# J10 Privacy and Health Information > Fire Service Safety Management System, version 0.3.3 (2026-10-25). The Human Factor. Document FSSMS-JUR-10. > > Canonical: https://thehumanfactor.ca/library/fire-service-safety/j10-privacy-and-health-information > > Licence: CC BY-NC-SA 4.0 with the Adopting Agency Grant (https://creativecommons.org/licenses/by-nc-sa/4.0/) > > General information only, not legal, medical or other professional advice. Verify every requirement against the current official text of the law, standards and manufacturer instructions that apply to you. Obtain your own legal review and consult your joint health and safety committee before adopting anything. You adopt, adapt, implement and rely on this material entirely at your own risk and on your own responsibility. Full terms: Terms of Use, thehumanfactor.ca. > **Warning: Law changes; verify before you rely on this page** > > This page summarizes what each jurisdiction’s law requires on this topic as of 2026-10-23. It is general information, not legal advice. Check the official text for your jurisdiction before you adopt or rely on anything here. See [00a Copyright, Licence and Legal Notices](https://thehumanfactor.ca/library/fire-service-safety/copyright-licence-and-legal-notices). ## What this topic covers This page covers two families of law. The first is the access to information and protection of privacy statute that governs a municipal fire department’s records, and whether the municipality is covered at all. The second is the health information statute that governs “custodians” or “trustees” of personal health information: physicians, clinics, ambulance operators and, in some provinces, public bodies themselves. Which law applies to a record depends on who holds it: the department, the department’s contracted physician or assistance-program clinician, or an ambulance operator. The page also notes newer duties some statutes impose, such as privacy impact assessments, breach notification and minimum retention. ## Why it matters to a fire department A fire department holds some of the most sensitive information in local government: members’ medical and fitness results, fit-test and hearing data, exposure logs, injury and psychological injury claims, peer support contacts, patient information from medical calls, caution flags on addresses, and helmet camera and drone imagery. Getting custody wrong does harm both ways. A member’s diagnosis that reaches an officer through a shared file breaks trust in the medical and peer support programs; patient details or images shared outside the law expose the department and the patient. Two misunderstandings are common: that a department becomes a “health information custodian” because it runs medical calls or a medical program (it usually does not; its clinician does), and that no privacy law applies because the municipality is outside the access statute (in several jurisdictions that is true, which makes the department’s own policy the only protection). ## What every department must cover, wherever it is 1. Know which access and privacy statute governs your department’s records, and whether your municipality is covered by it at all (see your jurisdiction below). 2. Know whether your contracted physician, occupational health nurse, assistance-program provider and peer support clinicians are custodians or trustees under the health information statute, and contract so that they hold the clinical record and the department receives only what it needs: fit, unfit, or fit with restrictions (see your jurisdiction below). 3. Know whether the department itself becomes a custodian or trustee, for example because it is a public body that collects health information or operates an ambulance service, and what that adds for medical first response records ([J25 Infection Control and Medical First Response](https://thehumanfactor.ca/library/fire-service-safety/j25-infection-control-and-medical-first-response)). 4. Keep health information apart from personnel and discipline files, with access by role only; take particular care with psychological injury and peer support records ([J28 Psychological Health and Safety](https://thehumanfactor.ca/library/fire-service-safety/j28-psychological-health-and-safety)). 5. Do a privacy impact assessment before introducing a system that collects personal information, such as an exposure-tracking app, wearable monitoring or cameras and drones, where the law requires one and as good practice where it does not (see your jurisdiction below). 6. Know when a privacy breach must be reported to the commissioner and to the people affected, and keep a breach register where required (see your jurisdiction below). 7. Keep personal information used to make a decision about a member for at least the minimum period the statute sets, and longer where [J09 Records Retention](https://thehumanfactor.ca/library/fire-service-safety/j09-records-retention) says so. 8. Treat patient information and imagery from emergency calls as health information that belongs in the patient care record; share it only as the law allows. 9. Give members access to their own exposure, medical and service records, and tell them how to ask. ## At a glance | Jurisdiction | Access and privacy law for municipal records | Health information statute | Department a custodian or trustee? | Clinicians custodians or trustees? | Verified | |:---|:---|:---|:---|:---|:---| | British Columbia | FOIPPA; breach notification | None separate for public-body employers | No; FOIPPA governs its health records | Private-sector privacy law | Partly | | Alberta | Access to Information Act and Protection of Privacy Act (2025) | Health Information Act | Only for ambulance work | If designated by regulation | Partly | | Saskatchewan | LAFOIP | Health Information Protection Act | Not as such; ambulance operators are trustees | Yes, licensed professionals not employed by a trustee | Yes | | Manitoba | FIPPA | Personal Health Information Act | Yes: a public body that holds health information is a trustee | Yes | Yes | | Ontario | MFIPPA; impact assessments and breach reporting from 2027-01-01 | PHIPA | No | Yes | Yes | | Quebec | Access Act; impact assessments and incident notice | Health and social services information Act | No | Not under that Act | Partly | | New Brunswick | RTIPPA (local public bodies) | PHIPAA | Possibly, when giving health care | Yes | Partly | | Nova Scotia | Municipal Government Act Part XX | Personal Health Information Act | Generally no | Yes | No | | Prince Edward Island | FOIPP for designated municipalities only | Health Information Act | Not named | Yes | Partly | | Newfoundland and Labrador | ATIPPA, 2015 (towns and cities) | Personal Health Information Act | Not expressly | Yes, when giving health care | Yes | | Yukon | Not covered by ATIPP; Municipal Act access rules | HIPMA | Unresolved | Yes | Partly | | Northwest Territories | ATIPP only if designated; none designated | Health Information Act | No, unless prescribed | Physicians and prescribed persons | Yes | | Nunavut | ATIPPA only if designated; none designated | None found | No | Not applicable | Partly | | Federal | Privacy Act for federal institutions; PIPEDA for federal works | None | Not applicable | Provincial law | Partly | ## British Columbia **Law.** Freedom of Information and Protection of Privacy Act, ss. 31 and 36.3 [(Freedom of Information and Protection of Privacy Act \[BC\], 1996, ss. 31, 36.3)](https://thehumanfactor.ca/library/fire-service-safety/j10-privacy-and-health-information#ref-freedom-of-information-and-protection-of-privacy-act-bc). **What must be covered.** - **Access and privacy.** FOIPPA governs municipalities and regional districts as local public bodies. - **Retention.** Personal information used by or on behalf of a public body “to make a decision that directly affects the individual” must be kept at least one year after use (s. 31). - **Breach notification.** If a privacy breach involving personal information in the public body’s custody or control “could reasonably be expected to result in significant harm”, the head must, without unreasonable delay, notify the affected individual and the commissioner (s. 36.3). - **Health information.** There is no separate health information statute for public-body employers; the E-Health Act is limited to health information banks (not read). A municipal department’s member health records are FOIPPA records. **Fire-service nuance.** - **Clinicians.** A private physician or clinic doing firefighter medicals is a private-sector organization, governed by the province’s private-sector privacy statute rather than FOIPPA; the contract should say who holds the clinical record. - **Breach readiness.** Exposure apps, scheduling systems and shared drives holding medical notes are the likely breach sources; include them in the breach procedure. **Status.** Partly verified on 2026-10-23 (FOIPPA consolidated to 2026-10-13; ss. 31 and 36.3 read). Schedule 1 coverage and the treatment of private clinicians are not confirmed. ## Alberta **Law.** Access to Information Act [(Access to Information Act \[AB\], 2024)](https://thehumanfactor.ca/library/fire-service-safety/j10-privacy-and-health-information#ref-access-to-information-act-ab); Protection of Privacy Act, s. 6 [(Protection of Privacy Act \[AB\], 2024, s. 6)](https://thehumanfactor.ca/library/fire-service-safety/j10-privacy-and-health-information#ref-protection-of-privacy-act-ab); Health Information Act, s. 1(1)(f) [(Health Information Act \[AB\], 2000, s. 1)](https://thehumanfactor.ca/library/fire-service-safety/j10-privacy-and-health-information#ref-health-information-act-ab). **What must be covered.** - **Access and privacy.** The Access to Information Act and the Protection of Privacy Act replaced the former FOIP Act on 2025-06-11; municipalities are local public bodies under them. - **Retention.** Personal information used to make a decision about an individual is kept at least one year (POPA s. 6(b)). - **Health information.** Custodians under the Health Information Act include “an ambulance operator as defined in the Emergency Health Services Act” (s. 1(1)(f)(ii.1)) and “a health services provider who is designated in the regulations as a custodian” (s. 1(1)(f)(ix)). A fire department that operates an ambulance service is a custodian for that work; for its other records it is a public body under POPA. **Fire-service nuance.** - **Two regimes in one department.** A fire-based ambulance service keeps patient records under the Health Information Act, while the same department’s member medical and exposure records fall under POPA. Keep the systems and access rules separate. - **Physicians.** Physicians and other regulated professionals are designated custodians by regulation. **Status.** Partly verified on 2026-10-23 (both 2024 Acts consolidated to 2025-12; Health Information Act to 2026-07-02). The custodian regulation was not read. ## Saskatchewan **Law.** The Local Authority Freedom of Information and Protection of Privacy Act, s. 2 (The Local Authority Freedom of Information and Protection of Privacy Act \[SK\], 1990-91, s. 2); The Health Information Protection Act, s. 2(t) [(The Health Information Protection Act \[SK\], 1999, s. 2)](https://thehumanfactor.ca/library/fire-service-safety/j10-privacy-and-health-information#ref-the-health-information-protection-act-sk); The Occupational Health and Safety Regulations, 2020, s. 7-3(6) [(The Occupational Health and Safety Regulations, 2020 \[SK\], 2021, s. 7-3)](https://thehumanfactor.ca/library/fire-service-safety/j10-privacy-and-health-information#ref-the-occupational-health-and-safety-regulations-2020-sk). **What must be covered.** - **Access and privacy.** Municipalities are “local authorities” under LAFOIP (s. 2(f)). - **Health information.** HIPA applies to “trustees” that have custody or control of personal health information, including a government institution, an ambulance operator under The Ambulance Act, “a health professional licensed or registered pursuant to an Act” who is not an employee of a trustee, and a person or body that provides a health service under an agreement with another trustee (s. 2(t)). A municipal fire department is not a trustee as such. - **OHS overlay.** Personal health information in respirator assessment records may not be disclosed without the worker’s consent [(The Occupational Health and Safety Regulations, 2020 \[SK\], 2021, s. 7-3(6))](https://thehumanfactor.ca/library/fire-service-safety/j10-privacy-and-health-information#ref-the-occupational-health-and-safety-regulations-2020-sk). **Fire-service nuance.** - **Fire-based ambulance.** A department that holds an ambulance operator’s licence is a trustee for that work. - **Clinicians.** A contracted physician is a trustee in their own right; the department should receive fitness conclusions, not clinical notes. **Status.** Verified against the official text on 2026-10-23 (LAFOIP consolidated to 2024-08-22; HIPA to 2024-08-13; trustee definition read). ## Manitoba **Law.** The Freedom of Information and Protection of Privacy Act, ss. 1 and 40 [(The Freedom of Information and Protection of Privacy Act \[MB\], 2026, ss. 1, 40)](https://thehumanfactor.ca/library/fire-service-safety/j10-privacy-and-health-information#ref-the-freedom-of-information-and-protection-of-privacy-act-mb); The Personal Health Information Act, ss. 1 and 17 [(The Personal Health Information Act \[MB\], 2026, ss. 1, 17)](https://thehumanfactor.ca/library/fire-service-safety/j10-privacy-and-health-information#ref-the-personal-health-information-act-mb). **What must be covered.** - **Access and privacy.** A municipality is a “local government body” under FIPPA (s. 1). The public body must have a written retention policy for personal information used in decisions, giving the individual a reasonable opportunity to obtain access (s. 40). - **Health information.** A “trustee” is “a health professional, health care facility, public body, or health services agency that collects or maintains personal health information” (PHIA s. 1). Because a municipality is a public body, the fire department is a trustee for the personal health information it collects or maintains, such as member medical results and patient care records. A written policy on retention and destruction is required (s. 17). **Fire-service nuance.** - **The department is a trustee.** Manitoba is the clearest case: member health information held by the department is governed by PHIA, not only FIPPA. Apply PHIA’s security and need-to-know rules to medical, fitness, exposure and injury files. - **Clinicians.** Licensed health professionals are trustees in their own right. **Status.** Verified against the official text on 2026-10-23 (FIPPA version in force since 2025-11-01; PHIA version since 2023-05-30; definitions read). ## Ontario **Law.** Municipal Freedom of Information and Protection of Privacy Act, ss. 28, 30, 30.1 and 52(3) [(Municipal Freedom of Information and Protection of Privacy Act \[ON\], 1990, ss. 28, 30-30.1, 52)](https://thehumanfactor.ca/library/fire-service-safety/j10-privacy-and-health-information#ref-municipal-freedom-of-information-and-protection-of-privacy-act-on); R.R.O. 1990, Reg. 823, s. 5 (General (R.R.O. 1990, Reg. 823) \[ON\], 2026, s. 5); Personal Health Information Protection Act, 2004, s. 3 [(Personal Health Information Protection Act, 2004 \[ON\], 2004, s. 3)](https://thehumanfactor.ca/library/fire-service-safety/j10-privacy-and-health-information#ref-personal-health-information-protection-act-2004-on). **What must be covered.** - **Access and privacy.** MFIPPA governs municipal institutions. Personal information that has been used is kept for “the shorter of one year after use or the period set out in a by-law or resolution” (General (R.R.O. 1990, Reg. 823) \[ON\], 2026, s. 5). - **New duties from 2027-01-01.** A written privacy impact assessment before collecting personal information (s. 28(3)-(4)); a duty to protect personal information against theft, loss and unauthorized use (s. 30(5)); and mandatory reporting of a breach to the Information and Privacy Commissioner, with notice to the people affected, where there is “a real risk of significant harm”, plus a breach register (s. 30.1). - **Employment records.** The Act does not apply to records about labour relations or employment-related matters in which the institution has an interest (s. 52(3)). - **Health information.** A fire department is not listed as a health information custodian; an ambulance service is (PHIPA s. 3(1), para. 4). A “health care practitioner” is a custodian (para. 1), so physicians and nurses who do firefighter medicals are custodians of the information they hold. **Fire-service nuance.** - **Member health files may sit outside MFIPPA.** Because of the employment exclusion, much of the member medical file the department holds as employer may fall outside MFIPPA (interpretation; confirm with the municipal clerk). Protect it by policy and contract; do not treat the exclusion as permission to share it. - **Plan the 2027 assessments.** New exposure-tracking or wellness systems introduced after 2026-12-31 will need a written privacy impact assessment first. **Status.** Verified against the official text on 2026-10-23 (MFIPPA consolidated from 2026-07-01; PHIPA from 2026-01-01). How the employment exclusion applies to member health files is interpretation. ## Quebec **Law.** Act respecting Access to documents held by public bodies and the Protection of personal information, ss. 3, 8, 63.5, 63.8 to 63.11 and 73 [(Act respecting Access to documents held by public bodies and the Protection of personal information \[QC\], 2026, ss. 3, 8, 63.5, 63.8-63.11, 73)](https://thehumanfactor.ca/library/fire-service-safety/j10-privacy-and-health-information#ref-act-respecting-access-to-documents-held-by-public-bodies-and-the-protection-of-personal-information-qc); Act respecting health and social services information, s. 4 [(Act respecting health and social services information \[QC\], 2026, s. 4)](https://thehumanfactor.ca/library/fire-service-safety/j10-privacy-and-health-information#ref-act-respecting-health-and-social-services-information-qc). **What must be covered.** - **Access and privacy.** Municipal bodies are public bodies under the Access Act (s. 3); the person with the highest authority is responsible for access and the protection of personal information (s. 8). - **Privacy impact assessment.** Required for any information system project or electronic service delivery project involving personal information (s. 63.5). - **Confidentiality incidents.** The body must take reasonable measures to reduce the risk; where there is “a risk of serious injury”, it notifies the Commission d’accès à l’information and the persons concerned, and it keeps a register of incidents (ss. 63.8-63.11). - **Retention.** Personal information is destroyed or anonymized once the purpose of its collection is achieved, subject to the Archives Act retention calendar (s. 73). - **Health information.** The health and social services information Act applies to health and social services bodies, such as the ministry, health institutions, ambulance permit holders and health communication centres (s. 4); municipal fire services are not listed (interpretation). **Fire-service nuance.** - **The Access Act governs member health records.** Firefighter medical and exposure records held by the municipality fall under the Access Act, including the incident notice and register. - **Clinicians.** A clinic’s own records follow professional secrecy rules and the private-sector privacy statute. **Status.** Partly verified on 2026-10-23 (both Acts consolidated to 2026-08-12). The non-application of the health information Act to fire services and the clinic rules are interpretations. ## New Brunswick **Law.** Right to Information and Protection of Privacy Act, s. 1 [(Right to Information and Protection of Privacy Act \[NB\], 2009, s. 1)](https://thehumanfactor.ca/library/fire-service-safety/j10-privacy-and-health-information#ref-right-to-information-and-protection-of-privacy-act-nb); Personal Health Information Privacy and Access Act, s. 1 [(Personal Health Information Privacy and Access Act \[NB\], 2009, s. 1)](https://thehumanfactor.ca/library/fire-service-safety/j10-privacy-and-health-information#ref-personal-health-information-privacy-and-access-act-nb). **What must be covered.** - **Access and privacy.** RTIPPA applies to “local public bodies”, which include local government bodies: municipalities, rural districts, rural communities, regional municipalities, regional service commissions and local boards (s. 1). - **Health information.** A “custodian” is an individual or organization that “collects, maintains or uses personal health information for the purpose of providing or assisting in the provision of health care or treatment … or delivering a government program or service”, and includes public bodies, health care providers who are not agents or employees of a custodian, the Minister, the provincial ambulance operator and WorkSafeNB (PHIPAA s. 1). **Fire-service nuance.** - **Medical first response may make the department a custodian.** Because public bodies are named, a municipal department that collects health information to provide care at medical calls may be a custodian for those records (interpretation; confirm with the Ombud). - **Clinicians.** Independent physicians and clinics are custodians in their own right. **Status.** Partly verified on 2026-10-23 (RTIPPA consolidated to 2025-02-13; PHIPAA to 2024-01-01; definitions read). The department’s custodian status is not settled. ## Nova Scotia **Law.** Municipal Government Act, Part XX [(Municipal Government Act \[NS\], 1998, Part XX)](https://thehumanfactor.ca/library/fire-service-safety/j10-privacy-and-health-information#ref-municipal-government-act-ns); Freedom of Information and Protection of Privacy Act [(Freedom of Information and Protection of Privacy Act \[NS\], 1993)](https://thehumanfactor.ca/library/fire-service-safety/j10-privacy-and-health-information#ref-freedom-of-information-and-protection-of-privacy-act-ns); Personal Health Information Act [(Personal Health Information Act \[NS\], 2010)](https://thehumanfactor.ca/library/fire-service-safety/j10-privacy-and-health-information#ref-personal-health-information-act-ns). **What must be covered.** - **Access and privacy.** Part XX of the Municipal Government Act governs access to and privacy of municipal records, including the fire department’s member health records, survey data, caution flags and camera or drone imagery; provincial public bodies fall under the Freedom of Information and Protection of Privacy Act. - **Health information.** The Personal Health Information Act governs custodians such as physicians, clinics, health authorities and the provincial emergency health service. A municipal fire department is generally not a custodian, but its contracted physician and assistance-program clinicians are; information a custodian holds about its own employees is excluded. **Fire-service nuance.** - **Charter municipalities.** A municipality with its own charter may have equivalent provisions in the charter; cite those instead. - **Medical first response.** Patient information and images held by the provincial emergency health service or a hospital are governed by the health information statute; the department must not disclose patient information or imagery except as the law permits. **Status.** Not verified. None of these statutes was read in the official text on the research date; this section follows secondary sources and must be confirmed against the official text. ## Prince Edward Island **Law.** Freedom of Information and Protection of Privacy Act, ss. 1 and 77 [(Freedom of Information and Protection of Privacy Act \[PE\], 1988, ss. 1, 77)](https://thehumanfactor.ca/library/fire-service-safety/j10-privacy-and-health-information#ref-freedom-of-information-and-protection-of-privacy-act-pe); Health Information Act, s. 1(e) [(Health Information Act \[PE\], 1988, s. 1)](https://thehumanfactor.ca/library/fire-service-safety/j10-privacy-and-health-information#ref-health-information-act-pe). **What must be covered.** - **Access and privacy.** FOIPP covers only “designated municipalities”: two cities and two towns named in the Act, plus any municipality designated by regulation, with a designation taking effect one year or more after the regulation (ss. 1(b.2), 1(e.1), 77(1)(b.3), 77(1.2)). Most Island fire departments, including rural fire companies, are outside FOIPP. Where FOIPP applies, “employee” includes volunteers (s. 1(c)). - **Health information.** Custodians include public bodies, health care providers and the provincial emergency medical services operator; fire departments are not named (s. 1(e)). **Fire-service nuance.** - **No statute for most departments.** A fire company outside FOIPP and not a custodian has no statutory privacy regime for member records; a written privacy policy, consent forms and contracts with clinicians are the only protection. - **Clinicians.** Health care providers are custodians, so the physician holds the clinical record. **Status.** Partly verified on 2026-10-23 (FOIPP consolidated to 2026-05-29; Health Information Act to 2026-03-30). Whether medical first response records bring a department under the Health Information Act is interpretation. ## Newfoundland and Labrador **Law.** Access to Information and Protection of Privacy Act, 2015, ss. 2(o) and 65 [(Access to Information and Protection of Privacy Act, 2015 \[NL\], 2015, ss. 2, 65)](https://thehumanfactor.ca/library/fire-service-safety/j10-privacy-and-health-information#ref-access-to-information-and-protection-of-privacy-act-2015-nl); Personal Health Information Act, s. 4(1) [(Personal Health Information Act \[NL\], 2008, s. 4)](https://thehumanfactor.ca/library/fire-service-safety/j10-privacy-and-health-information#ref-personal-health-information-act-nl). **What must be covered.** - **Access and privacy.** ATIPPA applies to a “local government body”, which includes towns and the three cities (s. 2(o)). A public body that uses personal information to make a decision about an individual keeps it at least one year (s. 65(1)). - **Health information.** Custodians include “a health care professional, when providing health care to an individual or performing a function necessarily related to the provision of health care” (PHIA s. 4(1)(e)), a person who operates “an ambulance service” (s. 4(1)(g)(iii)) and WorkplaceNL (s. 4(1)(o)). Fire department medical first response is not expressly listed. **Fire-service nuance.** - **Clinicians are custodians when they give care.** A physician doing firefighter medicals holds the clinical record as custodian; the department receives fitness conclusions. - **Medical first response.** Whether a fire department providing first response is a custodian is not addressed. **Status.** Verified against the official text on 2026-10-23 (ATIPPA consolidated to 2026-07-16; PHIA to 2026-05-15). The department’s status for medical first response is not confirmed. ## Yukon **Law.** Access to Information and Protection of Privacy Act [(Access to Information and Protection of Privacy Act \[YT\], 2018)](https://thehumanfactor.ca/library/fire-service-safety/j10-privacy-and-health-information#ref-access-to-information-and-protection-of-privacy-act-yt); Municipal Act, s. 236 [(Municipal Act \[YT\], 2002, s. 236)](https://thehumanfactor.ca/library/fire-service-safety/j10-privacy-and-health-information#ref-municipal-act-yt); Health Information Privacy and Management Act, s. 2 [(Health Information Privacy and Management Act \[YT\], 2013, s. 2)](https://thehumanfactor.ca/library/fire-service-safety/j10-privacy-and-health-information#ref-health-information-privacy-and-management-act-yt). **What must be covered.** - **Access and privacy.** “Public body” under ATIPP means ministerial bodies and prescribed statutory bodies; municipalities are not public bodies. Volunteer fire departments run by a territorial department are covered as part of a ministerial body. - **Municipal records.** The Municipal Act gives access to listed municipal records (s. 236); other records may be released by council “subject to due regard for the confidentiality of personal information”. - **Health information.** HIPMA custodians are the health department, hospital and health facility operators, health care providers and prescribed persons; “health” means “the physical and mental state of an individual” (s. 2). **Fire-service nuance.** - **Municipal departments rely on policy.** A municipal fire department has no ATIPP duties; its privacy protection for member and patient information rests on the Municipal Act’s confidentiality wording and its own policy. - **Medical first response.** Whether fire-service medical responders are HIPMA custodians is unresolved. **Status.** Partly verified on 2026-10-23 (ATIPP read in the 2025-03 capture; Municipal Act to SY 2024, c. 6; HIPMA in the 2024-12 capture). Territorial fire services’ coverage and custodian status are not confirmed. ## Northwest Territories **Law.** Access to Information and Protection of Privacy Act, s. 2 [(Access to Information and Protection of Privacy Act \[NT\], 1994, s. 2)](https://thehumanfactor.ca/library/fire-service-safety/j10-privacy-and-health-information#ref-access-to-information-and-protection-of-privacy-act-nt); Health Information Act, s. 1 [(Health Information Act \[NT\], 2014, s. 1)](https://thehumanfactor.ca/library/fire-service-safety/j10-privacy-and-health-information#ref-health-information-act-nt). **What must be covered.** - **Access and privacy.** A municipality is a public body only if “designated as a public body in the regulations” (s. 2). The regulations’ Schedule A (version since 2021-10-12) designates no municipality, so municipal fire departments are not covered. - **Health information.** Custodians are the health department, physicians, pharmacists and prescribed persons or organizations. “Health service” includes “an ambulance service”, so a fire department running emergency medical services provides a health service but is not a custodian unless prescribed (s. 1). **Fire-service nuance.** - **Policy carries the load.** With no statute reaching the municipal department, its written privacy policy and its contracts with clinicians decide how member and patient information is protected. - **OHS confidentiality still applies.** Personal medical information collected under the OHS regulations is confidential ([J09 Records Retention](https://thehumanfactor.ca/library/fire-service-safety/j09-records-retention)). **Status.** Verified against the official text on 2026-10-23 (ATIPP version since 2023-03-30 and Schedule A since 2021-10-12; Health Information Act version since 2026-03-06). Designations made in 2025-2026 were not checked. ## Nunavut **Law.** Access to Information and Protection of Privacy Act, ss. 2 and 42.1 [(Access to Information and Protection of Privacy Act \[NU\], 2024, ss. 2, 42.1)](https://thehumanfactor.ca/library/fire-service-safety/j10-privacy-and-health-information#ref-access-to-information-and-protection-of-privacy-act-nu). **What must be covered.** - **Access and privacy.** “Public body” includes a municipality only if “designated in the regulations” (s. 2); municipalities are exempt from privacy impact assessments (s. 42.1(3)). The regulations’ Schedule A (current to 2016-05-13) lists no municipality. - **Health information.** No stand-alone health information statute was found. **Fire-service nuance.** - **No statutory regime for municipal departments.** Member and patient information is protected only by policy, contracts and the OHS confidentiality rules. **Status.** Partly verified on 2026-10-23 (ATIPPA official consolidation 2024-05-31; Schedule A to 2016-05-13). Later regulation amendments (2020, 2025) were not read. ## Federal **Law.** Personal Information Protection and Electronic Documents Act, s. 4 [(Personal Information Protection and Electronic Documents Act \[CA\], 2000, s. 4)](https://thehumanfactor.ca/library/fire-service-safety/j10-privacy-and-health-information#ref-personal-information-protection-and-electronic-documents-act-ca); Canada Labour Code, ss. 134.1(6), 135(9) and 136(7) [(Canada Labour Code \[CA\], 1985, ss. 134.1, 135-136)](https://thehumanfactor.ca/library/fire-service-safety/j10-privacy-and-health-information#ref-canada-labour-code-ca); Privacy Act and Access to Information Act. **What must be covered.** - **Federal institutions.** Fire services of federal institutions, such as Defence, fall under the Privacy Act and the Access to Information Act. - **Federally regulated private sector.** PIPEDA applies to personal information “about an employee of … the organization” collected “in connection with the operation of a federal work, undertaking or business”, such as an airport authority’s fire service (s. 4(1)(b)); it does not apply to a government institution covered by the Privacy Act (s. 4(2)(a)). - **Health information.** There is no federal health information statute. - **Committees.** Policy committees, work place committees and representatives may not have access to a person’s medical records without that person’s consent [(Canada Labour Code \[CA\], 1985, ss. 134.1(6), 135(9), 136(7))](https://thehumanfactor.ca/library/fire-service-safety/j10-privacy-and-health-information#ref-canada-labour-code-ca). **Fire-service nuance.** - **Clinicians.** Physicians examining federal firefighters are governed by the privacy law of their province. **Status.** Partly verified on 2026-10-23 (PIPEDA s. 4 and the Code consolidated to 2026-09-30). The Privacy Act and Access to Information Act were not read. ## Chapters that rely on this topic **Front matter** - [00 Fire Service Safety Management System - Program HQ](https://thehumanfactor.ca/library/fire-service-safety/program-hq) **02 Governance** - [05 Document Control and Records](https://thehumanfactor.ca/library/fire-service-safety/document-control-and-records) **03 Assessment** - [05 Safety Culture Baseline](https://thehumanfactor.ca/library/fire-service-safety/safety-culture-baseline) **04 Policies** - [Policy - Occupational Medical, Fitness and Wellness](https://thehumanfactor.ca/library/fire-service-safety/policy-occupational-medical-fitness-and-wellness) - [Policy - Psychological Health and Safety](https://thehumanfactor.ca/library/fire-service-safety/policy-psychological-health-and-safety) - [Policy - Records, Privacy and Health Information](https://thehumanfactor.ca/library/fire-service-safety/policy-records-privacy-and-health-information) - [Policy - Workplace Violence and Harassment](https://thehumanfactor.ca/library/fire-service-safety/policy-workplace-violence-and-harassment) **05 Programs** - [Infection Control and Medical Response Safety Program](https://thehumanfactor.ca/library/fire-service-safety/infection-control-and-medical-response-safety-program) - [Medical, Fitness and Wellness Program](https://thehumanfactor.ca/library/fire-service-safety/medical-fitness-and-wellness-program) - [Occupational Cancer Prevention, Exposure Tracking and Screening Program](https://thehumanfactor.ca/library/fire-service-safety/occupational-cancer-prevention-exposure-tracking-and-screening-program) - [Psychological Health and Safety and Peer Support Program](https://thehumanfactor.ca/library/fire-service-safety/psychological-health-and-safety-and-peer-support-program) - [RPAS Program](https://thehumanfactor.ca/library/fire-service-safety/rpas-program) - [Workplace Violence and Harassment Program](https://thehumanfactor.ca/library/fire-service-safety/workplace-violence-and-harassment-program) **07 Audit** - [02 Audit Checklist Master Index](https://thehumanfactor.ca/library/fire-service-safety/audit-checklist-master-index) - [Checklist - Cancer Prevention, Exposure and Screening](https://thehumanfactor.ca/library/fire-service-safety/checklist-cancer-prevention-exposure-and-screening) - [Checklist - Infection Control and Medical Response](https://thehumanfactor.ca/library/fire-service-safety/checklist-infection-control-and-medical-response) - [Checklist - Medical, Fitness and Wellness](https://thehumanfactor.ca/library/fire-service-safety/checklist-medical-fitness-and-wellness) - [Checklist - Psychological Health and Peer Support](https://thehumanfactor.ca/library/fire-service-safety/checklist-psychological-health-and-peer-support) - [Checklist - RPAS, Marine and ARFF (Conditional Modules)](https://thehumanfactor.ca/library/fire-service-safety/checklist-rpas-marine-and-arff-conditional-modules) - [Checklist - Records and Information](https://thehumanfactor.ca/library/fire-service-safety/checklist-records-and-information) ## Definitions - **Custodian or trustee.** The person or body that a health information statute makes responsible for personal health information in its custody or control, such as a physician, clinic or ambulance operator. - **Personal health information.** Identifying information about a person’s physical or mental health, health care or health history. - **Privacy breach (confidentiality incident).** Unauthorized access to, use, disclosure or loss of personal information. - **Privacy impact assessment.** A documented assessment, done before a new system or program collects personal information, of the privacy risks and how they will be controlled. - **Public body.** A government organization covered by an access and privacy statute; whether a municipality is one depends on the jurisdiction. ## References Access to Information Act, S.A. 2024, c. A-1.4 (Alberta; consolidated to 2025-12-18). Access to Information and Protection of Privacy Act, 2015, S.N.L. 2015, c. A-1.2 (Newfoundland and Labrador; consolidated to 2026-07-16). Access to Information and Protection of Privacy Act, C.S.Nu., c. A-20 (Nunavut; consolidated to 2024-05-31). Access to Information and Protection of Privacy Act, S.N.W.T. 1994, c. 20 (Northwest Territories; consolidated to 2023-03-30). Access to Information and Protection of Privacy Act, S.Y. 2018, c. 9 (Yukon; consolidated to 2025-03-16). Act respecting Access to documents held by public bodies and the Protection of personal information, CQLR c. A-2.1 (Quebec; consolidated to 2026-08-12). Act respecting health and social services information, CQLR c. R-22.1 (Quebec; consolidated to 2026-08-12). Canada Labour Code, R.S.C. 1985, c. L-2 (Canada; consolidated to 2026-09-30; Part II). Freedom of Information and Protection of Privacy Act, R.S.B.C. 1996, c. 165 (British Columbia; consolidated to 2026-10-13). Freedom of Information and Protection of Privacy Act, R.S.P.E.I. 1988, c. F-15.01 (Prince Edward Island; consolidated to 2026-05-29). Freedom of Information and Protection of Privacy Act, S.N.S. 1993, c. 5 (Nova Scotia; consolidation date not recorded). General, R.R.O. 1990, Reg. 823 (Ontario; consolidated to 2026-10-20). Health Information Act, R.S.A. 2000, c. H-5 (Alberta; consolidated to 2026-07-02). Health Information Act, R.S.P.E.I. 1988, c. H-1.41 (Prince Edward Island; consolidated to 2026-03-30). Health Information Act, S.N.W.T. 2014, c. 2 (Northwest Territories; consolidated to 2026-03-06). Health Information Privacy and Management Act, S.Y. 2013, c. 16 (Yukon; consolidated to 2024-12-25). Municipal Act, R.S.Y. 2002, c. 154 (Yukon; consolidated to 2024-12-26). Municipal Freedom of Information and Protection of Privacy Act, R.S.O. 1990, c. M.56 (Ontario; consolidated to 2026-10-20). Municipal Government Act, S.N.S. 1998, c. 18 (Nova Scotia; consolidation date not recorded; Part XII, fire services, and Part XX, freedom of information). Personal Health Information Act, S.N.L. 2008, c. P-7.01 (Newfoundland and Labrador; consolidated to 2026-05-15). Personal Health Information Act, S.N.S. 2010, c. 41 (Nova Scotia; consolidation date not recorded). Personal Health Information Privacy and Access Act, S.N.B. 2009, c. P-7.05 (New Brunswick; consolidated to 2024-01-01). Personal Health Information Protection Act, 2004, S.O. 2004, c. 3, Sched. A (Ontario; consolidated to 2026-10-20). Personal Information Protection and Electronic Documents Act, S.C. 2000, c. 5 (Canada; consolidated to 2026-09-30). Protection of Privacy Act, S.A. 2024, c. P-28.5 (Alberta; consolidated to 2025-12-11). Right to Information and Protection of Privacy Act, S.N.B. 2009, c. R-10.6 (New Brunswick; consolidated to 2025-02-13). The Freedom of Information and Protection of Privacy Act, C.C.S.M. c. F175 (Manitoba; consolidated to 2026-10-23). The Health Information Protection Act, S.S. 1999, c. H-0.021 (Saskatchewan; consolidated to 2024-08-13). The Local Authority Freedom of Information and Protection of Privacy Act, S.S. 1990-91, c. L-27.1 (Saskatchewan; consolidated to 2024-08-22). The Occupational Health and Safety Regulations, 2020, R.R.S. c. S-15.1, Reg. 10 (Saskatchewan; consolidated to 2021-04-07). The Personal Health Information Act, C.C.S.M. c. P33.5 (Manitoba; consolidated to 2026-10-23).