HIPAA in Canada: When It Applies and What PHIPA Adds

HIPAA is a US law that reaches a Canadian company the moment that company creates, receives, maintains, or transmits protected health information (PHI) on behalf of a US covered entity or another business associate. The company is then a HIPAA business associate under 45 CFR 160.103, bound by a business associate agreement (BAA), while PIPEDA and provincial health laws such as Ontario's PHIPA still apply at home.

Does HIPAA apply to Canadian companies?

HIPAA applies to a Canadian company that performs a function involving PHI for a US covered entity, wherever the company is incorporated or hosted. The definition in 45 CFR 160.103 turns on the activity: a business associate is a person who, on behalf of a covered entity, creates, receives, maintains, or transmits protected health information.

HIPAA sorts regulated organizations into two groups:

HHS's cloud computing guidance closes two escape routes: a provider storing only encrypted ePHI without the key is still a business associate, and ePHI may be stored on servers outside the United States only under a BAA and the rest of the HIPAA Rules.

Which Canadian health-tech companies are HIPAA business associates?

Data de-identified under the HIPAA standard is not PHI, but treat that argument as a documented legal position, not an assumption.

What does a HIPAA business associate agreement commit a Canadian vendor to?

A HIPAA business associate agreement is the contract that makes a Canadian vendor's HIPAA obligations concrete and enforceable by the customer. Under 45 CFR 164.314(a), the BAA must require the vendor to:

• Comply with the Security Rule
• Flow the same terms down to any subcontractor that handles ePHI
• Report security incidents and breaches of unsecured PHI to the covered entity

The flow-down clause catches Canadian vendors. Every sub-processor in a vendor's stack that touches PHI needs a separate BAA with that vendor. Common examples:

• Hosting
• Email
• Support desk
• Transcription
• AI inference

In one telehealth company's HIPAA and GDPR gap assessment, discovery found more than 400 applications in use and no record of which held a BAA. One collaboration platform was on a plan tier that did not match the company's use of the platform with sensitive data. Plan tiers decide whether a BAA is available, so tier selection is a compliance decision.

A vendor risk assessment process that tracks BAA status per vendor is the practical control.

What does the HIPAA Security Rule require of a business associate?

The HIPAA Security Rule requires a business associate to protect the confidentiality, integrity, and availability of ePHI with administrative, physical, and technical safeguards, starting with a documented risk analysis. 45 CFR 164.308(a)(1)(ii)(A) requires an accurate and thorough assessment of the potential risks and vulnerabilities to ePHI held by the covered entity or business associate.

OCR's Risk Analysis Initiative targets the written HIPAA risk analysis. The 2025 Comstar and BST & Co. CPAs settlements with business associates both cite the risk analysis.

How fast must a business associate report a HIPAA breach?

A HIPAA business associate must notify the covered entity of a breach of unsecured PHI without unreasonable delay and no later than 60 calendar days after discovery. The covered entity then sends the notices in the table below. A BAA can set a shorter window, so read the contract first.

HHS's ransomware fact sheet treats ePHI encrypted by an attacker as a breach unless a low probability of compromise can be shown.

Can HHS enforce HIPAA against a business associate?

HHS can enforce HIPAA directly against business associates. HHS's direct liability fact sheet lists the obligations, including:

• Security Rule compliance
• Breach notice to the covered entity
• Permitted uses and disclosures of PHI
• BAAs with subcontractors

Two 2025 OCR settlements with business associates:

Civil money penalties follow four culpability tiers in 45 CFR 160.404, from did not know to willful neglect not corrected, with amounts adjusted each year for inflation. For a Canadian vendor, the first consequence is often contractual: BAAs commonly carry termination rights and indemnities.

What is changing in the HIPAA Security Rule?

HHS proposed a broad rewrite of the HIPAA Security Rule, and as of October 2026 the rewrite remains a proposal. The notice of proposed rulemaking was published in the Federal Register on January 6, 2025 (90 FR 898), comments closed March 7, 2025, and the 2026 Unified Agenda moved the rule to long-term actions and the target for final action from May 2026 to July 2027. No final rule has been published.

Building toward the proposal is a reasonable hedge, since much of the proposal describes controls US buyers already ask about.

Is there a HIPAA certification in Canada?

There is no official HIPAA certification in Canada or the United States. The HHS Security Rule FAQ states that no standard requires a regulated entity to certify compliance, and that HHS does not endorse or otherwise recognize private organizations' certifications regarding the Security Rule. A purchased HIPAA certificate does not prevent an OCR finding.

A US hospital asking a Canadian vendor for HIPAA certification is asking for evidence, usually one of three kinds:

HIPAA and PHIPA are laws. SOC 2 and HITRUST are voluntary attestations and certifications that help a company prove compliance with those laws. Related guides:

• The SOC 2 Type II report guide explains what the report tests
• SOC 1 vs SOC 2 covers which report fits
• SOC 2 vs HIPAA shows how one audit firm can test both in the same engagement
• The Type I first post covers starting with a Type I

What is the HIPAA equivalent in Canada?

Canada has no single HIPAA equivalent. Health information falls under:

• PIPEDA, for commercial activity
• Provincial health statutes, for custodians and their service providers
• Public-sector laws, for hospitals and health authorities

The Office of the Privacy Commissioner of Canada lists four provincial health laws as substantially similar to PIPEDA:

• Ontario
• New Brunswick
• Nova Scotia
• Newfoundland and Labrador

PIPEDA still applies to personal information transferred across provincial or national borders.

Which health privacy law applies in each province and territory?

PIPEDA adds a separate breach duty (OPC guidance):

• Report a breach of security safeguards that creates a real risk of significant harm to the Privacy Commissioner and affected individuals as soon as feasible
• Keep a record of every breach for two years

Bill C-36, tabled on June 15, 2026, would replace the privacy rules in PIPEDA with a new Protecting Privacy and Consumer Data Act. As of October 31, 2026, the bill is at second reading in the House of Commons, so PIPEDA still applies. The Bill C-27 and Law 25 post covers the earlier federal reform attempt and Quebec's Law 25.

What does PHIPA add for a Canadian vendor serving Ontario health care?

PHIPA regulates Ontario health information custodians (hospitals, clinics, physicians, labs) and reaches their technology vendors in two ways. A vendor acting for the custodian is an agent and must follow the custodian's rules. A vendor that supplies electronic services without acting as agent must meet the requirements in PHIPA s. 10(4) and O. Reg. 329/04, s. 6:

• Use PHI only as necessary to provide the service
• Not disclose the PHI
• Bind the vendor's employees and agents to the same restrictions

A vendor that lets two or more custodians share PHI electronically is a health information network provider, which must also notify affected custodians of unauthorized access at the first reasonable opportunity and publish a plain-language description of the network's safeguards.

Ontario's Information and Privacy Commissioner made the vendor point explicit in PHIPA Decision 284 (June 2025), on the ransomware attack against TransForm Shared Service Organization, a shared IT provider for five hospitals and a family health team clinic. The IPC found that the lack of privileged account management, including MFA, on the compromised administrator accounts was likely a contributing factor, and that outsourcing does not relieve custodians of responsibility. The cost of a data breach in Canada post puts numbers on incidents like the TransForm attack, and the IPC's AMP announcement sets out the penalty ranges.

What should a HIPAA + PHIPA readiness checklist cover for Canadian health-tech vendors?

A Canadian vendor selling to US providers, Canadian custodians, or both can use one checklist, because the controls overlap far more than the statutes do.

Items 1 to 4 decide whether a BAA can be signed honestly. Items 5 to 9 decide whether the security questionnaire that follows goes well.

Can one security program cover HIPAA and PHIPA?

A Canadian company handling PHI for the US health system is a business associate, and the BAA turns that status into obligations the vendor must prove. PHIPA and PIPEDA add Canadian duties to the same data, with different clocks and regulators. A vendor selling into both markets can meet all three regimes with one effective security program: map HIPAA, PHIPA, and PIPEDA onto the same controls, and add SOC 2 or HITRUST when a contract calls for a report.

Frequently asked questions about HIPAA in Canada

Does HIPAA apply in Canada?

HIPAA applies to a Canadian company that creates, receives, maintains, or transmits protected health information for a US covered entity or business associate. The company becomes a business associate under 45 CFR 160.103, signs a business associate agreement, and is directly liable for the HIPAA Security Rule. Otherwise, only Canadian privacy law applies.

Is there a HIPAA certification in Canada?

There is no official HIPAA certification in Canada or the US, and HHS does not endorse or recognize private organizations' HIPAA certifications. Buyers asking for certification want evidence: a documented Security Rule risk analysis and policies, a SOC 2 Type II report with HIPAA mapping, or a HITRUST e1, i1, or r2 certification for larger health systems.

What is the Canadian equivalent of HIPAA?

Canada has no single equivalent. PIPEDA governs personal information in private-sector commercial activity, and provinces have their own health information statutes, such as Ontario's PHIPA, Alberta's Health Information Act, and Quebec's Act respecting health and social services information. Ontario, New Brunswick, Nova Scotia, and Newfoundland and Labrador have health laws deemed substantially similar to PIPEDA.

Is PHIPA the same as HIPAA?

No. PHIPA is an Ontario law regulating health information custodians and the vendors serving them. HIPAA is a US federal law regulating covered entities and business associates. PHIPA requires breach notice at the first reasonable opportunity, where HIPAA sets a 60-day outer limit. One security program can meet both.

When does the new HIPAA Security Rule take effect?

The updated HIPAA Security Rule has no effective date yet. HHS published the proposal on January 6, 2025, and the 2026 Unified Agenda lists the rule as a long-term action with final action targeted for July 2027. Until a final rule is published, the current Security Rule at 45 CFR Part 164, Subpart C, is the law.