For boards of health and public health units

Two laws in one office

• The medical officer of health of a board of health is a health information custodian (PHIPA s. 3(1), paragraph 6).
• MFIPPA does not apply to personal health information in a custodian’s custody or control, unless PHIPA says otherwise (PHIPA s. 8(1)).
• PHIPA already has its own safeguards duty (s. 12(1)), its own notice to individuals when personal health information is stolen, lost or used or disclosed without authority (s. 12(2)), and its own notice to the IPC in prescribed circumstances (s. 12(3)).
• MFIPPA’s annual report already asks for some PHIPA figures, reported separately for each custodian (MFIPPA s. 26(2) and (3)).

So the new MFIPPA duties reach the personal information a board of health holds that is not personal health information under PHIPA. Where a particular record falls is a judgment for your privacy lead and, if needed, your solicitor. Not confirmed We did not research how PHIPA’s regulations interact with the new MFIPPA breach reporting; we flag it rather than guess.

What MFIPPA adds from January 1, 2027

• A written privacy impact assessment before each collection of personal information outside PHIPA (MFIPPA s. 28(3)).
• Reasonable safeguards for that information and its records (s. 30(5)).
• Breach reports to the IPC and notice to the people affected under the real risk of significant harm test (s. 30.1), alongside your existing PHIPA process.
• A record of reported MFIPPA breaches and the count in the annual report, first due March 31, 2028.

Who signs

The members of the board of health may designate one of themselves, or a committee, in writing to act as head under MFIPPA (s. 3(2)); otherwise the head is the members (s. 3(3)(b)). The head may delegate in writing (s. 49(1)). This is separate from the medical officer of health’s role as custodian under PHIPA.

Collections that usually need an MFIPPA assessment first

Examples that are often outside personal health information, to confirm with your privacy lead:

• Course and program registrations, such as food handler training.
• Complaints about premises, which hold the complainant’s contact details.
• Inspection and permit records that name owners and operators.
• Event registrations, surveys and newsletter sign-ups.
• Job and volunteer applications, and website contact forms.

What we found on public health websites

Several health units merged in recent years and some share one website, so we counted each website and each form once. We read 53 public forms in full on 23 websites. 91% left out at least one required part of the notice of collection, and 36% had none. A privacy policy was visible on 24 of 25 websites, a breach protocol or reporting route on 3, and a mention of privacy impact assessments on 4. Some forms we read may collect personal health information, where PHIPA’s own notice rules apply; we did not separate them.

We do not name any board of health. All institution types compared.

What the pack covers for a board of health

• The MFIPPA side: the assessment policy and template, a first assessment for a collection outside PHIPA, the breach protocol, decision guide, notices, log and register.
• Inventory: marks each collection as MFIPPA or PHIPA as your privacy lead decides, so staff know which process applies.
• Breach protocol: notes where your existing PHIPA process takes over, so staff do not run two processes for one incident.
• Not included: PHIPA documents for personal health information. Your existing PHIPA program stays as it is.

CA$7,500, invoice after delivery, net 30. Each document in detail.