Privacy — psychology, psychotherapy, counselling therapy and social work (Ontario)
Two different duties with two different triggers, and the asymmetry is the point. NOTICE TO THE INDIVIDUAL has NO threshold: on any theft, loss, or unauthorised use or disclosure of personal health information, notify the individual at the first reasonable opportunity and state in the notice that they may complain to the Commissioner (s. 12(2)). NOTICE TO THE IPC does have a threshold, set by O. Reg. 329/04 s. 6.3(1): theft is an automatic trigger, while other incidents run through a significance test weighing whether the information is sensitive, the volume involved, how many individuals are affected, and whether more than one custodian or agent was responsible. For a psychotherapy practice the sensitivity limb means even a single-client breach can clear that bar.
“(2) … if personal health information about an individual that is in the custody or control of a health information custodian is stolen or lost or if it is used or disclosed without authority, the health information custodian shall, (a) notify the individual at the first reasonable opportunity of the theft or loss or of the unauthorized use or disclosure; and (b) include in the notice a statement that the individual is entitled to make a complaint to the Commissioner…” — PHIPA, s. 12(2)