Governance, risk & compliance

Quebec Act respecting health and social services information (S.Q. 2023, c. 5) SQ 2023, c 5 (main parts in force 1 Jul 2024)

Read 24 Oct 2026.

An Act respecting health and social services information and amending various legislative provisions, S. Q.

2023, c. 5 (Bill 3), was assented to on 4 April 2023 and was read in the annual statute as published by the Québec Official Publisher; the consolidated chapter number (R-22.

1) was not confirmed from a consolidated text. Under s.

282 provisions come into force on dates set by the Government. Decree 946-2024 (5 June 2024, Gazette officielle du Québec, 12 June 2024) fixed 1 July 2024 for a long list of provisions, including ss.

1 to 89 and most of ss. 90 to 173 and the schedules, which brings in the incident, governance and penal provisions described here; the governance regulation (Règlement sur la gouvernance des renseignements de santé et de services sociaux, Minister’s order 2024-010) also takes effect on 1 July 2024.

Chapters: I General (ss. 1-12), II Collection and keeping (ss.

13-16), III Rights of access by the person concerned (ss. 17-43), IV Access by a service provider or researcher (ss.

44-61), V Use within a body (ss. 62-65), VI Communication (ss.

66-89), VII Governance and responsibilities (ss. 90-111), VIII Oversight by the Commission d’accès à l’information (ss.

112-128), IX Recourses (ss. 129-158), X Penal provisions (ss.

159 and following). Key duties: information is confidential unless used or communicated as the Act allows (s.

5); the highest authority of a body is the person in charge of the protection of information (s. 100); a body must log all accesses, uses and communications (s.

103, which Decree 946-2024 did not list for 1 July 2024; s. 265 sets a transitional register of communications until s.

103 is in force, and its in-force date was not read), adopt a governance policy (s. 105), conduct a privacy impact assessment for technology projects (s.

106) and keep a register of technology products (s. 107); a confidentiality incident that presents a risk of serious injury must be notified promptly to the Minister and the Commission and to the people concerned (s.

108), the body keeps an incident register (s. 110); the Commission can order protective measures (s.

123) and its orders become enforceable (s. 127).

Offences: ss. 159 and 160, with fines of $1,000 to $10,000 (natural persons) and $3,000 to $30,000 (others) for failing to report an incident, and $5,000 to $100,000 and $15,000 to $150,000 for unlawful communication, selling information, or ignoring a Commission order.

This framework does not repeat QC_LAW25 (private sector) and covers health and social services information held by bodies as the Act defines them (s. 4).

Not read: the regulations under the Act other than the governance regulation’s Gazette notice, and the consolidated French text. General information, not legal advice.

Assessment tiers & levels Lavawall supports

Lavawall assesses Quebec Act respecting health and social services information (S.Q. 2023, c. 5) at every level below, so you can start where you are and step up as your program matures.

How Lavawall® helps you get to Quebec Act respecting health and social services information (S.Q. 2023, c. 5) compliance

Most of Quebec Act respecting health and social services information (S.Q. 2023, c. 5) comes down to technical controls you have to run and prove: keeping systems patched, hardening configuration, detecting breaches early, backing up what matters, controlling access, and keeping evidence that all of it actually happened. Lavawall® runs those controls across Windows, macOS, Linux, and Microsoft 365 / Google Workspace from one console, maps them to Quebec Act respecting health and social services information (S.Q. 2023, c. 5), and tracks your posture continuously instead of once a year at audit time.

• Assess your current state against Quebec Act respecting health and social services information (S.Q. 2023, c. 5) in the Lavawall GRC module, with the questionnaire and control set built in.
• Remediate the gaps with the same platform — automated patching, configuration fixes, backups, and access review — not a separate project.
• Evidence everything with timestamped, exportable records auditors, insurers, and clients accept.

Related

Lavawall® supports Quebec Act respecting health and social services information (S.Q. 2023, c. 5) as part of a built-in catalogue of compliance frameworks. Framework requirements are summarized for planning purposes; always confirm the current official text before certifying.