A recent decision by the Information and Privacy Commissioner of Ontario involving a medical clinic highlights the importance of having written job duties and policies regarding the protection of patient personal health information.