AI, privacy and compliance
PHIPA-compliant software: a checklist for Ontario clinics
What Ontario's PHIPA expects of the software and vendors a clinic uses, and the questions to ask before any patient information moves.
Read the guideResources AI, privacy and compliance
Québec's health information act and Law 25: what clinics need from technology vendors
Since July 2024, Québec's health and social services information act sets new rules for clinic technology. What it asks, and what to ask your vendors.
Mahmoud ElHewaheyFounder, PulseAI Solutions28 October 2026 · 3 min read
The short version
- The Act respecting health and social services information came into force on July 1, 2024, and applies to private health facilities as well as public bodies.
- A privacy impact assessment is required before acquiring or overhauling technology that handles health information, and before information leaves Québec.
- Technology must default to the highest level of confidentiality, and every access must be logged.
- Service providers need a written mandate or contract with prescribed protection terms.
- Clinic Conductor stores and processes Québec clinics' information in Québec, on servers in Montréal.
Two laws, one direction
Québec modernized its privacy law in stages. Law 25 reformed the private-sector act and took full effect in September 2024. Alongside it, the Act respecting health and social services information came into force on July 1, 2024, creating a single regime for health and social services information held by public institutions, private health facilities, laboratories, specialized medical centres and others the Act designates. Which one governs a given clinic depends on how it is organized; your privacy officer confirms it.
What the health information act asks of technology
Obligations that reach a clinic's software
| Requirement | What it means in practice |
|---|---|
| Privacy impact assessment | Before acquiring, developing or overhauling a technology product or service that handles health information. |
| Register of technology | A published register of the technology products and services the organization uses. |
| Confidentiality by default | Products that collect information must be set to the highest level of confidentiality by default. |
| Logging | Every access to, or use of, health information is logged. |
| Service providers | A written mandate or contract with the protection terms the regulation prescribes. |
| Outside Québec | A privacy impact assessment before information is communicated outside the province. |
| Incidents | Reasonable steps to reduce harm, and prompt notice to the Minister, the Commission and affected people where there is a risk of serious injury. |
Data that stays in Québec
The Act allows health information to be stored outside Québec once a privacy impact assessment has been made and contractual protections that hold up are in place. The simplest way to meet that expectation is a vendor that keeps Québec clinics' information in Québec.
How Clinic Conductor handles Québec
Québec clinics are stored and processed in Québec, on servers in Montréal. We help with the privacy impact assessment Québec asks for, and every clinic signs an agreement that meets Québec's requirements before any data is shared.
Questions to ask a vendor serving Québec clinics
- Where exactly will our information be stored and processed?
- Will you support our privacy impact assessment with documentation?
- Are your products configured for maximum confidentiality by default?
- Do you log every access, and can we see the log?
- Will your contract include the protection terms the regulation prescribes?
- Is any of our information used to train AI? Put the answer in writing.
Questions, answered
When did Québec's health information act come into force?
Most of the Act respecting health and social services information came into force on July 1, 2024, with two related regulations.
Does Québec require health data to stay in Québec?
The Act requires a privacy impact assessment before health information is communicated outside Québec, and contractual protections with service providers. Keeping information in Québec is the simplest way to meet that expectation.
Where does Clinic Conductor store Québec clinics' data?
In Québec, on servers in Montréal.
This guide is general information about the law as published, written for clinic owners and their teams. It is not legal advice. Your privacy officer or counsel should confirm how it applies to your clinic.
Sources
See it running
What we do for Québec clinics, law by law, in the Trust Center.
Keep reading
Related guides.
AI, privacy and compliance
AI scribes and privacy in Canada: PHIPA, PIPEDA, Law 25 and the 2026 guidance
What Canadian privacy law and the 2026 regulator guidance require of a clinic using an AI scribe: consent, assessments, vendor terms, recordings and training.
Read the guideEMR and system integration
EMR integration for clinics: the complete guide
How a clinic connects its EMR to intake, forms, phones, faxes, labs and a CRM: the five ways to integrate, what each EMR exposes, and what to ask a vendor.
Read the guide