Under the Personal Health Information Protection Act (PHIPA), Health Information Custodians (HICs) must annually report health information privacy breach statistics to the Information and Privacy Commissioner of Ontario (IPC).

The IPC is an independent officer of the Legislative Assembly of Ontario. CMTO is providing this information on its behalf. If you have any questions about reporting or whether this requirement applies to you, please contact the IPC directly at statistics@ipc.on.ca or 416-326-3333.

For 2025, HICs who experienced a privacy breach must submit their report online via the IPC’s statistics submission website by March 1, 2026. Reports are not accepted by fax, mail, or email. All breaches must be reported, regardless of whether the IPC was notified at the time they occurred. HICs in private practice with no breaches in 2025 are exempt from reporting.

If you do not have an account and it’s your first time submitting an annual report to the IPC, read the IPC’s FAQs to help you set up an account.