Law 25 and PIPEDA Compliance Checklist for Private Clinics
Answer 15 questions about how your clinic protects client information. You get a compliance score and a prioritized action plan, adapted to Quebec's Law 25 or to PIPEDA and the privacy laws of the other provinces.
Solid foundations
Your clinic already has most of the expected measures in place. Close the remaining gaps below and review your practices once a year.
Partially compliant: gaps to close
Several important obligations are only partly covered. Start with the high-priority actions: they carry the most risk for your clients and your practice.
Significant compliance risk
Key obligations are missing. The good news: most of the actions below take a few hours each. Tackle the high-priority ones first, this month.
Your prioritized action plan
-
High priority Accountability Partially in place
Designate the person in charge of the protection of personal information in writing (by default, it is the person with the highest authority in the clinic) and publish their title and contact information on your website. Name a privacy officer in writing and make their title and contact information available on your website and in your intake documents.
-
Medium priority Governance policies Partially in place
Adopt governance policies approved by the person in charge (roles, retention and destruction, complaint handling) and publish a clear summary of them on your website. Write down your privacy policies and procedures (roles, retention and destruction, complaint handling) and make them available to clients, as required by the openness principle.
-
Medium priority Privacy policy Partially in place
Publish a privacy policy in clear and simple terms on your website and booking page, and inform people of any change to it. Publish a plain-language privacy notice on your website and booking page: what you collect, why, where it is stored and who can access it.
-
High priority Consent Partially in place
Use a written consent form that explains each purpose in clear terms, ask for consent separately for each purpose and keep the signed form in the client file. Health information is sensitive: consent must be express. Use a written consent form that explains each purpose in plain language, ask for consent separately for secondary purposes and keep the signed form in the client file.
Colib sends consent forms that clients sign online, and files them in the client's chart.
-
Low priority Website tracking Partially in place
Install a cookie consent banner that blocks analytics and advertising tags until the visitor opts in (privacy by default), and remove pixels from booking and form pages. Install a cookie consent banner that blocks analytics and advertising tags until the visitor opts in, and remove pixels from booking and form pages.
-
High priority Privacy incidents Partially in place
Open a confidentiality incident register today, and write a one-page procedure: contain the incident, assess the risk of serious injury, notify the Commission d'accès à l'information and the people concerned promptly. Open a breach record and keep entries for at least 24 months, and write a one-page procedure: contain the breach, assess the real risk of significant harm, report it to the privacy commissioner and notify the people concerned. Check whether your provincial health privacy law adds its own reporting rules.
-
Medium priority Privacy impact assessment Partially in place
Do a privacy impact assessment for each system that holds client information, starting with your EHR, and keep it on file. Ask your software vendors for their security documentation. Document a privacy and security review for each system that holds client information, starting with your EHR. Ask your software vendors for their security documentation.
-
Medium priority Data location Partially in place
List every tool that stores or processes client information and where its data is located. For anything outside Quebec, complete a privacy impact assessment and sign a written agreement, or switch to a provider hosted in Canada. List every tool that stores or processes client information and where its data is located. For anything outside Canada, tell clients in your privacy notice and secure contractual protections, or switch to a provider hosted in Canada.
Colib hosts all client information in Canada.
-
Medium priority Service providers Partially in place
Sign a written agreement with each service provider that accesses client information, covering confidentiality, security measures, use limited to the mandate, incident notification and destruction at the end of the contract. Make sure each service provider that accesses client information is bound by a contract covering confidentiality, security safeguards, limited use, breach notification and destruction at the end of the contract.
-
High priority Access control Partially in place
Give every person an individual account, restrict access to client files by role, turn on two-factor authentication and remove access the day someone leaves. Give every person an individual account, restrict access to client files by role, turn on two-factor authentication and remove access the day someone leaves.
Colib gives each user their own account, with two-factor authentication.
-
High priority Encryption and communications Partially in place
Encrypt every device that holds client information (BitLocker, FileVault, phone passcode), keep files in an encrypted EHR rather than on the desktop, and move client exchanges to a secure portal. Encrypt every device that holds client information (BitLocker, FileVault, phone passcode), keep files in an encrypted EHR rather than on the desktop, and move client exchanges to a secure portal.
Colib encrypts client information and includes a secure client portal with messaging.
-
Medium priority Access logs Partially in place
Use a system that logs access to client files, and review those logs periodically and after any suspected incident. Use a system that logs access to client files, and review those logs periodically and after any suspected incident.
Colib logs access to client files.
-
Medium priority Retention and destruction Partially in place
Write down the retention period required by your professional order, schedule a yearly review of closed files and destroy them securely (or anonymize them) once the period has ended, keeping a record of what was destroyed. Write down the retention period required by your regulatory college, schedule a yearly review of closed files and destroy them securely once the period has ended, keeping a record of what was destroyed.
-
Medium priority Access and portability requests Partially in place
Write a short procedure for access, correction and portability requests (identity check, 30-day deadline, response format) and test it: can you export a client's file in a readable format today? Write a short procedure for access and correction requests (identity check, 30-day deadline, reasons for any refusal) and test it on a real file.
-
Medium priority Training and confidentiality Partially in place
Have everyone sign a confidentiality agreement, and hold a short yearly training on privacy, phishing and incident reporting. Keep a record of attendance. Have everyone sign a confidentiality agreement, and hold a short yearly training on privacy, phishing and incident reporting. Keep a record of attendance.
Every point is covered. Keep your register, policies and training up to date, and repeat this self-assessment each year.
Close These Gaps Faster With Colib
Colib is a clinic management software and EHR built in Canada. Several points of your action plan are covered from day one: encrypted records hosted in Canada, individual accounts with two-factor authentication, access logs, online consent forms and a secure client portal.
- 30-day free trial
- No credit card required
- French and English
This self-assessment is for information only and does not constitute legal advice. For advice on your situation, consult a lawyer or your professional order or regulatory college.
What Law 25 Requires From Private Clinics in Quebec
Law 25 came into force in three phases between 2022 and 2024. Every obligation is now in effect, for large clinics as well as for self-employed practitioners. Read more on our Law 25 EHR page.
September 2022
- A person in charge of the protection of personal information, by default the highest authority of the clinic
- A register of confidentiality incidents
- Notification of the Commission d'accès à l'information and of the people concerned when there is a risk of serious injury
September 2023
- Governance policies and a privacy policy published on your website
- Privacy impact assessments, including before communicating information outside Quebec
- Stricter consent rules and the highest level of confidentiality by default
- Destruction or anonymization at the end of the retention period
September 2024
- Right to data portability: on request, computerized personal information must be provided in a structured, commonly used technological format
Outside Quebec: PIPEDA and Provincial Laws
PIPEDA applies to private clinics that collect personal information in the course of commercial activities, unless a substantially similar provincial law applies. Ontario, New Brunswick, Nova Scotia and Newfoundland and Labrador have health information laws for custodians, and Alberta and British Columbia have their own private-sector laws.
They all rely on the same principles: accountability, consent, limited collection and retention, safeguards, openness, individual access and breach reporting. PIPEDA compliant software.
What Is at Stake
Under Law 25, the Commission d'accès à l'information can impose administrative monetary penalties of up to $10 million or 2% of worldwide turnover, and penal fines can reach $25 million or 4%. Under PIPEDA, knowingly failing to report a breach or to keep breach records can lead to fines of up to $100,000.
For a clinic, the first risk remains the loss of client trust after an incident, and a complaint to your professional order.
How Colib Helps You Close the Gaps
Several points of this checklist depend directly on your clinic software. Colib was built in Canada with privacy in mind.
Hosted in Canada, Encrypted
Client information is encrypted and hosted in Canada, which simplifies your assessment of communications outside Quebec or outside Canada. See our security page.
Individual Accounts and Two-Factor Authentication
Each user has their own account protected by two-factor authentication, and access to client files is logged.
Consent Forms and Secure Portal
Send consent forms that clients sign online and replace email with a secure client portal.
Law 25 and PIPEDA for clinics -- frequently asked questions
Does Law 25 apply to a solo practitioner?
Yes. Law 25 applies to every enterprise that collects personal information in Quebec, including self-employed professionals and small clinics. There is no size exemption.
Who is the person in charge of the protection of personal information?
By default, it is the person with the highest authority in the enterprise: for a solo practitioner, it is you. The function can be delegated in writing, in whole or in part, and the title and contact information must be published on the website.
What counts as a confidentiality incident?
Any unauthorized access, use or communication of personal information, or its loss. A stolen laptop, an email sent to the wrong client or a ransomware attack are all incidents that must be recorded in the register.
Does client data have to be hosted in Canada?
Law 25 does not prohibit hosting outside Quebec, but it requires a privacy impact assessment and a written agreement before communicating information outside the province. Choosing software hosted in Canada makes that assessment much simpler.
Does PIPEDA apply to my clinic outside Quebec?
PIPEDA applies to private clinics engaged in commercial activities, except where a substantially similar provincial law applies, such as PHIPA for health information custodians in Ontario or PIPA in Alberta and British Columbia.
Is this checklist legal advice?
No. It is a self-assessment tool that helps you identify gaps and prioritize your work. For your specific situation, consult a lawyer or your professional order or regulatory college.
Explore More Colib Resources
Make Compliance the Default in Your Clinic
Encrypted records hosted in Canada, two-factor authentication, online consent forms and a secure client portal. Start your 30-day free trial -- no credit card required.