PHIPA, in plain language — grounded in what the IPC actually enforces
Source-cited analysis for Canadian clinic owners and privacy contacts. Every post draws on primary sources — IPC decisions, Ontario statutes, and official guidance — and carries a last-verified date.
Articles
Written for clinic owners, office managers, and privacy contacts — no legal background required.
Your EMR Vendor Isn't PHIPA-Compliant For You: What a Real Vendor Agreement Needs
Buying a Canadian-hosted EMR does not make your clinic PHIPA-compliant. Every third party that touches patient data — your EMR, your billing platform, your IT contractor — needs its own written agreement. Here is what that agreement actually has to cover.
Read articleThe First 72 Hours After a Privacy Breach: What Canadian Clinics Actually Have to Do
Breach response deadlines are not the same across Canada. Quebec's Law 25 comes closest to a hard 72-hour expectation; Ontario's PHIPA has no fixed clock at all — and getting that distinction wrong is its own risk. Here is the real timeline, province by province.
Read articleThe PHIPA Duty Almost Every Ontario Clinic Forgets: The Annual Breach Statistics Report
Reporting a breach to the IPC when it happens is only half the obligation. Ontario health information custodians also have to track every reportable breach all year and file an annual statistical return by March 1 — a duty most small clinics have never heard of.
Read articleQuebec Law 25 for Healthcare Clinics: The Compliance Overview
Law 25 carries the steepest privacy penalties in Canada — up to $25M or 4% of global turnover — and it reaches any clinic serving Quebec residents, not just clinics located in Quebec. Here is what it actually requires.
Read articlePHIPA Compliance for Clinics: The 2026 Plain-English Guide
What PHIPA compliance means for an Ontario clinic in 2026: consent, breach reporting, patient rights, and the penalties that now apply.
Read articlePHIPA vs HIPAA: Why US Compliance Tools Don't Make Your Ontario Clinic Compliant
Vanta, Drata, and Accountable HQ are built for HIPAA — US federal law. Ontario clinics are governed by PHIPA, a fundamentally different regime. Here is exactly what US tools miss, and why the gap matters after Ontario's first PHIPA fine.
Read articleOntario's first PHIPA fine: what the IPC found missing at the clinic
In August 2025, the IPC issued Ontario's first-ever PHIPA administrative monetary penalties. Here is exactly what was missing from the clinic that got fined — and the checklist every Ontario health information custodian needs to close those gaps.
Read articleWhy the compliance spreadsheet breaks under a PHIPA investigation
Most Ontario clinics manage PHIPA compliance with a folder of PDFs and a spreadsheet. Here is why that approach fails the IPC's 'repeatable and demonstrable' standard — and what a working compliance system actually looks like.
Read articleFind the gaps while they are still yours to fix.
The free scorecard maps your current practices against the six areas Decision 298 puts a custodian on the hook for. No login required.