If your clinic did its Law 25 homework (a privacy policy, a named privacy officer, an incident register), part of that work covers data that no longer falls under Law 25. Since July 1, 2024, patient files have been governed by the Act respecting health and social services information, known in French as the LRSSS. Its most visible requirements often land on your website, your booking tool and your vendors, which is the ground our web subscriptions cover.
People call it "Law 5" because it is chapter 5 of Quebec's 2023 statutes: it was introduced as Bill 3 and assented to on April 4, 2023. This article is written for the person who runs the clinic, not for the practitioner.
The short answer, for the busy
Quebec's Act respecting health and social services information (the LRSSS, or Law 5), in force since July 1, 2024, applies to anyone operating a "private health facility": a business where physicians, dentists or other professionals practise privately, without providing lodging or specialized medical treatments. For those clinics, patients' health information leaves Law 25, which still governs everything else, such as employee files or a newsletter list. The new obligations are mostly managerial: a privacy officer chosen from inside the clinic and reported to the Minister and the Commission d'accès à l'information, a governance policy published on the website, a public register of the software the clinic uses, annual staff training, vendor contracts that must contain specific clauses or be null, and a privacy impact assessment before any new tool or any hosting outside Quebec. A clinic where nobody belongs to a professional order sits in a grey zone.
Is your clinic covered?
Section 4 of the Act lists the "bodies in the health and social services sector", and Schedule II adds eleven categories of private businesses. The first covers most clinics: the "private health facility". The Act respecting the governance of the health and social services system (s. 481) defines it as an enterprise in which one or more physicians, dentists or other professionals regularly practise their profession privately and solely on their own account, without providing lodging or specialized medical treatments.
The Ministry's reference guide gives a psychologist's office and a community pharmacy as examples, the Collège des médecins gives a physicians' office, and the physiotherapy order writes that "the very large majority" of its members' workplaces are affected. A clinic delivering services on behalf of Santé Québec is covered for those activities (s. 4(4)). And a professional who keeps their own files inside a clinic is itself treated as a body (s. 4, third paragraph).
Two situations remain unclear.
Nobody belongs to a professional order. The Act does not define "other professionals". Quebec's Professional Code defines a "professional" as a permit holder entered on an order's roll, and massage therapy and naturopathy have no order in Quebec. We found no official position on this case. By default, Law 25 remains your baseline, and a legal opinion settles the rest.
A company employs the professionals. The definition targets professionals practising "solely on their own account". The official examples cited above do not settle this case, and the definition describes the independent practice first. A chain or a management company should have its status confirmed.
Two laws, one filing cabinet
Section 3 of Law 25 (the Act respecting the protection of personal information in the private sector) excludes health information held by a body within the meaning of the LRSSS, or by a third party on its behalf. The Commission d'accès à l'information confirms that Law 25 still governs these bodies' other personal information.
The LRSSS reaches further than people expect. Under section 2, a name or contact details become health information as soon as they are attached to information about someone's health or the services they receive, or collected so the person can be taken into care. Your online booking form therefore collects health information even if it only asks for a name, a phone number and a reason for the visit. Information collected for human resources management, on the other hand, is excluded. Employee files, job applications and a newsletter list open to the public all stay under Law 25, which we have summarized here.
What changes for management
The privacy officer. By default it is the person exercising the highest authority (s. 100), but delegation is narrower than under Law 25: in writing, to a director or a senior manager, failing which to a staff member or a professional practising in the clinic. Law 25 allows delegation "to any person" (s. 3.1), including an outside consultant; the LRSSS makes no such provision. The officer's title and contact details go to the Minister and the Commission, then onto the website (s. 102).
The governance policy. Section 105 sets its minimum content: roles, categories of people allowed to use the information, security measures, a schedule for updating software, incident and complaint handling, training. It is published on the website. The Act gave six months to adopt it, a deadline that passed in January 2025.
Training. Every staff member and every professional receives training recognized by the Minister when they start, then updates it every year (Regulation respecting governance, ss. 1 and 2). Front-desk staff, who are not members of an order, also need an access authorization and a written confidentiality undertaking (application regulation, s. 8).
What the rules spare you. No governance committee, and an annual rather than monthly review of access to files (Regulation respecting governance, ss. 7 and 8).
Your vendors, clause by clause
A clinic often entrusts its information to several pieces of software: the electronic medical record, booking, text-message reminders, billing.
Section 77 requires a written contract with every vendor that receives information, and dictates its content "on pain of nullity". Among other things, the vendor must send you, before any information is communicated, a confidentiality undertaking signed by every person who will have access. It must also notify your privacy officer of any breach without delay, accept your audits, disclose its subcontractors and destroy the information when the contract ends. Nothing guarantees that a vendor's standard terms, written for every market, contain these clauses: check them one by one.
If the information leaves Quebec, even just for hosting, section 78 requires a privacy impact assessment showing adequate protection before you sign. Section 106 also requires one for any acquisition or overhaul of a technology product. The format is close to the one in our privacy impact assessment guide for Quebec businesses.
Finally, section 107 requires a public register of every technology product in use: type, description and purposes, vendor, and a note if it makes decisions based exclusively on automated processing (application regulation, s. 10). Your website will list your software in plain view.
The clinic website, line by line
The booking form. Section 14 requires you to tell people, at collection, the name of the body, the purposes, the means, their rights of access and rectification, the retention period, and their ability to restrict or refuse access to their information. That last right is specific to the LRSSS (ss. 7 and 8), and a notice copied from a Law 25 template leaves it out. Our piece on online booking covers the rest of the module.
Advertising pixels. Under section 2, information that identifies a person and concerns the services they receive, including where and from whom, is health information. A booking is exactly that. A social media pixel on the confirmation page risks passing it to a platform without the express consent section 5 requires. Keep pixels off booking flows.
Patient requests. The privacy officer answers within 30 days (s. 34), and access is free (s. 66). Patients also have the right to know who consulted or received their information, and when (s. 18). Until access logging (s. 103) comes into force, that right is exercised by consulting a register in which the clinic records every communication to a third party: the nature of the information, the recipient, and the purpose and justification (s. 265).
Incidents, retention and fines
An incident that presents a risk of serious injury is reported to the Minister and to the Commission (s. 108), not to the Commission alone as under Law 25. The incident register is kept for at least five years (application regulation, s. 16).
How long files are kept follows your order's rules, which section 16 preserves. When that period ends, section 111 requires destruction or anonymization under the criteria explained in our article on anonymization, and the clinic keeps proof of each destruction.
The fines are smaller than under Law 25 (up to $25 million or 4% of worldwide turnover). For a company they range from $3,000 to $30,000 or from $15,000 to $150,000 depending on the offence, doubled from the first repeat offence (ss. 159 to 161), with no administrative monetary penalties. But holding information without meeting the governance obligations described above falls into the heavier category (s. 160), and each day counts as a separate offence (s. 163).
Where to start
Four steps, in order: confirm your clinic is covered, name and report the privacy officer, list your software and where each one is hosted, then go through the contracts one by one. The public side (policy, register, booking form, pixels) is handled on your website, work we do in our web subscriptions. To find out where your clinic stands, write to us: the first conversation costs nothing.
This article explains a legal framework to help a clinic ask the right questions; it is not legal advice. Whether a given clinic is covered depends on its structure and its professionals. The official texts published on LégisQuébec prevail: for a specific situation, consult a lawyer or your professional order.
Written byXavier Peich