Who to contact with concerns about the protection of your personal health information

Hospitals, long-term care facilities and home care services that are publicly funded are not considered to be engaged in commercial activities nor are they federal government institutions. As such, Canada’s federal privacy laws don’t apply to their core activities, namely, the provision of health care services.

However, all provinces and territories have legislation in place to deal with the personal information handling practices of provincial/territorial public sector institutions. Some even have laws that deal specifically with health information. If you have privacy concerns about a publicly funded hospital, long-term care facility or home-care service, our provincial and territorial counterparts are best placed to direct your query.

Privately funded long-term care facilities, nursing homes, retirement residences and home care services are generally considered to be conducting commercial activities and therefore Canada’s federal private sector privacy law, the Personal Information Protection and Electronic Documents Act (PIPEDA), would likely apply to their personal information handling practices unless substantially similar legislation exists within the province or territory.

In British Columbia, Alberta, Quebec, Ontario, New Brunswick, Nova Scotia and Newfoundland and Labrador, there are specific private sector and/or health sector laws that have been deemed substantially similar to PIPEDA which apply to private health organizations instead of PIPEDA. In those provinces, our provincial counterparts would be best placed to assist you.

Saskatchewan, Manitoba, Prince Edward Island, Yukon, and the Northwest Territories have enacted personal health information legislation that could apply to private health organizations operating in those jurisdictions. But because these health laws have not been declared substantially similar to PIPEDA, they do not replace PIPEDA. PIPEDA continues to apply concurrently (at the same time) as these other laws. Therefore, if your concerns relate to a private health organization operating in one of these provinces/territories, you may contact the OPC or our provincial/territorial counterparts for more information.

If your concern involves a private practitioner in Nunavut, where there is no specific private sector or health sector legislation in place and only PIPEDA applies, you can contact the OPC for more information.

In general, private health practitioners are considered to be engaged in commercial activity. This means Canada’s federal private sector privacy law, the Personal Information Protection and Electronic Documents Act (PIPEDA), would likely apply to their personal information handling practices unless substantially similar legislation exists within the province or territory.

In British Columbia, Alberta, Quebec, Ontario, New Brunswick, Nova Scotia and Newfoundland and Labrador, there are specific private sector and/or health sector laws that have been deemed substantially similar to PIPEDA which apply to private health practitioners instead of PIPEDA. In those provinces, our provincial counterparts would be best placed to assist you.

Saskatchewan, Manitoba, Prince Edward Island, Yukon, and the Northwest Territories have enacted personal health information legislation that could also apply to private health practitioners operating in those jurisdictions. But because these health laws have not been declared substantially similar to PIPEDA, they do not replace PIPEDA. In some cases, PIPEDA continues to apply concurrently (at the same time) as these other laws. Therefore, if your concerns relate to a private health practitioner operating in one of these provinces/territories, you may contact the OPC or our provincial/territorial counterparts for more information.

If your concern involves a private practitioner in Nunavut, where there is no specialized private sector or health sector legislation in place and PIPEDA applies, you can contact the OPC for more information.

Alberta and British Columbia have also enacted personal health information legislation that has not been declared substantially similar to PIPEDA; however, as noted above, private sector laws in both provinces have been deemed substantially similar. Therefore, if your concern relates to a private health practitioner in one of these provinces, our provincial counterparts would be best placed to assist you.

The Privacy Act applies to all federal government institutions. If you have privacy concerns about the handling of your personal health information by these or any other federal institution, the OPC should be able to help you.

The Public Health Agency of Canada, like other federal government institutions, is subject to the federal Privacy Act. The OPC should be able to assist with privacy concerns related specifically to the Public Health Agency of Canada.

Public health agencies of provinces, territories and some municipalities are subject to provincial and territorial laws dealing with the personal information handling practices of municipal and provincial/territorial public sector institutions generally. Some provinces and territories have laws that deal specifically with health information. If you have privacy concerns about a municipal/provincial/territorial public health institutions, our provincial and territorial counterparts are best placed to direct your query.

Canada’s federal private sector privacy law, the Personal Information Protection and Electronic Documents Act (PIPEDA), does not generally apply to health or medical-related charities, voluntary organizations, foundations, non-profits, associations or professional organizations unless they are engaged in commercial activity which may occur on rare occasions. (Note: fundraising is generally not considered a commercial activity.)

In some of the provinces and territories, there are provincial or territorial laws that apply to the charitable and non-profit sectors as well as associations and professional organizations. If you have privacy concerns about such an organization, start by contacting our provincial/territorial counterparts to find out if the organization is covered.

As a general rule, Canada’s federal private sector privacy law, the Personal Information Protection and Electronic Documents Act (PIPEDA), does not apply to the core educational activities of publicly funded schools, colleges or universities as they are not considered to be engaged in commercial activity.

That said, the personal information handling practices of publicly-funded educational institutions may be covered by applicable provincial and territorial laws. If you have privacy concerns about how a publicly funded school, college or university has handled your or your child’s personal health information, our provincial and territorial counterparts are best placed to direct your query.

Private educational institutions and daycare facilities that are more clearly engaged in commercial activities may be subject to Canada’s federal private sector privacy law, the Personal Information Protection and Electronic Documents Act (PIPEDA). If you have concerns about the personal health information handling practices of a private school or private daycare facility in any province or territory outside British Columbia, Alberta or Quebec, the OPC should be able to help you.

If your concerns involve a private educational institution or daycare centre in British Columbia, Alberta or Quebec, where substantially similar legislation applies instead of PIPEDA, our provincial counterparts would be better suited to assist you.

If you work for a federal government institution, the Privacy Act would apply and the OPC should be able to assist with any concerns you may have.

The personal information handling practices of provincial, territorial, and most municipal government institutions are subject to applicable provincial/territorial laws. If you work for a municipal or provincial/territorial government institution and have concerns about your employer’s handling of your personal health information, our provincial and territorial counterparts are best placed to direct your query.

Canada’s federal private sector privacy law, the Personal Information Protection and Electronic Documents Act (PIPEDA), only covers employees and potential employees of federally regulated businesses. More specifically, this includes employees of federally-regulated works, undertakings or businesses (FWUBs), such as banks, airlines and telecommunications companies. If you work for a federally-regulated company, the OPC should be able to assist with any concerns you may have.

PIPEDA also applies to personal information about employees of organizations in the territories which are considered to be FWUBs. If you work for one of these organizations, the OPC may be able to help.

If you work for a private sector employer in B.C., Alberta or Quebec where substantially similar private sector laws apply to employee information, including employee health information, our provincial colleagues in those respective jurisdictions are best placed to address your concerns.

Private insurance providers are considered to be engaged in commercial activity. This means that Canada’s federal private sector privacy law, the Personal Information Protection and Electronic Documents Act (PIPEDA), would likely apply across Canada, with the exception of British Columbia, Alberta and Quebec. Those provinces have substantially similar private sector laws that would apply instead of PIPEDA if the information is collected, used and disclosed within those provinces.

If your concerns relate to insurance companies operating in British Columbia, Alberta or Quebec, our provincial counterparts would be better placed to assist you.

If you have concerns regarding an insurer’s collection, use and disclosure of personal health information outside these provinces, the OPC should be able to help you.