PIPEDA
Canada’s federal private-sector privacy law sets ground rules for handling personal information in commercial activity and may apply to cross-border information flows.
Canadian privacy planning
PIPEDA, PHIPA, and healthcare AI speech recognition
Choosing a tool for yourself or your healthcare team? Make privacy and security part of the decision. The requirements depend on your organization, province, the information involved, and how you’ll use it.
Federal contextPIPEDA may apply to private-sector commercial activity
Provincial contextHealth information rules vary by province
Deployment contextResponsibilities depend on the actual workflow
Understand the rules and where information goes
A useful review identifies which rules apply, what information is involved, where it moves, and who is responsible at each stage.
PHIPA
Ontario’s health privacy law governs personal health information and includes duties for health information custodians and people acting on their behalf.
Provincial requirements
Other provincial private-sector or health privacy laws may apply, including Quebec requirements that need dedicated review.
Privacy by design
Questions to ask before choosing a tool
If you’re choosing for a team, involve the people responsible for clinical care, IT, privacy, security, legal advice, and purchasing, along with the product provider.
- What personal or personal health information enters the workflow?
- Who collects, uses, discloses, stores, or can access the information?
- What purposes, authority, consent, and notices apply?
- What safeguards, retention, access, breach, and vendor controls are required?
- What information should be excluded from marketing and general inquiry forms?
Work through the review step by step
Treat compliance as an organizational and deployment-specific process, not a product label.
-
1
Map
Document the proposed workflow, information, systems, locations, vendors, and user roles.
-
2
Classify
Identify the information types and the federal, provincial, contractual, and organizational requirements that may apply.
-
3
Assess
Review purpose, authority, consent, safeguards, access, retention, incident handling, and vendor responsibilities.
-
4
Approve and monitor
Document decisions, configure the approved deployment, train users, and reassess material changes.
Official Canadian privacy resources
These official resources can help you prepare questions for your legal, privacy, and security advisers.
You might also find these helpful
Dragon Medical One Canada
Explore Dragon Medical One for yourself or your team.
Explore DMODMO-to-DCP planning
Include privacy in future workflow planning.
Explore next stepsContact eDist Canada
Ask where to find privacy information for a specific product.
Contact the teamFrequently asked questions
Does using a healthcare product automatically make an organization PIPEDA or PHIPA compliant?
No. Compliance depends on the organization, applicable law, information, purpose, configuration, contracts, safeguards, people, and actual workflow.
Does PHIPA apply everywhere in Canada?
PHIPA is Ontario legislation. Other provinces and territories have their own legal frameworks, and federal law may also be relevant. Obtain advice for the jurisdictions involved.
Should patient information be submitted through an eDist website form?
No. Do not submit patient information or other sensitive health information through general sales, webinar, portal, or contact forms.
Who should participate in a healthcare AI privacy review?
The team may include privacy, legal, security, IT, clinical, procurement, records, vendor, implementation, and business stakeholders depending on the proposed use case.
Have a product privacy question?
Tell us which product you’re considering and how you plan to use it—without sending patient information. We can help you find information for your review team.