I'll fix almost anything in my house. The dishwasher, the snowblower, a lawnmower that last started when my daughters were in diapers. My toolbox and I have a deal: if it has screws, it's mine. But if you hand me a fax machine, I'll hand it straight back. Some appliances aren't worth saving, and that one leaks.
[Puts the screwdriver down] Here's the serious version. Ontario health information custodians reported 12,075 privacy breaches to the Information and Privacy Commissioner (IPC) in 2025, and misdirected faxes caused 5,438 of them, or 45%. Dental offices, optometry clinics and wellness practices sit right inside that number. Under the Personal Health Information Protection Act (PHIPA), the clinic is responsible for the records it holds, the staff who handle them and the IT providers who look after its systems.
This checklist walks clinic owners and practice managers through what PHIPA expects, what the 2025 numbers say and the technical and front-desk fixes that close the most common gaps. It's practical guidance, not legal advice. If you run a dental practice or an optometry clinic, it's written for you.
Key Takeaways
- Ontario health information custodians reported 12,075 privacy breaches in 2025. Misdirected faxes caused 5,438 of them, or 45% (IPC Ontario).
- Clinics must tell affected patients about a breach at the first reasonable opportunity, report certain breaches to the IPC, and send the IPC an annual breach statistics report.
- Since January 1, 2024, the IPC can impose administrative monetary penalties of up to $50,000 for an individual and $500,000 for an organization.
- The first penalties, in August 2025, included $7,500 for a clinic that had no privacy breach response protocol in place.
- Most fixes are habits and settings: own logins, MFA, encryption, a fax exit plan, a breach log and a front desk that verifies identity.
Does PHIPA apply to dental and optometry clinics?
Yes. PHIPA treats health care practitioners who provide care, including dentists and optometrists, as health information custodians. The custodian is accountable for personal health information in its custody or control. That covers charts, X-rays and retinal images, appointment notes, insurance details and even the fact that someone is your patient.
The duty doesn't stop at your own staff. Hygienists, opticians, front-desk staff and outside providers who handle records on your behalf act as your agents, and the custodian stays responsible for what they do. Your IT provider, your cloud practice software and your backup service all fall inside that circle. So "the vendor handles it" isn't an answer the IPC will accept. A written agreement that says how the vendor protects your data is.
What do Ontario's 2025 breach numbers tell clinics?
They say the biggest risk is everyday handling, not hackers. In its 2025 statistics, the IPC reported 12,075 health privacy breaches, up from 11,970 in 2024. Misdirected faxes rose from 5,047 in 2024 to 5,438 in 2025, about 45% of the total (IPC Ontario, Statistical Highlights).
The IPC calls faxes a weak link in the health sector's privacy chain and says it hopes the province will deliver on its promise to "axe the fax" by 2028. A clinic doesn't have to wait two years. Every referral you move off fax today is one fewer chance of sending a patient's chart to a stranger's office.
In my assessments, the other usual suspects are shared logins at the front desk, laptops without encryption and a "breach plan" that lives in someone's head. None of them needs a big budget to fix. They need someone to own them.
What must a clinic do when a privacy breach happens?
PHIPA sets three duties, and they're easier to meet if you've written them down before you need them.
- Tell the patient. If personal health information is stolen, lost, or used or disclosed without authority, the custodian must notify the affected person at the first reasonable opportunity, and tell them they can complain to the IPC.
- Report certain breaches to the IPC. Section 6.3 of Ontario Regulation 329/04 lists the cases that must go to the Commissioner, such as breaches by someone who knew they weren't allowed, breaches that are part of a pattern, and breaches that are significant because of the sensitivity or number of records involved (IPC Ontario, annual reporting guidance).
- Send your annual numbers. Every custodian must report the previous calendar year's breach statistics to the IPC, usually by March 1. A practice with zero incidents still reports zero.
The IPC's first administrative monetary penalties show why the plan matters. In PHIPA Decision 298, released August 27, 2025, the IPC fined a physician $5,000 for using patients' hospital records for personal financial gain, and fined his clinic $7,500. The IPC found the clinic had no privacy breach response protocol and was unprepared to deal with the breach (IPC Ontario; BLG summary). A one-page plan would have changed that story.
The PHIPA technical checklist for your clinic
Think of this as the maintenance schedule for your practice systems. Nothing on it is exotic, and most of it lives in settings you already pay for.
| Check | What "done" looks like |
|---|---|
| Own logins | Every person signs in to the practice software, email and computers with their own account. No shared "frontdesk" password. |
| Multi-factor authentication | MFA on email, practice software and remote access, starting with owners and anyone who can see the full patient list. See our MFA service. |
| Encryption | Every laptop, tablet and USB drive that holds patient data is encrypted, so a stolen bag doesn't hand anyone readable patient records. |
| Access by role | Staff see what their job needs. Remove access the day someone leaves. |
| Audit logs | Your practice software logs who opened which chart, and someone reviews it. Snooping is a breach too. |
| Backups | Backups run daily, a copy sits off-site or in the cloud, and you test a restore at least twice a year. Our backup and disaster recovery page explains the setup. |
| Updates | Windows, imaging software, browsers and firewalls get security updates on a schedule, not "when someone remembers". |
| Vendor agreements | A written agreement with every vendor that stores or supports patient data, covering safeguards, breach notice and where data is kept. |
Replacing the fax
Start with the referrals you send most often. Many specialists and labs now accept secure e-referral or an encrypted portal. Where you still have to fax, use a pre-programmed number list, confirm the number before the first send, and use a cover sheet that says what to do if it arrives at the wrong place. Then count your faxes each month. If the number isn't falling, something's wrong with the plan.
Email that meets the IPC's expectations
The IPC's guidance on communicating personal health information by email expects custodians to encrypt email that carries patient information between providers. If you email patients without encryption, you need a written email policy, the patient's consent, and you should keep the content to the minimum, such as appointment reminders (BLG summary of the IPC fact sheet). Check your regulatory college's own rules as well. Our advanced email security service can switch on encryption for the messages that need it.
Front-desk habits that prevent most breaches
Your front desk is the busiest privacy checkpoint in the building. A few habits do more than any software:
- Verify before you share. Confirm two identifiers, such as date of birth and address, before discussing records on the phone.
- Mind the screens. Angle monitors away from the waiting room and lock screens when you step away.
- Watch the volume. Keep diagnoses and balances out of conversations the waiting room can hear.
- Report fast, without blame. A misdirected fax reported in five minutes is a small problem. One found a month later is a big one.
- Train in short bursts. A few minutes a month beats an annual video. Our human risk management program does exactly that, and our guide to phishing protection covers the fake emails your team will see.
What are the penalties for a PHIPA breach?
There are two tracks. Since January 1, 2024, the IPC can issue administrative monetary penalties of up to $50,000 for an individual and $500,000 for an organization, without a court case (IPC Ontario, consequences of a breach). Separately, wilful offences can lead to prosecution, with fines of up to $200,000 for individuals and $1,000,000 for organizations since the 2020 amendments (McCarthy Tétrault).
The fine is rarely the biggest cost, though. Patient trust, staff time, a college complaint and a harder cyber insurance renewal usually cost more. The good news is that the controls insurers ask for are the same ones on this checklist.
Figures checked November 1, 2026. This article is general guidance for Ontario clinics, not legal advice. Confirm your duties with your regulatory college or a privacy lawyer.
Frequently asked questions
Do small clinics have to report breaches to the IPC?
Yes. Size doesn't change the duty. Every health information custodian must notify affected patients, report the breaches listed in the regulation to the IPC, and file the annual statistics report, even when the number is zero.
Can we email patients at all?
Yes, with care. Encrypt where you can. Where you can't, have a written email policy, get the patient's consent and limit what you send. Never put full charts or images in unencrypted email.
What should we do in the first hour of a breach?
Contain it first: recall or retrieve the fax or email, disable the lost device or account, and stop further access. Then write down what happened and when, tell your privacy contact, and decide who notifies the patient and whether the IPC must be told. If your IT provider is involved, call them in that first hour.
Does moving to cloud practice software make us compliant?
Not on its own. Cloud software can be very secure, but you still need your own logins, MFA, access rules, a vendor agreement and a breach plan. The clinic stays the custodian.
One last thing before you go. My toolbox and I will keep fixing dishwashers and lawnmowers. The fax machine can stay on the curb. Move your referrals somewhere safer, write your one-page breach plan, and your clinic will be well clear of that 45%.
Want a PHIPA check-up for your clinic?
Our Compliance as a Service team helps Ontario dental, optometry and wellness clinics put these safeguards in place and keep them there. We'll review your logins, encryption, backups, email and fax setup, then give you a plain-language action list.
Book your professional technology infrastructure resilience assessment. Email [email protected], visit cynerra.ca or call (855) CYNERRA (296-3772).
