Are patient photos protected under PHIPA?
What Ontario clinics actually have to do
PHIPA is Ontario law, not Canadian law. This page covers it in detail, tells you which statute applies everywhere else, and answers the two questions vendors most often get wrong.
Three things that surprise clinics
- →PHIPA is provincial. If you practise in Calgary, Vancouver or Halifax, a different statute applies.
- →PHIPA has no data residency rule. One Canadian health law does. It is not Ontario's.
- →There are two rulebooks. PHIPA governs privacy. Your college governs advertising.
This is not legal advice and it has not been reviewed by Canadian counsel. It is a practitioner-facing summary with every source named so you can check it. Health privacy in Canada is provincial, the rules differ by where you practise, and a professional college's advertising policy sits on top of the privacy statute. Have your own adviser review anything you intend to rely on.
The short version
PHIPA is an Ontario law, not a Canadian one. If your clinic is in Calgary, Vancouver or Halifax, PHIPA does not apply to you and a different statute does. This page covers PHIPA in detail and tells you which law applies everywhere else.
A patient photograph is personal health information. It is not a marketing asset that happens to feature a patient. It is part of the record, with the same obligations as a chart note.
PHIPA does not require your data to stay in Canada. Several vendors imply otherwise. One province's health law does have a residency rule, and it is not Ontario's.
There are two rulebooks, not one. PHIPA governs privacy. Your professional college governs advertising. A photograph can be perfectly lawful under PHIPA and still breach your college's policy, and the college is the one that disciplines you.
Which health privacy law applies to you
Does PHIPA apply across Canada?
No. PHIPA is the Personal Health Information Protection Act, 2004, and it applies in Ontario only. Every province has its own health privacy statute, and they differ in consent rules, breach reporting and penalties.
"PHIPA compliant" from a vendor selling across Canada is therefore an incomplete claim, including when we say it. What matters is whether the system supports the obligations that apply where you practise.
Which health privacy law applies in my province?
| Where you practise | The law | Who oversees it |
|---|---|---|
| Ontario | PHIPA, 2004 | Information and Privacy Commissioner of Ontario |
| Alberta | Health Information Act | Office of the Information and Privacy Commissioner of Alberta |
| British Columbia | PIPA for private practice, FIPPA for public bodies, plus the E-Health Act | Office of the Information and Privacy Commissioner for BC |
| Saskatchewan | Health Information Protection Act | Saskatchewan Information and Privacy Commissioner |
| Manitoba | Personal Health Information Act | Manitoba Ombudsman |
| Quebec | Recently restructured. Health and social services information legislation, alongside Law 25 | Commission d'accès à l'information |
| New Brunswick | Personal Health Information Privacy and Access Act | Office of the Ombud |
| Nova Scotia | Personal Health Information Act | Office of the Information and Privacy Commissioner for Nova Scotia |
| Prince Edward Island | Health Information Act | Information and Privacy Commissioner of PEI |
| Newfoundland and Labrador | Personal Health Information Act | Office of the Information and Privacy Commissioner |
| Yukon, NWT, Nunavut | Territorial legislation and PIPEDA, depending on the organisation | Territorial and federal commissioners |
Quebec's health information framework was restructured recently and the obligations differ meaningfully from the rest of Canada. If you practise in Quebec, this table is a starting point and not an answer.
What is PIPEDA and when does it apply instead?
PIPEDA is the federal private-sector privacy law. It applies to commercial activity where a province has no substantially similar law, and to personal information crossing provincial or national borders in commercial activity.
For a clinic, the practical question is whether you are a health information custodian. If you are, your provincial health statute governs. If you are not, PIPEDA may.
Custodians, med spas and agents
Am I a health information custodian?
If you are a regulated health professional providing health care, almost certainly yes. PHIPA defines custodians to include health care practitioners who provide health care, which covers physicians, nurses, and the other professions regulated under the Regulated Health Professions Act.
Does PHIPA apply to a medical spa?
This is the question most Ontario med spas get wrong, and the answer depends on who is delivering the treatment.
| Your clinic | Likely position |
|---|---|
| Physician-owned or physician-led | Custodian. PHIPA applies |
| Nurse-led, treatments delivered by an RN or NP | Custodian. Nurses are regulated health professionals |
| No regulated health professional involved in care | Possibly not a custodian. PIPEDA may apply instead |
A clinic outside PHIPA still has privacy obligations under PIPEDA, still answers to its professionals' colleges, and still has every commercial reason to behave as though PHIPA applied. What changes is which regulator you answer to and which breach rules you follow, which are exactly the things you need to know in advance rather than during an incident.
What is an agent under PHIPA, and is my software one?
An agent acts for the custodian, with the custodian's authorisation, in respect of personal health information. Staff are agents. In most arrangements a software provider is a service provider rather than an agent, and the distinction matters because the custodian remains accountable either way.
The practical point: the obligation does not transfer to your vendor. A vendor can give you the tools and the contract. It cannot take on your accountability, and any vendor implying otherwise is describing something that does not exist.
Patient photographs under PHIPA
Is a patient photograph personal health information?
Yes. PHIPA defines personal health information as identifying information about an individual that relates to their physical or mental health, the provision of health care, or payment for it. A clinical photograph taken in the course of care is all three at once, and it is obviously identifying. A face is the most identifying thing a person has.
Does that change if I only use it internally?
No. The classification does not depend on what you do with it. A photograph is personal health information from the moment it is taken, which is why where it is stored matters from that moment too.
The common failure is not malice, it is the camera roll. A photograph taken on a staff member's personal phone has already left the record and entered a consumer cloud account the clinic does not control.
Do I need consent to take a clinical photograph?
For care, consent is generally implied within the circle of care. PHIPA permits custodians to collect, use and disclose personal health information for providing health care on implied consent, within the group of custodians providing that care.
That covers taking and keeping the photograph for treatment. It does not cover anything else.
What is the circle of care?
It is the group of custodians providing health care to that patient, within which information can flow on implied consent. It is a well-understood concept in Ontario practice rather than a defined term in the statute.
A photograph leaving that circle generally needs express consent, unless PHIPA specifically allows the disclosure without it.
Can a patient tell me not to share part of their record?
Yes. This is often called the lockbox. PHIPA allows an individual to withhold or withdraw consent for a custodian to use or disclose their personal health information for health care purposes, with some exceptions.
A patient may be entirely willing to be photographed for their own record and entirely unwilling for anyone else in the practice to see it. A system that cannot restrict a single patient's photographs to a single clinician cannot honour that instruction.
The two rulebooks
Can I use patient photographs in marketing in Ontario?
Only with express consent, and then only within your college's advertising rules. These are two separate approvals and clinics routinely obtain the first and forget the second.
PHIPA requires express consent for use outside the circle of care. Your college then governs what the advertisement may say and show, regardless of what the patient agreed to.
What does express consent have to look like?
PHIPA does not prescribe a form. In practice, consent that would survive scrutiny is written, specific about which photographs and which uses, time-limited or withdrawable, and documented.
What a patient photo consent form must contain →
Which college rules apply to before-and-after photographs?
It depends on who you are. Physicians answer to the College of Physicians and Surgeons of Ontario, nurses to the College of Nurses of Ontario, and each has its own advertising expectations.
These policies are revised more often than statutes, and a vendor page is the wrong place to learn what yours says today. The pattern across Canadian colleges is restriction on testimonials, on claims of superiority, and on anything that could mislead about likely results.
Can I edit a before-and-after photograph?
Retouching a clinical photograph used in advertising is a bad idea everywhere and an express problem in some jurisdictions.
The safer position, and the one we build to: capture tools may help with positioning and consistency; nothing may change the image after capture. A photograph that has been smoothed, filtered or relit is no longer evidence of a result.
Reporting a privacy breach
Do I have to report a privacy breach to the IPC?
Sometimes to the Commissioner, and almost always to the patient. PHIPA requires custodians to notify the affected individual at the first reasonable opportunity when personal health information is stolen, lost, or used or disclosed without authority.
Notification to the Information and Privacy Commissioner of Ontario is required in defined circumstances, which include use or disclosure by someone who knew or ought to have known it was unauthorised, theft, further use or disclosure after the first incident, patterns of similar breaches, certain events that must also be reported to a regulatory college, and any breach the custodian judges to be significant, for example because the information is sensitive, a large volume is involved, or many people are affected.
Is there an annual report as well?
Yes. Custodians must provide the Commissioner with an annual statistical report of breaches, covering the previous calendar year.
This catches people out, because a clinic that correctly decided a single incident did not require immediate reporting still has to count it.
What is the most common PHIPA breach in a clinic?
Staff looking at records they had no reason to look at. It has a name in Ontario practice, snooping, and it is a defined reporting trigger.
Unauthorised access is invisible without an access log, and it is the breach type you are most likely to have and least likely to notice. CureCast records every view, download and share against the staff member, device and timestamp. See how the audit trail works →
What PHIPA can cost you
What are the penalties under PHIPA?
There are two separate routes and they are often confused.
| Administrative monetary penalties | Prosecution | |
|---|---|---|
| Who imposes | The Information and Privacy Commissioner directly | A court, following referral to the Attorney General |
| In force since | 1 January 2024 | Long-standing, maximums raised in 2020 |
| Maximum | $50,000 for an individual, $500,000 for other entities | Commonly cited as up to $200,000 and up to a year's imprisonment for an individual, and up to $1,000,000 for an organisation |
| How often used | New, and now in use | Rare |
Sources differ on the prosecution maximums and we have not verified them against the statute. Check the current text of PHIPA on Ontario's e-Laws before relying on a figure.
Has anyone actually been fined?
Yes. The Commissioner issued the first administrative monetary penalties in 2025, and the first against a physician was $5,000.
The size is the point, not the exception to it. The mechanism is now live, it has been used, and the first one is rarely the largest.
The Commissioner has been explicit that these penalties exist to encourage compliance rather than to punish, and that they can be increased by the economic benefit obtained. A clinic reading "$5,000" and relaxing has read it backwards.
Section 10.1 and electronic audit logs
Does PHIPA require an electronic audit log?
Not yet, and this is worth understanding precisely because most summaries get it wrong.
Section 10.1 was added to PHIPA by Bill 188 in 2020. It is on the statute books and it is not in force, awaiting proclamation, with supporting regulations still pending. As drafted it would require custodians using electronic means to maintain an electronic audit log and to provide it to the Commissioner on request.
So should I bother with one?
Yes, for three reasons that have nothing to do with section 10.1.
- Unauthorised access by staff is a defined breach-reporting trigger, and you cannot report what you cannot detect.
- The Commissioner's penalty framework weighs the extent to which a custodian could have taken steps to prevent a contravention. "We had no way of knowing" is not a defence, it is an aggravating fact.
- A provision awaiting proclamation tends to arrive on a schedule that suits the legislature rather than your software roadmap.
A clinic already keeping an electronic audit log is ahead of a requirement that is written, passed and waiting.
How long records must be kept
How long must I keep patient records in Ontario?
Ontario's retention periods come from professional regulation rather than from PHIPA. For physicians the requirement has long been ten years from the date of the last entry, or ten years from the patient's eighteenth birthday, whichever is later.
Other colleges set their own periods and they are not identical. Confirm yours directly.
Photographs are part of the record, so they are covered by whatever period applies to you. A practice that deletes photographs to save storage while keeping the notes has not retained the record.
Where Canadian health data may live
Does PHIPA require patient data to stay in Canada?
No. PHIPA contains no data residency requirement.
This surprises people and it is worth stating plainly, because several vendors imply otherwise. What PHIPA requires is that a custodian take steps that are reasonable in the circumstances to protect personal health information, and obtain the consent the statute requires for the use or disclosure in question.
Which Canadian health law does have a residency rule?
New Brunswick's. Its Personal Health Information Privacy and Access Act contains a provision restricting the storage of personal health information outside Canada by custodians.
British Columbia
The in-Canada rule under FIPPA was removed and replaced with an assessment requirement when sensitive personal information is to be stored outside Canada.
Nova Scotia
Its restriction on cross-border storage by public bodies and their service providers continues to apply.
All of these bind public bodies or custodians, not every clinic. If you are a private practice in Ontario, none of them applies to you.
Is data residency the same as data sovereignty?
No, and the difference matters more than the residency question itself.
A Canadian data centre operated by an American company satisfies a residency rule and does not remove that company from American jurisdiction. US authorities can compel a US provider to produce data it holds, including data held abroad, and can do so without notifying the Canadian organisation.
Any vendor telling you that a Canadian region solves this is overstating it, and you should treat that as information about the vendor.
If you are not in Ontario
I am not in Ontario. Does any of this change what I need from a system?
Almost none of it. The statutes differ in wording, in who regulates them and in what they fine you. What they ask a clinic to actually do is close to identical, because they are all built on the same handful of ideas.
| Every Canadian health privacy law expects | Which means, in a photo system |
|---|---|
| Consent appropriate to the use | Consent recorded, and held with the photographs it covers |
| Reasonable safeguards | Encryption, access control, and photographs that never reach a personal phone |
| Only the people who need access, have it | Permissions per staff member, per location |
| Detect and report unauthorised access | An access log you can actually read |
| The patient can see their record | Retrieval that works |
| Records kept for a defined period | Photographs retained with the chart, not deleted to save space |
What genuinely differs by province is the regulator you report to, the threshold at which a breach must be reported, and the size of the penalty. None of those three is something a photo system decides for you.
For a clinic in Vancouver, Calgary or Halifax, the requirements of a system are the same as in Ontario. What changes is the name on the letter if something goes wrong.
What CureCast does, and does not do
CureCast is clinical photo management. It is not an EMR, it does not hold your clinical notes, and it does not connect to a provincial health information exchange.
| Obligation | What CureCast provides |
|---|---|
| Photographs stay in the record, not on personal phones | Capture goes directly into the clinic account. Photographs never enter a staff member's camera roll |
| Detect unauthorised access | Every view, download and share is written to an audit trail |
| Restrict who sees what | Module and action-based permissions per staff member |
| Honour a patient's restriction | Confidential patient records, invisible to unauthorised staff |
| Keep the record intact | Photographs stored as captured. No editing, filtering or retouching |
| Separate locations | Multi-clinic access: Separate clinic accounts with isolated patient data, or shared access for authorised locations |
| Consent held with the record | Customisable consent forms, up to four signatures, stored as a PDF with the patient's photographs |
Make you compliant. PHIPA obligations attach to the custodian, not the vendor. A system can make them achievable and evidenced. It cannot assume them.
Sources and what we could not verify
Primary instruments. Obtain current texts from the issuing authority rather than relying on this page.
- Personal Health Information Protection Act, 2004, S.O. 2004, c. 3, Sched. A. Current text on Ontario's e-Laws
- O. Reg. 329/04, the general regulation under PHIPA, including breach reporting and annual statistics
- Bill 188, Economic and Fiscal Update Act, 2020, which added section 10.1 and raised the offence maximums
- Information and Privacy Commissioner of Ontario, decisions and guidance on administrative monetary penalties, in force 1 January 2024
- PIPEDA, Personal Information Protection and Electronic Documents Act, S.C. 2000, c. 5
- Personal Health Information Privacy and Access Act (New Brunswick), on storage outside Canada
- Freedom of Information and Protection of Privacy Amendment Act, 2021 (British Columbia), and the Personal Information Disclosure for Storage Outside of Canada Regulation
What we could not verify
Stated plainly, because a knowledge page that hides its gaps is not one.
- The prosecution maximums under PHIPA. Sources differ and we have not checked the statute directly
- The status of section 10.1. We believe it remains unproclaimed. Confirm on e-Laws
- Quebec's current health information framework. Restructured recently and not verified here
- College advertising policies. Deliberately not summarised, because they change more often than statutes
Written by Vishal Parikh, Founder, CureCast. Last reviewed 11 October 2026. For clinics in Ontario and across Canada. Not legal advice, and not reviewed by Canadian counsel. Health privacy in Canada is provincial, and a professional college's advertising policy sits on top of the privacy statute. Have counsel review anything you intend to rely on, and obtain current statutory text from the issuing authority rather than from any summary, including this one.
