Contents

PHIPA custodian duties for rehab clinics

PHIPA custodian duties for rehab clinics

Custodian responsibilities

Under PHIPA, Ontario rehab clinics that collect PHI are health information custodians. Duties include:

  • Reasonable safeguards for PHI
  • Access requests within 30 days
  • Retention and secure destruction per policy
  • Breach response and notification when required
  • Agent agreements with vendors that handle PHI on your behalf

Adding a document-collection layer

When intake moves from email to Hivi-X:

  1. Update your privacy impact assessment
  2. Document why pre-visit copies exist alongside the EMR
  3. Align retention and deletion schedules
  4. Train reception on approve/reject and access limits
  5. Use export to transfer intake into the chart of record when appropriate

Hivi-X is not a custodian substitute — it is infrastructure your clinic evaluates and controls.

PHIPA statute: ontario.ca/laws/statute/04p03.

General operational information for Ontario physiotherapy and rehabilitation clinics only — not legal, clinical, privacy, or billing advice. Your clinic remains the health information custodian under PHIPA. Hivi-X is document-collection software; it is not an EMR, does not submit WSIB Form 8, and does not certify college or PHIPA compliance.

Answers are general operational information only — not legal, tax, regulatory, clinical, privacy, immigration, or professional advice. Requirements vary by matter, client, and regulator.

Frequently asked questions

Is Hivi-X PHIPA-certified?
No certification exists for PHIPA "compliance." Hivi-X provides technical safeguards clinics may review in vendor due diligence. The clinic remains custodian.
Where is patient data stored?
On servers hosted in Canada. AI processing uses Hivi-X infrastructure — not OpenAI, Google, or Anthropic.
What should a privacy officer review before adopting Hivi-X?
Data flow diagrams, retention alignment with EMR policy, subprocessors, breach notification terms, access controls, and patient consent language for pre-visit collection.

Collect complete patient intake before the appointment

Hivi-X helps Ontario physiotherapy and rehabilitation clinics request health history, consent, insurance cards, referrals, and WSIB/MVA documents with reusable checklists, a secure guest link (no account needed) or my-id.ca portal, self-hosted AI summaries, and exportable packages for Jane, Cliniko, or your EMR.

PHIPA Custodian Duties For Rehab Clinics | hivi-x Docs