PHIPA breach windows: what actually counts as 'prompt'
Ontario's IPC has tightened what 'prompt notification' means under PHIPA. The window is shorter than most healthtech founders think - and the fines are personal.
The window the IPC expects
PHIPA doesn't print a number of days. It says notification must be 'prompt.' Ontario's Information and Privacy Commissioner has, through enforcement, effectively defined that as within hours of realising PHI was accessed without authority - not days, and certainly not after the forensics report is final.
The practical effect: your incident response retainer is the clock. If your forensics firm can't start within hours, your breach-council lawyer can't triage notification that quickly, and you blow past the window.
When fines become personal
Where PHI exposure affects public health - a misconfigured records system, a leak that impairs care - the IPC has signalled it will investigate directors personally, not only the organization. That's a D&O exposure layered on top of the cyber response.
Most cyber policies do not name PHIPA in their regulatory-proceedings cover by default. The fix is an affirmative PHIPA endorsement that pays for the regulator's investigation and any administrative penalty.
Reading is the start. A short conversation turns it into a plan.
No sales pressure. We'll look at your stage, your contracts, and your AI exposure, and tell you - plainly - where your current coverage won't hold up.
Risk notes, once a month.
One short note on Ontario tech risk - breaches, regulation, and what your policy should actually cover.
The PHIPA regulatory-defence endorsement
The endorsement to ask for pays defence costs in an IPC investigation and certain administrative penalties. It is not automatic - insurers that write generic cyber often require it as an add-on, and some exclude Ontario health-data regulators entirely.
If you store PHI, the question for your broker is not 'do we have cyber?' It's 'does our cyber respond to an IPC investigation of a director, specifically?'
Keep reading
Ransomware is changing in 2026 - and Ontario underwriters know it
Encryption is the old playbook. Extortion - the threat of leaking data, not locking it - is the new one. Here's what that means for your cyber limit.
When your AI hallucinates, who pays?
The Air Canada chatbot case is now precedent Ontario tribunals cite. If you ship an LLM feature, your Tech E&O needs an AI endorsement - not a hope.
SLA gaps your Tech E&O won't close
The uptime promise in your MSA is a contract. Your Tech E&O is insurance. They are not the same thing, and founders confuse them at their peril.
Keep exploring
General information only. Not insurance advice.