Ontario proposes mandatory cyber rules for hospitals, school boards and colleges
The Ontario government announced proposed changes on March 13 that would impose mandatory cyber security measures on hospitals, school boards, children's aid societies and post-secondary institutions, as part of a broader update to the province's cyber security, privacy and access to information framework.
The proposals would move much of the broader public sector from voluntary guidance to firm obligations. These are organizations that have been hit repeatedly by ransomware and by third-party breaches such as the 2024 PowerSchool incident, which the province's privacy commissioner investigated.
What is proposed on cyber security
According to a summary of the announcement by law firm Deeth Williams Wall, the proposed changes would:
- apply mandatory cyber security measures to hospitals, school boards, children's aid societies and post-secondary institutions;
- require broader public sector organizations to complete cyber maturity assessments every two years;
- require them to report critical cyber incidents and name a single point of contact for cyber security events;
- require school boards to notify parents or guardians when students' personal information is disclosed to third-party software; and
- allow certain information in employee accounts, such as email, to move with individuals between public sector roles.
Access to information changes
The same package would change Ontario's Freedom of Information and Protection of Privacy Act. Response deadlines would move from 30 calendar days to 45 business days. Institutions would have to help requesters whose requests lack detail, and the practice of releasing records in batches during processing would be written into law.
The most contested proposal would exclude records of the premier, cabinet ministers, parliamentary assistants and their offices from freedom of information requests. That exclusion has drawn criticism, the law firm noted.
What we don't know yet
The summary does not set out effective dates or the regulations that would define which incidents count as critical or what a cyber maturity assessment must cover. Those details will determine how much work hospitals, boards and colleges face.
What to do
- Broader public sector organizations in Ontario should identify who would act as their cyber security point of contact and how incidents are escalated today.
- School boards should list the third-party applications that receive student information, since parent notification would depend on that inventory.
- Organizations that have never done a maturity assessment can start with the Canadian Centre for Cyber Security's baseline controls as a reference.
