Guides
What Does PIPEDA Require from Medical Couriers Handling Specimens?
PIPEDA medical courier requirements cover all specimen couriers, while Ontario PHIPA and Alberta HIA add provincial duties. Here is what each law demands.
What to take away
- PIPEDA governs commercial handling of personal information, including health information, where no provincial health law applies. Ontario's PHIPA and Alberta's HIA replace it for health data in those provinces.
- A courier is usually a service provider or agent, not the custodian of the record. That role decides who answers a privacy complaint.
- Your service agreement must name safeguards, breach notice timelines, subcontractor limits and return or destruction of records.
- Skipping the agreement does not just look bad. The custodian can be reported to the Information and Privacy Commissioner, and your contract can be terminated mid-run.
A Toronto courier carrying a biopsy from a clinic to a lab touches three rulebooks at once. The federal Personal Information Protection and Electronic Documents Act sets the floor. Ontario's Personal Health Information Protection Act sits on top for health records. The hospital's own procurement policy sits on top of both.
Who has jurisdiction over specimen data
The Office of the Privacy Commissioner of Canada enforces PIPEDA for organisations in provinces without substantially similar health privacy law. British Columbia, Alberta, Ontario, Quebec, Nova Scotia and New Brunswick have their own health statutes. In those provinces the provincial commissioner leads on health information.
That split matters when a courier runs between provinces. A Calgary pickup falls under the Health Information Act. The same shipment crossing into Saskatchewan is back under PIPEDA for the portion handled there. Couriers who only read HIPAA material online miss this entirely, because HIPAA is a US statute with no force in Canada.
What triggers a privacy obligation
The trigger is not a signed contract. It is possession or control of identifiable health information in the course of commercial activity. A driver who can see a patient name, a health card number or a requisition form is handling personal health information.
Three events usually force paperwork:
- A hospital or lab adds you as an approved transport vendor.
- A clinic asks you to hold specimens overnight before a morning run.
- You subcontract a rural leg to another carrier.
Each event changes who is accountable. The custodian remains accountable to the patient even after the courier takes the bag.
What goes into a service agreement
Ontario's PHIPA requires a written agreement when a health information custodian shares records with an agent. Alberta's HIA uses the term affiliate and information manager, with similar effect. The agreement is not a formality. Inspectors ask for it.
- Named scope: which specimens, which routes, which hours.
- Safeguards: locked vehicles, sealed bags, driver screening, device encryption.
- Breach notice: how fast you tell the custodian, and in what form.
- Subcontractors: who may be used, and only with prior written consent.
- End of contract: return or secure destruction, with a certificate.
| Item | PIPEDA | Ontario PHIPA | Alberta HIA |
|---|---|---|---|
| Lead regulator | Federal Commissioner | IPC Ontario | OIPC Alberta |
| Written agreement | Required in practice | Required by statute | Required by statute |
| Breach notice | Report to Commissioner, notify individuals on real risk of significant harm | Notify custodian without delay | Notify affected individual |
| Retention | Only as long as needed | Custodian sets period | Designated retention period |
A courier that signs nothing still owes a duty of care. The missing paper only removes the courier's ability to prove what was agreed.
Example: a Toronto to Hamilton run
A Toronto lab courier picks up 40 requisitions at a downtown clinic and drives to Hamilton. The clinic is the custodian. The courier is the agent. Under PHIPA the clinic must have a written agreement with the courier covering safeguards and breach notice.
If a bag is left in an unlocked car and stolen, the courier notifies the clinic immediately. The clinic then assesses whether to notify patients and the IPC. The courier does not decide that alone. The courier's exposure is contractual and reputational, plus whatever the agreement says about penalties.
A Calgary version of the same run works through the HIA. The lab is the custodian, the courier is an information manager, and the agreement must say what happens to the manifests after delivery.
The agreement language is where most disputes start, which is why owners should read our guide to medical courier contract terms before signing a hospital schedule.
How long approval takes
There is no courier privacy licence in Canada. Approval is a vendor onboarding process run by each custodian, not a government permit. Timelines vary by institution and are best treated as illustrative:
- Intake and questionnaire: 1 to 2 weeks.
- Privacy and security review: 2 to 6 weeks.
- Driver screening and vehicle inspection: 1 to 3 weeks.
- Contract signature and first run: 1 to 2 weeks.
Federal and provincial privacy commissioners publish guidance rather than registrations. The full text of the federal statute is on the Justice Laws website, and the Office of the Privacy Commissioner explains the ten fair information principles on its PIPEDA overview page.
What happens if you skip it
Concrete consequence: a custodian that finds an unsigned agent agreement during an IPC review can be ordered to change its practices, and the courier is removed from the vendor list. In practice the courier loses the account within days, because the custodian cannot keep sending records to an agent it cannot document.
A patient complaint can also reach the commissioner directly. The commissioner can investigate, publish findings and name the organisation. For a small courier, the published finding is the durable damage.
Staff training records are part of the evidence file. Our employee training checklist covers what to keep on hand.
Common questions
Does PIPEDA apply to a courier in Ontario? For health information, PHIPA applies instead, because Ontario's law is substantially similar. PIPEDA still covers the courier's other commercial personal information, such as employee files and customer contact lists.
Do I need a business associate agreement in Canada? No. That is a US HIPAA instrument. Canadian custodians use service or agent agreements, sometimes called information management agreements in Alberta.
Who notifies patients after a lost specimen bag? The custodian decides and notifies. The courier's job is to report to the custodian without delay and document what happened.
Can I subcontract a run without telling the hospital? Usually not. Most agreements require prior written consent and flow the same privacy terms to the subcontractor. Unapproved subcontracting is a common cause of contract termination.
