Privacy responsibilities Québec
Québec: Law 25 and the health information act for clinics
In Québec, two laws work together. Since July 1, 2024, the Act respecting health and social services information covers the health information most clinics hold. Law 25’s private-sector rules cover the other personal information you keep, such as a mailing list. Both ask for the same basics: a person in charge, written rules, clear notices to patients, an assessment before information leaves Québec, and a register of incidents. Your privacy officer confirms which law covers each kind of information.
What you must do
Name a person in charge of protecting personal information.
Someone has to own the rules and answer patients.
By default it is the person with the highest authority in your clinic, who can delegate the role in writing. Publish their title and contact information on your website. Private sector act, section 3.1
Publish your governance rules and a plain-language privacy policy.
Patients should be able to read how you work before they share anything.
Your rules cover who can access what, how long you keep information and how you handle complaints. Put a short summary on your website. Commission d’accès à l’information
Tell patients what you collect, why, and their rights.
Consent only counts if the patient understands it.
When you collect information, explain the purpose, who may receive it, whether it may be sent outside Québec, and their rights to see it, correct it and withdraw consent. Private sector act, section 8
Assess before information leaves Québec, and before you adopt new technology.
Other places may protect information differently.
Do a privacy impact assessment before information is sent outside Québec, and before you acquire or overhaul a system that handles health information. Health and social services information act
Keep an incident register, and notify when there is a risk of serious injury.
A register shows what happened and what you did.
Record every confidentiality incident. When one creates a risk of serious injury, notify the Commission and the people affected promptly. Under the health information act, the Minister of Health is notified too. Commission d’accès à l’information, incidents
Tell patients when a decision about them is made only by automated processing.
People have a right to know when no person made the call.
Inform them when the decision is made, and let them ask for the information used and for a person to review it. Private sector act, section 12.1
Put your service providers under a written contract.
Information you hand to a vendor is still yours to protect.
The contract sets how the provider protects the information, uses it only for your mandate, and returns or destroys it at the end. Health and social services information act
A plain example
If your reports are reviewed in an online tool stored outside Québec, you need a privacy impact assessment first, and your patients should be told their information may leave Québec.
Why it matters
Québec’s laws carry real penalties, and the Commission can inspect and order changes. A clinic that has named its person in charge, published its rules and kept its register can answer any question quickly.
Common mistakes
- Leaving the person in charge off the website.
- Adopting a cloud tool without the assessment, because the vendor is Canadian.
- Keeping incidents in email threads instead of a register.
- Publishing a policy only in English.
How PulseAI helps
- Stored and processed in Québec, on servers in Montréal.
- An agreement that meets Québec’s requirements, signed before any data is shared.
- We help with the privacy impact assessment Québec asks for before you adopt new technology.
- If our agreement is ever breached, your person in charge of information protection hears from us immediately.
See how we protect your data on the Trust Center.
Questions, answered
Does Law 25 apply to my clinic?
Law 25 reformed Québec’s private-sector privacy law. Since July 1, 2024, the health information most clinics hold falls under the Act respecting health and social services information, which follows the same principles. Your other personal information stays under Law 25.
Who is the person in charge of protecting personal information?
By default, the person with the highest authority in the clinic. They can delegate the role in writing. Their title and contact information go on your website.
When do I need a privacy impact assessment?
Before information is sent outside Québec, and before you acquire, develop or overhaul a system that handles health information.
What do I do after a confidentiality incident?
Take steps to reduce the harm, record it in your register, and if there is a risk of serious injury, notify the Commission and the people affected promptly. Under the health information act, the Minister is notified too.
Your next step
Give every patient a clear privacy statement, and keep their acknowledgement on file.
Comparing vendors? Request our security package.
This page explains common obligations in plain language. It isn’t legal advice. Check with your privacy officer or lawyer for your situation.
Official sources
- Act respecting health and social services information (LégisQuébec)
- Gouvernement du Québec, the health and social services information act
- Act respecting the protection of personal information in the private sector (LégisQuébec)
- Commission d’accès à l’information, private organizations
- Commission d’accès à l’information, confidentiality incidents
Your privacy responsibilities: the other pages
- OntarioDuties of a health information custodian.
- Rest of CanadaPIPEDA and provincial health acts.
- United StatesDuties of a covered entity.
- Working with vendorsBAAs and service agreements.
- Using AI with patient dataFive plain rules.
- If something goes wrongBreach basics, and who to tell.
- Patient privacy templatesFree statements and acknowledgements.
How we protect your patients’ information is on our Trust Center.