Privacy breach reporting by province: rules for therapy clinics

Privacy breach reporting by province at a glance

The table groups jurisdictions by what the law requires. It summarizes the detailed table in the next section, where each rule links to the statute or commissioner page it came from. In the statutes and regulations we could open, none sets a number of days for a clinic’s breach notice. The wording is “first reasonable opportunity”, “as soon as practicable”, “without unreasonable delay”, “as soon as reasonably possible” or “as soon as feasible”.

Breach notification rules for every province and territory

Read the “Who must be told, and when” column together with the statute section it cites. A few cells have conditions that matter: Ontario tells the Commissioner only in seven listed circumstances, Newfoundland and Labrador only for a “material breach”, and Alberta applies two different tests to two groups of clinicians. Where we could not read the source wording, the cell says so. Quebec is outside the scope of this page.

Federal PIPEDA: the territories, cross-border information and breach records

PIPEDA applies to private-sector organizations that collect, use or disclose personal information in the course of commercial activity. The Office of the Privacy Commissioner of Canada (OPC) says organizations in the Northwest Territories, Yukon and Nunavut are considered federally regulated and are covered by PIPEDA, and that businesses handling personal information that crosses provincial or national borders are subject to it even in provinces with similar laws [BR-3] [BR-20]. Alberta’s and British Columbia’s private-sector Acts and the health Acts of Ontario, New Brunswick, Nova Scotia and Newfoundland and Labrador are the laws the OPC lists as substantially similar; Manitoba’s, Saskatchewan’s, Prince Edward Island’s and Yukon’s laws are not on that list, so whether PIPEDA also applies to a fee-for-service clinic there is a question for the OPC or counsel [BR-21].

Under PIPEDA a breach of security safeguards must be reported to the OPC and notified to affected individuals when it is reasonable to believe it creates a real risk of significant harm, as soon as feasible after the organization determines that the breach has occurred (s. 10.1) [BR-1]. The OPC says the risk turns on the sensitivity of the information and the probability of misuse [BR-3]. Every breach must be recorded, whether or not it is reportable, and the record is kept for 24 months after the day the organization determines the breach occurred [BR-2]. Knowingly contravening the reporting, notification or record-keeping duties is an offence (s. 28) [BR-1].

Where breach reporting is voluntary: British Columbia and Saskatchewan

British Columbia. PIPA contains no breach-notification provision [BR-6]. The Information and Privacy Commissioner’s breach page says the Commissioner continues to call on government to amend PIPA to require organizations to report breaches to the OIPC and to affected individuals facing a risk of significant harm. In the meantime: “we strongly recommend that breaches be reported to our office as a best practice.” [BR-22] The OIPC’s quick reference for small and medium-sized businesses lists containment, risk assessment, notification and reporting, and prevention, and says organizations can report breaches to the OIPC [BR-23]. For regulated professionals, the CHCPBC Privacy and Confidentiality standard (s. 7) requires a breach to be contained promptly and reported in a manner that complies with privacy legislation [BR-24].

Saskatchewan. The Health Information Protection Act as consolidated through 2024 has no breach-notification section, and the 2023 Regulations mention a breach only in the clause that makes a vendor tell the trustee of a breach of its agreement [BR-10] [BR-11]. The Information and Privacy Commissioner’s guidelines for trustees list the affected individuals among those to notify unless there are compelling reasons not to, and say: “While not mandatory, the IPC does encourage organizations to proactively report.” [BR-25] The Commissioner’s form for proactive reports asks that it be sent within seven days of discovery, or shortly after; that is the form’s request and not a statutory deadline [BR-26].

Voluntary does not mean optional for every clinic. A Saskatchewan or British Columbia clinic may still owe a notice under a contract, a funder’s agreement, a professional regulator’s standard or the federal rules described above, and this page does not cover those. Ask the regulator of each clinician and your own counsel.

What to record: incident logs, annual counts and breach records

Two sources require records of incidents, not only notices. PIPEDA requires a record of every breach of security safeguards for 24 months, reportable or not [BR-2]. Ontario requires each custodian to give the Commissioner, on or before 1 March, the number of times in the previous calendar year that information was stolen, lost, used without authority or disclosed without authority, or collected without authority through the electronic health record; the IPC’s page lists the breakdowns it expects, such as theft by an internal party or a stranger, ransomware or another cyberattack, and the number of individuals affected [BR-27].

Our reading: a clinic in Ontario has to be able to count incidents by type at the end of each year, including ones it never reported, which in practice means keeping a running incident log. The Ontario IPC page tells custodians to keep this information over the course of the calendar year so they are ready to report, and the pages we read for other provinces do not set an equivalent annual count.

Mixed clinics: Alberta’s two tests in one building

Alberta is the one province where one clinic can be subject to two breach tests. Physiotherapists became custodians under the Health Information Act on 22 June 2026, so their records follow the “risk of harm” test and a three-way notice to the Commissioner, the Minister and the individual. Occupational therapists, speech-language pathologists and psychologists are not on the list of custodian colleges, so their clinic records follow PIPA’s “real risk of significant harm” test and a notice to the Commissioner [BR-7] [BR-9] [BR-28]. We did not find guidance from the Alberta OIPC on how a clinic divides one incident between the two laws, so ask the OIPC or counsel. The Alberta page sets out who is a custodian and where each profession’s college standards sit.

Privacy breach reporting dates to watch

Every date below is absolute and links to the official page that states it. Re-read the page before a date arrives, because dates and wording on government pages change.

Official breach reporting pages and forms

These are the regulator pages and forms a clinic is least likely to find from a general government site. Each line says what the page holds. Several regulator sites block automated tools, so a page that loads for you may still fail a scripted link check.

How TherapyCRM fits

TherapyCRM is practice management software with a clinical record, for English-language clinics in Canada outside Quebec. It has an audit log of activity on practice records that staff with the audit-log permission can review, which a clinic can use when it investigates what happened in an incident. TherapyCRM does not decide whether a breach must be reported, and it does not replace a clinic’s incident log, its breach response plan or advice from its regulators, the commissioner’s office or counsel. TherapyCRM holds no privacy or security certification.

Frequently asked questions