PIPEDA Patient Reviews in Canadian Healthcare: Privacy Rules

For Canadian healthcare clinics, PIPEDA patient reviews call for public replies that stay general, offer a private route to the privacy officer, and avoid confirming a patient relationship.

What to take away

Who has jurisdiction over a patient review response

PIPEDA applies to private clinics that collect, use or disclose personal information in commercial activity, and health information sits inside that definition. The official PIPEDA overview lists the fair information principles, including consent and limits on collection.

The ten fair information principles are:

British Columbia, Alberta and Quebec have private sector statutes the federal government recognises as substantially similar, so those laws apply inside their borders. Ontario has no general private sector statute, but the Personal Health Information Protection Act reaches health information custodians directly and the Information and Privacy Commissioner of Ontario enforces it.

Quebec's private-sector statute is the Act respecting the protection of personal information in the private sector, as amended by Law 25; its regulator is the Commission d’accès à l’information du Québec.

A clinic answers two questions. Which statute governs the information, and which regulator takes a complaint.

What a compliant reply must contain

A public reply should include only a general acknowledgment, no confirmation of a patient relationship or treatment details, and a private contact route through the clinic's privacy officer.

A neutral template is:

Thank you for sharing your feedback. We take feedback seriously. To protect everyone's privacy, we can't discuss individual circumstances in a public forum. If you'd like to raise a concern privately, please contact our privacy officer at [privacy officer's public contact information].

A general thank-you for feedback is usually defensible. Anything that acknowledges a visit is not.

"We are sorry your appointment ran late" tells every reader that the person had an appointment. That is a disclosure of personal health information, and the absence of a name changes nothing.

Clinics that publish service content also meet advertising rules. Healthcare Patient Outreach's Healthcare Marketing Compliance Guide sets out where those rules sit beside privacy law.

Records to keep when a review draws a complaint

A clean, contemporaneous file helps the clinic answer a complaint. Keep:

Follow-up messages are where consent rules bite. CASL means Canada's Anti-Spam Legislation, the short title of Canada's federal anti-spam statute. Healthcare Patient Outreach's CASL Healthcare Email Marketing Compliance covers what Canadian law requires before one is sent. Retention periods vary by jurisdiction and record type; there is no single Canada-wide period for every review complaint file. Set and document a schedule under the rules that apply to the clinic, and don't automatically treat every review file as a clinical record. An access request can reach the file, so write the note as though a patient may read it.

What happens when a clinic confirms a patient relationship

The person who wrote the review can complain to the Office of the Privacy Commissioner or to a provincial commissioner. Where a clinic is found to have contravened the law, the matter can go to the Federal Court of Canada. The court can order the clinic to change its practices and to publish a notice of the finding.

A federal complaint generally begins with a complaint to the Office of the Privacy Commissioner of Canada. The OPC assesses it, may investigate and attempt resolution, and reports its findings; after that process, the complainant may apply to the Federal Court of Canada under PIPEDA. Court involvement is not automatic.

Findings are published by name. The reply and the internal note become part of a searchable public record that often outlasts the review. Healthcare Patient Outreach's Healthcare Reputation Management writing rarely mentions this exposure, because most of it is aimed at one regulator.

A second consequence arrives sooner. Staff who search the record to work out who a reviewer is have collected personal health information for a purpose the clinic does not need.

Where the rules differ by place

Provincial variation also shapes what counts as consent and how a complaint proceeds. Health Canada reports on health care delivery describe how the system is organised across provinces, which helps a clinic that operates in more than one.

Some commissioners issue binding orders. Others publish findings and recommendations. The effect on a clinic is similar, because a reply that identifies a patient becomes an exhibit either way.

Common questions