Which Privacy Law Applies to a Private-Practice Dietitian in Canada?

Does PIPEDA apply to a private-practice dietitian?

Sometimes, and less often than people assume — but more often than the usual summary suggests. The common shorthand is that provincial health privacy law displaces PIPEDA. That is true in Ontario, where PIPEDA is displaced for PHIPA custodians by federal order. It is not true in Saskatchewan or Manitoba: neither the Health Information Protection Act nor the Personal Health Information Act has ever been declared substantially similar, and there is no exemption order, so PIPEDA applies concurrently with the provincial statute.

Breach obligations vary just as much — Saskatchewan does not require reporting to its Commissioner, and British Columbia has no mandatory private-sector breach notification whatsoever.

That means a Saskatchewan or Manitoba practice is answering to two regimes at once rather than choosing between them. It is the opposite of what most secondary writing implies.

Am I a health information custodian?

It depends on how your province drafted the definition, and the three drafting styles produce genuinely different answers. Ontario's PHIPA captures a private-practice dietitian through the "health care practitioner" limb. New Brunswick's definition is open-ended — it says "and includes", so it captures rather than enumerates. Manitoba uses a short functional class test, and a dietitian qualifies through the health-professional class.

Saskatchewan enumerates categories of trustee rather than professions, and reaches practitioners through one of them: a health professional licensed or registered under an Act for which the Minister of Health is responsible. Its College states affirmatively that a dietitian in private practice is the trustee of the record, which is that provision applied rather than a claim in tension with it. Saskatchewan also carves out employees — the definition reaches "a person, other than an employee of a trustee", so an RD employed by a trustee is not personally a trustee, the employer is. Manitoba's definition has no equivalent carve-out.

Whoever the statute makes responsible then has to keep those records for a period that also differs by province — how long those records have to be kept.

One qualifier applies everywhere: custodian status is a legal test, not a job title. An RD acting as an agent of another custodian — hospital-employed, for instance — is generally not a custodian in their own right, whatever their province says about private practice.

Do I have to report a privacy breach?

Not in every province, and the exceptions are not the ones people expect. British Columbia's PIPA contains no mandatory breach-notification provision for the private sector — reporting to the Office of the Information and Privacy Commissioner is discretionary. Saskatchewan is the other outlier: reporting to the Saskatchewan Information and Privacy Commissioner is not mandatory under HIPA, which makes it the exception among provinces that have a health-information statute at all.

Where notification is mandatory the triggers differ. Alberta's Health Information Act requires a custodian to notify three parties — the Commissioner, the Minister, and the affected individual — where there is a risk of harm. That is a lower threshold than Alberta PIPA's "real risk of significant harm", so the 2026 designation changed the standard as well as the statute. Manitoba requires notice to the individual on a real-risk-of-significant-harm test, and where that is triggered the Ombudsman must be notified too; failing to notify is an enumerated offence.

Alberta also carries an express carve-out worth knowing: where giving notice could reasonably be expected to result in a risk of harm to the individual's mental or physical health, the custodian may decide not to notify them — but must immediately notify the Commissioner of that decision.

What is unresolved in Quebec?

Whether Law 25 or the health-sector regime governs a private-practice dietitian. Law 25 (P-39.1) excludes health and social services information held by a health and social services body, and that phrase is defined by the Act respecting health and social services information, chapter R-22.1, partly by a schedule that captures anyone operating a cabinet privé de professionnel within the meaning of the health system governance legislation. Whether a dietetic practice is such an office is not defined anywhere, so whether the exclusion reaches it is not settled in primary sources.

See the unresolved Quebec position, in context alongside the rest of what a Quebec practice must do differently.

Two further situations pull a practice out of Law 25 regardless of how that question resolves: providing services under an agreement on behalf of a listed body, and practising inside such a body that does not itself keep the records. This matters practically, because the two regimes impose different machinery. A Quebec practice should take advice on which applies rather than assuming, and should not rely on a page — including this one — to pick.