INDUSTRIES

PHIPA compliance and healthcare IT

PHIPA governs health information in Ontario, and an equivalent provincial act governs it everywhere else in the country. Not HIPAA. If a vendor is selling you HIPAA compliance for an Ontario clinic, that tells you how carefully they've read the file, and it's worth knowing before you sign.

WHAT APPLIES

Which rules apply to you?

  • PHIPA

    Applies now

    Ontario's health privacy act, with its own definition of a custodian and its own duties for the agents acting on a custodian's behalf. Your IT provider is usually an agent.

  • Provincial equivalents

    Applies conditionally

    Every province has its own health privacy statute. The obligations rhyme. The thresholds and the timing don't.

  • PIPEDA

    Applies conditionally

    The federal baseline, for the parts of what you do that provincial health law doesn't reach.

  • Breach notification

    Applies now

    To the Information and Privacy Commissioner, on thresholds that are set separately from the federal ones and don't move together with them.

  • HIPAA

    Doesn't apply

    US law. It governs nothing in a Canadian clinic, and a vendor quoting it is quoting the wrong country.

WHERE TO START

Which services answer them?

TECHNOLOGY

Whose kit does this run on?

The platforms we design, build and support. Named because a buyer with an estate already standardised on one of them needs to know before the first call, not after it.

Cisco, Fortinet, VMware, Azure, Microsoft, F5

QUESTIONS

What buyers in this sector ask.

If you're a health information custodian in Ontario, PHIPA. Outside Ontario, your province's health privacy statute does the same job with different thresholds. PIPEDA covers the commercial activity that provincial health law doesn't reach, so most practices touch both rather than choosing between them.

Yes, and so is any provider handling your health information. An agent has duties of its own, including telling the custodian at the first reasonable opportunity about any theft, loss, or unauthorised use or disclosure. Ask any provider to put that in the contract. If they hesitate, you've learned something.

Yes. In Hospital for Sick Children v. Ontario, 2025 ONSC 5208, the Divisional Court held that notification applies when an attack makes health information inaccessible, even temporarily, and even with no evidence it was viewed, accessed or stolen. A PHIPA breach no longer needs anything to have been taken.

The second one. HIPAA is United States law and governs nothing in a Canadian clinic. The Canadian equivalent is PHIPA in Ontario, and the corresponding statute in every other province. A vendor quoting HIPAA at an Ontario clinic has told you how carefully they read the file.

If you need a privacy lawyer's opinion on whether a specific incident is reportable, that's counsel's call, not ours. We build and evidence the controls, and we'll work alongside whoever advises you. Knowing which of the two you need is the cheapest hour in the whole process.

PARLONS-EN

Prêt à bâtir un réseau plus solide,
plus intelligent?

Découvrez nos servicesRéservez une consultation gratuite

Un spécialiste chevronné répond en moins d'une heure, 24/7.