Map the information duties on each side of the service
Ontario's privacy commissioner explains health privacy rights and custody. Identify the PHIPA arrangement for the Ottawa service. If a Quebec pathway is added, obtain a separate assessment of the organizations, records, and applicable Quebec duties.
Document where intake answers, notes, attachments, pharmacy messages, and support records move. The data may cross a provincial boundary even when the patient does not. Have privacy advisers assess the actual collection and disclosure rather than using a brand-level statement about Canadian hosting.
Set access by role and purpose. Administrative staff need sufficient information to help with appointments, but that does not automatically justify unrestricted access to clinical history. Test exports, search, and linked support products using synthetic records.
Prepare patient access, correction, incident, retention, and supplier-exit procedures. Check that the responsible organization can identify the complete record and provide an appropriate response. Make the language of that response understandable to the patient without assuming that a particular residence determines their preferred language.