Who to contact with concerns about the protection of your personal health information

Canadians are extremely concerned about the privacy of their personal health information which can be highly sensitive. As health information falls into many categories, and may be collected, used and disclosed by a number of organizations and institutions for various purposes, it may be subject to different privacy laws across various jurisdictions. In Canada, there is, for example:

  • private-sector privacy legislation at the federal level, overseen by the Office of the Privacy Commissioner of Canada (OPC);
  • in some cases, private-sector privacy legislation at the provincial level;
  • privacy legislation applicable to the federal, provincial and territorial public-sector; and
  • in some provinces and territories, legislation dealing specifically with health information protection.

It is possible that in certain situations, there may be more than one law that applies and in others, there may not be any applicable privacy law.

When it comes to the collection, use, disclosure, retention and destruction of your personal health information, it can be difficult to figure out where to direct your privacy-related questions. Always begin by contacting the organization or institution in question directly to try to resolve an issue. If you’re not satisfied with the results, this web page is intended to help you identify which privacy protection authority to contact with concerns regarding the handling of your personal health information.

I am concerned about a . . .

Publicly-funded hospital, long-term care facility or home-care service

Hospitals, long-term care facilities and home care services that are publicly funded are not considered to be engaged in commercial activities nor are they federal government institutions. As such, Canada’s federal privacy laws don’t apply to their core activities, namely, the provision of health care services.

However, all provinces and territories have legislation in place to deal with the personal information handling practices of provincial/territorial public sector institutions. Some even have laws that deal specifically with health information. If you have privacy concerns about a publicly funded hospital, long-term care facility or home-care service, our provincial and territorial counterparts are best placed to direct your query.

Private long-term care facility, nursing home, retirement residence or home-care service

Privately funded long-term care facilities, nursing homes, retirement residences and home care services are generally considered to be conducting commercial activities and therefore Canada’s federal private sector privacy law, the Personal Information Protection and Electronic Documents Act (PIPEDA), would likely apply to their personal information handling practices unless substantially similar legislation exists within the province or territory.

In British Columbia, Alberta, Quebec, Ontario, New Brunswick, Nova Scotia and Newfoundland and Labrador, there are specific private sector and/or health sector laws that have been deemed substantially similar to PIPEDA which apply to private health organizations instead of PIPEDA. In those provinces, our provincial counterparts would be best placed to assist you.

Saskatchewan, Manitoba, Yukon, and the Northwest Territories have enacted personal health information legislation that could apply to private health organizations operating in those jurisdictions. But because these health laws have not been declared substantially similar to PIPEDA, they do not replace PIPEDA. PIPEDA continues to apply concurrently (at the same time) as these other laws. Therefore, if your concerns relate to a private health organization operating in one of these provinces/territories, you may contact the OPC or our provincial/territorial counterparts for more information.

If your concern involves a private practitioner in Prince Edward Island or Nunavut, where there is no specific private sector or health sector legislation in place and only PIPEDA applies, you can contact the OPC for more information.

Private health practitioner, such as a family doctor, medical specialist, dentist, pharmacist, chiropractor, psychologist, optometrist, lab, clinic, etc.

In general, private health practitioners are considered to be engaged in commercial activity. This means Canada’s federal private sector privacy law, the Personal Information Protection and Electronic Documents Act (PIPEDA), would likely apply to their personal information handling practices unless substantially similar legislation exists within the province or territory.

In British Columbia, Alberta, Quebec, Ontario, New Brunswick, Nova Scotia and Newfoundland and Labrador, there are specific private sector and/or health sector laws that have been deemed substantially similar to PIPEDA which apply to private health practitioners instead of PIPEDA. In those provinces, our provincial counterparts would be best placed to assist you.

Saskatchewan, Manitoba, Yukon, and the Northwest Territories have enacted personal health information legislation that could also apply to private health practitioners operating in those jurisdictions. But because these health laws have not been declared substantially similar to PIPEDA, they do not replace PIPEDA. In some cases, PIPEDA continues to apply concurrently (at the same time) as these other laws. Therefore, if your concerns relate to a private health practitioner operating in one of these provinces/territories, you may contact the OPC or our provincial/territorial counterparts for more information.

If your concern involves a private practitioner in Prince Edward Island or Nunavut, where there is no specialized private sector or health sector legislation in place and PIPEDA applies, you can contact the OPC for more information.

Alberta and British Columbia have also enacted personal health information legislation that has not been declared substantially similar to PIPEDA; however, as noted above, private sector laws in both provinces have been deemed substantially similar. Therefore, if your concern relates to a private health practitioner in one of these provinces, our provincial counterparts would be best placed to assist you.

Federal government institution, such as Health Canada; Immigration, Refugees and Citizenship Canada; Veterans Affairs Canada; Employment and Social Development Canada, etc.

The Privacy Act applies to all federal government institutions. If you have privacy concerns about the handling of your personal health information by these or any other federal institution, the OPC should be able to help you.

Public Health Agency

The Public Health Agency of Canada, like other federal government institutions, is subject to the federal Privacy Act. The OPC should be able to assist with privacy concerns related specifically to the Public Health Agency of Canada.

Public health agencies of provinces, territories and some municipalities are subject to provincial and territorial laws dealing with the personal information handling practices of municipal and provincial/territorial public sector institutions generally. Some provinces and territories have laws that deal specifically with health information. If you have privacy concerns about a municipal/provincial/territorial public health institutions, our provincial and territorial counterparts are best placed to direct your query.

Health/medical-related charity, voluntary organization, foundation, non-profit, association or professional organization

Canada’s federal private sector privacy law, the Personal Information Protection and Electronic Documents Act (PIPEDA), does not generally apply to health or medical-related charities, voluntary organizations, foundations, non-profits, associations or professional organizations unless they are engaged in commercial activity which may occur on rare occasions. (Note: fundraising is generally not considered a commercial activity.)

In some of the provinces and territories, there are provincial or territorial laws that apply to the charitable and non-profit sectors as well as associations and professional organizations. If you have privacy concerns about such an organization, start by contacting our provincial/territorial counterparts to find out if the organization is covered.

Publicly-funded schools, colleges or universities

As a general rule, Canada’s federal private sector privacy law, the Personal Information Protection and Electronic Documents Act (PIPEDA), does not apply to the core educational activities of publicly funded schools, colleges or universities as they are not considered to be engaged in commercial activity.

That said, the personal information handling practices of publicly-funded educational institutions may be covered by applicable provincial and territorial laws. If you have privacy concerns about how a publicly funded school, college or university has handled your or your child’s personal health information, our provincial and territorial counterparts are best placed to direct your query.

Private schools and daycare facilities

Private educational institutions and daycare facilities that are more clearly engaged in commercial activities may be subject to Canada’s federal private sector privacy law, the Personal Information Protection and Electronic Documents Act (PIPEDA). If you have concerns about the personal health information handling practices of a private school or private daycare facility in any province or territory outside British Columbia, Alberta or Quebec, the OPC should be able to help you.

If your concerns involve a private educational institution or daycare centre in British Columbia, Alberta or Quebec, where substantially similar legislation applies instead of PIPEDA, our provincial counterparts would be better suited to assist you.

Employers

If you work for a federal government institution, the Privacy Act would apply and the OPC should be able to assist with any concerns you may have.

The personal information handling practices of provincial, territorial, and most municipal government institutions are subject to applicable provincial/territorial laws. If you work for a municipal or provincial/territorial government institution and have concerns about your employer’s handling of your personal health information, our provincial and territorial counterparts are best placed to direct your query.

Canada’s federal private sector privacy law, the Personal Information Protection and Electronic Documents Act (PIPEDA), only covers employees and potential employees of federally regulated businesses. More specifically, this includes employees of federally-regulated works, undertakings or businesses (FWUBs), such as banks, airlines and telecommunications companies. If you work for a federally-regulated company, the OPC should be able to assist with any concerns you may have.

PIPEDA also applies to personal information about employees of organizations in the territories which are considered to be FWUBs. If you work for one of these organizations, the OPC may be able to help.

If you work for a private sector employer in B.C., Alberta or Quebec where substantially similar private sector laws apply to employee information, including employee health information, our provincial colleagues in those respective jurisdictions are best placed to address your concerns.

Insurance company

Private insurance providers are considered to be engaged in commercial activity. This means that Canada’s federal private sector privacy law, the Personal Information Protection and Electronic Documents Act (PIPEDA), would likely apply across Canada, with the exception of British Columbia, Alberta and Quebec. Those provinces have substantially similar private sector laws that would apply instead of PIPEDA if the information is collected, used and disclosed within those provinces.

If your concerns relate to insurance companies operating in British Columbia, Alberta or Quebec, our provincial counterparts would be better placed to assist you.

If you have concerns regarding an insurer’s collection, use and disclosure of personal health information outside these provinces, the OPC should be able to help you.

** If you are uncertain as to whether either of Canada’s federal privacy would apply to your particular situation, you may wish to contact the Office of the Privacy Commissioner’s Information Centre for further assistance.

*** If neither the Office of the Privacy Commissioner of Canada, nor our provincial/territorial counterparts are able to assist you, you may wish to seek legal counsel.

Note: This web page is for informational purposes only and should not be interpreted as legal advice.

Date modified: