PHIPA vs HIPAA: Key Differences for Healthcare Compliance

What does PHIPA stand for?

PHIPA stands for the Personal Health Information Protection Act, 2004 and it is the law that governs patient health information in Ontario, Canada. It came into force in 2004 and is overseen by the Information and Privacy Commissioner of Ontario, an independent regulator that investigates complaints and breaches.

PHIPA sets the rules for how healthcare organizations collect, use, store, and share what it calls personal health information (PHI): anything that identifies a patient and relates to their health, such as medical records, test results, and prescriptions.

HIPAAとは何ですか？

HIPAA stands for the Health Insurance Portability and Accountability Act, the United States federal law that protects patient health information. It was passed in 1996, and in the US the same kind of data is called protected health information, which also shortens to PHI.

HIPAA is built on a few core rules: a Privacy Rule limiting how health data is used and shared, a Security Rule requiring safeguards for electronic records, and a Breach Notification Rule covering what happens when data is exposed. For the full picture, see our explainer on what HIPAA is and our walkthrough of the three rules of HIPAA.

Does HIPAA apply in Canada?

No, HIPAA does not apply in Canada. HIPAA is a US federal law and has no legal force north of the border. This trips people up all the time: a Canadian clinic asks for a "HIPAA-compliant" fax service when what it actually needs is one that meets Canadian privacy law. For Ontario healthcare, that law is PHIPA.

What is the Canadian equivalent of HIPAA?

There is no single Canadian equivalent of HIPAA. Health privacy in Canada is handled province by province, so Ontario has PHIPA, while a separate national law called PIPEDA covers private-sector personal data more broadly. For an Ontario healthcare provider, PHIPA is the one that applies to patient records.

That is also the short answer to a related question, PHIPA vs PIPEDA: PHIPA is the specific health privacy law for Ontario, and PIPEDA is the general federal privacy law. PHI under PHIPA is also narrower and more specific than personal information under PIPEDA, because it relates directly to a person's health and care. When health information is involved in Ontario, PHIPA leads.

What are the key differences between PHIPA and HIPAA?

The biggest differences between PHIPA and HIPAA come down to jurisdiction and the names each law gives to the same roles. Both aim to keep patient data private and both require strong security, consent, and breach reporting, but the details diverge in ways that matter for a vendor.

‍

The structures mirror each other almost role for role. PHIPA calls the healthcare organization a Health Information Custodian; HIPAA calls it a covered entity. PHIPA calls a vendor that handles data on the provider's behalf an agent; HIPAA calls it a business associate. In both systems the healthcare provider carries the core legal duty, and the vendor handles data only under a written agreement.

How do PHIPA and HIPAA differ on breach notification?

The timing is the biggest practical difference. Under HIPAA, a covered entity generally has up to 60 days to notify, and breaches affecting 500 or more records get reported to the federal regulator. PHIPA is faster and broader: a custodian must notify the affected patient and the Information and Privacy Commissioner of Ontario right away once a reportable breach trigger applies, and there is no minimum record count. PHIPA also adds a step HIPAA does not: custodians file an annual report to the IPC counting the reportable breaches from the previous calendar year, due by March 1.

For a fax provider, this shapes how incident response has to work. A service built only around the HIPAA 60-day clock would be too slow for Ontario. The provider needs to flag a qualifying incident and get the details to the custodian immediately, so the custodian can meet the faster PHIPA deadline.

How do PHIPA and HIPAA handle patient consent?

PHIPA and HIPAA both let health information flow for treatment without a separate signed form each time. Under PHIPA, an Ontario provider can rely on implied consent within the circle of care, meaning the practitioners directly involved in treating a patient, as long as a set of conditions is met. HIPAA works on a similar principle, allowing information to move for treatment, payment, and healthcare operations without separate authorization. Both laws require explicit consent once you go beyond those core purposes, like marketing.

For a fax provider, the practical point is the same under both laws: managing consent is the healthcare provider's job, not the vendor's. A fax service moves the document; it never decides whether consent exists.

What does PHIPA or HIPAA require for faxing patient records?

To fax patient records under PHIPA or HIPAA, the service has to do more than just send a document. Fax stays common in healthcare because it creates a clear point-to-point record between two known parties, but an ordinary fax tool will not satisfy either law. A compliant service needs encryption of data in transit and at rest, access controls like unique logins and two-factor authentication, audit logs that record who sent or opened each document, secure deletion that prevents recovery, and a written agreement that puts the vendor's obligations on paper.

The same logic applies when patient forms need to be signed electronically. If a clinic collects intake forms, consent forms, referral paperwork, or other patient-related documents through an e-signature platform, that service also needs the right safeguards and written agreement in place. For Ontario healthcare providers, that means using a PHIPA-ready service provider setup; for US healthcare providers, it means using a HIPAA-ready vendor with a signed BAA.

That written agreement is the dividing line. Without a PHIPA Service Provider Agreement  or a HIPAA BAA, a fax tool cannot be used for patient data, no matter how strong the technology is. The signed agreement is what makes the vendor formally accountable.

Is there a PHIPA certification or registry?

No, PHIPA does not run a central certification or registration program. Compliance is something an organization demonstrates rather than a badge it picks up from a registry. The custodian and its vendors keep their policies, safeguards, consent procedures, and breach records on file, and produce them if a customer or the Commissioner asks. This is why a careful vendor will say it is PHIPA compliant and can show its controls, rather than pointing to an official PHIPA seal that does not exist.

Can one fax service be both PHIPA and HIPAA compliant?

Yes, a single healthcare document platform can support both PHIPA and HIPAA workflows, and Fax.Plus and Sign.Plus do. Fax.Plus supports compliant online faxing for patient records, while Sign.Plus supports secure electronic signatures for healthcare forms, consent documents, referrals, and administrative paperwork.

Both services are PHIPA compliant for Ontario healthcare providers and HIPAA compliant for US healthcare organizations, and both provide the written agreement each law requires: a PHIPA Service Provider Agreement for Ontario providers and a signed Business Associate Agreement for US organizations. Ontario custodians can also choose a Canadian processing region for their tenant, enforced through technical region-pinning and the custodian agreement.

Under the hood, both services protect documents with encryption in transit and at rest, unique user access, role-based permissions, two-factor authentication, and audit logs for document activity. They run under independently audited ISO 27001 and SOC 2 Type II programs, with Swiss data residency and more than 20 residency locations available. Those certifications are independent inspections of how the services protect data, which is exactly what both PHIPA and HIPAA expect behind the legal wording.

You can read more about whether Fax.Plus is safe, explore the healthcare fax solution, see how HIPAA-compliant faxing works, or check the HIPAA-compliant fax API if you are building faxing into an existing system.