Canada Provincial Health Privacy and Public Sector Cyber: PHIPA, Alberta’s HIA and Ontario’s EDSTA

In Canada, a hospital, clinic, school board or university answers mainly to provincial law, not the federal PIPEDA, and in Ontario and Alberta those provincial rules now include hard security duties: breach reporting to the privacy commissioner, annual breach statistics, privacy impact assessments and, since 1 July 2026, 72-hour reporting of critical cyber incidents by Ontario's broader public sector. This guide covers three regimes that security teams in these sectors meet most often: Ontario's Personal Health Information Protection Act (PHIPA), Alberta's Health Information Act (HIA), and Ontario's Bill 194, which created the Enhancing Digital Security and Trust Act, 2024 (EDSTA) and amended the Freedom of Information and Protection of Privacy Act (FIPPA). It explains what each requires, how they overlap, and what they mean for the service accounts, vendor connections and AI tools that reach health and student data.

Private sector privacy in Alberta and British Columbia is covered in our Alberta and BC PIPA guide, Quebec in the Quebec Law 25 Guide, the federal law in the Canada PIPEDA and Bill C-27 Guide, and the AI parts of EDSTA in the Canada AI Regulation Guide (post-AIDA). This page does not repeat them.

Source note: the e-Laws text of O. Reg. 51/26 and O. Reg. 52/26 could not be read for this guide. Those regulations are summarised from the Government of Ontario EDSTA page and named secondary sources (BLG and Hicks Morley); PHIPA penalties from Blakes and Lerners; and the FIPPA, PHIPA and HIA duties from the IPC Ontario and OIPC Alberta sites. Each obligation names its source. Penalty figures and deadlines are included only where two independent sources agree. Confirm against the official text before relying on it.

Key takeaways

• Ontario public sector cyber reporting is live: under O. Reg. 51/26, in force 1 July 2026, covered hospitals, colleges, universities, school boards and children's aid societies must report critical cyber security incidents to the Ministry's Chief Information Security Officer within 72 hours of confirmation (Government of Ontario).
• Maturity assessments every two years: the same regulation requires a cyber security maturity assessment every two years, with a summary sent to the Ministry within 30 days of completion (Government of Ontario on the two-year cycle; BLG and Hicks Morley on the 30 days).
• PHIPA has seven breach reporting triggers: health information custodians must report to the Information and Privacy Commissioner of Ontario (IPC) at the first reasonable opportunity when any of seven situations applies, including ransomware and malware attacks, and file annual breach statistics.
• PHIPA penalties are real: since 1 January 2024 the IPC can issue administrative monetary penalties of up to C$50,000 for individuals and C$500,000 for organisations (Blakes; Lerners).
• Alberta's HIA was amended in 2026: Bill 11 amendments took effect on 22 June 2026, with further changes from 2 July 2026; custodians still notify the Commissioner, the Minister and affected individuals where a breach creates a risk of harm (OIPC Alberta).

Which law applies to whom

A single Ontario hospital can be subject to PHIPA for patient data, EDSTA for cyber incidents, and in some functions FIPPA. Plan one incident process that feeds all three reporting routes.

Ontario EDSTA: public sector cyber security duties

Bill 194, the Strengthening Cyber Security and Building Trust in the Public Sector Act, 2024, received Royal Assent as Statutes of Ontario 2024, chapter 24. Schedule 1 enacted EDSTA, which lets the province prescribe cyber security programmes, incident reporting and technical standards for public sector entities (Legislative Assembly of Ontario). Two regulations filed on 23 March 2026 took effect on 1 July 2026 (Hicks Morley; Government of Ontario).

O. Reg. 51/26: Cyber Security

• Contacts: name a primary cyber security contact with decision-making authority over cyber security, and an alternate, and give their details to the Ministry's CISO. The primary contact approves assessment summaries (Government of Ontario; BLG).
• Maturity assessments: complete a cyber security maturity assessment every two years using industry standards or best practices endorsed by the Ministry's CISO. BLG gives 1 July 2027 for the first, and Hicks Morley says it is due one year after the regulation applies. A summary goes to the Ministry within 30 days of completion (BLG; Hicks Morley); BLG says it covers the model used, any maturity score and improvement areas.
• Incident reporting: report a critical cyber security incident to the Ministry's CISO within 72 hours of confirming it (Government of Ontario; BLG; Hicks Morley). BLG summarises the threshold as at least one of: a significant adverse impact on public services, a public safety risk, significant recovery efforts or activation of the incident response plan, or a significant risk of reputational harm. The duty is not limited to incidents involving personal information.

BLG points out that activating an incident response plan can itself meet the threshold, so plans need a clear activation point and a reporting step. Our Security Programme Maturity Assessment Template can help with internal preparation, but use the framework the Ministry endorses for the formal assessment.

O. Reg. 52/26: Digital technology affecting individuals under 18

School boards must give written notice before disclosing students' personal information to third-party software providers: to parents for students under 16 and to the student for those aged 16 and 17 (BLG; Hicks Morley; the Government of Ontario confirms the recipient depends on the student's age). BLG advises boards to complete an inventory of software and the personal information shared with each provider. That inventory is also a list of every vendor integration and API connection holding student data, which is exactly the third-party access a security team needs to see. See our Cybersecurity for Schools Guide.

Ontario FIPPA: breach reporting and PIAs for provincial institutions

Schedule 2 of Bill 194 amended FIPPA. According to the IPC, most changes took effect on 1 July 2025:

• Breach reporting: report to the IPC and notify affected individuals as soon as feasible where it is reasonable to believe a breach poses a real risk of significant harm.
• Records and statistics: track qualifying breaches and submit annual statistics to the IPC by 31 March of the following year.
• Privacy impact assessments: complete a written PIA before collecting personal information and update it before significant changes; the PIA must cover access roles, retention and safeguards, and be given to the IPC on request.

Ontario PHIPA: what health custodians must do

The IPC lists seven situations in which a custodian must report a privacy breach to the IPC at the first reasonable opportunity:

1. Use or disclosure the person knew or ought to have known was not permitted, such as snooping.
2. Theft, including ransomware or malware attacks, unless the information was de-identified or encrypted.
3. Further unauthorised use or disclosure after an initial breach.
4. A pattern of similar breaches.
5. Discipline of a regulated college member connected to the breach.
6. Discipline of an agent who is not a college member.
7. A significant breach, judged by sensitivity, volume, number of people and number of custodians or agents involved.

Custodians must also notify affected individuals, and must submit the previous calendar year's breach statistics to the IPC by 1 March, including breaches below the reporting threshold (IPC). Where the breach involves the shared electronic health record, the custodian responsible for the unauthorised collection notifies the IPC.

Since 1 January 2024 the IPC can impose administrative monetary penalties of up to C$50,000 for an individual and C$500,000 for an organisation, plus any economic benefit gained (Blakes; Lerners). Blakes reports the IPC's guidance that penalties are generally reserved for more serious contraventions rather than one-off mistakes.

Snooping is the most common PHIPA failure in practice; our EHR Access Monitoring and Patient Privacy Guide covers detection.

Alberta HIA: custodians, affiliates and the 2026 amendments

The OIPC of Alberta summarises custodians' duties as: establish a privacy management programme; submit privacy impact assessments to the Commissioner before introducing or changing practices or information systems; and notify the Commissioner, the Minister and affected individuals of any loss of, or unauthorised access to or disclosure of, individually identifying health information where there is a risk of harm. Affiliates, including employees, contractors and information managers, must follow the Act and the custodian's programme, and the custodian stays responsible for them.

The Health Statutes Amendment Act, 2025 (No. 2) (Bill 11) amendments took effect on 22 June 2026, with further amendments from 2 July 2026 (OIPC Alberta). IAPP reports that the changes let information managers, such as AI scribe tools, EMR systems and virtual care vendors, submit their information security policies to the OIPC for review. If you supply technology to Alberta custodians, expect your security documentation to be read by the regulator as well as the customer.

What it means for non-human identities and AI tools

None of these laws mentions service accounts, but every one of them turns on who accessed what. Our recommendations:

• Vendor and integration accounts: EHR integrations, interface engines, AI scribes and edtech platforms connect with API keys, OAuth grants and service accounts. Inventory them, give each an owner, and scope them to the minimum data. See NHI Inventory Reconciliation.
• Attribution: PHIPA snooping investigations and EDSTA incident reports need logs that tie access to a specific identity. Shared integration accounts make that impossible.
• Encryption and theft: PHIPA's theft trigger does not apply to encrypted data, so key management matters. A stolen key with the data means the exception may no longer help.
• PIAs: include machine access, AI tools and vendor connections in FIPPA and HIA privacy impact assessments, not only human roles.
• Revocation: remove vendor credentials when contracts end; see Credential Rotation at Scale.

The Healthcare Identity Security Guide covers the wider identity programme for health organisations.

Compliance steps

1. Map which of PHIPA, FIPPA, EDSTA and the HIA apply to each part of the organisation.
2. For EDSTA entities, confirm the primary and alternate contacts were filed and plan the first maturity assessment.
3. Build one incident decision process that tests the EDSTA 72-hour critical incident threshold, the PHIPA seven triggers, the FIPPA real risk of significant harm test and the HIA risk of harm test.
4. Set up breach logging that supports PHIPA (1 March) and FIPPA (31 March) annual statistics.
5. Update PIAs to cover vendor connections, AI tools and machine access.
6. For school boards, finish the software and data-sharing inventory and the notice process.
7. Inventory and scope service accounts and vendor credentials that reach health or student data.

Common failure patterns

• An incident plan with no defined activation point, so the EDSTA 72-hour clock is unclear.
• Treating a ransomware attack as a cyber matter only and missing PHIPA's theft trigger.
• Shared vendor accounts in clinical and student systems that defeat attribution.
• Annual breach statistics left until the deadline and rebuilt from email.
• PIAs that list staff roles but not integrations or AI tools.

Practitioner checklist

• Applicable provincial laws mapped per business unit.
• EDSTA contacts filed; maturity assessment scheduled with a Ministry-endorsed framework.
• Critical cyber incident threshold and 72-hour reporting step written into the response plan.
• PHIPA seven triggers, FIPPA and HIA notification tests in the breach procedure.
• Annual breach statistics captured continuously.
• Vendor, integration and AI tool identities inventoried, owned, scoped and logged.
• PIAs cover machine access and third-party connections.

Standards and references

• Government of Ontario: Enhancing Digital Security and Trust Act
• Ontario e-Laws: O. Reg. 51/26, Cyber Security
• Legislative Assembly of Ontario: Bill 194
• IPC Ontario: FAQ on FIPPA and MFIPPA amendments
• IPC Ontario: Report a health privacy breach
• OIPC Alberta: Health Information Act
• BLG: Ontario introduces cyber and educational technology regulations
• Hicks Morley: New public sector cyber security governance obligations in force 1 July
• Blakes: Ontario PHIPA administrative monetary penalties now in force
• Lerners: New administrative monetary penalty for PHIPA contraventions
• IAPP: PIAs, shared custody and AI highlight changes to Alberta's Health Information Act

Related NHI Mgmt Group resources: Alberta and BC PIPA · Canada AI Regulation Guide (post-AIDA) · Healthcare Cyber Regulation Map · Central Government Cybersecurity Programme Guide. This guide summarises Ontario and Alberta provincial rules as at November 2026 and is not legal advice.