Primary speaker:
Sandy Chang, Institutional (Health) Privacy Officer and Assistant Director of Clinic Administration, Health & Wellness Centre
Description:
In recent years, the University of Toronto has redesigned how it governs health information by adopting a centralized Health Information Custodian (HIC) model, aligning campus clinics with the governance structures used in major health institutions. This presentation explores how this change has strengthened digital trust across the university’s healthcare ecosystem and improved accountability, transparency and consistency in handling personal health information.
The session will introduce the governance model (Governing Council as HIC; designated Contact Person; Privacy Officer; Heads of Clinics; and Agents) and demonstrate how these roles work together to ensure PHIPA compliance. Attendees will learn about key operational enablers including the HIC Agent Database, standardized agreements, centralized training resources, the HIC Information Hub and campus-wide breach response processes that contributed to a reduction in minor privacy breaches.
We will also discuss how cross-campus collaboration — spanning FIPPA, IT security, legal, OVPS, HR/LR and clinical teams — advances a culture of privacy beyond compliance. The session will conclude with a look ahead: the expanding digitization of campus health services, the introduction of AI assisted clinical tools and how recent provincial guidance informs responsible implementation to preserve trust.
