CIHI is committed to protecting the privacy of Canadians and ensuring the security of their personal health information. We also maintain the confidentiality of health care records. Our commitment extends to all the information in our databases, as well as to users of this website.
We have a comprehensive privacy program, and we review and update our privacy and security policies annually. Download a copy of our brochure.
We welcome your feedback and questions
- Contact us at privacy@cihi.ca.
- Have a data inquiry or research question? Make a custom data request.
- For more information, please see Disclosures of CIHI Data.
CIHI’s privacy information
CIHI’s privacy program
CIHI’s privacy program
We have a comprehensive privacy program to protect the confidentiality and security of our Canadian health care data holdings. Part of this program is a set of strict privacy and security policies. These policies govern how we collect, store, analyze and disseminate data for the health care system in Canada.
Our program also includes
- A Privacy and Legal Services Secretariat committed to developing a culture of privacy at CIHI
- An active Privacy, Confidentiality and Security team that includes representation from across the organization
- A chief privacy advisor, who provides advice and counsel on privacy matters
- A privacy and data protection committee, a subcommittee of our Board of Directors
- Mandatory staff training to keep Canadian health care information protection matters front and centre
We are a prescribed entity for the purposes of Section 45(1) of Ontario’s Personal Health Information Protection Act, 2004 (PHIPA, 2004). This act applies to health information custodians in Ontario, such as the Ministry of Health and Long-Term Care, hospitals and physicians.
These entities can disclose personal health information to us without patient consent. The act permits disclosure for the purposes of analysis or compiling statistical information for the management of the health system.
This designation and the strict responsibilities that come with it also assure our data partners across the country that
- Our privacy and security policies comply with the highest standards
- Our overall information management practices safeguard the important and sensitive information we are trusted with
The Information and Privacy Commissioner (IPC) of Ontario reviews our practices and procedures every three years.
Our privacy policies, practices and procedures were first approved by the Ontario IPC in 2005, again in 2008, and more recently in 2011. For more information, please see the Privacy Policies and Protocols section below.
Privacy impact assessments
Privacy impact assessment (PIA) documents evaluate and address the privacy impacts of programs and systems. CIHI is committed to completing PIAs on all its data holdings:
- Canadian Joint Replacement Registry (CJRR) (2010) (PDF, 672KB)
- Canadian MIS Database (CMDB) (Oct. 2002) (PDF, 89KB)
- Canadian MIS Database Update 2012 (May 2012) (PDF, 241KB)
- Canadian Multiple Sclerosis Monitoring System (CMSMS) (Jul. 2012) (PDF, 1410KB)
- Canadian Organ Replacement Register (CORR) (Sep. 2010) (PDF, 1040KB)
- Addendum (Jul. 2012) (PDF, 522KB)
- Canadian Patient Cost Database (CPCD) (Aug. 2012) (PDF, 675KB)
- Canadian Regulated Nursing Professionals Databases
- CIHI Portal (2008) (PDF, 582KB)
- Addendum 2008–2009 (PDF, 681KB)
- Addendum 2010–2011 (PDF, 307KB)
- Clinical Administrative Databases (CAD) (Jun. 2005) (PDF, 629KB)
- Discharge Abstract Database (DAD)
- Hospital Morbidity Database (HMDB)
- National Ambulatory Care Reporting System (NACRS)
- Continuing Care Reporting System (CCRS) (Apr. 2012) (PDF, 654KB)
- Data Quality Special Studies (May 2011) (PDF, 886KB)
- Health Human Resources Databases (HHRD) (May 2012) (PDF, 804KB)
- Health Personnel Database (HPDB) (2004) (PDF, 933KB)
- Health Personnel Database Update 2011 (PDF, 1380KB)
- Home Care Reporting System (HCRS) (2011) (PDF, 331KB)
- Hospital Mental Health Database (HMHDB) (2011) (PDF, 345KB)
- National Prescription Drug Utilization Information System Database (NPDUIS) (2011) (PDF, 611KB)
- National Rehabilitation Reporting System (NRS) (2009) (PDF, 724KB)
- National System for Incident Reporting (NSIR) (2010) (PDF, 693KB)
- National Trauma Registry (NTR) and Ontario Trauma Registry (OTR) (Apr. 2013) (PDF, 6034KB)
- Primary Health Care Voluntary Reporting System (PHCVR) (Jan. 2013) (PDF, 987KB)
- Ontario Mental Health Reporting System (OMHRS) (Sep. 2011) (PDF, 402KB)
- Therapeutic Abortion Database (TADB) (Jun. 2003) (64KB)
- Therapeutic Abortion Database Update 2011 (PDF, 61KB)
Privacy policies and protocols
- Policy on Health Facility Identifiable Information (Oct. 2011)
- Privacy Breach Management Protocol (Oct. 2011)
- Privacy Impact Assessment Policy (Oct. 2011)
- Privacy Policy on the Collection, Use, Disclosure and Retention of Personal Health Information and De-Identified Data, 2010 (Updated Jul. 2011)
- Privacy Policy on the Collection, Use, Disclosure and Retention of Personal Health Information and De-Identified Data, 2011 (Health Workforce)
- Privacy Policy on the Use of Mobile Computing Equipment (Oct. 2011)
- Privacy and Security Framework, (Feb. 2010 , updated Mar. 2011)
- Privacy and Security Training Policy (Oct. 2011)
Featured reports on privacy
- CIHI Submission to the Information and Privacy Commissioner/Ontario: 2011 Prescribed Entity Status (Report) (Letter) (Oct. 2011)
- A Year in Review: CIHI’s 2010–2011 Annual Privacy Report (Jun. 2012) (PDF, 2,580 KB)
- Review of the Canadian Institute for Health Information: A Prescribed Entity Under the Personal Health Information Protection Act (Report) (Letter) (Oct. 2005)
- Report of the Information and Privacy Commissioner/Ontario—Review of the Canadian Institute for Health Information: A Prescribed Entity Under the Personal Health Information Protection Act (Oct. 2008)
