Health information in Quebec: the Act and security

A software vendor signs with a clinic, a pharmacy or an institution in the health network. Since July 1, 2024, that contract is no longer only a commercial matter: if it gives access to health information, it must be in writing and contain the clauses the law lists, on pain of nullity. The Act respecting health and social services information places part of the security on those who serve the network.

What the Act says

Assented to on April 4, 2023, the Act (CQLR, chapter R-22.1) came into force on July 1, 2024, according to the Quebec government. It covers any information that allows a person to be identified, even indirectly, and that concerns in particular the person's state of health or the services the person received (section 2). It applies to "health and social services bodies" (section 4): the ministry and institutions, but also, according to the ministry's guide, private health facilities (a community pharmacy, for example), laboratories and private seniors' residences.

Governance. The person exercising the highest authority within the body is the person in charge of the protection of information and delegates that function only in writing (section 100). The body adopts and publishes a governance policy that sets out, among other things, the logging mechanisms, the security measures and the processing of incidents (section 105).

Security. Section 99 requires security measures that are reasonable given, in particular, the sensitivity, the quantity and the medium of the information. The governance regulation, in force since July 1, 2024, adds a rhythm: training on entry into office and a yearly update, a yearly evaluation of the effectiveness of security measures, an evaluation of technological products or services at least every two years.

Access and logging. A professional has access to the information needed to provide services (section 38); other service providers, on the conditions set by regulation (section 39). Section 103 requires logging all accesses, uses and communications: which information, who, on what date and at what time. According to the ministry's guide and the consolidated text updated to June 10, 2026, it is not yet in force. Until then, the body keeps a register of communications (section 265) and analyzes accesses every month, as the regulation requires (once a year for Schedule II).

Incidents. A confidentiality incident covers access, use or communication not authorized by law, loss and any other breach of the protection of information. The body takes reasonable measures to reduce the risk of injury; if that risk is serious, it promptly notifies the Minister, the Commission d'accès à l'information and the persons concerned (section 108), and it keeps a register of incidents (section 110). Failing to make a required report exposes an organization to a fine of $3,000 to $30,000 (section 159).

Why it matters for a supplier

Section 77 brings the supplier into the regime through the contract. When the body communicates information to a mandatary or contractor that is not itself a body, the written document must set out the provisions of the Act that apply, the protection measures (compliant with the governance rules and the special rules of the network information officer) and six obligations:

• send to the body, before any communication, a confidentiality agreement completed by every person who may use the information;
• when working remotely, use only technological products or services authorized by the body;
• immediately notify the person in charge of the protection of information of any violation or attempted violation;
• allow the body to conduct any verification or investigation;
• send, free of charge and on request, all information obtained or produced;
• keep nothing at the end of the contract and destroy the information in a secure manner.

A third person the supplier retains is subject to the same obligations, and the body must be notified. If information leaves Quebec, a privacy impact assessment comes before the contract (section 78). The body also conducts one for any acquisition, development or overhaul project (section 106). The Minister may by regulation reserve certain uses for certified products (section 92); the supplier of a certified product must keep it compliant throughout the term of the contract (section 94), on pain, for a company, of a fine of $15,000 to $150,000 (section 160).

What to do, in order

1. Know whether you are covered. The definition is broad: a name attached to a medical appointment is enough, and according to the guide de-identified information remains covered.
2. Reread the contract with section 77 beside it, then have the confidentiality agreements completed before the first access.
3. Map the path of the notice. An attempted violation is reported immediately to the body's person in charge, who has notices of their own to give.
4. Produce logs that can be used. Which information, who, when: that is what section 103 will require and what the body's monthly analysis already demands.
5. Prepare the assessment file. Flows outside Quebec, subcontractors, end of service: the body needs it for its assessment and its schedule of end-of-service dates.
6. Plan the exit. Return, secure destruction, and the proof of destruction the regulation requires the body to keep.

The next step

Take your most recent contract with a Quebec health body and tick the six obligations of section 77. Our Law 25 page describes the neighbouring general regime, which continues to govern other personal information.