Mandatory health data breach reports are due to the Information and Privacy Commissioner of Ontario by March 1. Reporting by covered health data custodians will be put toward the IPC's annual breach report mandated under the Personal Health Information Protection Act. Reporting is mandatory for a range of incidents defined by the regulator, including data loss, theft, improper use or disclosure. The IPC also outlined the incident sizes that require reporting.