Agents of HICs

Under the Personal Health Information Protection Act (PHIPA) in Ontario, an Agent is any individual or entity authorized to act on behalf of a Health Information Custodian (HIC) in handling personal health information (PHI). Agents must follow PHIPA regulations and only use PHI as permitted by the HIC.

*Please note that this list may not be complete.

1. Employees and Staff of a HIC

Anyone working for a HIC who handles PHI as part of their job responsibilities, including:

• Physicians and Surgeons working for a hospital or clinic
• Nurses, Nurse Practitioners, and Nursing Staff
• Medical Office Assistants and Receptionists
• Dentists and Dental Hygienists working in a clinic
• Pharmacists and Pharmacy Assistants
• Physiotherapists, Occupational Therapists, and Kinesiologists working in a clinic
• Paramedics employed by ambulance services
• Technologists and Technicians (e.g., X-ray, MRI, ultrasound, lab)

2. Independent Contractors and Healthcare

Professionals Affiliated with a HIC Healthcare providers who are not direct employees but work under the authority of a HIC, including:

• Locum Doctors working in hospitals, clinics, or healthcare teams
• Visiting Specialists treating patients within a HIC’s facility
• Temporary Nursing Staff or Agency
• Nurses
• Consultants (e.g., healthcare quality improvement specialists)
• Physiotherapists or Speech-Language Pathologists working for a hospital
• Independent Psychologists providing assessments for a healthcare organization

3. Administrative and Support Staff Handling PHI

Individuals involved in scheduling, records management, billing, and operations within a HIC:

• Medical Office Administrators
• Clinic Receptionists and Front Desk Staff
• Hospital Administrative Clerks
• Health Records and Information Management Personnel
• Billing and Insurance Processing Staff
• Transcriptionists handling medical dictations

4. IT and Technology Professionals Managing Health Data

IT professionals and tech providers who manage or support PHI systems on behalf of a HIC:

• IT Administrators working within a hospital or clinic
• Electronic Medical Record (EMR) System Support Staff
• Cybersecurity and Compliance Officers in a healthcare organization
• Software Developers maintaining custom healthcare applications
• Data Analysts working within a healthcare facility
• Cloud Storage and IT Security Personnel managing PHI systems

5. Third-Party Service Providers Acting on Behalf of a HIC

Companies or individuals providing external services that involve PHI handling:

• Medical Billing Companies
• Third-Party Claims Processors
• Healthcare IT Vendors maintaining EMRs/EHRs
• Cloud-Based Health Data Storage Providers
• Patient Call Centers handling appointment scheduling
• Secure Messaging or Telehealth Providers
• Legal Firms handling patient-related healthcare cases for a HIC
• Collection Agencies working on unpaid healthcare bills for a provider

6. Researchers and Academics Conducting Studies with PHI (Under Authorization)

Researchers working with a HIC for medical or clinical research purposes:

• University and Hospital Research Teams accessing PHI
• Epidemiologists studying patient data for public health purposes
• Clinical Trial Coordinators accessing PHI for regulated studies

7. Volunteers and Students Under Supervision of a HIC

Individuals learning or assisting within a HIC’s operations:

• Medical, Nursing, or Pharmacy Students during placements
• Volunteer Caregivers assisting in hospitals or hospices
• Interns working within a healthcare administration setting

8. Legal Representatives and Advisors for a HIC

Individuals authorized to handle PHI in legal or compliance contexts:

• In-House Legal Counsel for hospitals or clinics
• External Lawyers managing patient-related legal matters
• Privacy and Compliance Officers ensuring PHIPA adherence

Who is NOT an Agent Under PHIPA?

Certain individuals and entities may interact with PHI but are not considered agents unless they are directly authorized by a HIC:

• Patients (even if accessing their own PHI)
• Family members (unless they have legal authority, such as power of attorney)
• Employers outside of healthcare settings
• Private insurance companies (except when managing claims on behalf of a HIC)
• General technology and service companies providing infrastructure/support but are not managing PHI (e.g., internet providers, marketers, sales teams)