This spring the largest penalty to date was issued under Ontario’s Personal Health Information Protection Act (“PHIPA”). A social work student was convicted of accessing personal health information without authorization, and ordered pay a $20,000 fine and a $5,000 victim fine surcharge after pleading guilty to “willfully accessing the personal health information of five individuals.” The breach took place in Goderich, Ontario’s prettiest town, where the student was completing a placement with a family health…