Establish the MSP's Role
An MSP supporting an Ontario healthcare client should establish whether it acts as the custodian's agent, another electronic service provider or a health information network provider. The role changes the obligations; treating every IT supplier as the same category can miss requirements.
| MSP Decision | What to Put in Place |
|---|---|
| Agent of a custodian | Handle information only within the authorized duties and restrictions, and notify the custodian at the first reasonable opportunity after a privacy breach. |
| Electronic service provider that is not an agent | Check the specific restrictions on use, disclosure and employee access. |
| Health information network provider | Check the additional requirements for this role, including logs, safeguards and agreements. |
Make the Service Match the Agreement
Document who can reach health information through remote support, backups and ticket attachments. Agree the permitted handling and an incident contact, then ensure the tools and technician permissions support those limits. These are operational checks to make with the client, alongside the applicable legal requirements.
Use the Ontario IPC guidance for the role your MSP actually performs. A US healthcare agreement does not replace this Ontario review.
Common Questions
Is PHIPA the Canadian name for HIPAA?
No. PHIPA is Ontario legislation with its own scope and supplier roles. Other Canadian provinces and US healthcare arrangements require their own analysis.