Practical guidance on Canadian health privacy law — PHIPA, Law 25, and cross-jurisdictional obligations — for clinic administrators and privacy officers.
Administrative Monetary Penalties are now in force. The first AMP was issued in August 2025 after a physician accessed 831 newborns' records without authorization. Here is what your Ontario clinic must have in place.
Physicians, pharmacies, and long-term care homes are all health information custodians under PHIPA. Your EMR vendor and IT contractor are not — but they remain your responsibility. Here is how the three roles work and what it means for your contracts.
Any organization collecting personal information about Quebec residents must comply with Law 25 — regardless of where they are incorporated. That includes Ontario clinics with Quebec patients, health-tech vendors, and labs. Here is what changed across the three phases and what you must have in place today.
