PREPARED BY: Planning and Strategic Initiatives

DATE: March 12, 2026

SUBJECT: 2025 Privacy Summary Report

BACKGROUND/PURPOSE

The Windsor-Essex County Health Unit (WECHU) is a “health information custodian (HIC)” in accordance with section 3 of the Personal Health Information Protection Act (PHIPA), and an “institution” in accordance with section 2 of the Municipal Freedom of Information and Protection of Privacy Act (MFIPPA). Under this legislation the WECHU has obligations to ensure the rights of individuals with respect to privacy, access, and correction of records of personal information (PI) and personal health information (PHI), and access to general records that pertain to the WECHU operations and governance.

All institutions under MFIPPA, and HICs under PHIPA, are required to provide statistical reports to the Information and Privacy Commissioner of Ontario (IPC) on an annual basis with respect to:

• Confirmed privacy breaches under PHIPA (Appendix A)
• Access and correction requests under PHIPA (Appendix B)
• Access and correction requests under MFIPPA (Appendix C)

The WECHU is required to submit statistical reports for each category by the deadline of March 1^st for PHIPA reports and March 31^st for MFIPPA. 

DISCUSSION

Privacy breaches

In 2025, the WECHU had 18 confirmed breaches. Privacy breaches in 2025 predominantly included incidents where personal information (PI) and/or personal health information (PHI) in electronic form were disclosed without authority. The increase in incidents involving electronic records likely reflects the increased adoption of electronic record-sharing, as procedures shift away from fax and paper documentation to align with IPC guidance. However, when managed properly, electronic methods are more secure and often can be audited or recalled. 

MFIPPA access and correction to information requests

In 2025, the WECHU completed 14 formal Freedom of Information requests based on the MFIPPA, compared to 22 in 2024. 

PHIPA access and correction to information requests

In 2025, the WECHU completed 228 formal Freedom of Information requests based on the PHIPA during the reporting year. 227 requests were to access records, and 1 was to correct personal records. The significant increase in 2024-2025 access requests can be attributed to the change in WECHU procedure to process all requests with PHI, such as immunization records, through the formal system. This is a measure to decrease the risk of privacy incidents and to improve consistency across the organization. 

CONCLUSION

In summary, all MFIPPA requests and all PHIPA requests were completed within the statutory time limits in 2025. The focus for the coming year will be to continue to work on improving privacy management at the departmental level. This includes the development of Standard Operating Procedures and the review of existing ones to ensure they are handling PI and PHI in a secure manner.