Use case

How to hide OHIP and Ontario driver's licence numbers in online meetings

6 min read

  • Canada
  • Ontario
  • Screen sharing

If you work in Ontario with patient or client records, two numbers probably cross your screen every day: the OHIP number on a health card, and the number on a driver’s licence. Both are protected by law, and both are easy to show by accident the moment you share your screen on a call.

This post covers what the law actually says about each one, and how to keep them off a shared screen with Smart Blur.

A health number is personal health information

Ontario’s Personal Health Information Protection Act (PHIPA) lists an individual’s health number as personal health information in its own right. It doesn’t need a diagnosis or a visit record next to it. The number alone is enough.

That has two consequences people often miss.

First, it isn’t only clinics and hospitals that have to be careful. PHIPA limits how anyone who isn’t a health care provider may collect or use an Ontario health number, and says they may not disclose it except where the regulations or another law allow. Insurers, employers and service providers who hold health numbers are covered by those limits too.

Second, a health care provider that lets a health number be seen by someone who shouldn’t see it has a privacy breach on its hands. Under PHIPA, the provider must tell the affected person at the first reasonable opportunity when their health information is stolen, lost, or accessed by someone without authorization. A vendor’s support engineer reading a patient’s OHIP number off your shared screen can fit that last description.

The penalties show how seriously Ontario takes this. Since January 2024 the Information and Privacy Commissioner of Ontario can issue administrative penalties of up to $50,000 for individuals and $500,000 for organizations, and the fines for offences under the Act go up to $200,000 for an individual and $1,000,000 for an organization. A one-off slip on a call is not what the largest fines are aimed at. But a breach still has to be handled, reported to the patient and explained, and that is work nobody wants.

A driver’s licence number falls under a different law

Driver’s licence numbers aren’t health information, so PHIPA doesn’t apply to them. For most private businesses in Ontario, the federal Personal Information Protection and Electronic Documents Act (PIPEDA) does, and it requires organizations to protect the personal information they hold against unauthorized use or disclosure.

The Office of the Privacy Commissioner of Canada points out why licence numbers deserve that care: they are unique to the driver and usually last a lifetime, which makes them valuable to identity thieves.

Ontario’s numbers give away more than most. The letter at the start is normally the first letter of the holder’s last name, and the last digits are their date of birth. So a licence number on screen also shows part of someone’s name and the day they were born.

Where screen sharing comes in

None of this is new to anyone who handles records. What’s changed is how often those records end up on a call: walking a colleague through a claim, getting help from a software vendor, training someone new, demoing a system to a client. Records systems put the health number and licence number at the top of the page, because that’s where you need them when you’re working alone. They don’t know when you’ve started sharing.

Being careful helps, until the day a page loads with more on it than you expected. And if the call is recorded, a number that was on screen for two seconds can be paused and read later.

How Smart Blur helps

Smart Blur blurs personal information on the page itself, in your browser, before anyone on the call can see it. Nothing is uploaded and there is no account, so the records you’re protecting never leave your computer.

Its built-in patterns cover common data such as Social Security numbers, card numbers and phone numbers, but the ID patterns are built around US formats and don’t reliably catch Ontario’s. The printed form of an OHIP number, 1234-567-890-AB, isn’t caught at all, and where the digits are caught, the version code or the licence letter stays visible. So add two patterns of your own. Custom patterns are part of the free version.

OHIP number

\b\d{4}[\s-]?\d{3}[\s-]?\d{3}(?:[\s-]?[A-Z]{1,2})?\b

This covers the 10-digit health number with or without spaces or hyphens, and the one- or two-letter version code after it. Green photo cards always have a version code; some older red and white cards don’t, and the pattern handles both. It includes the version code on purpose: Smart Blur only blurs the text a pattern matches, and a pattern for the digits alone would leave the version code readable.

Ontario driver’s licence

\b[A-Z]\d{4}[\s-]?\d{5}[\s-]?\d{5}\b

This covers the letter and all 14 digits, however they’re spaced, so neither the surname initial nor the date of birth is left showing.

Adding them

Open the Smart Blur panel, click Advanced Settings, and choose Patterns. Under Custom Regex Patterns, give each pattern a name (“OHIP”, “Ontario licence”), paste it in, leave the flags box as gi, and click Add. If you only want the rules to run on your patient system or claims portal, tick Limit to specific domains or URLs and add its address.

The patterns work whenever Manual Mode is on in the panel, which it is by default. Smart Blur Pro adds Auto-enable when sharing, if you’d rather leave protection off during the day and have it switch on when you start sharing from your browser.

Before your next call, open a real record and check that both numbers are fully blurred. One thing to look for: if your system shows the version code in its own box or column, apart from the number, that box is a separate piece of text and the pattern won’t cover it.

Records often carry a SIN or passport number as well. Those are covered in keep Canadian SINs and passport numbers safe in your screen share.

This post explains the law in general terms and isn’t legal advice. Your privacy officer is the right person to ask how it applies to your organization.

Sources