Québec Law 25 and health information

Before communicating personal information outside Québec, a business must do a privacy impact assessment that weighs the sensitivity of the information, its purposes, the protections (including contractual ones), and the legal framework of the place it is going (Private Sector Act, s. 17). The transfer may go ahead only if protection would be adequate, under a written agreement. The same applies to outsourcing.

Public bodies are held to the same test (Access Act, s. 70.1). Health and social services bodies need a PIA before communicating outside Québec, and before any service contract "involving the communication of information outside Québec" (Act respecting health and social services information, ss. 73 and 78).

Note the line is the Québec border: a vendor storing in Toronto is outside Québec.