The Personal Health Information Protection Act, also known as PHIPA, is Ontario legislation established in November 2004.

[1] The PHIPA replaced the Health Cards and Numbers Control Act (SO 1991, c 1).

[2] PHIPA provides a set of rules for the collection, use and disclosure of personal health information by a "Health Information Custodian" (HIC), and includes the following provisions:[1] PHIPA applies to individuals and organizations involved in the delivery of healthcare services.

Under the Act, they are referred to as HICs, "prescribed organizations", or "agencies", each with various function.

A HIC can be any number of individuals or organizations who have custody or control of personal health information.