Bill 3 establishes a dedicated legal framework for health and social services information in Québec. It treats such information as presumptively confidential, defines which organisations count as “health and social services bodies,” restricts collection to what is necessary, and builds multiple, regulated routes for access and sharing — including for direct care, administrative management and approved research.
Beyond access rules, the bill imposes operational duties on bodies (governance policies, logging, incident handling), empowers the Minister to set certification and technical standards, creates a centralized national information filing system with registers (users, providers, bodies) and gives the Commission d’accès à l’information investigatory and enforcement powers backed by monetary penalties. The result is a single, prescriptive regime that reallocates operational responsibility for security and sharing to health bodies while centralizing many authorization and certification functions with the Ministère and delegated managers.
At a Glance
What It Does
Creates a sector-specific privacy and access law for health and social services information: defines covered data and covered bodies; mandates consent rules and narrow collection; sets prescriptive governance and security obligations for bodies; establishes routes for provider and researcher access; and authorizes a Minister‑run national filing system and certification program.
Who It Affects
Public and private health and social services institutions, clinicians and other service providers working inside those bodies, researchers seeking identifiable or linked data, technology vendors supplying health IT, and the Minister’s delegated manager and the Commission d’accès à l’information.
Why It Matters
This law replaces prior patchwork rules (including repealing the Act respecting the sharing of certain health information) and concentrates operational control of health-data sharing and security in provincial authorities while imposing concrete compliance tasks on bodies — from privacy impact assessments to mandatory logging and certified technology.
More articles like this one.
A weekly email with all the latest developments on this topic.
What This Bill Actually Does
The bill draws a bright line around “health and social services information” and the entities that hold it, treating such data as confidential by default and permitting use or disclosure only under enumerated conditions or with valid consent. Consent must be clear, informed, time‑limited and purpose‑specific; where technology enables profiling or identification, the body must notify the person and obtain consent for those uses.
Bodies must also avoid keeping identifiable information longer than necessary and may be subject to minimum retention periods by regulation.
Individuals gain structured access and correction rights, with express mechanisms to restrict or refuse access to particular providers or categories of providers (including refusals that bar researchers from soliciting participation). The law builds detailed rules for minors, incapable adults and heirs, and it requires bodies to respond to access or rectification requests within a fixed statutory period and to document reasons for any refusal.For operational uses, the bill creates routes for service providers and researchers.
Clinicians who are professionals under the Professional Code may access records when necessary for care or teaching. Researchers attached to certain institutions may obtain identifiable data only after a written authorization process that requires a research ethics approval, a proportionate privacy impact assessment, consultation with data holders, and a binding agreement that limits use, pairing, security measures and retention; other external researchers must go through a designated research access centre.
When communications outside Québec are contemplated, assessments must evaluate foreign legal protections.Governance and technical safeguards are central: the Minister will set information‑governance rules and may require certification of technological products and services; a network information officer issues special security rules; each body must adopt a governance policy, log all uses and communications, include default privacy settings, run privacy impact assessments for IT projects and have incident procedures. The Commission d’accès à l’information gains inspection, investigation and adjudicative powers and can order remedial measures; the Act also creates criminal and administrative penalties for unlawful collection, communication or failure to report incidents.Finally, the Act establishes a national information filing system to index records across bodies, host a user/provider/body registry, support prescription sharing, keep a consent registry for post‑mortem organ/tissue removal and provide appointment‑finding and booking mechanisms.
The Minister may operate the system directly or appoint an operations manager under detailed contractual obligations and notification, monitoring and reporting duties; transitional rules move existing systems and registries into the new framework over time.
The Five Things You Need to Know
A body must respond to an access or rectification request within 30 days; failing to respond is deemed a refusal and triggers review by the Commission d’accès à l’information (section 33).
Every body must log all uses and communications of health and social services information, identify users and report annually to the Minister (section 95).
Researchers seeking identifiable data must obtain written authorization from their institution (or the research access centre for outside researchers) supported by a research ethics decision and a proportionate privacy impact assessment; the institution then enters a binding agreement that limits use, pairing and retention (sections 39–45, 48–53).
The Minister may require that only certified technological products or services be used in prescribed cases; the Minister publishes a certification list and can demand compliance documentation from suppliers and bodies (sections 84–88).
The Act creates tiered fines for noncompliance: for example, fines range up to $150,000 for organisations for serious offences, with higher penalties for repeat offences and doubled fines where directors are implicated (sections 148–151).
Section-by-Section Breakdown
Every bill we cover gets an analysis of its key sections.
Definitions, scope and confidentiality default
This opening package defines “health and social services information” (broadly: identifiable data about health, biological material, services provided, or data derived under public health functions) and precisely lists the entities that qualify as health and social services bodies (Minister, institutions, named public bodies, contracted providers and categories added by regulation). It establishes the starting rule: information held by those bodies is confidential and may not be used or communicated except under the Act or with express, purpose‑limited consent.
Collection limits, consent mechanics and individual rights
These provisions operationalize collection and consent: bodies may collect only what is necessary; they must inform individuals at collection (who is collecting, why, how, retention period and rights) and present written consent separately. Consent rules include age thresholds (under 14 versus 14+), allow theme‑based consent for research, and require assistance on request. They also create formal mechanisms for people to restrict or refuse access to specified providers or researchers, and set out detailed access and rectification rights, exceptions for harm or third‑party confidentiality and procedural obligations for the person in charge of protection (acknowledgement, timelines, written reasons for refusals).
Access by service providers and researchers
This section distinguishes provider and researcher routes. Service providers who are regulated professionals get access when necessary for care, teaching or reflective practice; other service providers are covered by regulation. Researcher access is split: researchers attached to hospital or public bodies must obtain institutional authorization supported by a research ethics committee decision and a proportionate privacy impact assessment; the institution consults other data holders and then signs a detailed data‑use agreement specifying limits on pairing, publication and security. External researchers apply to a government‑designated research access centre that coordinates acquisition, analysis and destruction of data. Revocation grounds and breach reporting obligations are spelled out.
External communications, public safety exceptions and the delegated manager
The Act enumerates when bodies may communicate data externally: where another law expressly requires it; for public safety (serious, urgent risk to life or serious injury); for prosecution or police interventions; and under contracts or mandates with strict confidentiality and technical conditions. Importantly, a delegated manager of government digital data (within the Ministère) can authorize communications that fall outside express statutory authorizations — subject to written requests, privacy and algorithmic impact assessments and conditions on security, foreign transfer protections and form (de‑identified where possible). The manager keeps a public register of authorizations and can revoke them.
Ministerial rules, certification, network officer and body obligations
This cluster gives the Minister power to set sectorwide information governance regulations (roles, logging, quality standards, retention, interoperability), to certify technological products and services and to publish the certified list. A network information officer issues special security rules (identity management, access authorization, incident management) and enforces them. Bodies must adopt governance policies, designate a person in charge of protection, log all accesses, run PIAs for IT projects, default to highest privacy settings for client‑facing tech, keep incident registers and report serious breaches to the Minister and Commission.
National information filing system and registers
The Act creates a Minister‑operated national filing system intended to index user records across bodies, enable prescription sharing, host a consent registry for post‑mortem organ/tissue removal, store advance directives and support appointment‑finding and booking. The Minister may keep operations or appoint an operations manager under a contract that mandates security, proactive log monitoring, annual reporting and immediate incident notification. The system must support logging on every access and the Minister may require institutions to use the system by regulation.
This bill is one of many.
Codify tracks hundreds of bills on this topic across all five countries.
Explore this topic in Codify Search →Who Benefits and Who Bears the Cost
Every bill creates winners and losers. Here's who stands to gain and who bears the cost.
Who Benefits
- Patients and service users — gain clearer, enforceable access and rectification rights, the ability to restrict or refuse access to particular providers or researchers, and default privacy protections for client‑facing technology.
- Researchers working inside approved bodies — obtain a defined path to identifiable or linked data through an institutional authorization backed by ethics review and a privacy impact assessment.
- Health system managers and planners — receive structured data access and a new national filing system designed to index records, support appointment matching and permit system‑level analytics.
- Clinicians and teaching staff — get statutory access when information is necessary for care, training or reflective practice, improving continuity of care across bodies.
- Public health authorities — benefit from clarified powers and a central registry/system for surveillance and coordinated responses (with built‑in safeguards for external transfers).
Who Bears the Cost
- Health and social services bodies (public and many private providers) — must adopt governance policies, designate protection officers, implement logging, run PIAs, change retention practices and report incidents, all of which carry staffing, compliance and IT costs.
- Technology vendors and suppliers — face certification requirements and audit demands, potential limitations on selling uncertified products into the sector and obligations to support bodies’ compliance over contract lifetimes.
- Researchers outside designated institutions — must route requests through a research access centre and comply with stricter coordination and contractual constraints, which may slow project timelines.
- The Ministère and delegated managers — assume centralized operational, authorization and certification duties (including maintaining registers, assessing PIAs/algorithmic analyses and running the national system), creating resourcing and governance responsibilities at the provincial level.
- Third‑party contractors and mandatary providers — are subject to contract clauses that require strict confidentiality, secure hosting, notification of incidents and destruction at contract end, increasing contractual and operational burden.
Key Issues
The Core Tension
The central dilemma is straightforward: deliverable health care, timely public‑safety and system‑level uses of data require comparatively fast, wide data flows, but robust privacy and public trust demand strict controls, logging and approvals; the bill attempts to square that circle by centralizing approvals, technical certification and governance — which reduces ad hoc risk but increases operational complexity and concentrates control in provincial authorities and certified suppliers.
The bill tries to reconcile three goals — protecting individual privacy, enabling care and supporting research/system management — by layering procedural safeguards (consents, PIAs, ethics approvals) around multiple exceptions and centralized authorizations. That approach creates operational complexity: bodies must both lock down data and enable many different lawful pathways for disclosure, each with its own assessment, agreement and reporting requirements.
Smaller bodies and private providers will face disproportionate implementation costs and may turn to a narrow set of certified vendors, increasing concentration risk.
Centralized discretion is another strain. The delegated manager’s power to authorize communications that are not otherwise expressly permitted, and the Minister’s ability to certify technologies and designate an operations manager for the national filing system, shift important balancing choices away from case‑by‑case frontline judgment to provincially controlled technical and contractual instruments.
While that can standardize protections, it also creates single‑point dependencies — for example on the certified‑product list or the operations manager — and concentrates both legal and practical risk. Finally, the research pathways are rigorous but administratively heavy: required PIAs, ethics approvals, consultations with data holders and detailed agreements will safeguard privacy but lengthen timelines and raise the transaction costs of legitimate research.
There's more to this law than the bill.
Codify Laws traces every connection across the legislative lifecycle.