PIPEDA vs PHIPA: which privacy law applies to my business?

PIPEDA is Canada’s federal private sector privacy law. PHIPA is Ontario’s health privacy law. They overlap less than founders expect, because each is triggered by who you are and whose behalf you act on.

How do PIPEDA and PHIPA compare?

	PIPEDA	PHIPA
Who it covers	Organizations collecting, using or disclosing personal information in the course of commercial activity (s. 4)	Health information custodians in Ontario, and their agents and service providers
What information	Personal information	Personal health information held by or for a custodian
Consent	Meaningful consent; generally express for sensitive information such as health data	Knowledgeable consent; can be implied, and assumed implied within the circle of care for providing health care (ss. 18 and 20)
Public notice	Make information about your practices readily available, usually a privacy policy	A written public statement of information practices (s. 16)
Access requests	Respond within 30 days, extendable in limited cases (s. 8)	Respond within 30 days, extendable by up to 30 more in limited cases (s. 54)
Breach reporting	Report to the federal Privacy Commissioner and notify individuals if there’s a real risk of significant harm (s. 10.1)	Notify the individual at the first reasonable opportunity, and the IPC in prescribed circumstances (s. 12)
Regulator	Office of the Privacy Commissioner of Canada	Information and Privacy Commissioner of Ontario
Enforcement	Commissioner investigates; Federal Court can order changes and award damages; fines for listed offences up to $100,000	IPC can make orders and impose administrative penalties; offence fines up to $1,000,000 for organizations

How do I know if I’m a health information custodian?

Mostly by who provides the care. Section 3 of PHIPA lists custodians, including health care practitioners and people who operate a group practice of them, when they have custody or control of personal health information because of that work. A clinic run by regulated professionals is usually a custodian. A fitness studio, unregulated coaching business or direct-to-consumer wellness app usually isn’t, so PIPEDA generally applies instead. See privacy for wellness clinics.

Can a business be covered by both?

Yes, for different activities. The federal government exempted Ontario custodians from PIPEDA for their collection, use and disclosure of personal health information within Ontario (SOR/2005-399), but a clinic’s retail, membership or app business can still fall under PIPEDA. Map each data flow to one law or the other before you write your forms.

What if I sell software to clinics?

You are usually pulled into PHIPA through your customers. A vendor that handles personal health information for a custodian acts as its agent or electronic service provider, and clinics will expect a written agreement covering access, security, breach notice and use of the data. See does PHIPA apply to my health or wellness app.

Is health information treated lightly under PIPEDA?

No. Principle 4.3 in Schedule 1 says an organization should generally seek express consent when information is likely to be considered sensitive, and health information usually is. The rules differ in detail from PHIPA, not in how seriously they treat the data.

Who do I report a breach to?

It depends on which law covers the information. Custodians report to the IPC where the regulation requires it, and must also file annual breach statistics. Businesses under PIPEDA report to the federal Privacy Commissioner when the real risk of significant harm test is met, and keep a record of every breach. See when to report a privacy breach.

When to work under which

• PHIPA: you’re a regulated practitioner or clinic, or you provide services that handle personal health information for one.
• PIPEDA: you’re a business collecting personal information from customers, including health-related information, with no custodian involved.
• Both: you run a clinic with a commercial side, or a consumer app that also connects users to regulated practitioners.
• Other laws too: users in Quebec, British Columbia or Alberta can bring in those provinces’ private sector privacy laws.

What to do next

We prepare clinic privacy and consent documents and privacy policies after reviewing your data practices, at fixed fees on our fees page.

This guide is general information about Ontario and Canadian law, not legal advice for your situation. To map which law applies to your business, book a free 15-minute consult.