Anonymised, illustrative composite. In an ordinary deal, confidentiality is a contract problem solved by an NDA. In a health file it is a condition precedent to lawful disclosure, and the agreement the statute requires is not the agreement the buyer had drafted.
At a glance
A buyer building a multi-site rehabilitation group agreed heads of terms on four clinics for $6,800,000. Its diligence request list was the one it used on every deal, and item 14 read: customer list with contact details, visit history and revenue per customer for the last 36 months. Applied to 23,400 active patient records at a physiotherapy and chiropractic group, that is a request for a complete clinical and billing extract.
The seller's counsel refused it. The buyer's deal lead read the refusal as posturing and escalated. It was not posturing.
The starting position under the Personal Health Information Protection Act, 2004 is a prohibition, not a permission. Section 29: “A health information custodian shall not collect, use or disclose personal health information about an individual unless, (a) it has the individual's consent under this Act and the collection, use or disclosure, as the case may be, to the best of the custodian's knowledge, is necessary for a lawful purpose; or (b) the collection, use or disclosure, as the case may be, is permitted or required by this Act.”
The clinics' operators are custodians: s.3(1) paragraph 1 includes “A health care practitioner or a person who operates a group practice of health care practitioners.” There is no patient consent to disclosure for a sale process. So everything turns on whether the Act permits it.
It does, narrowly. Section 42(1): “A health information custodian may disclose personal health information about an individual to a potential successor of the custodian, for the purpose of allowing the potential successor to assess and evaluate the operations of the custodian, if the potential successor first enters into an agreement with the custodian to keep the information confidential and secure and not to retain any of the information longer than is necessary for the purpose of the assessment or evaluation.”
Read as a checklist, that subsection carries four constraints the buyer's NDA did not satisfy. The recipient is the potential successor. The purpose is to assess and evaluate the operations of the custodian. The agreement must be entered into first. And the agreement must contain a retention limit tied to the purpose, which survives a deal that never completes.
The buyer wanted 41 fields per patient across 23,400 records. What it actually needed, when the request was tested against the questions it was trying to answer, was seven aggregate measures: visits by service line by month, payer mix as percentages, new-patient counts, discharge and re-referral rates, cohort retention at 3, 6 and 12 months, revenue per visit by clinician grade, and cancellation rates.
None of those seven requires an identifier. The rebuild cost about $28,000 of the seller's bookkeeping and clinical-systems time, and added three weeks. The buyer's alternative — insisting on the extract — would not have produced a better answer to any of its seven questions.
Two further sections narrowed the room before s.42(1) was reached at all. Section 30(1): “A health information custodian shall not collect, use or disclose personal health information if other information will serve the purpose of the collection, use or disclosure.” And s.30(2): “A health information custodian shall not collect, use or disclose more personal health information than is reasonably necessary to meet the purpose of the collection, use or disclosure, as the case may be.”
That is a hard gate for a diligence request, because if aggregate figures answer the question, the identifiable data may not be disclosed at all. Section 42(1) is not a licence to hand over the file; it is a permission that only begins to operate on what s.30 has not already excluded.
The recipient constraint mattered as much. Section 42(1) names the potential successor. The buyer's lender, its quality-of-earnings accountants and the analytics vendor it had planned to use are not named in the subsection, and the seller was not prepared to treat them as covered by implication. The structure had to be drawn around the word the statute uses.
The exposure is real and gated. Section 72(1)(a) makes it an offence where a person “wilfully collects, uses or discloses personal health information in contravention of this Act or its regulations”, and s.72(2) sets the penalty for a person who is not a natural person at “a fine of not more than $1,000,000”, with $200,000 or up to a year's imprisonment for an individual. Section 72(5) requires the Attorney General's consent before a prosecution is commenced. Note the qualifier in s.72(1)(a): the offence is a wilful contravention. An inadvertent over-disclosure is a breach of the Act without necessarily being an offence under that paragraph — but it is still a disclosure the custodian was prohibited from making, with the regulatory and civil consequences that follow.
A two-stage room. Stage one carried aggregate counts and percentages identifying no individual, and satisfied the buyer's seven questions. Stage two was a s.42(1) review: a signed agreement in the statutory form entered into before anything was shown, a named two-person review team, on the seller's premises, no copying and no extraction, scoped to assessing and evaluating the operations, and a deletion and destruction certificate at the end of it.
The commercial NDA was still signed. It sat on top of the statutory permission as a contractual overlay — it was not the authority for the disclosure, and could not have been. Compare a data room leak that reached a competitor, where the same information moves under contract alone, and see customer data in a business sale: what you may actually transfer.
The seller would have made a disclosure it had no authority to make, with the corporate penalty ceiling at $1,000,000 and the individual ceiling at $200,000 or a year. That is the statutory maximum, not the expected outcome, and it is gated by the Attorney General's consent.
The more likely cost is the one that lands whether or not anyone is prosecuted: a regulator's file, a notification exercise across 23,400 patients, and a buyer whose first act as the new custodian is to explain a predecessor's breach to the patient base it just paid $6,800,000 for.
The tell was item 14 on a reused request list. A standard diligence list asks for the customer list, and in a health file that single line has to be rewritten before it is sent — not renegotiated after it arrives.
The second tell is a seller's refusal that comes from counsel rather than from the principal. A vendor protecting its negotiating position refuses through the banker. A vendor that has been told it cannot lawfully comply refuses through the lawyer.
A 30-minute call is enough to tell you whether AI pays for itself here.
Canadian small-business transaction data is not published anywhere, so most valuations in this country quote an American benchmark. The Deavo–Treadstone Acquisition Index is a daily record of Canadian listings built to replace that: asking-price distributions by province and city are published now, and days on market, departure rates and asking-to-sale spreads follow as the series lengthens. Leave an email and we will tell you as each measure lands.
No pitch, no listings. One email when the first report lands.
