Pass the IAPP Certified Information Privacy Professional CIPP-C Questions and answers with CertsForce

Under Ontario's Personal Health Information Protection Act (PHIPA), health information custodians may rely on implied consent in situations where the information is used for the provision of healthcare unless the patient explicitly opts out. However, private insurance companies do not directly provide healthcare and typically require explicit consent to collect, use, or disclose health information. This is because their primary role involves assessing insurance claims and risk, rather than delivering healthcare services. Long-term care homes, ambulance services, and pharmacies, on the other hand, are directly involved in the provision of care and can typically operate under an implied consent model when sharing information for healthcare purposes.

The Personal Information Protection and Electronic Documents Act (PIPEDA) applies to private sector organizations that operate across provincial or national borders in Canada in the course of commercial activities. Therefore, employees of an airline offering flights across Canada would be subject to PIPEDA because their employer operates in a federally regulated sector involving interprovincial transportation. The other examples given—underwriters for a New Brunswick insurance company, clerks at a Montreal credit union, and the IT department of a provincial government office in Saskatchewan—are subject to provincial privacy laws rather than PIPEDA. In the case of the credit union in Quebec and the insurance company in New Brunswick, provincial privacy laws apply to their operations within the province, and provincial public sector privacy laws cover the Saskatchewan Office of Residential Tenancies.