Health Information Custodian (HIC)
What is Health Information Custodian?
A Health Information Custodian (HIC) is an individual or organization that has custody or control of personal health information while providing healthcare services. Under Ontario’s Personal Health Information Protection Act (PHIPA), Health Information Custodians have legal responsibilities for protecting the privacy, confidentiality, accuracy, and security of the health information they collect and manage.
Examples of Health Information Custodians include physicians, hospitals, pharmacies, long-term care homes, laboratories, community health centres, and many regulated healthcare professionals.
Because HICs are directly responsible for safeguarding patient information, healthcare compliance training plays an essential role in helping organizations understand and fulfill these responsibilities.
Why Health Information Custodians Matter
Patients place enormous trust in healthcare providers every day. They expect their personal health information to remain confidential while still being available to support safe and coordinated care.
Health Information Custodians are responsible for maintaining this balance. They must ensure that patient information is collected only when necessary, accessed only by authorized individuals, disclosed appropriately, and protected throughout its lifecycle.
These responsibilities extend beyond legal compliance. Strong privacy practices help maintain patient confidence and strengthen the quality of healthcare delivery.
Who Can Be a Health Information Custodian?
Under PHIPA, a wide range of healthcare organizations and professionals may qualify as Health Information Custodians.
Examples include:
- Physicians and medical clinics
- Hospitals
- Dentists
- Pharmacies
- Community health centres
- Long-term care homes
- Independent health facilities
- Diagnostic laboratories
- Ambulance services
- Certain regulated healthcare professionals
Each organization remains responsible for protecting the personal health information under its custody or control.
Related Terms
Two Factor Authentication
End-to-End Encryption
Privacy Policy