Privacy & Security for Pharmacies

In Ontario, PHIPA names a pharmacy under the Drug and Pharmacies Regulation Act as a health information custodian in its own right, alongside the pharmacist. Alberta goes further and names licensed pharmacies as custodians by statute under the Health Information Act. That matters because notice, audit-log and reporting duties attach to the store as an entity, not only to the individual dispensing, so the obligations survive staff turnover and ownership changes.

No. Ontario and Alberta name pharmacies as health-information custodians with statutory breach and reporting duties. BC layers a dispensing network, PharmaNet, on a private-sector law with no mandatory regulator-notification duty yet. Quebec applies its enterprise-focused Law 25 and a separate health-information Act. A multi-province banner needs one program tracking all four, not a single template stretched across borders.

A privacy breach is assessed under PHIPA or the equivalent provincial statute and can trigger IPC reporting and individual notice. A discipline matter runs through the College of Pharmacists' Code of Ethics process and can end in caution, conditions or licence action. The two tracks often run together: OCP guidance requires an employer to report privacy-related discipline and resignations to the College and the IPC at once, so one incident generates two files.

Start with who is accountable, usually the Designated Manager, then document the policies that already govern daily practice informally: who can look up a profile, how the counter handles police requests, and how long records are kept. Layer in staff training on lookups and disclosure, a simple breach log, and a plan for claims downtime. A structured baseline lets a single-owner store reach this point without hiring anyone.

Yes. Loyalty accounts, e-commerce orders and delivery addresses are personal information under PIPEDA or the applicable provincial equivalent, but they are not health information governed by PHIPA or the Health Information Act. Even when both data sets sit in the same point-of-sale system, the pharmacy needs separate consent language, retention rules and access boundaries for the two categories, since front-store staff should not need dispensary-level access to do their jobs.

An ordinary breach exposes information after the fact; a chain-wide attack that encrypts dispensing systems stops the store from filling prescriptions while the incident is still unfolding. Patients need medication the same day and claims cannot adjudicate. Planning for a pharmacy has to cover continuity of care alongside notification, a different discipline than a typical office breach response.

The pharmacy generally stays accountable for personal health information even when a third-party system is holding or transmitting it, because custodian obligations do not transfer to a vendor by contract alone. Delivery-app, refill-app and e-prescribing connections should each have a clear line in your vendor agreements and incident plan showing who notifies whom, and how fast, if that partner fails.