1) of the Act is amended by adding the following clauses: (m.2) prescribing exceptions or additional requirements that apply with respect to the prescribed organization and the records described in subsection 51 (5), (6) or (7), which may include excluding, (

i) classes of records from the application of those subsections, or (ii) classes of persons from access to those records in a prescribed form or manner; (m.3) governing the application of

section 52 to records in the custody or control of the prescribed organization, or that are described in this Act as being treated as if they were in the custody or control of the prescribed organization, which may include prescribing exceptions in subsection 52 (1) that do not apply or permitting or requiring another person to be responsible for identifying whether an exception applies to the records; (m.4) establishing and governing pilot programs with respect to records described in subsection 51 (5), including allowing the prescribed organization to specify the eligibility of individuals or groups of individuals to receive records in a specified format or manner; (m.5) prescribing the format or manner in which records described in subsection 51 (5), (6) or (7) shall be made available;

16 (m.6) authorizing the prescribed organization to deactivate digital health identifiers or block an individual’s access to the records described in subsection 51 (5), (6) or (7) and governing the conditions and process for reactivating the digital health identifier or access to records; (m.7) requiring the prescribed organization to provide summaries of records in addition to the records described in subsection 51 (6) or (7), and governing the circumstances when a

summary shall be provided; (m.8) authorizing a health information custodian to provide summaries in response to a request for access instead of the complete record described in subsection 51 (8) in specified circumstances, subject to any conditions;

(3) Section 73 of the Act is amended by adding the following subsection: Two or more organizations prescribed

(4.1) A regulation made under clause (1) (d.1) may prescribe more than one organization to act as the prescribed organization for the purposes of this Act and may provide for the respective powers, duties and functions of each organization under this Act. Health Information Protection Act, 2016 14 Subsection 1 (10) of

Schedule 1 to the Health Information Protection Act, 2016 is repealed. Commencement 15

(1) Except as otherwise provided in this section, this

Schedule comes into force on the day the More Convenient Care Act, 2025 receives Royal Assent.

(2) Sections 1 to 9, subsections 10 (1), (2) and (3) and sections 11 to 13 come into force on a day to be named by order of the Lieutenant Governor in Council.

Document details

Collection	Ontario — Bills
Citation	p44 s1 bill 11 b011ra e.pdf
Type	bill
Volume / chapter	p44 s1 bill 11 b011ra e.pdf
Language	en
Format	json
Source	PROVINCIAL
Identifier	9f58ab4be7b86bbaa12496ecf2a4396959cced56

Source file is stored in the law ingest library (json).