This guide is a general summary and is not intended as legal advice. For guidance specific to your practice, consult a legal professional or your regulatory body.
Is Jane PIPEDA compliant?
Yes, Jane is compliant with the Personal Information Protection and Electronic Documents Act (PIPEDA).
Does PIPEDA apply to my clinic?
The Personal Information Protection and Electronic Documents Act (PIPEDA) is the primary privacy law in Canada. It applies to private-sector organizations across Canada that collect, use, or disclose personal information in the course of commercial activity (for example, conducting business activities within your clinic!).
In some cases, clinics will directly apply these federal laws, but you may need to check out the provincial level laws which apply to you as well. Some provinces, such as Ontario, Alberta, and British Columbia, have their own health privacy legislation. Quebec clinics should also be aware of Law 25.
Not sure which laws apply to you? The Office of the Privacy Commissioner (OPC) has guidance on how federal and provincial laws interact, and we'd always recommend checking with your provincial regulatory body or a privacy professional if you're unsure.
As an aside, for clinics in Quebec subject to the Regulation on Medical Records, Places of Practice, and Cessation of Practice by Physicians, effective Jan 1, 2027, Quebec physicians must use an EMR certified by Santé Québec. After careful review, Jane will not be pursuing certification as it is incompatible with how frequently Jane is updated and improved.
What are my responsibilities under PIPEDA?
Under PIPEDA, "personal information" is described as any factual or subjective information, recorded or not, about an identifiable individual. Essentially, it means any detail that can be used (alone or combined with other details) to identify a specific person.
This includes information in any form, such as:
- Age, name, ID numbers, income, ethnic origin, or blood type
- Opinions, evaluations, comments, social status, or disciplinary actions
- Employee files, credit records, loan records, medical records, existence of a dispute between a consumer and a merchant, and intentions (for example, to acquire goods or services, or change jobs)
PIPEDA's 10 fair information principles govern how personal information is collected, used, and disclosed, and individuals' rights to access that information. Here's how Jane can help your clinic comply with each one.
1. Accountability
PIPEDA Fair Information Principle 1 – Accountability
"An organization is responsible for personal information under its control. It must appoint someone to be accountable for its compliance with these fair information principles."
To comply with the accountability principle, the person appointed to be responsible for your clinic's privacy compliance should likely also be the Account Owner in Jane. To learn more about Account Ownership, check out our Terms of Use or this guide on the topic.
As well, each staff member should have their own profile account to minimize shared access and reduce data entry errors. The Account Owner can manage what each staff member can access using Jane's Staff Access Levels feature.
2. Identifying Purposes
PIPEDA Fair Information Principle 2 – Identifying Purposes
"The purposes for which the personal information is being collected must be identified by the organization before or at the time of collection."
How can Jane help? Using features available in Jane (such as intake form customizations) can help you to outline your purpose for collecting personal information at the time of collection.
3. Consent
PIPEDA Fair Information Principle 3 – Consent
"The knowledge and consent of the individual are required for the collection, use, or disclosure of personal information, except where inappropriate."
How can Jane help? You can create and customize your own consents using Jane's Intake Forms feature to support your PIPEDA compliance.
4. Limiting Collection
PIPEDA Fair Information Principle 4 – Limiting Collection
"The collection of personal information must be limited to that which is needed for the purposes identified by the organization. Information must be collected by fair and lawful means."
This means collecting only the information required for the stated purpose. For example, if a patient is visiting your clinic for treatment, PIPEDA requires that you collect information only for the purposes of that treatment and not more than would be reasonable for that purpose.
How can Jane help? Jane's Intake Forms feature lets you control exactly which pieces of personal information (i.e. profile fields) you collect from patients. You can customize the Profile Fields tab in your intake forms to collect only the information relevant to your practice.
5. Limiting Use, Disclosure, and Retention
PIPEDA Fair Information Principle 5 – Limiting Use, Disclosure, and Retention
"Unless the individual consents otherwise or it is required by law, personal information can only be used or disclosed for the purposes for which it was collected. Personal information must only be kept as long as required to serve those purposes."
This principle refers to limiting how you reasonably and compliantly use, disclose, and retain client personal information, which mostly comes down to your day-to-day practices.
How can Jane help? Jane allows you to utilize settings and features like staff access levels, chart privacy settings, the Patient Data Retention Report, deletion features, and more to manage this principle.
6. Accuracy
PIPEDA Fair Information Principle 6 – Accuracy
"Personal information must be as accurate, complete, and up-to-date as possible in order to properly satisfy the purposes for which it is to be used."
Part of storing and processing personal information responsibly and ensuring the information is truly useful means making sure that the information is, and remains, accurate. In a clinical context, this means the information collected and stored about clients should reflect them accurately and as wholly as necessary to provide sound care.
How can Jane help? Clinics can validate client information is accurate, complete, and up-to-date using features in Jane like periodic Intake Forms. Patients can also log into their accounts to update their information in a self-serve capacity. As well, we have settings in place behind the scenes to ensure that the correct format of information is entered (for example, that a real date is entered into the date of birth field).
7. Safeguards
PIPEDA Fair Information Principle 7 – Safeguards
"Personal information must be protected by appropriate security relative to the sensitivity of the information."
This means that information should be protected by security features, settings, and practices that are reasonable for how sensitive the information is, keeping in mind that the most sensitive information (like health data) should receive the strongest protections.
How can Jane help? We've implemented a number of security and privacy processes to keep your data secure within Jane. You can check out our Security and Trust page to learn more about the options available in Jane, which can complement data safety practices you implement at the clinic-level.
8. Openness
PIPEDA Fair Information Principle 8 – Openness
"An organization must make detailed information about its policies and practices relating to the management of personal information publicly and readily available."
Personal information is often much more than just personal. It can be very sensitive. People like to know how the information they share with others is being protected, and this transparency is a key piece of safety and legal compliance.
How can Jane help? You can use Jane's Intake Forms feature to customize your own consents by adding a policy template, supporting your clinic's openness obligations. You may also wish to post related information (such as your privacy policy) on your online booking site.
9. Individual Access
PIPEDA Fair Information Principle 9 – Individual Access
"Upon request, an individual must be informed of the existence, use, and disclosure of their personal information and be given access to that information. An individual shall be able to challenge the accuracy and completeness of the information and have it amended as appropriate."
Similarly with the openness principle, clients have a right to know what information you hold on them, how it's being used, and so forth. They should also be able to inform if information is inaccurate and incomplete so that it can be corrected! People also have the right to know what information a business holds about them and how it's being used, as well as be able to access it and correct it. Note that, with health data, there is some nuance to providing a client with access to all of their information, so be sure to check with your regulatory body if you have questions.
How can Jane help? When a patient requests their personal information, you can export chart data at any time from within Jane, or use the shared chart feature to give patients direct access to their chart entries.
10. Challenging Compliance
PIPEDA Fair Information Principle 10 – Challenging Compliance
"An individual shall be able to challenge an organization's compliance with the above principles. Their challenge should be addressed to the person accountable for the organization's compliance with PIPEDA, usually their Chief Privacy Officer."
Each clinic needs to appoint an internal privacy official to monitor PIPEDA compliance and respond to complaints and inquiries.
How can Jane help? While clinics would be responsible for responding to client inquiries about the personal information held by the clinic, you can reach out to Jane's Privacy Team at [email protected] for questions about Jane's own privacy compliance.
Have questions about this guide or anything else related to privacy? Email Privacy and Security Support at [email protected].