 However, the findings of a three-year review by the Information and Privacy Commissioner of Ontario (IPC) published in a 2008 report allayed some of these concerns and largely supported CIHI's assertion that the organization's security policies, procedures and protocols ensure high standards of privacy protection.According to the report, the "IPC is satisfied that CIHI continues to have in place practices and procedures that sufficiently protect the privacy of individuals whose personal health information it receives and that sufficiently maintain the confidentiality of that information," and that as of October 31, 2008, the IPC was satisfied that CIHI met the requirements of the Personal Health Information Protection Act.Since 2005, CIHI has maintained prescribed entity status under the Personal Health Information Protection Act (PHIPA).