Patient Privacy — Quebec
Sourced from Canadian federal statutes and official sources. Provincial information reflects each province's own legislation and court rulings. Written in plain language for general understanding — this is educational content, not legal advice. Our editorial standards
What is this right?
Your health data is protected on two levels — PIPEDA federally for the private sector, and dedicated provincial health privacy statutes (Ontario's PHIPA, Alberta's HIA, Saskatchewan's HIPA, and so on). Whichever applies to you, the principles converge.
The core rules:
- Collect, use, and disclose only what's necessary
- Get your knowledge and consent (narrow exceptions for things like public-health reporting)
- Keep the data secure
- Retain records only as long as needed
You have the right to access your own medical records — providers usually have to respond within 30 days. You can request corrections for errors and file complaints with the privacy commissioner if your data is disclosed improperly.
When does it apply?
- Every patient whose health information is collected by providers, hospitals, pharmacies, or labs.
What to Do If Your Medical Information Is Shared Without Your Consent in Canada
- Request records in writing — providers have around 30 days to respond.
- Ask who's accessed your information and why. Audit logs exist for a reason.
- Request corrections for any errors you find.
- File with the provincial privacy commissioner if your data was disclosed without consent.
- Use patient portals where they exist — they make access logs visible.
What should you NOT do?
- Don't assume providers share records automatically. Canada has no single national electronic health record system — your records can be in five different silos.
- Don't ignore breach notifications. Follow up; document; ask what's being done.
- Don't share your health card number casually. It's a vector for identity fraud.
- Don't assume your employer can see your medical file. They get fit-for-duty information, not your diagnosis or treatment plan.
How Quebec differs from federal law
Patient privacy in Quebec is protected by a combination of the Quebec Charter of Human Rights and Freedoms, the Act respecting health services and social services, and Quebec's privacy legislation.
- Section 5 of the Quebec Charter guarantees the right to respect for private life. Health information is considered among the most sensitive personal information.
- The Act respecting health services and social services (section 19) provides that a user's health record is confidential and that no one may have access to it except with the user's consent or as authorized by law.
- Quebec's Act respecting the sharing of certain health information (CQLR c P-9.0001) governs the Quebec Health Record (Dossier Sante Quebec, or DSQ) — an electronic system that allows authorized health professionals to access certain health information (medications, lab results, medical imaging) with the patient's consent. Patients can opt out of the DSQ.
- Healthcare professionals are bound by professional secrecy (professional privilege) under their respective professional codes. A healthcare provider cannot share your information without your consent except in limited circumstances defined by law (e.g., mandatory reporting of certain infectious diseases or child abuse).
- You have the right to access your own health record at any institution where you have received care. The institution must provide access within 20 days of the request.
Additional Steps in Quebec
To access your health record, submit a written request to the medical records department of the institution where you received care. To manage your DSQ preferences (Quebec Health Record), visit the RAMQ website or a RAMQ office. File privacy complaints with the Commission d'acces a l'information (CAI) at cai.gouv.qc.ca if you believe your health information was improperly accessed or shared.
Relevant Law: Quebec Charter of Human Rights and Freedoms (CQLR c C-12), s. 5; Act respecting health services and social services (CQLR c S-4.2), ss. 17-28; Act respecting the sharing of certain health information (CQLR c P-9.0001)
Common Questions
What is the patient privacy right in Canada?
Your health data is protected on two levels — PIPEDA federally for the private sector, and dedicated provincial health privacy statutes (Ontario's PHIPA, Alberta's HIA, Saskatchewan's HIPA, and so on). Whichever applies to you, the principles converge.The core rules:Collect, use, and disclose only what's necessaryGet your knowledge and consent (narrow exceptions for things like public-health reporting)Keep the data secureRetain records only as long as neededYou have the right to access your own medical records — providers usually have to respond within 30 days. You can request corrections for...
When does patient privacy apply?
Every patient whose health information is collected by providers, hospitals, pharmacies, or labs.
What should I do if my health information in Canada was disclosed without my permission?
Request records in writing — providers have around 30 days to respond.Ask who's accessed your information and why. Audit logs exist for a reason.Request corrections for any errors you find.File with the provincial privacy commissioner if your data was disclosed without consent.Use patient portals where they exist — they make access logs visible.
What mistakes should I avoid with patient privacy?
Don't assume providers share records automatically. Canada has no single national electronic health record system — your records can be in five different silos.Don't ignore breach notifications. Follow up; document; ask what's being done.Don't share your health card number casually. It's a vector for identity fraud.Don't assume your employer can see your medical file. They get fit-for-duty information, not your diagnosis or treatment plan.
Patient Privacy in other states
Same topic, different jurisdiction. Pick the one that applies to you.