Patient data in a system without a PHIPA Business Associate equivalent
Canadian private practices collecting patient health information through general-purpose tools — Google Forms for intake, Mailchimp for appointment reminders, Dropbox for file sharing — are using platforms that have not signed a PHIPA-equivalent data agreement and do not meet the access, storage, and audit requirements that apply to personal health information. Health information in Canada includes not just diagnosis and treatment records but also appointment history, the fact that a patient has attended a specific type of clinic, and any health history collected through intake forms. Under PHIPA and equivalent provincial legislation, health information custodians (which include private health practitioners) must ensure that any third-party platform processing patient health information on their behalf has appropriate contractual protections in place — equivalent to the Business Associate Agreement required under HIPAA in the United States. Google, Mailchimp, and Dropbox provide Business Associate Agreements under HIPAA for US clients, but do not provide PHIPA-equivalent agreements for Canadian health information custodians in most cases. Ignited Nepal assesses the practice's current tool stack against PHIPA requirements and reconfigures patient communication workflows to use PHIPA-compliant platforms — primarily Jane App and Cliniko, which are built for Canadian healthcare and designed for PHIPA compliance — for all processes that handle patient health information.