DentalX Back to home

Ontario Annex: Agent and Electronic Service Provider Terms

ANX-CA-ON · Draft of October 6, 2026 · revision 1 · version 1.0

Final draft for counsel's review. It is not in effect, and no clinic has accepted it. Items still to be confirmed are highlighted in the text.

This is the controlling text.

SHA-256 of this text: 450ecc39edd89bda0abf2d203a49f78a265ff8f6c3cfe83dcd88a39bc43c2622

Canada — Ontario — ANX-CA-ON: Agent and Electronic Service Provider Terms

Document ID: ANX-CA-ON · Version: 1.0 · Language: English (a French version is available on request; English controls) · Effective date: [[TO CONFIRM: publication date]] Applies to: Clinics in Ontario. Part of the Master Data Processing Agreement (the "MDPA"). Terms defined in the MDPA have the same meaning here.

1. Parties and roles

1.1 The custodians. Each health information custodian listed in the acceptance certificate (the "Custodian") is a party to this Annex. The Custodians are each dentist, dental hygienist or other regulated health professional of the Clinic who is a health information custodian under the Personal Health Information Protection Act, 2004 ("PHIPA"), or the single custodian designated under PHIPA for a group practice. Where the acceptance certificate records a designation, the designated custodian is the Custodian.

1.2 VstreamX's role. For the personal health information ("PHI") of the Custodians' patients in DentalX, VstreamX acts as the Custodians' agent under section 17 of PHIPA: it hosts and handles PHI on their behalf. Section 6(1) of Ontario Regulation 329/04 applies to a person who supplies electronic services to a custodian and who is not an agent of the custodian, so it does not apply to VstreamX by law. VstreamX nevertheless accepts the restrictions in clause 3 as contractual terms.

1.3 Responsibility stays with the Custodian. The Custodian remains responsible for the PHI that VstreamX handles on its behalf (PHIPA s. 17(3)).

2. Permitted handling (PHIPA s. 17)

VstreamX collects, uses, discloses, retains or disposes of PHI on a Custodian's behalf only where:

  • the Custodian permits it;
  • it is necessary in the course of providing DentalX;
  • it is not contrary to PHIPA or another law; and
  • it complies with any conditions the Custodian imposes in the Service.

VstreamX does not handle PHI for its own purposes (MDPA clause 4).

3. Contractual restrictions modelled on O. Reg. 329/04, s. 6(1)

VstreamX accepts the following as terms of this Annex. They are modelled on section 6(1) of O. Reg. 329/04, adapted to an agent:

  1. It shall not use any PHI to which it has access in the course of providing the services for the Custodian, except as necessary in the course of providing the services.
  2. It shall not disclose any PHI to which it has access in the course of providing the services for the Custodian, except to the Sub-processors in MDPA Schedule 3 that act on its behalf in providing those services, as PHIPA s. 17 permits an agent to do with the Custodian's permission, or where the law requires.
  3. It shall not permit its employees, or any person acting on its behalf, to be able to have access to the PHI, unless the employee or person agrees to comply with the restrictions that apply to VstreamX.

[[TO CONFIRM: Ontario counsel's confirmation that the agent characterisation is correct for DentalX]]

Sub-processors. Each Sub-processor in MDPA Schedule 3 is bound, through its contract with VstreamX, by the obligations in MDPA clause 7.2, including the restrictions in items 1 and 3 as they apply to it.

4. No health information network services

  • No sharing between custodians. DentalX does not enable two or more custodians that are not part of the same Clinic to share PHI with one another by electronic means.
  • Why. VstreamX therefore does not act as a health information network provider under section 6(2) and (3) of O. Reg. 329/04.
  • If that changes. Before VstreamX offers any feature that would do so, it will provide the additional written agreement, assessments and information that section 6(3) requires.

5. Theft, loss and unauthorised use or disclosure

5.1 Notice to the Custodian. VstreamX notifies the Custodian at the first reasonable opportunity, and in any event within the 24 hours of MDPA clause 9, if PHI handled by VstreamX on the Custodian's behalf is:

  • stolen;
  • lost;
  • collected, used or disclosed without authority; or
  • used or disclosed in contravention of this Annex.

5.2 What the Custodian must do. This allows the Custodian to notify the individual at the first reasonable opportunity, and the Information and Privacy Commissioner of Ontario where the regulations require (PHIPA s. 12(2) and (3); O. Reg. 329/04, s. 6.3).

5.3 Annual report. VstreamX gives the Custodian the information it holds for the Custodian's annual statistical report to the Commissioner, due by 1 March of each year.

6. Access and correction

  • Access. VstreamX assists the Custodian within 5 business days to respond to an individual's request for access to, or correction of, their record of PHI (PHIPA Parts V), so that the Custodian can meet the 30-day period.
  • Self-service. The Service lets the Custodian export and correct a patient's record itself.

7. Audit logs

  • Access to the logs. On request, VstreamX gives the Custodian access to the audit trail of the Custodian's patients' records (MDPA Schedule 2, C.12).
  • Read-access logging. When section 10.1 of PHIPA (electronic audit logs) is proclaimed in force, VstreamX will provide the log content it requires: the type of information viewed, handled, modified or otherwise dealt with, the person, the date and time, and the patient. It will also provide that log to the Custodian on request. [[TO CONFIRM: roadmap date for full read-access logging, which DentalX does not yet record for every read]]

8. Information practices and transparency

VstreamX provides the Custodian with a plain-language description of DentalX's safeguards (MDPA Schedule 2), the location of the PHI (MDPA clause 13.1) and the Sub-processors (MDPA Schedule 3). The Custodian uses it for its written public statement of information practices (PHIPA s. 16).

9. Retention

  • The Custodian's duty. Under the Royal College of Dental Surgeons of Ontario's rules on dental records, records must be kept for at least 10 years after the date of the last entry, or until 10 years after the day the patient reached or would have reached the age of 18, whichever is later.
  • No auto-deletion. DentalX does not auto-delete clinical records.
  • At the end. At the end of the service, the export allows the Custodian to keep them.

[[TO CONFIRM: current RCDSO dental recordkeeping guidance, including any wording on consent to third-party electronic storage]]

10. Precedence and applicable law

  • PHIPA applies. PHIPA and its regulations apply to the handling of PHI under this Annex whatever law governs the commercial relationship.
  • No waiver. Nothing in the Terms or the MDPA waives or limits a Custodian's duties, or VstreamX's duties as agent or electronic service provider, under PHIPA.
  • Agency for PHIPA purposes. Section 22 of the Terms says the parties are independent contractors. That statement does not prevent VstreamX from being the Custodian's agent for the purposes of PHIPA.

Items to confirm before publication (Ontario)

  1. Publication date.
  2. Ontario counsel's confirmation of the agent characterisation (§1.2, §3).
  3. A roadmap date for full read-access logging (§7).
  4. The current RCDSO recordkeeping guidance, including any consent wording for third-party storage (§9).