Québec · Loi 5 (renseignements de santé)

Health-information access and privacy for Québec bodies

AccessPoint manages Law 5 access and correction requests, the right to restrict access, confidentiality-incident notification, and privacy assessments — pre-configured for Québec, French-first, and running inside your own Microsoft 365 tenant.

Start Free Trial Request a Demo

Québec — Renseignements de santé at a glance

Access deadline
A maximum of 30 days to respond to a request for one's own health and social services information
Correction
Individuals may request correction of their information
Access fees
Access to one's own information is generally provided without charge, subject to reasonable reproduction or transcription costs
Breach notification
Report confidentiality incidents to the CAI and affected persons where there is a risk of serious harm, and keep a register of incidents
Oversight
Commission d'accès à l'information (inspection and adjudicative powers; penal sanctions up to $150,000)
Languages
French (primary), with English

Built for Québec — Renseignements de santé

One platform for the whole access-and-privacy mandate, pre-configured for this regime and running in your own Microsoft 365 tenant.

Law 5 access and correction

Access to a person's own health and social services information on the 30-day timeline, correction requests, and defensible records — all built on Microsoft 365.

The right to restrict access

Law 5 lets a person lock their information away from a designated professional, a category of professionals, certain family members, or researchers. AccessPoint records these directives and enforces them in your disclosure decisions.

Confidentiality incidents

Log a confidentiality incident, assess the risk of serious harm, notify the CAI and affected persons, and maintain the register of incidents Law 5 requires.

Privacy assessments (EFVP)

Run the privacy impact assessment expected before a new use, communication, or system involving health information — a guided questionnaire, a risk register, and an exportable record.

French-first, aligned with Law 25

Built for a French-language program and mapped to the Law 25 requirements Law 5 mirrors, so your health-sector and general privacy obligations stay in step.

In your own Québec tenant

Every request, assessment, and record stays inside your own Microsoft 365 and Azure tenant — no third-party cloud, no cross-border transfers, no per-user fees.

The Law 5 mandate

Law 5 rewrote how Québec health information is accessed and protected. AccessPoint runs it.

Since July 1, 2024, the Loi sur les renseignements de santé et de services sociaux — Law 5 — has governed health and social services information across Québec, with further provisions phasing in on a later schedule. It gives every person a right of access to and correction of their own information, a new right to restrict who may see it, and it requires bodies to notify the Commission d'accès à l'information and affected individuals of confidentiality incidents that carry a risk of serious harm. Law 5 carries much of Law 25 into the health sector. AccessPoint runs access, correction, restriction directives, incident notification, and privacy assessments on one platform, in your own tenant.

Right to restrict Directives that limit who may access a person's health information, tracked and enforced.
Incident notice Notification to the CAI and affected persons, with the register Law 5 requires.
Privacy assessments EFVP-style assessments aligned with Law 25, on the same platform.

Configured out of the box

Installing the ca-qc-rsss configuration pack seeds your tenant with everything this regime needs — a starting point you can adjust, not a lock-in.

Related guide: FOI Workflow Quick Check
  • Law 5 (LRSSS) as the legal-authority spine, mapped to the Law 25 requirements it mirrors
  • Québec statutory-holiday calendar and 30-day access due-date rules
  • Access, correction, and communication grounds under Law 5
  • Right-to-restrict-access directives for professionals, categories, family, and researchers
  • Confidentiality-incident assessment, CAI notification, and incident register
  • Access logging and the annual use-reporting expected of health and social services bodies
  • Privacy assessment (EFVP) templates for new uses, communications, and systems
  • French-first correspondence and notification templates

Québec — Renseignements de santé Questions

What is Law 5 and when did it take effect?
Law 5 is Québec's Loi sur les renseignements de santé et de services sociaux (LRSSS, CQLR c. R-22.1). Its core provisions came into force on July 1, 2024, with certain provisions phasing in later. It governs how health and social services bodies collect, use, communicate, and give individuals access to health information, and AccessPoint ships pre-configured for it.

How does Law 5 relate to Law 25?
Law 5 is the health-sector regime and carries much of Law 25 into it — privacy by default, consent, and privacy assessments — while the Commission d'accès à l'information oversees both. AccessPoint maps Law 5 to the Law 25 requirements it mirrors so your health and general privacy programs stay aligned.

Does AccessPoint support the right to restrict access and confidentiality-incident reporting?
Yes. AccessPoint records a person's directives to restrict who may see their information and enforces them in disclosure decisions, and it logs confidentiality incidents, assesses the risk of serious harm, and produces notifications to the Commission d'accès à l'information and affected individuals, with the register Law 5 requires.

Where does Québec health data reside?
Entirely within your own Microsoft 365 and Azure tenant, presented in a French-first interface. Requests, records, assessments, and audit history never leave your control — no third-party cloud and no cross-border data transfers.

Run Law 5 Access, Restriction, and Incidents in One Platform

Try AccessPoint free for 30 days, pre-configured for Québec. No credit card required.

Start Free Trial