Canada’s health-technology sector has never been more ambitious. From Toronto’s AI-diagnostics startups to Montreal’s digital-therapeutics firms, the pull of the United States — a market roughly ten times the size of Canada’s — is almost irresistible. But the instant a Canadian company stores, processes, or even glances at American patient data, it steps into a regulatory regime most founders underestimate.
The assumption I hear most often goes like this: “We follow PIPEDA and Quebec’s Law 25, so we’re covered.” You’re not. Canadian privacy law governs how you handle Canadians’ data. The moment US Protected Health Information (PHI) lands in your environment, the Health Insurance Portability and Accountability Act — HIPAA — comes with it, and it does not care that your servers sit in Ontario or your head office is in Vancouver.
You’re probably a “Business Associate”
HIPAA splits the world into Covered Entities (hospitals, clinics, health plans) and Business Associates — the vendors that create, receive, maintain, or transmit PHI on a Covered Entity’s behalf. A Canadian SaaS platform that a US clinic uses to schedule patients, transcribe notes, or run analytics is, almost by definition, a Business Associate. And since the HITECH Act and the 2013 Omnibus Rule, Business Associates are directly liable under HIPAA — not merely on the hook contractually, but subject to federal enforcement.
That distinction matters because the penalties are not theoretical. Civil monetary penalties are tiered by culpability and can exceed $2 million per violation category, per year. Add mandatory breach notification, potential class actions, and the reputational damage of a regulator investigation, and the “we didn’t realize HIPAA applied to us” defense becomes very expensive.
Geography doesn’t create a loophole
Founders sometimes hope that keeping data on Canadian soil puts them outside HIPAA’s reach. It doesn’t. HIPAA has no geographic boundary written into it; it follows the data and the relationship. If you handle a US Covered Entity’s PHI, you’re expected to meet the Security Rule’s administrative, physical, and technical safeguards regardless of where the servers live. Data residency is a real and separate concern — some US health systems insist on US-hosted data, and some Canadian obligations pull the other way — but it is never a substitute for HIPAA compliance.
Two rulebooks running at once
Here’s the part that trips teams up: you rarely get to pick just one regime. A Canadian healthtech serving both markets is often juggling HIPAA for its US data and PIPEDA or Loi 25 for its Canadian data — simultaneously. Quebec’s Law 25, for instance, requires a privacy impact assessment before you transfer personal information outside the province, which is exactly what a US-hosted deployment can trigger. The obligations overlap in spirit (safeguard data, be transparent, report breaches) but differ in the specifics, and “compliant in Canada” does not auto-translate to “compliant in the US.”
What to do before you sign your first US customer
- Sign a Business Associate Agreement (BAA) before any PHI changes hands — never after.
- Map your data flows. Know exactly where PHI enters, where it rests, who can see it, and where it leaves.
- Build to the Security Rule now — encryption in transit and at rest, access controls, audit logging, and a documented incident-response plan.
- Flow down obligations to your own subcontractors (cloud host, analytics vendor). Their gap becomes your breach.
- Run the Canadian transfer assessment in parallel so Loi 25 or PIPEDA don’t ambush you later.
The Office for Civil Rights, which enforces HIPAA, has been clear that “we’re a small foreign vendor” is not a mitigating factor. The good news: a Canadian company that treats HIPAA compliance as an engineering and governance discipline — not a checkbox — often ends up with a stronger security posture than its US competitors. In a market where hospital procurement teams increasingly demand proof before they sign, that rigor isn’t a cost. It’s the thing that closes the deal.
