Governance, risk & compliance

Saskatchewan Health Information Protection Act (HIPA) S.S. 1999, c. H-0.021; H-0.021 Reg 2 (2023)

The Health Information Protection Act (HIPA), S.

S. 1999, c.

H-0. 021, and The Health Information Protection Regulations, 2023 (H-0.

021 Reg 2). HIPA binds trustees that have custody or control of personal health information: government institutions, the provincial health authority and health care organizations, licensees of personal care homes, mental health facilities, ambulance services, laboratories and pharmacies, regulated health professionals, health professional bodies, and people who provide a health service under an agreement with another trustee (s.

2(1)(t)). An information management service provider (IMSP, s.

2(1)(j)) is a person or body that processes, stores, archives or destroys a trustee’s records containing personal health information, or provides information management or information technology services to a trustee for those records, which describes a managed service provider. Before giving personal health information to an IMSP the trustee must have a written agreement that governs access, use, disclosure, storage, archiving, modification and destruction, and provides for protection (s.

18(2), effective 1 August 2023). The Regulations (s.

7) require the agreement to describe the service, set out the IMSP’s security and safeguarding obligations, provide for destruction, limit the IMSP to the permitted purposes, require compliance with the agreement, and require the IMSP to notify the trustee at the first reasonable opportunity of any breach of the agreement. The IMSP may not use or disclose the information except for the permitted purposes and must follow the agreement (s.

18(3) and (4)). Section 16 requires policies and procedures for administrative, technical and physical safeguards; the Regulations (s.

5) require staff training and a signed pledge of confidentiality; s. 17 and Regulations s.

6 require a written retention and destruction policy (at least 10 years after the last episode of care, or until age 20 for a minor, or a retention schedule) with a destruction record. HIPA has no statutory duty to notify individuals or the Information and Privacy Commissioner (IPC) of a breach; the IPC’s Privacy Breach Guidelines for Trustees (August 2022) call notifying affected individuals and the IPC best practice.

A trustee or IMSP that fails to keep information secure commits an offence unless it took all reasonable steps (s. 64(1.

1) and (1. 2)); the fine is up to $50,000 and a year in jail for an individual and up to $500,000 for a corporation, and employee snooping is its own offence (s.

64(2), (3. 1), (3.

2)). No data residency rule was found in HIPA or its Regulations.

Saskatchewan has no private-sector privacy statute found, and HIPA is not on the Privacy Commissioner of Canada’s list of health laws substantially similar to PIPEDA, so PIPEDA applies to commercial activity in Saskatchewan. This framework applies the existing Act to AI tools; it does not add AI rules.

General information, not legal advice.

Assessment tiers & levels Lavawall supports

Lavawall assesses Saskatchewan Health Information Protection Act (HIPA) at every level below, so you can start where you are and step up as your program matures.

How Lavawall® helps you get to Saskatchewan Health Information Protection Act (HIPA) compliance

Most of Saskatchewan Health Information Protection Act (HIPA) comes down to technical controls you have to run and prove: keeping systems patched, hardening configuration, detecting breaches early, backing up what matters, controlling access, and keeping evidence that all of it actually happened. Lavawall® runs those controls across Windows, macOS, Linux, and Microsoft 365 / Google Workspace from one console, maps them to Saskatchewan Health Information Protection Act (HIPA), and tracks your posture continuously instead of once a year at audit time.

• Assess your current state against Saskatchewan Health Information Protection Act (HIPA) in the Lavawall GRC module, with the questionnaire and control set built in.
• Remediate the gaps with the same platform — automated patching, configuration fixes, backups, and access review — not a separate project.
• Evidence everything with timestamped, exportable records auditors, insurers, and clients accept.

Related

Lavawall® supports Saskatchewan Health Information Protection Act (HIPA) as part of a built-in catalogue of compliance frameworks. Framework requirements are summarized for planning purposes; always confirm the current official text before certifying.