Privacy responsibilities Rest of Canada
Rest of Canada: PIPEDA and provincial health acts
Outside Ontario and Québec, the law that covers your clinic depends on your province. Several provinces have their own health information acts, Alberta and British Columbia have their own private-sector laws, and the federal law, PIPEDA, fills the gaps. The duties look much the same everywhere: a named person, consent for a clear purpose, safeguards, patient access and correction, and a record of every breach.
What you must do
Confirm which law applies.
The rules, and the regulator, depend on where you practise.
New Brunswick, Newfoundland and Labrador and Nova Scotia have health information acts that apply instead of PIPEDA. Alberta and British Columbia have private-sector laws that apply instead of PIPEDA, and Alberta’s Health Information Act covers the custodians it names. Other provinces and the territories have health laws of their own, and PIPEDA can apply alongside them. Office of the Privacy Commissioner of Canada
Name a person who is accountable.
Someone in the clinic has to own privacy.
Choose a privacy lead and make their contact information easy to find. PIPEDA fair information principles
Collect for a clear purpose, with consent.
Patients should know why you ask for each piece of information.
Explain the purpose when you collect, collect only what you need, and use it only for that purpose unless the patient agrees or the law allows. PIPEDA requirements in brief
Protect information with safeguards that match its sensitivity.
Health information is among the most sensitive there is.
Use access controls, strong sign-in and written agreements with every vendor. PIPEDA fair information principles
Let patients see and correct their information.
It is their record.
Answer requests promptly and within the time your law sets. PIPEDA requirements in brief
Report breaches with a real risk of significant harm, and keep records of every breach.
Regulators look at your records, including the breaches you did not report.
Under PIPEDA, report to the Office of the Privacy Commissioner and notify the people affected as soon as feasible, and keep a record of every breach for two years. Office of the Privacy Commissioner of Canada, Mandatory reporting of breaches
Why it matters
Every one of these laws expects you to show your work: who is accountable, what patients were told, and what happened when something went wrong. Clinics that keep simple records answer questions in minutes.
Common mistakes
- Assuming PIPEDA applies when a provincial health act does, or the reverse.
- Keeping a record only of the breaches that were reported.
- Collecting information on intake forms that no one uses.
How PulseAI helps
- Canadian clinics are stored and processed in Canada.
- Information is used only for the reasons your clinic sets.
- Patients keep their right to see and correct their information, through your clinic.
See how we protect your data on the Trust Center.
Questions, answered
Does PIPEDA apply to my clinic?
It depends on your province. New Brunswick, Newfoundland and Labrador and Nova Scotia have health information acts that apply instead of PIPEDA. Alberta and British Columbia have private-sector laws that apply instead. Elsewhere, PIPEDA can apply alongside a provincial health act.
Which breaches must I report under PIPEDA?
Breaches that create a real risk of significant harm. Report them to the Office of the Privacy Commissioner and notify the people affected as soon as feasible.
How long must I keep breach records?
Under PIPEDA, keep a record of every breach for two years, including the ones you did not have to report.
Your next step
Give every patient a clear privacy statement, and keep their acknowledgement on file.
Comparing vendors? Request our security package.
This page explains common obligations in plain language. It isn’t legal advice. Check with your privacy officer or lawyer for your situation.
Official sources
- Office of the Privacy Commissioner of Canada, Provincial laws that may apply instead of PIPEDA
- Office of the Privacy Commissioner of Canada, PIPEDA requirements in brief
- Office of the Privacy Commissioner of Canada, PIPEDA fair information principles
- Office of the Privacy Commissioner of Canada, Mandatory reporting of breaches
Your privacy responsibilities: the other pages
- OntarioDuties of a health information custodian.
- QuébecLaw 25 and the health information act.
- United StatesDuties of a covered entity.
- Working with vendorsBAAs and service agreements.
- Using AI with patient dataFive plain rules.
- If something goes wrongBreach basics, and who to tell.
- Patient privacy templatesFree statements and acknowledgements.
How we protect your patients’ information is on our Trust Center.