PIPEDA vs HIPAA: a quick map for cross-border health data compliance
A health product sold in Canada and the US usually answers to HIPAA for its US covered entity customers and to PIPEDA, or a provincial health privacy law, in Canada. The laws overlap on safeguards and differ on triggers, clocks and contracts. This map is engineering guidance, not legal advice.
How do PIPEDA and HIPAA obligations compare for health software?
Quick answer
PIPEDA vs HIPAA is not a choice: a cross-border product meets both. HIPAA binds covered entities and business associates; PIPEDA binds organizations handling personal information in commercial activity, unless a substantially similar provincial law applies. Agnotic Technologies builds one control set, with breach and access workflows that track both clocks.
| Criterion | HIPAA (US) | PIPEDA (Canada) |
|---|---|---|
| Who it applies to | Covered entities and their business associates | Organizations in commercial activity, unless a substantially similar provincial law applies |
| Consent | Treatment, payment and health care operations are permitted without authorization; many other uses need one | Consent is the default for collection, use and disclosure, with listed exceptions; new purposes need new consent |
| Breach trigger | Breach of unsecured PHI, presumed unless a risk assessment shows a low probability of compromise | Breach of security safeguards that creates a real risk of significant harm |
| Breach timing | Individuals notified without unreasonable delay, no later than 60 calendar days after discovery | Report to the Privacy Commissioner and notify individuals as soon as feasible |
| Breach records | Document each breach and the risk assessment behind the decision | Record every breach, including those below the harm threshold, and keep it 24 months |
| Individual access | Act within 30 days, with one 30-day extension and a written reason | Respond within 30 days, extendable by up to 30 days in stated cases |
| Cross-border processing | No transfer restriction in the rule; the BAA and safeguards follow the data | Allowed; the organization stays accountable and should tell people their data may be processed abroad |
| Contracts with service providers | Business associate agreement with the terms in 45 CFR 164.504(e) | Contractual or other means that give comparable protection (Schedule 1, principle 4.1.3) |
| Accountable person | A designated privacy official and security official | Designated individuals accountable for compliance with the principles |
What they are
What is HIPAA (US)
HIPAA's Privacy, Security and Breach Notification Rules apply to covered entities, meaning health plans, clearinghouses and most providers, and to the business associates that handle PHI for them. A software vendor is usually in scope as a business associate under a BAA.
What is PIPEDA (Canada)
PIPEDA is Canada's federal private-sector privacy law. It applies to organizations that collect, use or disclose personal information in the course of commercial activities, through ten fair information principles, unless a provincial law declared substantially similar applies, as Ontario's PHIPA does for health information custodians.
Key differences
Which law applies to which customer?
Start from the customer, not the product. A US hospital or health plan is a HIPAA covered entity, and your product is its business associate. A private Canadian clinic or health company is generally under PIPEDA for its commercial activity, unless the federal government has declared a provincial law substantially similar for that activity. Record each tenant's governing law at onboarding, because it drives consent, breach and access rules.
How do the breach clocks differ?
HIPAA sets an outer limit: notice to individuals without unreasonable delay and no later than 60 calendar days after discovery (45 CFR 164.404). PIPEDA section 10.1 requires a report to the Privacy Commissioner, and notice to affected individuals, as soon as feasible when a breach creates a real risk of significant harm. One incident can start both clocks, so the incident record needs discovery time, affected people by country and a harm assessment for each law.
Why does PIPEDA need a record of every breach?
Section 10.3 requires a record of every breach of security safeguards, and the Breach of Security Safeguards Regulations require each record to be kept for 24 months after the organization determines the breach occurred. That includes breaches judged below the harm threshold. Build the incident log so low-risk events are recorded too, not only the ones that trigger notice.
Can Canadian health data be processed in the US?
PIPEDA does not ban it. Principle 4.1.3 keeps the organization responsible for information transferred to a third party for processing and requires contractual or other means for comparable protection. The Privacy Commissioner's guidelines add that organizations should tell customers their information may be processed in another jurisdiction and may be accessed there by courts, law enforcement and national security authorities. Customer contracts can still require Canadian residency, so check each one.
How do access request timelines line up?
They are close. HIPAA requires action within 30 days, with one extension of up to 30 days if the individual gets a written reason and a new date (45 CFR 164.524). PIPEDA requires a response within 30 days, with an extension of up to 30 days in the cases section 8 lists. One access workflow with a 30-day due date and a tracked extension covers both.
When to use each
When to use HIPAA
- Your customers include US hospitals, practices or health plans.
- Your product creates, receives, maintains or transmits PHI for those customers.
- You subcontract hosting or support that touches US customers' PHI.
- You need the specific BAA terms US buyers will ask for.
When to use PIPEDA
- Your customers include private Canadian clinics or digital health companies.
- You process Canadians' health information for a commercial service.
- You store or process Canadian data outside Canada, including in the US.
- You need a service provider privacy agreement for Canadian customers.
Which engineering controls satisfy PIPEDA and HIPAA at once?
1. Tenant jurisdiction flag. Each customer record carries its governing law, so consent, breach and access rules apply per tenant.
2. One incident record, two clocks. Capture discovery time, affected people by jurisdiction and separate HIPAA and PIPEDA harm assessments, and keep every record, including low-risk events, for at least 24 months.
3. Consent ledger. Store consent by purpose with timestamps, so Canadian secondary-use consent and US authorizations can both be shown.
4. Access request workflow. A 30-day due date, a tracked extension with its written reason, and an export of the record in a usable format.
5. Data location map. Record where every data store and subprocessor runs, so cross-border notices and contracts match what the system does.
6. Contract set. A BAA for US covered entities and a service provider privacy agreement for Canadian customers, both naming the same subprocessors.
7. Shared safeguards. Encryption, unique user IDs, audit logs and access reviews apply to every tenant; neither law needs a separate technical stack.
Which sources does this comparison rely on?
- PIPEDA, S.C. 2000, c. 5: sections 8, 10.1 and 10.3 and Schedule 1 (laws-lois.justice.gc.ca)
- Breach of Security Safeguards Regulations, SOR/2018-64 (laws-lois.justice.gc.ca)
- Office of the Privacy Commissioner of Canada, guidelines for processing personal data across borders (priv.gc.ca)
- 45 CFR 164.404: notification to individuals of a breach (eCFR)
- 45 CFR 164.524: individual access to PHI (eCFR)