What section 12(1) says
PHIPA s. 12(1) provides that a health information custodian "shall take steps that are reasonable in the circumstances to ensure that personal health information in the custodian's custody or control is protected against theft, loss and unauthorized use or disclosure" and that records containing the information are protected against unauthorized copying, modification or disposal.
There is no list of required technologies. That is deliberate, and it is why the obligation does not go out of date: what is reasonable in the circumstances changes as practice changes, and "nobody told us to do it" has never been a defence under a reasonableness standard.
Reasonable steps are measured against practice, not against the statute
Because the test is reasonableness, the question after an incident is what a comparable custodian would have done. Independent security testing of systems that hold personal health information is now ordinary practice among custodians of any size, which raises the bar for anyone who has never run one.
The Information and Privacy Commissioner of Ontario oversees PHIPA and publishes guidance and decisions. Reading what the IPC has said about safeguards in past matters is the most direct way to see where the line is being drawn.
Breach notification makes the untested system expensive
PHIPA s. 12(2) requires the custodian to notify the affected individual at the first reasonable opportunity when personal health information is stolen, lost, or used or disclosed without authority, subject to the exceptions in the Act.
That is the cost asymmetry. A finding in a report is a ticket. The same weakness found by someone else becomes a notification obligation, a conversation with the regulator, and a conversation with your patients.
Where the weaknesses usually are in health systems
Access control dominates, because clinical systems are built so that people can reach records quickly in an emergency and that pressure cuts against least privilege.
- Role boundaries that let a user read records outside their circle of care
- Patient portals where changing an identifier returns another patient's record
- Integration endpoints and HL7 or FHIR interfaces with weaker authorization than the main application
- Audit logging that records reads but is never reviewed, or is not tamper-resistant
- Third-party and vendor access that outlived the project it was created for
- AI features and assistants with read access to records and no record of what they read
How CyberArc handles health data during an engagement
Testing systems that hold personal health information means handling personal health information. CyberArc's data handling is PHIPA-aware: client data is processed on local AI models by default, and cloud AI tools are used only with the client's written consent.
That matters for the written agreement. A custodian cannot authorize an arrangement that would itself be an unauthorized disclosure, so the scope and the data handling terms are agreed before any access is granted.