Under the Personal Health Information Protection Act (PHIPA), Health Information Custodians (HICs) must annually report health information privacy breach statistics to the Information and Privacy Commissioner of Ontario (IPC).

The IPC is an independent officer of the Legislative Assembly of Ontario. CMTO is providing this information on their behalf. If you have any questions about reporting or whether this requirement applies to you, please contact the IPC directly at statistics@ipc.on.ca or 416-326-3333.

For 2024, HICs who experienced a privacy breach must submit their report online via the IPC’s statistics submission website by March 1, 2025. Reports are not accepted by fax, mail, or email. All breaches must be reported, regardless of whether the IPC was notified at the time they occurred. HICs in private practice with no breaches in 2024 are exempt from reporting.

If you do not have an account and it’s your first time submitting an annual report to the IPC, you can register here to set up an account and get a login id and a password.