Patient Privacy

Source: PIPEDA, S.C. 2000, c. 5; Provincial health privacy statutes (Ontario: PHIPA, 2004; Alberta: HIA; Saskatchewan: HIPA)

Written in plain language for general understanding. This is educational content, not legal advice. Based on Canadian federal statutes and official sources.

Canadian Federal Law

What is this right?

Your health information is protected at both the federal level (PIPEDA) and by provincial health privacy laws. Most provinces have dedicated health privacy statutes, such as Ontario's PHIPA, Alberta's HIA, and Saskatchewan's HIPA.

The key principles are:

  • Only collect, use, and disclose what is necessary
  • Require your knowledge and consent (with limited exceptions like public health reporting)
  • Keep your data secure
  • Retain records only as long as needed

You have the right to access your own medical records — providers must typically respond within 30 days. You can also request corrections to errors in your file and file complaints with the privacy commissioner if your information is improperly disclosed.

When does it apply?

  • Every patient whose health information is collected by healthcare providers, hospitals, pharmacies, or labs.

What should you do?

  • Request your medical records in writing — the provider must respond within approximately 30 days.
  • Ask who has access to your health information and why.
  • Request corrections if you find errors in your medical records.
  • File a complaint with the provincial privacy commissioner if your health information is disclosed without your consent.
  • Use patient portals where available to monitor who is accessing your records.

What should you NOT do?

  • Don't assume providers automatically share records — there is no single national electronic health record system in Canada.
  • Don't ignore breach notifications — if a provider tells you your data was compromised, take it seriously and follow up.
  • Don't share your health card number casually — it can be used for identity fraud.
  • Don't assume your employer can access your full medical details — they are only entitled to fit-for-duty information, not your diagnosis or treatment specifics.

You came here to know your rights — help someone else know theirs.

Support This Mission