Blog

Canada doesn't have HIPAA. Here's what it has instead

September 30, 2026 · 26 min read

MadeTo is a Canadian company, and a lot of the businesses we talk to sell on both sides of the border. So when we wrote about why HIPAA compliance matters, the obvious follow-up question was: what about Canada?

The short answer is that Canada doesn’t have a HIPAA. It has something messier: a federal privacy law, three provinces with their own private-sector laws, a ring of provincial health information laws, and a new federal bill that isn’t law yet. The penalties are mostly smaller than in the US. The breaches are not. And HIPAA itself can still apply to a Canadian business, depending on who its customers are.

This post covers all of that: which laws apply, what the numbers say, and what has actually happened to Canadian organizations that got it wrong. As with the HIPAA post, we went to the regulators first (the Office of the Privacy Commissioner of Canada, the provincial commissioners, Statistics Canada, the Canadian Centre for Cyber Security, the statutes themselves) and linked everything. And the same caveat applies: this is a map, not legal advice.

The short version

• Canada splits HIPAA’s job across several laws. The federal law, PIPEDA, covers most businesses. Alberta, BC and Quebec have their own private-sector laws. Most provinces also have a health information law for “custodians” like pharmacies and clinics.
• Penalties outside Quebec are small by US standards. The largest penalty under Ontario’s health privacy law so far was $7,500. Quebec is the exception, with penalties that can reach millions of dollars or a percentage of worldwide turnover.
• Breaches are routine. Businesses file roughly 700 breach reports a year with the federal privacy commissioner, affecting about 20 million Canadians in the most recent year. Ontario’s health custodians alone logged more than 10,000 health privacy breaches in 2023.
• Insiders are a bigger problem than hackers, at least in Ontario’s health sector, where snooping was the top category of breaches reported to the commissioner.
• HIPAA follows US customers across the border. A Canadian business that handles patient data for a US clinic or pharmacy, or bills US insurers, can fall under HIPAA.
• The real costs are operational. Stores closed, systems down for weeks, years of litigation and a public report nobody wanted published.

Which laws apply

PIPEDA, the federal baseline

The Personal Information Protection and Electronic Documents Act applies to personal information that businesses collect, use or disclose in the course of commercial activity, and health information is personal information. If you sell personalized health products online from Ontario, Manitoba or the Atlantic provinces, PIPEDA is probably your starting point.

PIPEDA steps aside where the federal government has declared a provincial law “substantially similar.” According to the Office of the Privacy Commissioner, that currently means:

• Private-sector laws in Alberta, British Columbia and Quebec, which replace PIPEDA for most businesses in those provinces.
• Health information laws in Ontario, New Brunswick, Newfoundland and Labrador, and Nova Scotia, which replace it for health information custodians there.

Even in those provinces, PIPEDA still governs personal information that crosses provincial or national borders, which matters for anyone shipping custom products from one province to another.

Provincial health information laws

Most provinces have a separate law for health information “custodians” or “trustees”: typically pharmacies, clinics, regulated health professionals and the organizations they work with. Ontario’s is PHIPA, Alberta’s is the Health Information Act, and Quebec added a new health information act that came into force in July 2024 and covers private clinics and labs, among others.

Whether your business is a custodian depends on the province and on what you do. A pharmacy or a clinic run by a regulated professional usually is. A direct-to-consumer supplement brand usually isn’t, and falls under PIPEDA or its provincial equivalent instead. For dental labs, orthotics makers and hearing-aid dispensers, the answer varies by province, so it’s worth checking with your provincial privacy commissioner or a lawyer rather than assuming.

Quebec’s Law 25

Quebec overhauled its private-sector privacy law with Law 25, phased in between 2022 and 2024, with its penalty regime in force since September 2023. It’s the strictest regime in the country. Among other things, it requires a documented assessment before personal information leaves Quebec, including to a US cloud provider or fulfilment partner, and a written agreement covering the transfer (BLG).

Sending data to the US

Outside Quebec, sending personal information to a US vendor is allowed. Under the federal commissioner’s longstanding guidance, you stay responsible for it, you need contracts that give it a comparable level of protection, and you should tell customers their data may be processed in another country and be accessible to that country’s courts and authorities (BLG summary of the OPC’s guidance).

Alberta goes one step further for health information: its Health Information Act makes it an offence for a custodian to hand over health information in response to a subpoena or court order from outside Alberta.

When HIPAA applies to a Canadian business

HIPAA doesn’t stop at the border. Its definitions of “covered entity” and “business associate” don’t say anything about where a business is located, so what matters is what you do and for whom:

HHS allows US healthcare organizations to use vendors that store data outside the United States, as long as a business associate agreement is in place and the extra risk is covered by their risk analysis.

In practice, we couldn’t find a single case of the US Office for Civil Rights penalizing a company outside the United States. HIPAA reaches Canadian businesses through their customers instead: the US clinic or pharmacy carries the regulatory risk, so it pushes that risk onto its vendors through contracts, security questionnaires and audits. For a Canadian business selling into US healthcare, HIPAA is mostly a sales requirement. If you can’t show you handle patient data properly, you don’t get the contract.

What it costs, on paper

Penalties vary enormously depending on the province and the law:

Most Canadian regimes outside Quebec work through prosecutions in provincial court rather than a regulator issuing fines, and the amounts actually imposed have been small. Ontario’s first-ever administrative penalties under its health privacy law, in September 2025, were $5,000 against a physician and $7,500 against his clinic. In 2017, a $20,000 fine for snooping in health records was described by Ontario’s commissioner as the highest ever for a health privacy breach in Canada at the time.

Breach reporting rules also differ. Under PIPEDA, a business must report a breach to the federal commissioner and notify the people affected when it creates a “real risk of significant harm,” which includes humiliation and damage to reputation as well as financial loss, and it must keep a record of every breach, reportable or not (PIPEDA ss. 10.1 and 10.3). Ontario’s health custodians must notify patients of every breach, report certain kinds to the commissioner, including snooping and most ransomware, and file annual breach statistics (IPC guidelines). Unlike HIPAA’s fixed 60-day deadline, Canadian laws mostly say “as soon as feasible.”

What’s coming: Bill C-36

The federal government has tried to replace PIPEDA twice. Bill C-11 died in 2021, and Bill C-27 died in early 2025. The third attempt, Bill C-36, the Protecting Privacy and Consumer Data Act, was introduced on June 15, 2026 and hadn’t moved past its first reading as of the end of September. According to the Library of Parliament’s summary, it would:

• allow administrative penalties up to $10 million or 3% of global revenue, and fines up to $25 million or 5%;
• require a privacy impact assessment before personal information is transferred outside Canada, which would bring something like Quebec’s rule to the whole country;
• require service providers to tell their clients about breaches;
• add a right to have personal information deleted.

It can’t take effect until a separate bill creating a new regulator also passes, so PIPEDA will likely stay in force for a while yet. But if the transfer assessment survives, every Canadian business using a US cloud service, lab or fulfilment partner will need to document it.

The numbers

Canada doesn’t have a single public list of health breaches like the US Department of Health and Human Services does. The numbers are spread across federal and provincial regulators, each with its own rules about what counts. Put together, they tell a consistent story.

Federal breach reports

Breach reports filed with the federal privacy commissioner under PIPEDA:

In 2025–26, unauthorized access made up 78% of reports. Most of those were cyber incidents, followed by social engineering and employees misusing their access. The commissioner also believes many breaches go unreported, or even undetected, particularly at small and medium-sized businesses, which make up nearly 90% of Canadian businesses (OPC annual report 2022–23).

Health accounts for only 3–5% of these federal reports, but that’s because most health breaches are reported to provincial commissioners instead.

Ontario: ten thousand health breaches a year

Ontario is the closest thing Canada has to a complete count, because health custodians there have to count every breach, however small. They reported 9,998 breaches in 2022 and 10,770 in 2023. The single biggest cause was misdirected faxes, more than 5,000 of them in 2023.

The breaches serious enough to be reported to the commissioner tell a different story. Of the 590 reported in 2023:

• Snooping: 197, a third of the total.
• Misdirected or lost information: 162.
• Unauthorized collection, use or disclosure: 127.
• Cyberattacks: 66, more than double the year before.
• Stolen information: 33.

In Ontario’s health sector, the person most likely to misuse a patient’s record is someone who already has access to it. That’s why audit logs, which record who looked at what, matter as much as firewalls.

Alberta and Quebec

Alberta’s health custodians self-reported 475, 448 and 492 breaches in the three years to 2024–25. That report also describes pharmacy delivery services sending medication to the wrong people, a mistake any business that ships personalized health products can make. The commissioner was candid about enforcement: two convictions in the year, with fines of $12,000 and $2,000, and an admission that the law “is not structured in such a way to effectively deter snooping.”

Quebec’s regulator received 514 privacy incident reports in 2024–25, up 16% on the year and up 559% over three years. Health care and social assistance was the top sector, with 94 reports. The leading causes were cyberattacks, human error and ransomware.

Ransomware and cost

The Canadian Centre for Cyber Security calls ransomware “the top cybercrime threat facing Canada’s critical infrastructure” (National Cyber Threat Assessment 2025–2026). It also notes that ransomware groups pick victims based on opportunity rather than specific targeting, and that the average ransom paid in Canada in 2023 was about $1.13 million. Health care isn’t singled out as the most targeted sector. It’s a target because it’s an opportunity, like everyone else.

For a small business, Statistics Canada’s numbers are more realistic than the headline averages. 16% of Canadian businesses were hit by a cyber incident in 2023, and businesses spent $1.2 billion recovering, double what they spent two years earlier. Of the ransomware victims who paid, 84% paid less than $10,000.

At the other end of the scale, IBM’s 2026 study put the average cost of a data breach in Canada at a record $7.11 million. The biggest factor pushing costs up was a breach at a supplier or vendor.

The Canadian horror stories

Canada’s case file is light on big fines and heavy on lasting damage.

A patch alert in a junk-mail folder: LifeLabs, 2019

LifeLabs, Canada’s largest community lab company, discovered a cyberattack in October 2019. The attackers got in through vulnerabilities in the software behind its online appointment booking system, flaws that had been public since 2017. The software’s vendor had sent two critical security alerts. The second one, according to the joint investigation by the Ontario and BC privacy commissioners, landed in the junk mail folder of a developer who wasn’t on the security team, and nobody else was subscribed to the alerts. LifeLabs’ own internal assessments had flagged patch management as a problem three years running.

LifeLabs paid the ransom. The commissioners counted about 16 million records covering 8.6 million people, including test results and health card numbers, and called LifeLabs’ view that health card numbers weren’t sensitive “very cavalier.” LifeLabs then spent years in court trying to keep the commissioners’ report from being published. It lost, and the report came out in November 2024, after a four-year battle.

A class action settled in 2023 for $9.8 million, on top of $5.6 million LifeLabs had already spent on credit monitoring. With more than 900,000 valid claims, each claimant received $7.86.

An order list is a health record: Ontario Medical Supply, 2025

The Canadian case closest to the businesses MadeTo is built for involves a supplier, not a hospital. Ontario Medical Supply delivers medical supplies to home-care patients for Ontario Health atHome. In 2025, it was hit by ransomware, and the data taken covered about 200,000 home-care patients: their names, contact information and the medical supplies and equipment they had ordered. Patients were told in late June, and the breach became public only after an opposition MPP raised it. A government report suggests the company paid a ransom.

No diagnosis was stolen. It didn’t need to be. For a business that makes compression garments, orthotics, hearing aids or compounded medications, a list of who ordered what is a list of who has which condition.

A pharmacy chain closes every store: London Drugs, 2024

In April 2024, London Drugs discovered a ransomware attack and closed all 79 of its stores across Western Canada for more than a week. The LockBit group demanded US$25 million. London Drugs said it was “unwilling and unable to pay,” and the attackers leaked corporate files that reportedly included employee medical information. The company has said patient and customer databases weren’t compromised. A proposed class action on behalf of employees has been filed.

One stolen password and a province’s health records: Newfoundland and Labrador, 2021

In October 2021, an attacker logged into Newfoundland and Labrador’s health system VPN with a stolen employee password. Two weeks later, ransomware took down health IT across the province. The province’s privacy commissioner found that the breach likely affected “the vast majority of the population of the province,” that remote access had used only a password, with no second factor, that the health IT agency was “severely understaffed,” and that a warning the year before “should have rung alarm bells.” The public waited almost 500 days to be told officially that it had been ransomware. The province’s health minister put the cost at about $16 million.

No second factor on the admin accounts: five Ontario hospitals, 2023

In October 2023, attackers hit TransForm, the shared IT provider for five hospitals in southwestern Ontario. One hospital’s database alone covered about 267,000 patients. Ontario’s privacy commissioner later found that the lack of multi-factor authentication on three administrator accounts was “a likely contributing factor” (PHIPA Decision 284). A $480 million proposed class action followed.

The file-transfer tool nobody cleaned out: Nova Scotia, 2023

Nova Scotia’s government used the MOVEit file-transfer tool to move files, and when attackers exploited a flaw in it in 2023, data on about 100,000 people was stolen before the vendor had even announced the flaw. The province’s privacy commissioner found that the tool had become a “repository for extraneous records,” with files kept for years instead of being deleted after 14 days, and that no privacy impact assessment had been done (CBC).

If your business swaps prescriptions, scans or impressions with clients through a file-sharing tool, this is the one to remember. Data you no longer need can’t be stolen if it’s gone.

A laptop with 631,000 people on it: Medicentres, 2013

Medicentres, an Alberta clinic chain, lost billing information on 631,000 Albertans when an IT consultant’s laptop was stolen. The laptop was “password protected, but not encrypted,” and the public found out nearly four months later (Alberta privacy commissioner).

Using patient data to sell something: Ontario’s first penalties

Ontario’s first administrative penalties under its health privacy law weren’t about hackers. Over three weeks in 2024, a physician ran 146 searches of a shared hospital records system looking for newborn boys, then contacted about 91 families to offer circumcision at his private clinic. He was fined $5,000 and his clinic $7,500. The commissioner found the clinic had a “complete lack of any documented privacy policies, practices and procedures” (Dentons).

Alberta’s Health Information Act has a matching offence: using identifying health information to market a service without the person’s specific consent. If you hold customers’ health profiles, the line between “personalized recommendation” and “using health data to sell” is one regulators are watching.

Snooping pharmacists

Pharmacies show up again and again in Canadian snooping cases. A Sobeys pharmacy manager in Nova Scotia created fake customer profiles to look up 46 people’s prescription records over about two years, which the province’s commissioner called a “real and present danger” (CBC). A pharmacy student on placement at a Saskatchewan Shoppers Drug Mart looked up 114 people’s records. An Alberta pharmacist who accessed 104 people’s records received a conditional sentence including three months of house arrest, the harshest outcome we found; we couldn’t find a case of anyone in Canada actually jailed for a health privacy offence.

Why Canadian class actions pay so little

In 2022, Ontario’s Court of Appeal ruled in Owsianik v. Equifax and two companion cases that an organization that gets hacked isn’t liable for “intrusion upon seclusion,” a privacy wrong that allows damages without proof of loss, because the hackers did the intruding, not the company. The Supreme Court of Canada declined to hear an appeal (Bennett Jones). People affected by an outside attack now have to prove negligence and actual loss, which helps explain the $7.86 LifeLabs payments.

Snooping is different. In Hopkins v. Kay, the same court held that patients can sue over health records accessed by a custodian’s own staff (Torys). And class actions keep getting filed regardless, as the TransForm and London Drugs cases show. Small payouts per person don’t mean small legal bills.

What the Canadian stories have in common

Look at the causes and they’re the same ordinary failures as in the US:

• A missed security update (LifeLabs).
• Remote access with only a password (Newfoundland and Labrador).
• Admin accounts without a second factor (TransForm).
• Data kept long after it was needed (Nova Scotia).
• An unencrypted laptop (Medicentres).
• Employees browsing records they had no reason to open (the pharmacy cases, and a third of Ontario’s reported health breaches).
• No written privacy policies (Ontario’s first penalty case).
• A supplier’s breach that became the client’s crisis (Ontario Medical Supply).

The good news is that one set of controls covers both countries. Two-factor authentication on every account, encryption on laptops and stored data, audit logs that can catch snooping, a record of every incident, short retention for shared files, and written agreements with every vendor that touches customer data together satisfy most of what HIPAA expects of a business associate, PIPEDA’s breach-record duty, Ontario’s breach reporting and Quebec’s transfer assessments.

What to do about it

1. Figure out which law applies to you. Are you a health information custodian in your province? Do you handle patient data for US healthcare customers? Do you sell to consumers in Quebec, or in Washington State? The answers decide which rules you’re under. If you’re not sure, the provincial privacy commissioners publish guidance, and it’s worth an hour with a lawyer.
2. Turn on two-factor authentication everywhere, especially remote access and admin accounts. It was missing in both the Newfoundland and TransForm cases.
3. Patch promptly, and make sure security alerts reach someone whose job is to act on them.
4. Log who looks at customer health information, and actually review the logs. Snooping is the most common serious breach in Ontario’s health sector.
5. Keep a record of every privacy incident, even the small ones. PIPEDA requires it, and it’s the one habit every Canadian regime rewards.
6. Delete what you don’t need, especially in shared drives and file-transfer tools.
7. Encrypt laptops and backups, and keep a backup attackers can’t reach.
8. Put written agreements in place with every vendor that touches customer data, and if you use US vendors, tell your customers their data may be processed outside Canada. In Quebec, do the transfer assessment first.
9. Don’t use customers’ health information to market to them without clear, specific consent.
10. Write your privacy policies down. Ontario’s commissioner publishes a free privacy management handbook for small health care organizations.

How we think about this at MadeTo

We’re building MadeTo in Canada for businesses on both sides of the border, and for a lot of them an order carries health information. So we build for the stricter of the two sets of rules, not the looser one. What’s already in place:

• Every business’s data is walled off at the database level, not just in application code.
• Sensitive fields are encrypted, and access to them is controlled by role.
• Changes to sensitive records are recorded, and so are views of them, which is exactly what you need to catch the snooping that shows up in so many of the cases above.
• Two-factor authentication is required for every account.
• Our own public site runs cookieless analytics and no advertising pixels.

If you run a made-to-order business that handles health information in Canada, the US or both, and you’re working through this yourself, join the waitlist below. We’d like to hear what you’re dealing with.

Sources

Laws and regulators:

• PIPEDA, full text
• Office of the Privacy Commissioner: provincial laws that may apply instead of PIPEDA
• Office of the Privacy Commissioner, annual report 2025–26
• Alberta Health Information Act and the Alberta privacy commissioner’s 2024–25 annual report
• Ontario Information and Privacy Commissioner, 2023 annual report backgrounder and health privacy breach guidelines
• Commission d’accès à l’information du Québec, 2024–25 annual report
• Bill C-36 on LEGISinfo and the Library of Parliament’s legislative summary
• Canadian Centre for Cyber Security, National Cyber Threat Assessment 2025–2026
• Statistics Canada, Canadian Survey of Cyber Security and Cybercrime, 2023
• 45 CFR 160.103, HIPAA’s definitions of covered entity and business associate

Investigation reports:

• LifeLabs: joint report of the Ontario and BC privacy commissioners
• Newfoundland and Labrador: privacy commissioner’s report on the 2021 cyberattack
• Nova Scotia: MOVEit breach public report
• Medicentres: Alberta privacy commissioner’s investigation report

Other case sources are linked in each story above, including law-firm analyses from BLG, Osler, Dentons, Bennett Jones and Torys, and news coverage from CBC, the Globe and Mail, Global News, CTV, Law Times, The Record and BleepingComputer.