PII vs PHI Data Security
A practical map of PII and PHI obligations across Canada and the US: HIPAA and the business associate trigger, the FTC Health Breach Notification Rule, PIPEDA, Ontario PHIPA and Quebec Law 25, with a control table by data type.
PII vs PHI for Health-Tech and SaaS Companies: which law applies when, and what each data type actually needs
PII (personally identifiable information) is any information about an identifiable person. PHI (protected health information) is a narrower US legal term: individually identifiable health information held or transmitted by a HIPAA covered entity or its business associate. Canada has no "PHI" label; it regulates personal health information through PIPEDA and provincial health laws instead.
Every few weeks we get a version of the same call. A 40-person health-tech company has a hospital pilot on the table, procurement has sent a business associate agreement, and the CTO wants to know whether signing it makes the whole platform "HIPAA". The honest answer: part of it, and the part that matters most is the one nobody has mapped. Before encryption or audit logs, we ask where patient data enters, where it lands, and who chose to put it there.
What is the difference between PII and PHI?
PHI is PII with a legal context attached. A name and date of birth in your CRM is PII. Put that record inside a system a clinic, health plan or clearinghouse pays you to operate, and it becomes PHI under HIPAA.
The context test surprises founders. A sleep score in a direct-to-consumer app is not PHI, because no covered entity is involved. A plain list of patient names in a dental clinic's scheduling tool is PHI, with no diagnosis in sight.
Canada skips the label. PIPEDA treats health information as sensitive, Quebec names medical information as sensitive, and Ontario's PHIPA governs health information held by custodians and their vendors.
Which law applies to your health data, and when?
Most companies hit more than one regime.
Your situation | Law that applies | Breach trigger and clock | What vendors get wrong |
|---|---|---|---|
A US clinic, health plan or clearinghouse pays you to handle its patient data | HIPAA, as a business associate | Notify the covered entity within 60 days of discovery | Treating the BAA as a formality |
Consumers choose your US health app, no covered entity involved | FTC Health Breach Notification Rule, plus state laws | Includes unauthorized disclosure, such as to an ad pixel; 60 days | Treating "not HIPAA" as "not regulated" |
You serve Canadian customers commercially | PIPEDA | Real risk of significant harm; log every breach | Logging only reportable incidents |
You serve an Ontario hospital, clinic or pharmacy | PHIPA, through the custodian | Custodian notifies patients at the first reasonable opportunity | Using patient data for product analytics |
You hold Quebec residents' personal information | Quebec Law 25 | Risk of serious injury: notify the regulator and people promptly; keep a register | Skipping the assessment before data leaves Quebec |
When does a SaaS company become a HIPAA business associate?
Under the HHS business associate guidance, a business associate is anyone outside the covered entity's workforce who performs a service on its behalf involving PHI. The trigger is the relationship, not the data type.
Two points catch SaaS teams out. First, cloud storage counts. HHS states in its cloud computing FAQ that a provider storing ePHI is a business associate even if it cannot view the data because it is encrypted. Second, the chain continues: any sub-processor that touches the PHI needs its own BAA with you.
Read the BAA's reporting clause carefully. Hospitals routinely ask for 5 or 10 days, far shorter than the 60-day outer limit in the HHS Breach Notification Rule. Negotiate a number your incident process can actually meet.
When are you NOT a HIPAA business associate?
Most vendors skip this question, and it saves the most money. You are generally not a business associate when:
A consumer picks your app and enters their own data. Per the HHS health app scenarios, a patient sending a summary to their doctor does not change that.
You only transmit data, the narrow "conduit" exception. Almost no SaaS product qualifies, because SaaS stores data.
Your access to PHI is incidental.
The data is de-identified before it reaches you.
Not being a business associate is not a free pass. A direct-to-consumer health app falls under the FTC Health Breach Notification Rule, which carries civil penalties of up to $53,088 per violation. The FTC's first case under that rule, against GoodRx in 2023, was not about hackers. It was about health data shared with advertising platforms, and it ended in a $1.5 million civil penalty. Washington's My Health My Data Act adds consent rules for consumer health data and lets individuals sue.
How do Canadian health privacy laws change the picture?
PIPEDA covers commercial activity, including data that crosses provincial borders. The OPC's breach guidance requires you to report breaches that create a real risk of significant harm, notify affected people as soon as feasible, and keep a record of every breach for two years, reportable or not. Knowingly failing to do so is an offence with fines of up to $100,000.
Ontario's PHIPA reaches you through your customer. If you supply electronic services to a health information custodian, you may use its health information only to deliver the service and may not disclose it. Expect the custodian's contract to push breach notice and audit rights onto you. Since January 1, 2024 the IPC can issue administrative monetary penalties of up to $500,000 for organizations, and offence fines for organizations reach $1,000,000.
Quebec's Act respecting the protection of personal information in the private sector (as amended by Law 25) is the strictest of the three for a SaaS company. Health information is sensitive and needs express consent. You must run a privacy impact assessment and sign a written agreement before personal information is communicated outside Quebec, which covers your US cloud region. Administrative penalties reach $10 million or 2% of worldwide turnover, whichever is greater.
Which security controls does each data type need?
Our view: the control that separates PHI from PII is not encryption. Everyone encrypts. It is access logging someone reviews, and a contract chain you can produce.
Control | General PII | Consumer health data (non-HIPAA) | PHI (business associate) | Our opinion |
|---|---|---|---|---|
Data map and inventory | Required by every regime in practice | Required, include tracking pixels and SDKs | Required, plus a documented risk analysis | The most skipped and most valuable control |
Encryption at rest and in transit | Expected | Expected | Expected, and it can take a lost device out of breach notification | Table stakes, not a differentiator |
Role-based access and MFA | Expected | Expected | Required, scoped to the minimum necessary | Separate support access to production PHI first |
Audit logs reviewed on a schedule | Good practice | Good practice | Required, and the first thing an investigator asks for | A log nobody reads is not a control |
Third-party script review | Good practice | Critical, this is the FTC's enforcement pattern | Critical, HHS has issued tracking technology guidance | Higher priority than a new DLP tool |
Vendor contracts (BAA, DPA) | DPA | DPA plus consent records | BAA with every sub-processor touching PHI | Keep a one-page register you can hand to a customer |
Data loss prevention software | Optional | Optional | Optional, not named in the Security Rule | Buy it after the four rows above are done |
The Verizon 2026 DBIR found third-party involvement in 48% of breaches. In health data, that third party is often the vendor reading this post.
What should you do in the first 90 days?
Days 1 to 30: map and classify
List every system that receives customer data, including SDKs, support tools and AI assistants. Our data security and privacy practice starts here.
Tag each data flow as PII, consumer health data or PHI using the table above.
Pull every signed BAA and DPA into one register, with each agreement's reporting deadline.
Days 31 to 60: close the high-impact gaps
Remove or restrict third-party scripts on any page that touches health data.
Enforce MFA and separate admin accounts for anyone with production access.
Turn on audit logging for PHI stores and assign a named person to review it weekly.
If you hold Quebec data in a US region, complete the privacy impact assessment.
Days 61 to 90: prove it
Run a tabletop exercise against your shortest contractual notification deadline. Our incident response guide for small businesses has a starting script.
When you do not need a PHI program
If no covered entity pays you and you collect no consumer health data, skip the HIPAA control set. A B2B SaaS company holding business contacts needs a data map, MFA, encrypted endpoints and a breach log. That is it. Our privacy primer covers the baseline.
Do not sign a BAA "to be safe" either. It creates obligations you will not meet. We turn down HIPAA program work when the data map shows no PHI.
Frequently asked questions
Is a name and email address PHI?
In a clinic's patient portal run by a business associate, yes. In a consumer app's marketing list, no, though it is still personal information.
Does encrypting PHI mean we do not need a BAA?
No. A provider storing encrypted ePHI is still a business associate. Encryption to HHS standards can mean a lost device does not trigger notification.
Do Canadian companies need to comply with HIPAA?
Yes, if a US covered entity hires you to handle its patients' data. HIPAA follows the contract, not your head office.
What does outside help cost?
Many teams start with a cybersecurity baseline assessment. Our Virtual CISO Crawling tier starts from $2,000 a month for 15 to 20 hours; see current pricing. If you are weighing a BAA right now, book a call before you sign it.
Related Articles
Top vCISO Services for Small Businesses
Best vCISO Providers for Small Businesses - Canada
vCISO Cost Guide: What a Virtual CISO Really Costs
What Is Shadow AI?
How to Protect Data Privacy
Why Privacy Matters
Our Industry Certifications
Our diverse industry experience and expertise in AI, Cybersecurity & Information Risk Management, Data Governance, Privacy and Data Protection Regulatory Compliance is endorsed by leading educational and industry certifications for the quality, value and cost-effective products and services we deliver to our clients.
We specialize in transforming scaling SMB's, Startups, SaaS businesses in regulated industries into cyber-resilient organizations with cost-effective Virtual / Fractional CISO & AI Governance Services.
Awards & Recognition
