PIPEDA and Patient Reviews: How Canadian Clinics Can Respond Without Breaching Privacy

What to take away

• A public reply must not confirm that the reviewer is a patient.
• PIPEDA covers private clinics, and several provinces add a statute of their own.
• A compliant reply stays general, names a privacy officer, and omits treatment details.
• The Office of the Privacy Commissioner can take a complaint to Federal Court.
• Keep a dated copy of the review, the reply and the reasoning behind both.

Who has jurisdiction over a patient review response

PIPEDA applies to private clinics that collect, use or disclose personal information in commercial activity, and health information sits inside that definition. The official PIPEDA overview lists the fair information principles, including consent and limits on collection.

British Columbia, Alberta and Quebec have private sector statutes the federal government recognises as substantially similar, so those laws apply inside their borders. Ontario has no general private sector statute, but the Personal Health Information Protection Act reaches health information custodians directly and the Information and Privacy Commissioner of Ontario enforces it.

A clinic answers two questions. Which statute governs the information, and which regulator takes a complaint.

What a compliant reply must contain

A reply that stays inside the rules contains a narrow set of ingredients.

• A statement that the clinic does not discuss individual care in public.
• A named contact, usually the privacy officer, with a general phone line.
• A note that concerns can go to the clinic or to the relevant commissioner.
• A correction of a factual error, but only where the error concerns the clinic.
• An invitation to continue privately, worded so it confirms no relationship.

A general thank-you for feedback is usually defensible. Anything that acknowledges a visit is not.

"We are sorry your appointment ran late" tells every reader that the person had an appointment. That is a disclosure of personal health information, and the absence of a name changes nothing.

Clinics that publish service content also meet advertising rules. The Healthcare Marketing Compliance Guide sets out where those rules sit beside privacy law.

Records to keep when a review draws a complaint

A clinic that can produce a clean file answers a commissioner in days rather than months. The file should hold:

• A dated copy of the review as posted, with the platform and the link.
• The clinic's reply, kept even if it was later edited or deleted.
• The privacy officer's note on whether the reply disclosed personal information, with reasons.
• The privacy policy version in force on the date of the reply.
• The complaint record, with dates, the handler and the outcome.

Follow-up messages are where consent rules bite, and CASL Healthcare Email Marketing Compliance covers what Canadian law requires before one is sent. Retention periods are set provincially, and the review file usually follows the clinical record it touches. An access request can reach the file, so write the note as though a patient may read it.

What happens when a clinic confirms a patient relationship

The person who wrote the review can complain to the Office of the Privacy Commissioner or to a provincial commissioner. Where a clinic is found to have contravened the law, the matter can go to the Federal Court of Canada. The court can order the clinic to change its practices and to publish a notice of the finding.

Findings are published by name. The reply and the internal note become part of a searchable public record that often outlasts the review. Healthcare Reputation Management writing rarely mentions this exposure, because most of it is aimed at one regulator.

A second consequence arrives sooner. Staff who search the record to work out who a reviewer is have collected personal health information for a purpose the clinic does not need.

Where the rules differ by place

Jurisdiction	Main statute	Regulator
Federal	PIPEDA	Office of the Privacy Commissioner of Canada
British Columbia	Personal Information Protection Act	Office of the Information and Privacy Commissioner for BC
Alberta	Personal Information Protection Act	Office of the Information and Privacy Commissioner of Alberta
Quebec	Private sector privacy law, amended by Law 25	Commission d'acces a l'information du Quebec
Ontario	Personal Health Information Protection Act	Information and Privacy Commissioner of Ontario

Provincial variation also shapes what counts as consent and how a complaint proceeds. Health Canada reports on health care delivery describe how the system is organised across provinces, which helps a clinic that operates in more than one.

Some commissioners issue binding orders. Others publish findings and recommendations. The effect on a clinic is similar, because a reply that identifies a patient becomes an exhibit either way.

Common questions

Can a clinic ask a reviewer to take the conversation offline? Yes, if the invitation is generic and confirms nothing. A line such as "we would like to discuss your appointment" is not. Clinics that want structured feedback can use Patient Satisfaction Survey Questions written for that purpose.

Do we have to delete a review if the patient asks? No. The platform owns the content, and PIPEDA gives a clinic no right of removal. A clinic can ask the platform to remove a post that reveals personal health information.

Can staff check the record to identify a reviewer? No. That look-up collects personal health information for a purpose the clinic does not need, and in some provinces it is an offence.

Does the American approach apply here? Not directly. The HIPAA Privacy Rule permits certain disclosures for treatment, payment and operations, and it does not map onto Canadian consent rules.