Bill 31 is being called a response to PIPEDA and a way to ensure patients' personal information is protected. Take an early look at how some organizations are already working to comply

Ontario health organizations will soon have to review the way they handle customer information to ensure their procedures comply with the new bill presented to the Ontario government.

Bill 31 requires all companies and organizations that deal with personal health information to ensure they obtain consent from all patients to use their information in non-medical cases, such as marketing. It also requires companies to verify the software protects the security of all files.

If Bill 31 passes, it would require health information custodians (health-care practitioners, operators of hospitals, nursing homes, pharmacies or ambulance services) to notify patients if their personal information is stolen, lost or accessed by unauthorized persons.

The federal privacy law created problems with respect to health care because it implied that doctors had to receive written consent from their patients before using or sharing personal information. That was one of the reasons health-care organizations did not have to comply with PIPEDA when it first came into effect in 2001.

"PIPEDA was never designed with personal health legislation in mind for the province of Ontario," said John Beardwood, lawyer for Fasken-Martineau-Dumoul in law firm in Toronto.

The new provincial privacy law would not require health information custodians, who have custody or control of personal information as a result of their work, to have patients fill out a consent form every time the information they visit the doctor’s office. Instead, the personal information would be stored on secure database, only accessible by the custodians.