A hospital collects patient records. An insurance company asks for medical details. A software company stores health information for clinics. All three deal with sensitive data, but they may not have to follow the same privacy law.
This is what makes PHIPA vs PIPEDA an important question for Canadian businesses. PIPEDA covers personal information used in certain commercial activities. PHIPA applies to personal health information handled by specific healthcare providers and other parties in Ontario. However, not every Ontario business that collects health information falls under PHIPA.
The answer depends on what your business does with the data and where the information is sent. In some situations, many privacy laws could apply.
So, how do you find out which rules your business needs to follow? In the next sections, you will learn how these laws work and who must comply with them.
PIPEDA vs. PHIPA: What Is the Difference?
PIPEDA and PHIPA protect personal information. But they cover different activities and organisations. Here is how the two laws compare.
| Factor | PIPEDA | PHIPA |
| Full name | Personal Information Protection and Electronic Documents Act | Personal Health Information Protection Act, 2004 |
| Jurisdiction | Federal | Ontario |
| Information covered | Personal information within the law’s scope | Personal health information covered by PHIPA |
| Who must comply | Organisations involved in covered commercial activities, including federally regulated businesses | Mainly health information custodians and other parties with duties under PHIPA |
| Regulator | Office of the Privacy Commissioner of Canada | Information and Privacy Commissioner of Ontario |
| Primary focus | Privacy in the private sector | Privacy of personal health information |
| Consent | Meaningful consent, subject to legal exceptions | Consent rules specific to healthcare, including implied consent and permitted exceptions |
| Breach reporting | Report breaches posing a real risk of significant harm to the federal regulator | Report breaches to Ontario’s Commissioner in circumstances specified by regulation |
| Information crossing borders | Applies to covered commercial transfers between provinces or countries | Section 50 sets conditions for certain disclosures outside Ontario |
PIPEDA compliance does not apply to every business operating in Canada. Alberta, British Columbia and Quebec have private sector privacy laws that are recognised as similar to PIPEDA. Ontario’s PHIPA and certain other provincial health privacy laws also have this status, for covered health information.
However, federal requirements may still apply to activities involving information transferred across provincial or national borders.
Which Privacy Law Applies to Your Business?
Step 1: Determine Whether You Handle Personal Information or Personal Health Information
Check what Personal Information your business collects. Then also check whether someone could use Personal Information to identify a person.
For example, an email address collected for a newsletter or an employee’s contact details count as Personal Information.
PHIPA defines Personal Health Information specifically. PHIPA includes information about:
- A person’s physical or mental health and medical history
- Diagnoses, prescriptions and treatments received
- Healthcare appointments and plans of care
- Eligibility for healthcare and related payments
A wellness app may collect details about someone’s health too. That alone does not mean PHIPA applies to the company running it.
Step 2: Determine Whether You Are a PHIPA Health Information Custodian
Under PHIPA, a health information custodian (HIC) must fall within one of the categories defined by law. These include:
- Healthcare practitioners and operators of group practices
- Hospitals and pharmacies
- Medical laboratories and specimen collection centres
- Other healthcare facilities and services specified in legislation
Consider an Ontario physician who controls patient charts. Their legal position differs from that of a fitness app company collecting exercise data directly from users.
For PHIPA compliance in Canada, check Section 3 of the Act carefully. It defines who qualifies as a custodian and sets out important exceptions.
Step 3: Determine Whether You Are Acting as an Agent or Independent Organization
Does your company handle patient information on behalf of a healthcare provider? Or does it decide how to use that information for its own business?
This matters for EHR providers and appointment platforms. Cloud storage companies and AI medical scribes must also consider their role.
For example:
A SaaS company stores patient records for a clinic and follows its instructions. It may qualify as an agent under PHIPA. Ensuring patient data protection requires continuous monitoring and regular API security testing to prevent unauthorized access across cloud integrations
Step 4: Ask Whether the Processing Occurs During a Commercial Activity
Next, check whether your business collects or uses personal information as part of a commercial activity. This is one of the main factors that determines whether PIPEDA Canada applies.
Some examples include:
- Selling products through an e-commerce website
- Offering paid SaaS subscriptions
- Running a commercial telehealth platform
- Collecting customer details through lead generation
- Managing customer accounts for paid services
Employee records are treated differently. PIPEDA applies to employee information in businesses that are federally regulated, like banks and airlines. It usually does not apply to employee records in private companies.
Step 5: Check Whether the Business Is Federally Regulated
Banks and telecom companies are federally regulated, along with airlines and certain rail and shipping operators.
PIPEDA applies to these businesses and also covers their employee information.
Before completing your Pipeda phipa compliance checklist, check if your business operates in a federally regulated sector. An Ontario address does not change which level of government regulates your business.
Step 6: Map Where the Information Travels
Where does the information go after your business collects it? It may stay in Ontario. It may pass through systems in another province or country.
Trace the routes your data takes:
- Ontario clinic to a local data processor
- Ontario business to a customer database in Alberta
- Ontario SaaS provider to a cloud service in the United States
- Ontario telehealth provider to a patient in another province
PIPEDA may apply when personal information crosses provincial or national borders as part of commercial activities. Include transfers handled by outside service providers in your review. Here, cybersecurity companies can help businesses assess data flows, identify security risks, and evaluate how third-party providers protect personal information during processing and transfers.
Can PIPEDA and PHIPA Apply to Different Parts of the Same Business?
Yes. A physiotherapy clinic may use patient information for treatment while collecting other details through its website or marketing activities. Each activity may come under different privacy rules.
Here is what the clinic needs to review:
| Information | What to look at |
| Patient charts | How clinical records are managed |
| Appointment records | Whether bookings form part of patient care |
| Website analytics | What visitor information is collected |
| Newsletter signups | How subscriber details are used |
| Staff records | Which employment privacy rules apply |
| Patient portal | What the software provider can do with patient records |
| External processing | Where the provider handles the information |
For Cybersecurity and PHIPA Compliance, the clinic should maintain a record of who has access to each system and what information they can handle. It should also document which activities need a separate privacy review.
PIPEDA vs. PHIPA Compliance Requirements Compared
| Requirement | PIPEDA | PHIPA |
| Consent | Requires meaningful consent. Express consent is generally needed for sensitive information | Allows express or implied consent in specified situations |
| Collection, use and disclosure | Limits collection to identified purposes. Further use or disclosure generally needs consent | Limits collection and use to what is reasonably necessary, subject to statutory exceptions |
| Access and correction | Individuals can request access to their information and correction of errors, subject to exceptions | Patients can request access to health records and corrections, subject to legal limits |
| Safeguards | Requires protection against loss, theft, unauthorised access and disclosure | Requires reasonable steps against theft, loss, unauthorised copying, modification and disposal |
Consent is not needed in all situations. Both laws permit certain activities without consent when their statutory conditions are met.
Data Breach Requirements Under PIPEDA vs. PHIPA
Under PIPEDA
Not every data breach needs to be reported to the Office of the Privacy Commissioner of Canada (OPC). Reporting is required when the incident creates a real risk of significant harm (RROSH) to an individual.
To assess that risk, organisations must consider:
- How sensitive the exposed information is
- How likely someone is to misuse it
If the breach is at this level, the company has to tell the OPC and let the people affected know as quickly as possible after finding out the breach happened.
There is also a separate recordkeeping requirement. Organisations must maintain records of every breach of security safeguards, even when reporting to the OPC is unnecessary.
Under PHIPA
PHIPA has a way of reporting. Health information custodians must inform Ontario’s Information and Privacy Commissioner (IPC) as soon as possible when a breach is in one of the seven groups listed in the rules.
These categories cover incidents such as deliberate misuse of patient information, stolen records, repeated breaches, and certain serious incidents.
Notification to affected individuals is a separate duty. A custodian may still need to inform patients about a privacy breach even when the incident does not meet the conditions for reporting to the IPC.
What PIPEDA and PHIPA Mean for SaaS, Cloud, and AI Vendors
A vendor might say that its software follows PHIPA rules. You still need to understand how it protects your information. Ask for written answers and evidence before you choose a provider.
Ask Vendors These Questions
Data use and AI training
- Can the vendor use your information for purposes beyond providing the agreed service?
- Does it use customer data to train AI models?
- What happens to AI prompts, recordings, transcripts, embeddings, and generated responses?
Access and authentication
- Who can access your live data?
- Can you limit access based on employee roles?
- Does the platform support multifactor authentication?
Monitoring and security testing
- Does the system record administrator and privileged user activities?
- Can you access or export audit logs?
- Has the vendor completed independent penetration testing?
- Can it provide evidence that identified security issues were fixed?
Data ownership and exit
- Can you export your information when the contract ends?
- How does the provider permanently delete your records?
- Can deleted information remain in backups?
Request technical documentation and recent security assessment reports rather than relying on the vendor’s compliance claims.
Strengthen Privacy Safeguards With Qualysec
A company can have privacy rules and still leave patient records exposed because of a security flaw. Someone might get in through a poorly secured API or find a way around an application’s login system. These kinds of problems can stay hidden until someone actually tests whether the controls are working as they should.
Qualysec helps organisations find these weaknesses through penetration testing. Its services cover web and mobile applications as well as APIs. Testing is also available for cloud systems and external networks, along with IoT devices.
The assessment uses both automated checks and manual testing. Just listing possible vulnerabilities, Qualysec checks whether it can actually exploit those weaknesses and what kind of information might be exposed.
You receive a report explaining the findings and their severity. It also includes steps to reproduce the issues so your developers can investigate them. Qualysec offers remediation guidance and retesting after it makes fixes.
Conclusion
The question isn’t whether your business is based in Ontario. It’s which law applies to the information you handle.
PHIPA may cover your patient records, while PIPEDA or another provincial law may apply to other parts of your business. Look at who handles the information and what it’s used for. You also need to know where it goes and which jurisdiction covers that activity.
If the legal position isn’t clear, speak with a Canadian privacy lawyer. Have your systems checked for security weaknesses, too. Legal compliance means little if you leave sensitive records exposed.
Speak with Qualysec about testing the systems that handle your sensitive information.
FAQs
1. Does PHIPA replace PIPEDA in Ontario?
PHIPA replaces PIPEDA for certain activities involving Ontario health information custodians. It does not replace the federal law across the province. PIPEDA may still apply to other commercial activities.
2. Do Ontario businesses have to comply with both PIPEDA and PHIPA?
Not always. Some businesses only fall under one law. Others may have to follow both when they handle different types of information or carry out activities covered by separate privacy rules.
3. Does PHIPA apply to every company that handles health information?
No, PHIPA imposes responsibilities on other parties handling health information and applies to some healthcare custodians. Just because a business gathers medical information does not immediately make it a custodian.
4. Does PHIPA require patient data to be stored in Canada?
No. PHIPA does not impose a general requirement to store all patient data in Canada. However, Section 50 sets conditions for disclosing Ontario health information outside the province.
