Ontario is the most populous province in Canada and, as a result, has a large and complex network of hospitals and health care facilities. While this scale helps ensure access to care, it can also complicate care coordination—especially as providers manage high patient demand amid staffing challenges.
For patients, these challenges arise not only during care delivery but also when accessing or sharing medical records. Depending on where care was provided, information may be stored across multiple facilities and systems, making it harder to retrieve, consolidate or send records when they’re needed. This is especially frustrating for substitute decision-makers and caretakers who manage care on behalf of a minor, aging parent or loved one.
This article provides clear guidance for Ontarians who need to securely share their health records with their care team. It explains how the Personal Health Information Protection Act (PHIPA) applies to record access and sharing, and how patient-centred platforms like PocketHealth can help centralize imaging and other health records—giving patients greater control over their information.
Every province or territory in Canada has its own legislation that protects patient health data and governs how it is stored, accessed and managed. In Ontario, this legislation is the Personal Health Information Protection Act (PHIPA).
PHIPA outlines the responsibilities of health information custodians, which are the health care facilities responsible for creating and maintaining patients’ medical records. Examples include hospitals, clinics, nurses, doctors and other health care professionals. It also explains patients’ rights to obtain copies of their records, request corrections and control the consent required for records to be shared with third parties.
To protect patient privacy, certain data-sharing rules must be followed, including patient consent. Implied consent applies to your “circle of care,” the members of your care team who share your health information with each other to coordinate care or stay up to date on your conditions. Examples include doctors, specialists, pharmacists, nurses and others.
Implied consent means a member of your care team doesn’t require your verbal or written consent each time your medical information is used to provide care. For example, when your doctor sends a prescription to your pharmacist, it is implied that you consent to the pharmacist receiving the information to complete the task. Otherwise, you would need to give consent every time you filled a prescription.
You have the right, by law, to withdraw this consent. You can also inform your providers of any information you don’t want shared within your circle of care.
Express consent means the patient must give permission for their data to be shared outside their circle of care. Examples include third parties such as insurance companies, medical researchers, employers, lawyers and others. This permission can be verbal, but it is often provided via an electronic or written request. Express consent can also be withheld if the patient chooses.
There are many possible situations where your personal health information may need to be shared. Here are some common scenarios.
If you have multiple health providers, such as physiotherapists and specialists, shared access to your records can improve care coordination. For example, if a specialist can access clinical notes and discharge summaries from your primary care doctor, they can see what tests and treatments have already been performed. This reduces repeat tests and keeps treatment plans efficient.
Access to medical records is critical in emergencies, particularly if you are not in a state to provide your full health history. When emergency care practitioners can see your previous assessments and documents, they quickly learn your health history and any underlying conditions. This helps them provide care that is informed and suited to your needs.
If you want a second opinion, for example, when being diagnosed with certain conditions, sharing your medical records in advance is helpful. When the new provider is familiar with your previous tests and procedures, the appointment can be more productive and efficient.
You may need to request that your current doctor release these records to the new physician. This usually requires a signed disclosure form, the new provider’s contact information and time for the records to be shared. Your current provider’s office can provide details on the process and any additional requirements.
Travelling can create challenges when accessing care abroad, from obtaining routine prescriptions to managing medical emergencies. In any case, health care professionals need access to your medical records to meet your needs. If you know you will be abroad, it helps to obtain your records before you travel.
Sometimes insurance companies need details on a medical service provided to the patient so they can correctly file a claim for payment. Examples include OHIP (the Ontario Health Insurance Plan) and WSIB (the Workplace Safety and Insurance Board). This may mean sending them applicable imaging reports, appointment notes, test results or other health data. This will likely require submitting an express consent request form to your provider and possibly paying a small fee.
There may be legal situations where an authorized authority or various government organizations require a person’s medical records. These are often to comply with court orders or law enforcement investigations and are usually done with a warrant. These legal exceptions do not require patient consent for record access.
In a province-wide public health situation, such as reporting infectious diseases or vaccination statuses, patient consent is not required to access this data.
Provinces have their own electronic health record (EHR) systems to authorize medical providers to access and share patient information. Ontario also has its own EHR system, but it only collects select health information at the provincial level and is not accessible to patients.
While many records can be shared across authorized health care facilities, some clinics and specialists use separate systems, further complicating record sharing.
This is just one of the many challenges that patients and providers face with record access. Here is an overview of other common barriers to sharing medical records.
Retrieving records can be time-consuming, especially when multiple providers are involved. This may require filling out several physical or electronic forms, paying fees or in rare cases, requesting copies in person.
Beyond the time required to complete release forms, the process of releasing information can be unexpectedly complex. Legally, most facilities need your written consent to share records with anyone outside your care circle, even if you are requesting your own records.
Filling out forms and paying fees can be a hassle, but it becomes more complicated when special considerations apply, such as obtaining consent on someone else’s behalf. If a patient is unable to make decisions independently, a caregiver may need to be formally registered as a substitute decision-maker on the patient’s behalf. This typically requires documentation, such as a Power of Attorney form or court order.
PHIPA requires health information custodians to provide patients access to medical records within a reasonable time, usually 30 days. Waiting for records can be frustrating when time-sensitive factors, such as an upcoming appointment for a second opinion, are involved.
Specialized records, like medical imaging, may not be included when your records are shared. When records are incomplete, extra time is needed to request and track this information to keep your data accurate and up to date. This can sometimes delay your care. Incomplete or scattered records are common, especially if you’ve seen multiple health care professionals.
At the provincial level, Ontario’s EHR system contains extensive patient data for health care providers to access. However, it is not your full health history, so even these records may be missing certain medical data.
Many medical facilities now provide patients with access to digital records via online portals or secure downloads. However, online records can vary in security and completeness. Some access is partial, so specific records, such as X-rays or other imaging, may require a formal request.
At times, online records may not be secure, such as when sent by unencrypted email. It is important to use a platform that provides both secure sharing and full record access.
PocketHealth is a secure, easy-to-use platform that lets patients access medical imaging and upload other health records from a single login. You can store, manage and share records on your own terms, which is useful if you have a large care team with multiple providers. For those managing family records, you can add up to four family members on the same account, making it easy to keep track of everyone’s information.
In addition to consolidated access, the platform offers educational features and resources, such as tools that highlight key anatomy in imaging reports and report explanations that summarize radiology findings in easy-to-understand language. Personalized follow-up recommendations are also available, which is especially useful when managing care across multiple providers.
Greater access to and control over your medical records can empower and educate you in your health journey. For Aileen, digital access to her imaging records via PocketHealth made her feel more involved during her metastatic breast cancer treatment. She could easily share results with her husband while improving her own understanding, which helped her communicate more effectively with her doctors.
Timely access to your medical records makes it easier to securely share information with your care team, reduce delays and stay actively involved in your care. Whether you’re coordinating care across multiple providers or supporting a loved one, understanding your PHIPA rights and using secure digital tools to access and share your records puts you in control of how your information is used.
Here are some common questions regarding accessing and sharing health records in Ontario.
Many providers offer patient portal access, allowing you to view your records online. You may need to request login permissions to get started. You can also contact your clinic to request copies of your records, which usually requires written consent and may include a small fee.
There are exceptions, but the typical retention period in Ontario is 10 years from the date of the last recorded entry or 10 years after the date patients turn 18.
Most providers offer some form of digital access to your medical records, though they may be fragmented or incomplete if you received care from a different medical provider. If your provider doesn’t have a patient portal, you can still request a copy, and many will provide a digital version, such as a PDF. Some clinics may still offer only hard copies, like CDs or paper records, though this is rare.
If records are shared as part of a referral, your primary care provider will typically send relevant information directly to the receiving provider to support your care. This is typically done with implied consent and does not incur a fee for patients.
If you want to share additional records or send information outside of a referral, you may need to submit a formal request to have your provider release those records. In these cases, providers may charge a reasonable fee for copying or transferring records, which can vary by facility and record type.
PocketHealth provides secure online access to your medical imaging records and allows you to upload and manage other health documents. You can then easily share these records yourself with your care team or family members, helping you avoid repeated requests, delays and release fees.
Published: December 19, 2025
Trusted by more than 900+ hospitals and clinics.
