Quebec Law 5September 13, 2026

Quebec Law 5 and Law 25: how do you distinguish the information involved?

Prepare the facts needed to examine health-information rules: organization, activities, data and exchanges within a project.

Introduction

To distinguish the frameworks commonly called “Law 5” and “Law 25,” start with the organization, the information and its handling. A clinic application or a task labelled administrative does not, by itself, establish the applicable rules. A factual map helps prepare the project’s legal review.

Clarify what the names refer to

Law 25 amended Quebec privacy legislation. Here, “Law 5” refers to the framework of the Act respecting health and social services information presented by the Quebec government. These short names should not replace identification of the applicable legislation.

The purpose here is to prepare information for competent review. We do not propose an automatic rule assigning one law to an entire clinic, every supplier or any piece of information that mentions health.

Renseignements de santé et de services sociaux — information pour les professionnels

Principaux changements apportés par la Loi 25

Look beyond the process name

Quebec explains that certain information collected for user registration or care management can fall within the definition of health and social services information, in the context of the organizations concerned. Calling a process “administrative” is therefore not enough to conclude that it involves no health information.

To prepare the analysis, describe data categories without reproducing real records. What does the tool receive and produce? An attachment, a free-text note or an appointment reason may change the questions to examine. Identify unknowns instead of filling gaps with assumptions.

Renseignements de santé et de services sociaux — information pour les professionnels

Professionals protecting health information across several systems and access zones — Protecting health information depends on the actual data journey, the people who access it and the systems that receive it.

A scoping sheet with five questions

First: which organization carries out the activity, and in what role? Second: which service or workflow is involved? Third: what information enters, moves through and leaves it? Fourth: which participants and suppliers contribute? Fifth: what decision must be made before the project proceeds?

Add available documents and their owners: service description, supplier terms, exchange diagram and access inventory. A hosting address does not describe every possible access. The sheet gathers facts; determining the applicable rules and required permissions is separate work.

Fictional example: sorting appointment requests

A fictional clinic is considering a tool that sorts requests arriving in a shared inbox. The project is described as administrative assistance. The team finds that messages may contain a consultation reason and attachments. The input therefore needs a more precise description than “incoming emails.”

Before a trial, the team can use entirely fictional data to describe the intended workflow: receipt, suggested classification, human review and filing. It then prepares questions about participants, permissions and supplier conditions. This example does not authorize use of real records or determine the applicable legal framework.

Turn unknowns into decisions to prepare

Separate three categories in the working record: confirmed facts, legal questions and technical choices. For each question, identify who must provide information or conduct the review. A supplier’s unsupported statement that it is “compliant” leaves an open question about scope.

The review should identify the workflow examined, information obtained, assumptions and conditions for proceeding. If the project changes through new data, access or a supplier, revisit the affected elements. This avoids applying a conclusion to an operation different from the one examined.

Frequently asked questions

Does Law 5 replace Law 25 for every health organization?

A general conclusion does not replace examination of the organization, activities and information. Have the relevant framework identified for the workflow under review, along with situations outside that review.

Do we need to send a patient record to scope the need?

A description of categories, tools and workflow is enough to prepare initial questions. Use a fictional example and agree separately on any access needed for an intervention.

Does this sheet constitute a privacy impact assessment?

No. It gathers facts to prepare an assessment or a scope decision. A privacy impact assessment has its own scope and method, to be defined for the project and applicable framework.