What happened: In the August 22, 2026 Ontario Gazette, the Minister of Health published a notice of a proposed amending regulation under the Personal Health Information Protection Act, 2004 (PHIPA). Public comments are open until October 21, 2026.
What is proposed
Per the Gazette notice, the amendment would expand the Digital Health Identifier (DHI) framework so patients can securely reach more digital health services through it, beyond the provincial electronic health record. It sets eligibility criteria for health information custodians that want to use DHI authentication services, and it includes privacy safeguards for how data is handled.
The regulatory text is on Ontario’s Regulatory Registry. After the comment period the Minister reports to the Lieutenant Governor in Council, who may finalize the regulation with or without changes.
Does this apply to a med spa?
Maybe not directly. The proposal is about health information custodians. Regulated health professionals who collect personal health information in Ontario, such as physicians and nurses in independent practice, are commonly custodians, but whether your clinic is one depends on how it is structured. If you are unsure, ask your counsel or your regulator.
Even if you are not affected, it is worth reading. It signals where patient identity and access to records are going in Ontario, and clinics that keep clean, portable records will find any transition easier.
How to comment
Send written comments, in English or French, to:
Information Management Strategy and Policy Branch, Ministry of Health, Digital and Analytics Strategy Division, Office of the Chief Digital Health Officer, 222 Jarvis Street, 7th Floor, Toronto ON M7A 0B6, or by email to healthprivacy.moh@ontario.ca.
Where Zdrovia fits
Privacy and records handling are central to how Zdrovia is built, including Canadian data centres and encryption at rest and in transit. Read more on our security page.
This is general information, not legal advice. Check the Gazette notice for the authoritative text and deadline.