Last verified: October 23, 2026, against the HIPAA regulations on eCFR and the Canadian federal and provincial sources linked below. General information, not legal advice. Provincial rules vary; confirm with your privacy officer or counsel.
HIPAA in Canada is one of the most common questions Canadian clinic owners type into Google: "hipaa canada" and "hipaa in canada" each get about 2,400 searches a month in Canada, and "canadian hipaa equivalent" another 210 (Google Ads Keyword Planner data via DataForSEO, Canada, 12-month average to Sep 2026). The confusion is understandable. Most marketing software and advice comes from the US and is written around HIPAA.
In short: HIPAA is US federal law and doesn't govern a Canadian clinic's ordinary care of Canadian patients. Canada has no single equivalent. Your clinic follows PIPEDA and a provincial law instead, such as PHIPA in Ontario, the Health Information Act in Alberta or Quebec's private-sector act and health information act. US rules can still matter through US vendors and US billing.
Short answer: HIPAA and Canadian clinics
HIPAA's rules apply to three kinds of entity, per 45 CFR 160.102 (opens in a new tab): health plans, health care clearinghouses, and "a health care provider who transmits any health information in electronic form" in connection with a covered transaction. Business associates of those entities are covered where a rule says so.
A clinic in Calgary or Halifax that treats local patients, bills a provincial plan or private Canadian insurer, and uses Canadian systems is none of those things. Its obligations come from Canadian law.
For the US side of the line, who HIPAA applies to walks through covered entities and business associates in detail.
Canada's equivalents, by province
There is no "Canadian HIPAA." There is a federal private-sector law plus provincial laws, and which one applies depends on your province and the kind of information.
| Province | Health information at a private clinic | Other personal information |
|---|---|---|
| Ontario | PHIPA | PIPEDA |
| Alberta | Alberta HIA (for custodians) | Alberta PIPA |
| Quebec | Act respecting health and social services information | Private-sector act, amended by Law 25 |
| British Columbia | BC PIPA | BC PIPA |
| New Brunswick, Newfoundland and Labrador, Nova Scotia | Provincial personal health information act | PIPEDA |
| Other provinces and territories | Provincial health law; PIPEDA may also apply | PIPEDA |
Simplified from the OPC's list of provincial laws that may apply instead of PIPEDA (opens in a new tab), its summary of privacy laws (opens in a new tab) and the CAI's scope page for Quebec's health information act (opens in a new tab). PIPEDA also applies when information crosses provincial or national borders.
HIPAA vs PIPEDA vs provincial health laws
The laws share a family resemblance: consent, safeguards, breach notice, a regulator. The details differ in ways that change marketing decisions.
| Item | HIPAA (US) | PIPEDA (federal) | PHIPA (Ontario) | HIA (Alberta) | Quebec (Law 25) |
|---|---|---|---|---|---|
| Who it binds | Covered entities and business associates | Private organizations in commercial activity | Health information custodians, such as practitioners and group practices | Custodians named in the Act and regulations | Businesses (private-sector act) |
| Marketing with health information | Authorization required (164.508(a)(3) (opens in a new tab)), narrow exceptions | Meaningful consent; express for sensitive information | Express consent required (s. 33) | Uses limited to the purposes listed in s. 27, which don't include marketing | Express consent for sensitive information (s. 12) |
| Breach notice trigger | Breach of unsecured PHI (164.404 (opens in a new tab)) | Real risk of significant harm | Any theft, loss or unauthorized use or disclosure, to the patient | Risk of harm | Risk of serious injury |
| Outer timing | No later than 60 days after discovery | As soon as feasible | First reasonable opportunity | As soon as practicable | Promptly ("avec diligence") |
| Who is told | Individuals (other notices also apply) | OPC and individuals | Patient; IPC in prescribed cases | Commissioner, Minister and individual | CAI and affected people |
A simplification for comparison. Each cell compresses a statutory test; read the linked law or regulator page before relying on any row. Sources: eCFR; OPC breach guidance (opens in a new tab); PHIPA (opens in a new tab); Alberta HIA (opens in a new tab); CAI Law 25 summary (opens in a new tab).
Two differences surprise US-trained marketers. Ontario's PHIPA requires notice to the patient for any theft, loss or unauthorized use or disclosure, without a harm threshold (subject to narrow prescribed exceptions). And Alberta's HIA lists the purposes for which custodians may use identifying health information, rather than allowing marketing with permission.
When US rules can matter: US vendors and cross-border care
HIPAA can come into play in a few situations. None of them turns a Canadian clinic into a HIPAA clinic for everything; each needs a specific look.
- Billing US insurers. HIPAA's definition of covered entity (opens in a new tab) includes a provider who "transmits any health information in electronic form in connection with a transaction," and transactions include health care claims. A Canadian clinic that bills US health plans electronically should ask counsel whether that brings it within HIPAA.
- US-based vendors. Your vendor's HIPAA program doesn't change which law governs you. It also doesn't satisfy your Canadian duties, which include telling patients when information may be processed abroad.
- US patients. Treating a visiting American in your clinic doesn't, on its own, make HIPAA apply to you. Canadian law governs care you provide in Canada.
Going the other way, the OPC's cross-border guidelines (opens in a new tab) say PIPEDA doesn't prohibit sending personal information to a US processor, but your clinic stays accountable and information abroad "may be accessible to law enforcement and national security authorities of that jurisdiction."
'HIPAA-compliant' tools: what the label means in Canada
When a US vendor says its tool is "HIPAA-compliant," it usually means the vendor will sign a business associate agreement (BAA) for certain plans and has safeguards that meet the HIPAA Security Rule. That is useful evidence about security. It is not a Canadian legal standard, and no official certification for HIPAA compliance exists.
What the label doesn't tell you:
- Where data is stored. A HIPAA-ready tool may store everything in the US, and a BAA won't necessarily say where.
- Whether it meets provincial rules. PHIPA, Quebec's act and Alberta's HIA impose duties a BAA wasn't written for, such as Quebec's assessment before information leaves the province.
- Whether marketing features are safe. Many "HIPAA-compliant" form builders still let you install ad pixels on the form page.
Medfy sits on both sides of the border, so here is exactly what it does. Each practice is assigned a data region. US patient information is stored in separate, encrypted databases in the US; Canadian patient information (forms, chat, CRM) is stored in a separate, encrypted database in Canada. Ad platforms never receive patient data. Medfy signs a BAA with every practice before patient data flows. For a Canadian clinic that BAA is a US instrument: a contractual commitment, not something Canadian law requires. See Medfy's HIPAA and security page for encryption, access controls and audit logs.
Choosing vendors: data residency and agreements
Ask Canadian questions of every vendor, including US ones with strong HIPAA programs:
- Which country and province store patient data, including backups?
- Which subcontractors (subprocessors) can access it, and where are they?
- Will you sign an agreement that reflects my provincial law, not only a US BAA?
- How fast will you tell me about a breach, and with what detail?
- What happens to the data when I leave: export, deletion, confirmation?
Start with what's visible from outside. A free marketing audit flags privacy risks on your public site, such as tracking pixels on patient forms. For the full provincial picture, see healthcare marketing in Canada.
This is general information, not legal advice. Confirm how it applies to your practice with a qualified advisor.
Frequently asked questions
Does HIPAA apply in Canada?
Generally no. HIPAA is US law and applies to health plans, clearinghouses and providers that transmit health information electronically in connection with covered transactions, plus their business associates. A Canadian clinic caring for patients in Canada follows PIPEDA and provincial laws instead. Exceptions need a specific look, such as a clinic that bills US health plans electronically, so raise any US billing or partnership with counsel.
What is the Canadian equivalent of HIPAA?
There isn't a single one. PIPEDA is the federal private-sector privacy law, and provinces have their own: PHIPA in Ontario, the Health Information Act in Alberta, Quebec's private-sector act and health information act, BC's PIPA, and health information acts in New Brunswick, Newfoundland and Labrador and Nova Scotia. Which applies depends on your province and whether the information is health information.
Can a Canadian clinic use US-based HIPAA-compliant software?
Often, yes. The Privacy Commissioner of Canada says PIPEDA doesn't prohibit transferring personal information abroad for processing, but your clinic stays accountable, should tell patients their information may be processed outside Canada, and needs a solid contract. Provincial rules can add steps, such as Quebec's assessment before information leaves the province. A HIPAA label shows security effort, not compliance with Canadian law.
Does a Canadian clinic treating US patients need to follow HIPAA?
Treating a visiting American in your Canadian clinic doesn't by itself bring you under HIPAA; Canadian privacy law governs that care. The question changes if you bill US health plans electronically, since HIPAA covers providers who transmit health information electronically in connection with covered transactions such as claims. If US billing is a regular part of your practice, get advice from counsel familiar with both countries.