PREPARED BY: Planning and Strategic Initiatives
DATE: 2025-02-06
SUBJECT: 2024 Privacy Summary Report
BACKGROUND/PURPOSE
The Windsor-Essex County Health Unit (WECHU) is a “health information custodian (HIC)” in accordance with section 3 of the Personal Health Information Protection Act (PHIPA), and an “institution” in accordance with section 2 of the Municipal Freedom of Information and Protection of Privacy Act (MFIPPA). Under this legislation the WECHU has obligations to ensure the rights of individuals with respect to privacy, access, and correction of records of personal information (PI) and personal health information (PHI), and access to general records that pertain to the WECHU operations and governance.
All institutions under MFIPPA, and HICs under PHIPA, are required to provide statistical reports to the Information and Privacy Commissioner of Ontario (IPC) on an annual basis with respect to:
- Confirmed privacy breaches under PHIPA (Appendix A)
- Access and correction requests under PHIPA (Appendix B)
- Access and correction requests under MFIPPA (Appendix C)
The WECHU is required to submit statistical reports for each category by the deadline of March 1st for PHIPA reports and March 31st for MFIPPA.
DISCUSSION
Privacy breaches
In 2024, the WECHU had 6 confirmed breaches. Privacy breaches in 2024 predominantly included incidents where personal information (PI) and/or personal health information (PHI) in paper form was disclosed without authority. The WECHU is looking at various ways to prevent breaches of this manner through the reduction of paper records and secure electronic methods for disclosure.
MFIPPA access and correction to information requests
In 2024, the WECHU completed 22 formal Freedom of Information requests based on the MFIPPA, compared to 18 in 2023.
| Year | Number of MFIPPA Requests | |
|---|---|---|
| Access | Correction | |
| 2024 | 22 | 0 |
| 2023 | 18 | 0 |
| 2022 | 21 | 1 |
PHIPA access and correction to information requests
In 2024, the WECHU completed 261 formal Freedom of Information requests based on the PHIPA during the reporting year. 258 requests were to access records, and 3 were to correct personal records. The significant increase in access requests can be attributed to the change in WECHU procedure to process all requests with PHI, such as immunization records, through the formal system. This is a measure to decrease the risk of privacy incidents and to improve consistency across the organization.
| Year | Number of PHIPA Requests | |
|---|---|---|
| Access | Correction | |
| 2024 | 258 | 3 |
| 2023 | 55 | 0 |
| 2022 | 1540 | 169 |
CONCLUSION
In summary, all MFIPPA requests and all PHIPA requests were completed within the statutory time limits in 2024. The focus for the coming year will be continuous improvement of access to information processes, and a review of the current website to ensure that WECHU is providing efficient mechanisms for formal access to records, including through proactive disclosure.