HIPAA in Canada: Does It Apply, and What PHIPA and PIPEDA Require Instead

Someone sent you a vendor form with a box that says "HIPAA compliant?" and now you're searching HIPAA Canada to figure out whether you're supposed to tick it. You're not alone. That question gets asked thousands of times a month by Canadian clinics, health-tech founders and the IT people who support them.

Here's the short answer. HIPAA is a US law and it doesn't apply to a clinic, pharmacy or health business operating in Canada. Your health data is governed by your province's health privacy law (PHIPA in Ontario, the Health Information Act in Alberta, and so on) and, for commercial activity those laws don't reach, by the federal PIPEDA. HIPAA only reaches a Canadian company when it handles US patient data on behalf of a US healthcare client, usually under a contract called a Business Associate Agreement.

So the useful question isn't "are we HIPAA compliant?" It's "which Canadian law binds us, and can we prove we follow it?" This guide answers that by province, shows what getting it wrong now costs in Canadian dollars, and ends with an IT checklist you can hand to whoever runs your systems.

Not sure which rules apply to you? Our free compliance readiness assessments take a few minutes and show your gaps before you spend anything.

Does Canada have HIPAA? Is HIPAA in Canada at all?

No. Canada has no single national health privacy law, and HIPAA itself has no force here.

What Canada has instead is a layered system. Two federal privacy laws sit at the top, and every province adds its own rules, several of them written just for health information. That's why a dentist in Halifax, a physiotherapy clinic in Mississauga and a private surgical centre in Laval can all face slightly different obligations for the same patient file.

It sounds messy. It is, a bit. But for any one organisation the answer usually boils down to one or two laws, and the table further down shows which.

Is HIPAA a US or Canadian law?

It's a US federal law. HIPAA, the Health Insurance Portability and Accountability Act, applies to three types of US "covered entity": health plans, health care clearinghouses, and health care providers that transmit health information electronically in standard transactions. It also reaches their "business associates", meaning anyone who creates, receives, maintains or transmits protected health information on a covered entity's behalf (45 CFR 160.103).

Nothing in that definition covers a clinic in Canada treating Canadians. That's the whole reason the Canadian answer is "no".

What is the HIPAA equivalent in Canada?

There isn't one equivalent. There are several, and which one counts as "your HIPAA" depends on who you are and where you operate.

You'll see plenty of articles call PIPEDA "Canada's version of HIPAA". That's only half right. For most health care providers in Ontario, New Brunswick, Newfoundland and Labrador and Nova Scotia, a provincial health law replaces PIPEDA for health information. In those provinces the provincial act is the closer match.

What are the two federal privacy laws in Canada?

The Office of the Privacy Commissioner of Canada (OPC) enforces two federal laws (OPC):

• The Privacy Act covers how federal government institutions handle personal information.
• PIPEDA, the Personal Information Protection and Electronic Documents Act, covers private-sector organisations that collect, use or disclose personal information in commercial activity. It also covers the employee data of federally regulated businesses like banks, airlines and telecoms.

PIPEDA applies in the three territories, to information that crosses provincial or national borders, and in any province without a "substantially similar" law of its own. Federal penalties for the most serious PIPEDA offences reach $100K per offence.

Where do provincial health laws take over?

The OPC lists which provincial laws are "substantially similar" to PIPEDA, which means they apply instead of it (OPC):

• General private-sector laws: Alberta, British Columbia and Quebec.
• Health information laws: Ontario, New Brunswick, Newfoundland and Labrador, and Nova Scotia.

Other provinces have health privacy laws too, but they haven't been declared substantially similar, so PIPEDA may still apply alongside them.

Which law applies in your province?

Here's the quick map. It covers the four provinces where most Canadian health organisations sit. Public hospitals and health authorities often fall under a separate public-sector act as well, so treat this as the starting point, not the last word.

Is HIPAA in Ontario?

No. Ontario's health privacy law is PHIPA. It applies to "health information custodians" (doctors, dentists, pharmacies, labs, hospitals, long-term care homes and so on) and to their "agents", which is anyone acting on the custodian's behalf. Your EMR vendor, your managed IT provider and your cloud backup company are usually agents.

That agent role matters. It means your IT provider has PHIPA duties of its own, and your contract should say so. If you want to see how we map PHIPA to services, start with our page on PHIPA compliance for health organisations.

What applies in Quebec?

Quebec now has a dedicated health law. The Act respecting health and social services information came into force on 2024-07-01. It applies to designated health and social services bodies, which include public institutions, private health facilities, labs and specialised medical centres (Blakes).

Two rules stand out for IT. A body can share health information with a service provider only under a written contract with prescribed terms, including immediate breach reporting, audit rights and no retention after the contract ends. And a privacy impact assessment is required before health information is sent outside Quebec. Everything else in a Quebec business falls under Law 25, which we cover on our Quebec Law 25 compliance page.

What applies in British Columbia (HIPAA Canada BC)?

BC is the odd one out. It has no general health information act for the private sector. A private physician's office, clinic or lab follows BC's Personal Information Protection Act (PIPA), while hospitals and health authorities follow the public-sector FIPPA (Doctors of BC).

So when you read that "BC's health law is PIPA", that's true for private practice, but PIPA is a general privacy law. It covers your patient files and your marketing list with the same rules.

What applies in Alberta (HIPAA Canada Alberta)?

Alberta's Health Information Act governs custodians such as physicians, pharmacists and other regulated health providers. Amendments passed in a November 2025 omnibus bill came into force in June 2026, touching privacy impact assessments, shared health information, de-identification and AI, and letting "information managers" like EMR and AI scribe vendors submit their security policies to the OIPC for review (IAPP). Other private businesses in Alberta follow Alberta's PIPA.

When does HIPAA apply to a Canadian company?

Here's the exception the short answer promised. HIPAA reaches a Canadian organisation when it works for a US covered entity and touches that entity's protected health information. At that point it's a business associate under the US definition, wherever its office is.

In practice it shows up as a contract. The US client asks you to sign a Business Associate Agreement (BAA), and the BAA makes you responsible for HIPAA safeguards, breach reporting and passing the same terms down to your own subcontractors.

Picture a Montreal software company that builds scheduling tools. Its Canadian clinic customers fall under Quebec and Ontario law. Then it signs a hospital network in Vermont. From that day, the US patient data it hosts is covered by a BAA and HIPAA rules, and the Canadian data is still covered by Canadian law. Two regimes, one platform. That's the situation where "HIPAA compliance" in Canada is a real requirement rather than a marketing line.

What doesn't trigger HIPAA:

• Treating a US tourist at your Toronto clinic. You're not acting for a US covered entity.
• Buying software that the vendor calls "HIPAA compliant". The label is about the vendor's US market, not your obligations.
• Storing Canadian patient data on a US cloud. That raises Canadian questions (consent, contracts, and Quebec's assessment rule), not HIPAA ones.

PHIPA vs HIPAA: how are the two laws different?

Both laws protect health information and both require safeguards, breach notice and patient access. The detail is where they part.

The biggest practical difference for IT is the breach trigger. Under HIPAA, a documented risk assessment showing a low probability of compromise can take an incident out of the breach category. In Ontario, that door has closed.

What counts as a HIPAA violation, and what does it cost in Canada?

In the US, a HIPAA violation is any use or disclosure of protected health information the rules don't allow, or a failure to put the required safeguards in place. Canada's version of the same idea, under PHIPA, is any collection, use or disclosure without authority, plus failing to take reasonable steps to protect the information.

The most common real-world example is snooping: staff opening records they have no reason to see.

What did the 2025 SickKids ruling change?

In Hospital for Sick Children v. Ontario (Information and Privacy Commissioner), 2025 ONSC 5208, the Divisional Court upheld the Commissioner's view that ransomware which encrypts health information is an unauthorised "use" and a "loss". That triggers PHIPA's duty to notify, "even if only temporarily, and there is no evidence the information was actually viewed, accessed or stolen" (BLG).

Read that twice if you run IT for an Ontario clinic. "Nothing was taken" is no longer a reason to stay quiet. Your recovery time and your backups are now part of your notification story, which is why tested backup and disaster recovery matters as much as the firewall.

How much are PHIPA penalties?

Since 2024-01-01, the Information and Privacy Commissioner of Ontario can issue administrative monetary penalties (IPC Ontario):

The IPC says it won't use these penalties for honest one-off mistakes, and the caps can be exceeded where someone profited from the breach. Officers and employees who authorised an offence, or knowingly failed to stop it, can be held personally liable, and there's no time limit on starting a prosecution.

The first penalties landed in 2025. In PHIPA Decision 298, a physician used a shared hospital health record system to look up newborn boys and then contacted their parents to sell circumcision services at his private clinic. The IPC fined the physician $5K personally and the clinic $7.5K, and noted that the clinic had opened with no documented privacy policies or breach plan at all. Small amounts. Big precedent.

What does "HIPAA compliance" mean for a Canadian clinic's IT?

If a form asks whether you're HIPAA compliant, the honest answer for most Canadian organisations is: "HIPAA doesn't apply to us. We comply with [your provincial act] and PIPEDA." Then back it up. Here's the IT side of a Canadian health privacy checklist, written so you can hand it to your provider.

1. Name the law and the roles. Write down whether you're a custodian, an agent or a service provider, and under which act. Most contracts never say.
2. Put agent duties in every IT contract. Breach notice to you at the first reasonable opportunity, no secondary use, return or destruction at the end. The OPC's new guidance on assessing third-party service providers (2026-09-10) is a good template for the questions to ask. Our third-party risk management work follows the same pattern.
3. Log every chart access, and review the logs. Decision 298 was a snooping case. You can't prove who opened which record without audit logs that someone actually reads. Strong identity and access management is the base for this.
4. Plan for encryption-only ransomware. Offline or immutable backups, a restore time you've tested, and a notification script ready before you need it.
5. Assess before you move data. A privacy impact assessment before a new EMR, AI scribe or cloud move. In Quebec, it's mandatory before health information leaves the province. See our privacy impact assessment service.
6. Train staff on what "authorised" means. Curiosity isn't a purpose. Most violations start with a person, not a hacker.
7. Keep evidence. Policies, training records, access reviews and incident logs. The IPC asked for exactly this in Decision 298.

Picture a three-location physiotherapy group in the Greater Toronto Area. Its new booking platform is American and markets itself as "HIPAA compliant". That label tells the group the vendor has done security work for the US market. It doesn't tell them whether the vendor will act as a PHIPA agent, where the data sits, or how fast they'll hear about a breach. Those three answers belong in the contract.

Want this mapped to your systems? We assess clinics and health-tech firms against PHIPA, PIPEDA and Quebec's rules, and fix what we find. Start with our PHIPA compliance page for health organisations, or our PIPEDA compliance service if you're a business that handles health data commercially.

Is federal privacy law about to change?

Possibly, but not yet. Bill C-36, which would enact the Protecting Privacy and Consumer Data Act and amend PIPEDA, was introduced on 2026-06-15. LEGISinfo shows it has completed first reading in the House of Commons and hasn't reached committee (LEGISinfo). It isn't law, and its text may change.

For health organisations, provincial health laws stay where they are either way. If C-36 passes, the change you'd feel is in the federal layer: the commercial side of health businesses and anything crossing provincial borders. We'll update this post when the bill moves. If you want the wider view of how privacy rules fit with risk and governance, our guide to what GRC means for Canadian organisations is a good next read.

Frequently asked questions about HIPAA in Canada

Does HIPAA apply to Canada at all?

Not to Canadian organisations treating Canadians. It applies only when a Canadian company works for a US covered entity and handles that entity's protected health information, usually under a Business Associate Agreement.

Is there something like HIPAA in Canada?

Yes, but it's split. PIPEDA is the federal baseline, and provincial health laws such as Ontario's PHIPA, Alberta's HIA and Quebec's health information act govern most health care providers.

What is the Canada HIPAA equivalent for a private clinic in Ontario?

PHIPA. It binds the clinic as a health information custodian and anyone acting for it as an agent, including IT providers.

Do I need "HIPAA compliance" in Canada to buy health software?

No. You need the vendor to meet your provincial law and PIPEDA. A HIPAA label shows security effort, not Canadian compliance. Ask about agent duties, data location and breach notice instead.

Can I sue someone for disclosing my health information in Canada?

Under PHIPA, yes. After an IPC order or a conviction, an affected person can sue for actual harm, plus up to $10K for mental anguish where the conduct was wilful or reckless. Other provinces have their own routes. Talk to privacy counsel about a specific case.

What should you do next?

If you're a Canadian clinic, stop worrying about HIPAA and pin down the law that applies to you. If you're a Canadian vendor with US healthcare clients, plan for both regimes on the same platform. Either way, the IT work is the same: contracts that name roles, logs that prove access, and backups that hold up when ransomware hits.

We work with health organisations in Toronto, Ottawa and Montreal, and remotely across Canada. Talk to us about a health privacy review of your systems.

This article explains the law in general terms as of 2026-10-13. It isn't legal advice. For a decision about your organisation, talk to privacy counsel.