Privacy and Privacy impact assessments – Health Canada

Privacy impacts all of Health Canada's programs and operations. The Department's privacy responsibilities are governed by the Privacy Act and the Treasury Board Privacy Protection Policy. They govern the way the Department collects, uses, discloses and retains personal information.

As directed by the Treasury Board Secretariat, Health Canada strengthens privacy protection through the development of Privacy Impact Assessments.

Privacy Impact Assessments

A Privacy Impact Assessment (PIA) refers to a comprehensive process for determining the effects of program and service delivery initiatives on individual privacy. The PIA process is a useful methodology to ensure that privacy is built in at the outset of any new program or service and to assure the public that their privacy is safeguarded.

The PIA process

Institutions must develop and maintain PIAs to evaluate whether program and service delivery initiatives involving personal information comply with privacy requirements and to resolve privacy issues that may be of potential concern.

Under Treasury Board Secretariat policy, all departments and agencies must conduct PIAs for proposals of all new programs and services that raise privacy issues. The PIA goes through an internal approval process before being signed-off on by the Deputy Minister and sent to the Office of the Privacy Commissioner for review.

Privacy Impact Assessment summaries

• The Implementation of the Workplace Presence Management Tool (WPMT) (October 2024)
• Equitable Access to Language Training Program (January 2024)
• Workplace Wellness Service Centre (April 2022)
• Corporate Services Branch (CSB) Eligible Retiree and CSB Retiree Alumni Inventory (July 2021)
• Asynchronous video interviews for staffing (VidCruiter) (2020)
• Public Service Occupational Health Program (2020)
• Peer Support Program (2020)
• Monitoring of Medical Assistance in Dying (MAID) (2019)
• Disclosure of Confidential Business Information under the Food and Drugs Act (August 2016)
• Thalidomide Survivors Contribution Program (February 2016)
• Medical Device Problem Reporting (August 2013)
• National Dose Registry (April 2013)
• Transfer of the Health Canada Human Resources Database to People Soft (2011-2012)
• Office of Consumer and Public Involvement (OCAPI) - Patient and Consumer Participation Pool (2011-2012)
• Privacy Impact Assessments (PIAs) and Preliminary Privacy Impact Assessments (PPIAs) (2007-2008)
• Drug Exception Centre (DEC) Privacy Impact Assessment (PIA) Summary (2007)
• Privacy Impact Assessments (PIAs) and Preliminary Privacy Impact Assessments (PPIAs) (2006-2007)
• Canada Vigilance Program (formerly known as Canadian Adverse Drug Reaction Monitoring Program) (2004)
• United States (US) Food and Drug Administration (FDA) - Derived Adverse Event Reporting System and Database (2004)

Completed privacy compliance evaluations

• Online Staffing Expansion Project (VidCruiter) (March 2022)

Privacy initiatives

• Pan-Canadian Health Information Privacy and Confidentiality Framework - A guide to assist organizations that handle personal health information in putting in place sound privacy practices. It will also serve as a reference point for broader policy initiatives, such as updating legislation.
• Personal Information Protection and Electronic Documents Act (PIPEDA)

Related resources

• Access to Information Request Form
• Contact Us
• Info Source
• Principles for Assisting Applicants/Requesters (Duty to Assist)
• Reports and Publications