Resources AI, privacy and compliance
What Ontario's PHIPA expects of the software and vendors a clinic uses, and the questions to ask before any patient information moves.
Mahmoud ElHewaheyFounder, PulseAI Solutions28 October 2026 · 3 min read
The short version
PHIPA governs personal health information in Ontario. Physicians, clinics and other health care practitioners are health information custodians: they are accountable for the information in their custody, including what their vendors do with it. A vendor shares the work under the custodian's direction, and the responsibility stays with the custodian.
Three roles a software vendor can play
| Role | What it means | What you need |
|---|---|---|
| Agent | Acts on the clinic's behalf with patient information, for the clinic's purposes | A written agreement setting out what the agent may do, and the clinic's policies applied to it |
| Electronic service provider | Supplies services that let the clinic collect, use or store information electronically | Assurance that it will not use or disclose the information except to provide the service |
| Health information network provider | Enables two or more custodians to share information electronically | A written agreement and the additional duties in PHIPA's regulation, including audit records on request |
PHIPA was strengthened in recent years. The Information and Privacy Commissioner of Ontario can now issue administrative monetary penalties, in addition to the fines a court can impose on conviction. The amounts make vendor choice a governance decision for the clinic.
Patients can ask to see and correct their information. Every system that holds part of the record, including vendors' systems, has to support the clinic in answering those requests.
PHIPA requires custodians to make a written public statement about their information practices available. Choose vendors whose practices can be explained simply, and share that explanation with patients. Our Trust Center is written so a clinic can do exactly that.
No product is compliant on its own. PHIPA compliance comes from how the clinic, as custodian, and the vendor operate together: a written agreement, use limited to the clinic's purposes, strong safeguards, an audit trail, breach procedures, and support for patients' access and correction rights.
Often. A vendor acting on the clinic's behalf with personal health information is generally an agent; one that only supplies electronic services is an electronic service provider. Your privacy officer decides which role applies.
PHIPA does not contain a general data residency requirement. Many Ontario clinics require Canadian storage by policy, and should ask every vendor where information is stored and processed.
Clinic Conductor is compliant with PHIPA, Québec's Law 25, PIPEDA and HIPAA. Canadian clinics are stored and processed in Canada, every clinic signs a privacy agreement before any data is shared, and patient data is never used to train AI.
This guide is general information about the law as published, written for clinic owners and their teams. It is not legal advice. Your privacy officer or counsel should confirm how it applies to your clinic.
Sources
See it running
Clinic Conductor is compliant with PHIPA, Québec's Law 25, PIPEDA and HIPAA. The Trust Center sets out how.
AI, privacy and compliance
What Canadian privacy law and the 2026 regulator guidance require of a clinic using an AI scribe: consent, assessments, vendor terms, recordings and training.
Read the guideAI, privacy and compliance
Since July 2024, Québec's health and social services information act sets new rules for clinic technology. What it asks, and what to ask your vendors.
Read the guideEMR and system integration
How a clinic connects its EMR to intake, forms, phones, faxes, labs and a CRM: the five ways to integrate, what each EMR exposes, and what to ask a vendor.
Read the guide
