The More Convenient Care Act, 2025 bundles six discrete changes to Ontario health law. It creates the Health Care Staffing Agency Reporting Act (a new reporting and record‑retention regime for temp staffing agencies), inserts a digital health‑identifier framework into PHIPA through a new “prescribed organization,” changes local public‑health governance in Hamilton, tightens provincial sign‑off on medical officers’ class orders, permits nurse practitioners to perform functions under the Mandatory Blood Testing Act, and applies the French Language Services Act to the Connecting Care service organization.
For system operators, privacy officers and compliance teams the bill is significant because it centralizes some identity and access functions (digital health identifiers) under a prescribed organization with new ministerial directive powers and Commissioner oversight; it forces staffing agencies to produce semi‑annual aggregate data and to keep contracts and invoices; and it shifts certain decision‑making and accountability relationships in public health and clinical reporting. The package raises immediate operational, privacy and governance questions that will be resolved largely in regulation and in the designation of the prescribed organization.
At a Glance
What It Does
The Act enacts a standalone Health Care Staffing Agency Reporting Act requiring prescribed aggregate reporting and three‑year retention of certain contracts and invoices; it amends PHIPA to authorize a prescribed organization to create and operate digital health identifiers subject to PHIPA‑style duties, Commissioner review and Ministerial directives; and it makes governance and operational changes across public health and clinical statutes.
Who It Affects
Health care facility staffing agencies (temporary help agencies that place staff in hospitals, long‑term care and other prescribed facilities), the future prescribed organization and its agents/vendors, health information custodians that exchange data with that organization, municipal public‑health governance in Hamilton, nurse practitioners involved in mandatory blood testing, and privacy/compliance officers across health institutions.
Why It Matters
The Act creates new, recurring compliance obligations (reporting, record retention, security and breach notification) and gives the Minister and the Commissioner concrete tools to shape how digital identity and data flows operate in Ontario’s health system — a potential structural shift in where identity, access and some custody responsibilities sit.
More articles like this one.
A weekly email with all the latest developments on this topic.
What This Bill Actually Does
The Health Care Staffing Agency Reporting Act requires temporary help agencies that place prescribed workers in public hospitals, long‑term care homes and other prescribed facilities to submit prescribed aggregate administrative, billing or pay‑rate information to the Minister on a regular basis (the Act contemplates a semi‑annual schedule, with regulations able to change timing). Agencies must retain true copies of assignment contracts and invoices for specified periods and submit reports in prescribed form.
The Minister may publish prescribed elements of those reports; the Act sets criminal fines for non‑compliance and gives broad regulation‑making authority, including the power to apply new rules to agreements entered into before the Act or regulations were filed.
PHIPA receives its largest operational amendment: the addition of Part V.2 creates a regulated regime for “digital health identifiers.” A prescribed organization (to be named in regulation) may create unique identifiers, run validation and verification services, provide authentication and account‑management services, and receive personal health information for those purposes. Most collection, use and disclosure under Part V.2 requires the individual's express consent, but the Act gives regulations power to modify consent requirements for specified activities.
The prescribed organization must have Commissioner‑approved practices and procedures, perform periodic privacy/security assessments, publish plain‑language descriptions, dispose of identifiers inactive for two years, and notify individuals and the Commissioner of breaches that meet prescribed thresholds. The Minister can issue binding directives to the prescribed organization after a defined consultation and posting process; the Legislation Act’s Part III does not apply to those directives.Operational checks are layered into the PHIPA changes: the Information and Privacy Commissioner reviews and approves privacy practices, can renew approvals and can order the prescribed organization (and its agents) to grant access, change practices, or take/remain from specified actions.
However, the Freedom of Information and Protection of Privacy Act will not apply to the prescribed organization’s PHI unless the new Act or regulations say otherwise, and the Lieutenant Governor in Council has broad authority to modify or exclude parts of PHIPA’s application to the organization.Other, narrower changes include re‑establishing a board of health in Hamilton whose members the city appoints and for which the city supplies public‑health employees; amending the Health Protection and Promotion Act so medical officers of health must notify and obtain written approval from the Chief Medical Officer before issuing class orders; allowing nurse practitioners to perform many physician functions under the Mandatory Blood Testing Act (including preparing reports and participating in sample collection and analysis chains); and applying the French Language Services Act to the Connecting Care service organization. Several provisions come into force on Royal Assent, while key PHIPA items and parts of the staffing‑agency Act are deferred to dates set by the Lieutenant Governor in Council.
The Five Things You Need to Know
Staffing agencies must submit prescribed aggregate billing, administrative or pay‑rate information at least every six months (regulations may change frequency) and use a prescribed form and timeline.
Agencies must retain assignment contracts for three years after contract expiration and invoices for three years after issuance for prescribed information.
The Minister may publish prescribed parts of the staffing reports and regulations may apply new rules retrospectively to agreements entered into before the Act came into force.
The prescribed organization must dispose of any digital health identifier inactive for two or more years and must have Commissioner‑approved privacy practices subject to triennial review.
Offences under the staffing‑agency Act carry fines up to $10,000 for individuals and $25,000 for corporations; the Act also bars private claims for compensation arising from its enactment or from authorized collection/use/disclosure.
Section-by-Section Breakdown
Every bill we cover gets an analysis of its key sections.
Semi‑annual reporting, three‑year record retention and publication powers
This Schedule establishes who counts as a covered staffing agency and what data must flow to the Minister: prescribed aggregate administrative, billing and pay‑rate information about placements. The Act prescribes a minimum reporting cadence (every six months), mandatory retention windows (three years for contracts and invoices tied to prescribed information) and gives the Minister the discretion to publish prescribed elements. Crucially, regulations may exempt classes of persons, attach conditions, and apply rules to pre‑existing contracts — which creates immediate implementation work for agencies and their counsel to map existing agreements against potential regulation scenarios.
Creates a regulated regime for digital health identifiers under a ‘prescribed organization’
Part V.2 authorizes a designated entity — the prescribed organization — to create digital health identifiers through validation/verification services, provide authentication and account management, and receive PHI for those activities. The statutory model is consent‑based, but the Lieutenant Governor in Council may craft exceptions or carve‑outs (including modifying Part III of PHIPA). The prescribed organization must implement Commissioner‑approved privacy practices, perform risk assessments, publish plain‑language descriptions, and follow breach‑notification rules; the Minister may issue binding directives after a minimum 45‑day consultation period with the Commissioner and public posting. The Schedule also expands the Commissioner’s remedial toolkit, including orders directed at the prescribed organization and its agents.
Local public‑health board re‑established with city control and staffing responsibilities
The Schedule re‑establishes a board of health for Hamilton and makes the city responsible for establishing the board’s size by by‑law and for appointing all members. The city must supply the public‑health employees it considers necessary — and those employees remain city employees. The city also retains functions around appointing and dismissing medical officers of health and must receive annual reports and recommendations from the board on public‑health issues within municipal jurisdiction.
Chief Medical Officer of Health sign‑off required before class orders
The amendment requires medical officers of health to notify the province’s Chief Medical Officer of Health of any proposed class order and obtain written approval before issuing a class order directed to a local class of persons. That procedural change centralizes a provincial check on local emergency or control measures and signals tighter provincial coordination on public‑health directives.
Expands nurse practitioners’ roles in mandatory blood testing
The Schedule adds nurse practitioners to multiple definitions and provisions so that an NP can act where the Act previously required a physician: preparing required reports, being the reporting clinician, and taking or overseeing blood‑sample collection under Board orders. The Board’s order framework remains, including timed sample collection (within two business days) and analytical/reporting duties for analysts; the text also tightens delivery and notification duties so applicants, respondents and reporting clinicians receive or are notified about results and attempts to deliver them.
French Language Services Act applies to the Connecting Care service organization
This short amendment makes the Connecting Care service organization subject to Ontario’s French Language Services Act as if it were a government agency. Practically, that creates obligations for bilingual service delivery and public‑facing documentation for the organization’s activities, including any public consultation or directives connected to digital health services.
This bill is one of many.
Codify tracks hundreds of bills on this topic across all five countries.
Explore this topic in Codify Search →Who Benefits and Who Bears the Cost
Every bill creates winners and losers. Here's who stands to gain and who bears the cost.
Who Benefits
- Patients and individuals who want streamlined online access: digital health identifiers aim to simplify identity verification and access to electronic health records, potentially reducing administrative friction for patients navigating the system.
- Health system planners and ministries: semi‑annual staffing‑agency data will provide a new aggregate evidence stream on staffing costs and placements to inform workforce planning and procurement.
- Nurse practitioners: the bill formally extends roles under the Mandatory Blood Testing Act to nurse practitioners, giving them statutory authority to prepare reports and participate in sample collection and analysis processes.
- City of Hamilton and its municipal council: by taking on appointment powers and employee supply for the board of health, the city gains more direct control over local public‑health governance and operations.
- Information and Privacy Commissioner: the Commissioner gains new review, approval and ordering powers over the prescribed organization’s privacy practices, increasing regulatory leverage over digital‑identity activities.
Who Bears the Cost
- Health care facility staffing agencies: they will face new reporting, record‑keeping and publication exposure, plus potential fines and administrative costs to collect and submit prescribed aggregate data.
- The prescribed organization and its vendors/agents: significant obligations for privacy/security assessments, Commissioner‑approved practices, breach notification and disposal protocols will require investment in security, governance and compliance.
- Health information custodians and clinical providers: custodians who interface with the prescribed organization may face new disclosure conditions, format and access requirements, and obligations that regulations may impose.
- The Ministry of Health and the Commissioner’s offices: both will absorb design, oversight and operational work — drafting regulations, managing consultations, reviewing and approving practices, and responding to breaches or directives.
- Individuals and privacy advocates: while not a direct financial cost, the centralization of identity services and a potential FOI exemption for the prescribed organization increase privacy‑risk exposure and create potential costs if remediation or legal challenges follow breaches.
Key Issues
The Core Tension
The central dilemma is a trade‑off between system convenience and integration (one or more centralized digital identity services, easier data flows and better workforce visibility) versus privacy, transparency and legal accountability (central custody of PHI, potential FOI exemptions, regulatory carve‑outs to consent, and limited private remedies). The Act pushes hard toward integration while leaving several accountability mechanisms dependent on regulation and Ministerial action.
The bill centralizes identity and some custody‑like responsibilities in a prescribed organization while preserving PHIPA’s structure only to the degree that regulations allow. On paper, most collection/use/disclosure for digital health identifiers requires express consent, but the Lieutenant Governor in Council can modify or exclude PHIPA provisions and permit exceptions to consent through regulation — a combination that could materially broaden the organization’s operational authority without parliamentary review of each change.
The non‑application of FOI to the prescribed organization (unless regulations say otherwise) compounds that risk, because it limits transparency pathways for third‑party oversight.
Another practical tension is accountability. The Commissioner receives expanded ordering and review powers, and the Minister obtains directive authority with a defined consultation process, but directives are expressly excluded from the Legislation Act’s Part III.
That creates an unusual governance architecture where ministerial directives can be binding, yet the processes and limits around those directives sit outside the ordinary regulatory‑making framework. Separately, the staffing‑agency Act includes a clause barring compensation claims for persons affected by the Act’s enactment and collection/use/disclosure under it, and it provides Crown immunity for officials acting in good faith — provisions that reduce legal risk for government actors but also limit remedies for affected private parties.
Operationally, many key settings are left to regulation: which organizations become the prescribed organization (or organizations), what exactly is ‘prescribed’ information in staffing reports, how consent exceptions are framed, what thresholds trigger breach notification to the Commissioner, and how pilot programs or deactivation powers operate. Those delegations make the Act a framework statute: the real shape of obligations and protections will depend heavily on forthcoming regulations, orders and the identity and governance of the prescribed organization.
There's more to this law than the bill.
Codify Laws traces every connection across the legislative lifecycle.