Ontario’s health privacy legislation, the Personal Health Information Protection Act (PHIPA), establishes a set of rules regarding patients’ personal health information (PHI). PHIPA gives patients the right to:

• be informed of the reasons for the collection, use and disclosure of their personal health information
• be notified of the theft or loss or of the unauthorized use or disclosure of their personal health information
• refuse or give consent to the collection, use or disclosure of their personal health information, except in certain circumstances
• withdraw their consent by providing notice
• expressly instruct that their personal health information not be used or disclosed for health care purposes without their consent
• access a copy of their personal health information, except in limited circumstances
• request corrections be made to their health records
• complain to our office if they are refused access to their personal health information
• complain to our office if they are refused a correction request
• complain to our office about a privacy breach or potential breach; and
• begin a proceeding in court for damages for actual harm suffered after an order has been issued or a person has been convicted of an offence under PHIPA.

Source: Information and Privacy Commissioner of Ontario https://www.ipc.on.ca/health-individuals/file-a-health-privacy-complaint/your-health-privacy-rights-in-ontario/