up:: Doing the Work MOC
PQC for Canadian Health Systems
A Canadian hospital sits under provincial health privacy law rather than anything federal or American, and the American material that dominates this subject describes a statute that does not reach it. What does reach it is a reasonableness standard, a privacy commissioner who has been specific about encryption in a way the statute is not, and a federal post-quantum roadmap with hard years in it that applies to government departments rather than to hospitals.
This note is general education about Canadian health privacy and federal cyber guidance, not legal advice. Obligations under PHIPA and its provincial equivalents are determined with your own privacy office and counsel.
The short version:
- PHIPA requires reasonable steps to protect personal health information against theft, loss and unauthorized use, disclosure, copying, modification or disposal. It names no algorithm.
- ⭐ Ontario’s privacy commissioner has been more specific than the statute, including a fact sheet on the health-care requirement for strong encryption and orders requiring encryption of PHI on mobile devices.
- ⭐ Custodians stay responsible when a third party holds the data, which makes vendor cryptography a custodian problem rather than a vendor problem.
- ⭐ The federal roadmap carries the dates: high-priority systems by end 2031, remaining systems by end 2035. It binds Government of Canada departments rather than hospitals.
- Those dates still matter to you, because they are the schedule your suppliers are working to.
What does PHIPA actually require?
Reasonable steps, and the phrasing is deliberately outcome-shaped. A health information custodian must take steps that are reasonable in the circumstances to ensure that personal health information in its custody or control is protected against theft, loss, and unauthorized use, disclosure, copying, modification or disposal.
That standard names no cryptography, which is normal for privacy legislation and is why the commissioner’s guidance carries more practical weight than the statute here.
⭐ The IPC has been specific where the Act is not. Its guidance includes a fact sheet on the health-care requirement for strong encryption, and Orders HO-004 and HO-007 required that personal health information stored on mobile devices be strongly encrypted. Encryption is therefore an established expectation in this jurisdiction even though the statute never says the word in a control requirement.
Source: Information and Privacy Commissioner of Ontario, “Fact Sheet #16, Health-Care Requirement for Strong Encryption,” ipc.on.ca.
⚠️ The consequence for post-quantum is the one to sit with. An expectation of “strong encryption” set in guidance is a moving expectation. It was satisfied by one set of algorithms when those orders were written, and what satisfies it is a question about the current state of cryptography rather than about the text.
Why does third-party responsibility matter more here?
Because the commissioner has been explicit that it does not transfer. A custodian remains responsible for ensuring strong cybersecurity safeguards even when using third-party infrastructure and services, and is expected to conduct due diligence on providers’ protections against unauthorized access or disclosure.
⭐ For a hospital that is the entire post-quantum problem in one sentence, because almost none of the cryptography protecting patient data is in software the hospital wrote. The EPR is a vendor platform, the imaging archive is a vendor platform, the diagnostic devices are somebody’s product, and the responsibility for all of their cryptography is the custodian’s. The instrument is diligence and contract, which is what procurement language exists for.
Where are the dated milestones?
With the federal cyber authority, and they are specific:
| Milestone | What it requires |
|---|---|
| April 2026 | Federal departments produce an initial departmental PQC migration plan, and begin annual reporting on migration progress |
| End of 2031 | PQC migration of high-priority systems complete |
| End of 2035 | PQC migration of remaining systems complete |
Source: Canadian Centre for Cyber Security, “Roadmap for the migration to post-quantum cryptography for the Government of Canada (ITSM.40.001),” effective 23 June 2025, cyber.gc.ca.
⚠️ This is scoped to the Government of Canada. It does not bind a provincial hospital, and claiming otherwise is the kind of error a supplier will catch.
⭐ What it does is set your suppliers’ schedule. Vendors selling into Canadian federal buyers are working to 2031 and 2035, and their product roadmaps are where those dates reach a hospital. The UK’s NCSC published nearly identical years independently, which is useful corroboration that the ecosystem’s clock is real: see PQC for NHS Trusts.
Why does the shelf-life argument survive the jurisdiction change?
Because it is a fact about the data rather than the regulator. A pediatric record created this year describes someone alive in 2090, and the identifiers cannot be reissued. The vulnerability test reads the same in Ontario as it does anywhere.
What changes is pressure. A reasonableness standard gives a custodian more room and less external force to use it, which is why the dates in the federal roadmap and the expectations in the commissioner’s guidance are the two useful levers rather than the Act itself.
Where does the cryptography live?
| Surface | Typical zone | Note |
|---|---|---|
| The hospital information system and EPR | Zone 2 | Vendor platform, longest-lived data in the organization |
| Diagnostic imaging and PACS archives | Zone 1 and 2 | ⭐ The largest at-rest estate, holding the oldest cryptography |
| Medical devices and clinical equipment | Zone 3 | Decade-plus service lives. See PQC in Medical Devices |
| Provincial and regional data sharing | Zone 2 | Terms set by the province or the network |
| Third-party service providers | Zone 3 | ⭐ Custodian responsibility, provider control |
| Building and facilities systems | Zone 3 | Industrial lifecycles, rarely inventoried |
Common misconceptions
“HIPAA-style rules apply to us.” They do not. PHIPA and its provincial equivalents are the governing law, and the structure of the obligation is different.
“PHIPA doesn’t require encryption.” The statute requires reasonable steps, and the commissioner has repeatedly treated strong encryption as one of them, including in binding orders. Reading the Act alone understates the expectation.
“Our vendor is responsible for their own security.” The commissioner’s position is that the custodian remains responsible, including when a third party runs the infrastructure.
“The 2031 and 2035 dates are ours.” They belong to federal departments. They are your suppliers’ dates, which is a different and still useful thing.
Questions people ask
What is the first artifact to produce? A cryptographic inventory of the EPR and the imaging archive, which is also the evidence a due-diligence conversation with a provider needs.
How do we handle provider due diligence on this? As an extension of the diligence already expected of custodians, using the vendor-claims checklist rather than a separate process.
Does anything differ outside Ontario? The statute differs by province and the structure does not: reasonable safeguards, a provincial commissioner, and guidance carrying the specifics. The federal roadmap is national.
Is our position better or worse than a US hospital’s? Better on supplier visibility, worse on internal pressure. You have national dates to plan against and no rule compelling you to act on them.
What about federally regulated organizations? An organization inside federal jurisdiction has PIPEDA obligations alongside provincial health law, and the roadmap above may reach it directly rather than through suppliers.
Everything here is the map, given freely. When a hospital needs its estate inventoried and its provider diligence brought up to what a custodian is actually responsible for, that’s the work I do.
Last verified 2026-09-07 · Updated 2026-09-07 · Maintained by Addie LaMarr, LaMarr Labs.