Governance, risk & compliance

Manitoba Personal Health Information Act (PHIA) C.C.S.M. c. P33.5; M.R. 245/97

The Personal Health Information Act (PHIA), C.

C. S.

M. c.

P33. 5, and the Personal Health Information Regulation, M.

R. 245/97.

PHIA binds trustees: health professionals, health care facilities (hospitals, personal care homes, psychiatric facilities, medical clinics, laboratories and others set out in s. 1 and the Regulation), public bodies and health services agencies that collect or maintain personal health information.

It also reaches the people who work for them: an information manager (s. 1) is a person or body that processes, stores or destroys personal health information for a trustee or provides information management or information technology services to a trustee, which describes a managed service provider.

A trustee may give personal health information to an information manager only under a written agreement that protects it against unauthorized access, use, disclosure, destruction or alteration (s. 25(3)); the information manager must meet the same protection, retention and destruction requirements as the trustee (s.

25(4)), and the information stays the trustee’s for the purposes of the Act (s. 25(5)).

Section 18 requires reasonable administrative, technical and physical safeguards and the Regulation (ss. 2 to 8) adds a written security policy and procedures, a record of user activity for each electronic system that is kept for at least three years and audited, staff training, a signed pledge of confidentiality, and an audit of safeguards at least every two years.

Since the 2021 amendments (S. M.

2021, c. 47, in force 1 January 2022), a trustee must tell an individual as soon as practicable about a privacy breach that could reasonably be expected to create a real risk of significant harm, and must also notify the Ombudsman (s.

19. 0.

1; Regulation ss. 8.

7 to 8. 9).

Offences, including failing to give that notice, carry fines up to $50,000, and directors and officers who authorize or acquiesce can be fined too (ss. 63 and 64).

The Ombudsman investigates and audits (Parts 4 and 5). No data residency rule was found in PHIA or its Regulation.

Manitoba has no private-sector privacy statute in force that was found: The Personal Information Protection and Identity Theft Prevention Act (C. C.

S. M.

c. P33.

7) comes into force on proclamation (s. 45) and no proclamation was found, and PHIA is not on the Privacy Commissioner of Canada’s list of health laws substantially similar to PIPEDA, so PIPEDA applies to commercial activity in Manitoba.

The Public Sector Artificial Intelligence and Cybersecurity Governance Act (S. M.

2026, c. 43, assented 1 June 2026) is not in force and applies only to public sector entities that regulation prescribes.

This framework applies the existing Act to AI tools; it does not add AI rules. General information, not legal advice.

Assessment tiers & levels Lavawall supports

Lavawall assesses Manitoba Personal Health Information Act (PHIA) at every level below, so you can start where you are and step up as your program matures.

How Lavawall® helps you get to Manitoba Personal Health Information Act (PHIA) compliance

Most of Manitoba Personal Health Information Act (PHIA) comes down to technical controls you have to run and prove: keeping systems patched, hardening configuration, detecting breaches early, backing up what matters, controlling access, and keeping evidence that all of it actually happened. Lavawall® runs those controls across Windows, macOS, Linux, and Microsoft 365 / Google Workspace from one console, maps them to Manitoba Personal Health Information Act (PHIA), and tracks your posture continuously instead of once a year at audit time.

• Assess your current state against Manitoba Personal Health Information Act (PHIA) in the Lavawall GRC module, with the questionnaire and control set built in.
• Remediate the gaps with the same platform — automated patching, configuration fixes, backups, and access review — not a separate project.
• Evidence everything with timestamped, exportable records auditors, insurers, and clients accept.

Related

Lavawall® supports Manitoba Personal Health Information Act (PHIA) as part of a built-in catalogue of compliance frameworks. Framework requirements are summarized for planning purposes; always confirm the current official text before certifying.