I’m Kate Dewhirst.

I’m a lawyer who writes about legal issues affecting healthcare in Canada

Kate Dewhirst Health Law - bringing the law to life. Meet Kate (in 13 seconds)

Tracking Privacy Breaches in 2018 – Tools and Tips

Posted by

I’ve delivered five team privacy training sessions for health care groups this month all over the province. One thing that has everyone talking is the new requirement to track privacy breaches and report the statistics to the Information and Privacy Commissioner of Ontario in 2019.

Here are some tools and tips to help you better understand this new requirement.

A. What do we have to keep track of?

The IPC explains the requirement here

I wrote an introductory blog about it here

B. How do we keep track?

The Ontario Hospital Association created an AMAZING tool.  It is an Excel spreadsheet and has pre-populated for you all the requirements and has an amazing “instructions” tab. They made it public for free.  Download it here: Annual Breach Reporting Tracking Tool – for 2018  

ANY health information custodian can use it. It’s not unique to hospitals. So if you are a doctor’s office or midwifery clinic or NPLC or pharmacy or mental health clinic or a sole practitioner or any other kind of health information custodian  – the OHA’s tracking tool will work for you too.

Remember: The IPC will have an online form for you to complete. So the OHA Tool is just your tracking tool.  You will need to reenter the total numbers when prompted to do so in February/March 2019 on the IPC’s web portal. Stay tuned. I’ll let you know when it is live.

C. In group practices, who has to report?

This is the million dollar question.  If you are in a group practice, like a Family Health Team or a Family Health Organization or a Nurse Practitioner Led Clinic or a Birth Centre or a multidisciplinary team or partnership – you have to know whether there is a single health information custodian or whether each clinician is individually a custodian.   How do you know?  It should be written down.  If it is not written down – you should get legal advice to determine who is the custodian or custodians.

Every health information custodian is required to track and report privacy breaches.  In group practices where individual clinicians are individual health information custodians – you will have to decide whether to report individually or collectively to the IPC.  If you need help making this decision, let me know.

D. Is this my privacy breach to record? 

What happens if you receive a fax or email that was not meant for you.  Is that your privacy breach to track and report?  No.  It is the sender’s privacy breach.  You should notify the sender that you received the communication in error – but you do not have to add that to your statistical numbers.

Privacy Officer Training: The next round of Privacy Officer training starts in May 2018.  If you want to join me or want to read more about it – click here for information and registration details.


If you enjoyed this article please share it:


Previous and next posts from Kate:

Some of Kate’s Upcoming events

Where immigration and health law issues collide

April 25, 2018

Presentation to invited Community Health Centre clients

In collaboration with immigration lawyer Jacqueline Swaisland.

2018 Privacy Officer Training

May 8 to June 12, 2018

16 hours live and online training

for Privacy Officers and Privacy Officers-to-be. Live sessions held in Toronto. Course is now full, but here are details and booking for Kate's October course.

De-escalation training

May 16, 2018

Training session for a Toronto Family Health Team

In conjunction with leadership coach Christine Burych.

Team Privacy Training Events

May 17, June 13

For Primary Care clinics and FHTs

Kate trains health professionals from another two primary care organizations how being privacy-respectful can improve therapeutic relationships. more details...

Ask me anything (about health privacy)

12 noon, May 23, 2018

An hour webinar with Kate where you can ask Kate any privacy-related questions you have.

Open to all health Privacy Officers. Register here.

Kate Dewhirst Health Law

Kate says:

My mission is bringing the law to life. I make legal theory understandable, accessible and fun! I’m available and love to work for all organizations in the healthcare sector across Ontario and beyond.

Subscribe to my mailing list and keep up to date with news:

Latest Tweets

What does a Privacy Officer do in a health care organization? https://t.co/rQRBq051u3 #healthprivacy #HealthLaw #TorontoLawyer

about 4 hours ago

The Commissioner provided an update on Latest Developments at the IPC. Here are some highlights.… https://t.co/XKVkb6Aunm

about 8 hours ago

Have you looked at your hospital’s Professional Staff Rules and Regulations lately? https://t.co/CTp6xa8OyC #HealthLaw #hospitals

about 10 hours ago

contact details

901 King Street West Suite 400 East Tower
Toronto Ontario M5V 3H5

(416) 855 9557