Patient Privacy in British Columbia
Reviewed by the Commoner Law Editorial Team. Sourced from Canadian federal statutes and official sources. Provincial information reflects each province's own legislation and court rulings. Written in plain language for general understanding — this is educational content, not legal advice. Our editorial standards
What is this right?
Your health information is protected at both the federal level (PIPEDA) and by provincial health privacy laws. Most provinces have dedicated health privacy statutes, such as Ontario's PHIPA, Alberta's HIA, and Saskatchewan's HIPA.
The key principles are:
- Only collect, use, and disclose what is necessary
- Require your knowledge and consent (with limited exceptions like public health reporting)
- Keep your data secure
- Retain records only as long as needed
You have the right to access your own medical records — providers must typically respond within 30 days. You can also request corrections to errors in your file and file complaints with the privacy commissioner if your information is improperly disclosed.
When does it apply?
- Every patient whose health information is collected by healthcare providers, hospitals, pharmacies, or labs.
What to Do If Your Medical Information Is Shared Without Your Consent in Canada
- Request your medical records in writing — the provider must respond within approximately 30 days.
- Ask who has access to your health information and why.
- Request corrections if you find errors in your medical records.
- File a complaint with the provincial privacy commissioner if your health information is disclosed without your consent.
- Use patient portals where available to monitor who is accessing your records.
What should you NOT do?
- Don't assume providers automatically share records — there is no single national electronic health record system in Canada.
- Don't ignore breach notifications — if a provider tells you your data was compromised, take it seriously and follow up.
- Don't share your health card number casually — it can be used for identity fraud.
- Don't assume your employer can access your full medical details — they are only entitled to fit-for-duty information, not your diagnosis or treatment specifics.
How British Columbia differs from federal law
Patient health information in BC is protected by the Freedom of Information and Protection of Privacy Act (FIPPA) for public health authorities, and the Personal Information Protection Act (PIPA) for private-sector health providers (such as private clinics, pharmacies, and private hospitals).
- Health information is considered sensitive personal information under both Acts. It can only be collected, used, or disclosed for the purposes for which it was originally collected — primarily your health care.
- You have the right to access your own health records. Under FIPPA, public health authorities must respond to access requests within 30 business days. Under PIPA, private providers must respond within 30 business days.
- The E-Health (Personal Health Information Access and Protection of Privacy) Act (SBC 2008, c. 38) governs the provincial electronic health record systems, including rules for who can access data in these systems and audit trail requirements.
- Complaints about privacy breaches by health care providers go to the BC Office of the Information and Privacy Commissioner (OIPC).
Additional Steps in British Columbia
To request your own health records, contact the health information management department at your hospital or clinic, or your doctor's office directly. If your request is denied or delayed, file a complaint with the BC OIPC at oipc.bc.ca. For concerns about your electronic health records, contact your regional health authority's privacy officer.
Relevant Law: Freedom of Information and Protection of Privacy Act, RSBC 1996, c. 165; Personal Information Protection Act, SBC 2003, c. 63; E-Health (Personal Health Information Access and Protection of Privacy) Act, SBC 2008, c. 38
Common Questions
When does patient privacy apply?
Every patient whose health information is collected by healthcare providers, hospitals, pharmacies, or labs.
What should I do if my health information in Canada was disclosed without my permission?
Request your medical records in writing — the provider must respond within approximately 30 days.Ask who has access to your health information and why.Request corrections if you find errors in your medical records.File a complaint with the provincial privacy commissioner if your health information is disclosed without your consent.Use patient portals where available to monitor who is accessing your records.
What mistakes should I avoid with patient privacy?
Don't assume providers automatically share records — there is no single national electronic health record system in Canada.Don't ignore breach notifications — if a provider tells you your data was compromised, take it seriously and follow up.Don't share your health card number casually — it can be used for identity fraud.Don't assume your employer can access your full medical details — they are only entitled to fit-for-duty information, not your diagnosis or treatment specifics.
Patient Privacy in other states
Same topic, different jurisdiction. Pick the one that applies to you.