Every year, Registered Massage Therapists (RMTs) who hold the role of a “Health Information Custodian (HIC)” are obligated to report privacy breach statistics to the Information and Privacy Commissioner of Ontario (IPC).

This annual reporting requirement is part of the Personal Health Information Protection Act, 2004 (PHIPA) – Section 6.4. The report must summarize any occurrences of privacy breaches in 2023 that impacted HICs’ clients. HICs must submit their 2023 statistical reports to the IPC on or before Friday, March 1, 2024.

Who is considered to be a Health Information Custodian (HIC)?

The IPC defines an HIC as a person or organization that has custody or control of personal health information as a result of, or in connection with, performing the duties of providing healthcare. The person must be a healthcare worker or someone who operates a group practice of healthcare practitioners. You may also be an HIC if you are in an independent practice, or work as an independent contractor within a multi-disciplinary clinic/spa. All RMTs are required to understand their obligations based on their contract or employment arrangement.

For more information about these requirements, please refer to the IPC’s Frequently Asked Questions on Annual Statistical Reporting.