PIPEDA vs HIPAA: What Canadian Clinics with US Patients Need to Know

Canadian dental clinics treat US patients more often than many owners realise. Snowbirds wintering in British Columbia or Ontario, cross-border workers in border cities, and American tourists needing emergency care all end up in Canadian chairs. When that happens, a practical question arises: does American health-privacy law (HIPAA) follow the patient across the border?

For most Canadian dental practices, the answer is no. PIPEDA, Canada's federal private-sector privacy law, governs the patient data you collect regardless of the patient's citizenship. But understanding exactly why HIPAA typically does not apply, where it might, and how your PIPEDA obligations already address the gap is worth working through clearly.

What Is PIPEDA?

The Personal Information Protection and Electronic Documents Act (PIPEDA) is Canada's federal private-sector privacy law. It applies to organisations that collect, use, or disclose personal information in the course of a commercial activity, which includes virtually every private dental practice in the country.

PIPEDA is built around 10 fair information principles: Accountability, Identifying Purposes, Consent, Limiting Collection, Limiting Use and Disclosure and Retention, Accuracy, Safeguards, Openness, Individual Access, and Challenging Compliance. Each principle carries specific obligations for how your clinic handles patient data, from the moment you record a patient's name and date of birth to the day you destroy outdated records.

Three provinces (Alberta, British Columbia, and Quebec) have enacted their own substantially similar private-sector privacy laws. Dental clinics in those provinces may be governed by provincial legislation for in-province data handling, though PIPEDA still applies whenever patient data crosses provincial or national borders, including when cloud-based practice software is hosted in another province.

What Is HIPAA?

The Health Insurance Portability and Accountability Act is the United States' primary health-privacy law. The US Department of Health and Human Services (HHS) enforces it through its Office for Civil Rights and applies it to three categories of covered entities.

Beyond covered entities, HIPAA regulates business associates: third-party companies engaged to perform functions that involve patient health information on behalf of a covered entity. Business associates must sign written Business Associate Agreements (BAAs) and face direct HIPAA liability. Protected Health Information (PHI) under HIPAA is individually identifiable health information held in any form, including 18 specific Safe Harbor identifiers such as names, addresses, dates (other than year), phone numbers, email addresses, and medical record numbers.

Does HIPAA Apply to Canadian Dental Clinics Treating US Patients?

For most Canadian practices, HIPAA does not apply. Here is why.

HIPAA coverage depends on whether a dental clinic is a "covered entity" under US law. The key trigger for health care providers is the electronic transmission of health information for standard HIPAA transactions, the most common of which is submitting a claim to a US health plan. A Canadian dental clinic that accepts payment directly from US patients (cash, credit card, or reimbursement arranged privately by the patient) is not submitting claims to US insurers electronically. Without that electronic transaction, the clinic is not a covered entity and HIPAA does not apply to it.

There is one edge case worth noting. If a Canadian clinic were to bill a US health plan directly on behalf of a US patient, that electronic transaction could bring HIPAA coverage into scope. This arrangement is uncommon but not impossible. If your practice does submit claims to US insurers electronically, consult a legal adviser with cross-border health-law experience before treating that data as PIPEDA-only.

Key Differences at a Glance

Even where HIPAA does not directly apply to a Canadian clinic, understanding the differences helps you respond confidently when US patients (or their insurers) ask about how their data is handled.

One structural difference worth understanding: PIPEDA's consent model places more control in the patient's hands. Patients must provide express consent for the collection of their health data and can withdraw that consent at any time, subject to legal or contractual restrictions. HIPAA, by contrast, permits a broad range of treatment-related disclosures without individual authorisation, instead placing obligations on covered entities to limit disclosures to the minimum necessary.

Practical Scenarios for Canadian Clinics

Scenario 1: US Snowbird Receiving Routine Care

A Florida resident spends winter in Victoria, BC, and books a cleaning and exam. You collect their name, date of birth, health history, and credit card. You do not bill any US insurer. PIPEDA governs this data. You must obtain meaningful consent for collecting their health information, apply safeguards appropriate to the sensitivity of the data, and notify the OPC and the patient if a breach creates a real risk of significant harm. No HIPAA obligation applies.

Scenario 2: Cross-Border Worker Near Windsor or Niagara

A US resident who works in Canada visits your Niagara Falls clinic. Same principles apply: Canadian law governs the data, and direct payment at the chair keeps your clinic outside HIPAA's scope. If the patient later asks you to forward records to a US dentist, you must obtain the patient's consent before releasing the information and confirm the recipient's identity, exactly as you would for any records transfer.

Scenario 3: Dental Tourism and Coordination of Benefits

Some patients travel to Canada specifically for lower-cost dental work and intend to seek reimbursement from their US employer's health plan afterward. In this arrangement, the patient is seeking reimbursement directly from their insurer. You provide records to the patient, who submits them. You are not submitting claims to a US plan electronically. HIPAA still does not apply to your clinic. If a US insurer contacts you directly requesting records without patient authorisation, decline and request the patient provide written consent first.

5 Steps to Protect US Patient Data Under PIPEDA

Whether your patient is Canadian or American, the same PIPEDA obligations apply. These five steps cover the areas most relevant when treating US patients.

What US Patients May Ask About and How to Respond

Some US patients arrive expecting HIPAA-level familiarity. Their home providers use HIPAA notice of privacy practices forms, and they may ask where yours is or whether you comply with HIPAA. A clear, confident response builds trust without creating legal confusion.

Frequently Asked Questions

Is HIPAA enforceable in Canada?

HIPAA is US federal legislation enforced by the HHS Office for Civil Rights. It has no direct legal force in Canada. Canadian dental clinics are not subject to HHS jurisdiction unless they are a US-covered entity, which most independent Canadian practices are not.

Do Canadian software providers need a Business Associate Agreement?

BAAs are a HIPAA requirement for US-covered entities engaging third-party service providers that handle PHI. If your Canadian clinic is not a HIPAA-covered entity, you are not required to execute BAAs with your software providers under US law. However, your software contracts should still include data-handling and confidentiality obligations to satisfy PIPEDA's safeguards and accountability principles. Some Canadian software vendors offer BAAs for their US-based clients but are not required to offer them to Canadian-only clients.

What if our clinic is owned by a US dental group?

Corporate dental groups operating across the US-Canada border may have internal HIPAA compliance programmes that extend to Canadian locations. Whether US law actually applies to a Canadian subsidiary depends on the specific corporate structure, data flows, and whether the Canadian entity is independently incorporated. If you are part of a US-owned dental group, your corporate compliance team and outside legal counsel should advise on your specific obligations.

Is PIPEDA as protective as HIPAA for health data?

Both laws require meaningful protections for health information, but they approach consent differently. PIPEDA requires express consent for collecting health data, giving Canadian patients more explicit control over collection at the outset. HIPAA permits a broader range of treatment-related disclosures without individual authorisation, but imposes strict technical safeguards and formal business-associate contracting requirements. Neither is unambiguously more protective; they reflect different regulatory philosophies. Canadian patients benefit from strong federal and in some provinces additional provincial privacy rights.

Can I send patient records to a US dental provider?

Yes, with the patient's written consent. Under PIPEDA, you must identify the purpose of any disclosure and obtain consent before releasing personal information to a third party, including a foreign dental provider. Retain a copy of the consent and a record of what was sent, to whom, and on what date.