PIPEDA Compliance Automation Software for Digital Healthcare

PIPEDA stands for The Personal Information Protection and Electronic Documents Act.

Part of the reason that PIPEDA is important is that organizations covered under it must obtain consent from individuals when they collect, use, or disclose that data.

This means that information collected from clients can only be used for the purposes it was collected. If an organization wants to use that information again in a different way, they must again ask for consent.

According to PIPEDA, any personal information that is considered factual or subjective about an identifiable individual should be protected. This includes information in many different forms, such as:

• Age
• Name
• Identification numbers (i.e., provincial health card number, SIN number, etc.)
• Income
• Ethnic heritage
• Blood type
• Opinions or comments
• Social status
• Disciplinary actions
• Employee files
• Previous merchant disputes
• Credit history
• Loan records

PIPEDA is a federal regulation for protecting personal information.

PHIPA (Personal Health Information Protection Act) is a provincial regulation for protecting personal information, specifically as it relates to clients in Ontario.

The biggest key difference between these two regulations is that PIPEDA applies to personal information in a broader spectrum, while PHIPA focuses on protections for personal health information.

Because the federal government has concluded that PHIPA and PIPEDA principle guidelines are very similar in some ways, companies that are PHIPA compliant may be exempt from certain parts of PIPEDA.

It is a requirement in Canada that all federally-related organizations remain PIPEDA compliant, or be subject to an equivalent provincial law. This could include businesses, such as:

• Telecommunication companies
• Banks (domestic/authorized foreign) and other financial institutions
• Television and radio broadcasters
• Airlines, airports, and aircrafts
• Offshore drilling operations

It’s important to note that these applicable businesses must also offer the same protections for their employees’ personal information, as they do for their clients.

Since healthcare in Canada is provided at the provincial level, each province has their own health data privacy requirements.

• Alberta: HIA
• Ontario: PHIPA
• Manitoba: PHIA
• New Brunswick: PHIPAA
• Newfoundland and Labrador: PHIA
• Prince Edward Island: HIA
• Quebec: QHR
• Saskatchewan: HIPA
• British Columbia: FIPPA
• Nova Scotia: PHIA
  
  Due to the fact that Ontario is the most densely populated province in the country, this is the provincial regulation that we hear about most often, but similar regulations exist for other provinces across the country.