SecurityBrief Canada - Technology news for CISOs & cybersecurity decision-makers
Flux result 0333da61 fac9 4d8f 9326 1b1ff888419b

Bill S-5 on the table: An attempt to end health data silos

Wed, 8th Apr 2026

More than 95 per cent of Canadian physicians use electronic medical record systems. Yet on any given day, a patient transferred from a family doctor's office to a specialist, an emergency room, or a hospital in the next province might arrive with no digital record at all.

In Canada, many patient files are locked inside proprietary software that simply refuses to speak to anyone else. It is a dysfunction that has persisted for decades, and the federal government is now attempting, for the second time in two years, to legislate its way out of it.

Bill S-5, the Connected Care for Canadians Act, was introduced in the Senate of Canada on February 4, 2026, by Health Minister Marjorie Michel. The bill is a direct revival of Bill C-72, which had cleared first reading in the House of Commons in June 2024 before dying on the Order Paper when Parliament was prorogued in January 2025. This time, the government chose to begin the legislative process in the Senate rather than the Commons (a procedural choice intended to advance parallel legislative tracks in a minority Parliament).

"The Connected Care for Canadians Act is about empowering Canadians to securely access their own health data, so patients and those involved in their care have the information they need to make the right decisions at the right time. This legislation is a critical step towards a more connected health care system that supports all Canadians," said Michel in a public statement.

At the time of publication, the Senate had completed a second reading, with the bill referred to the Standing Senate Committee on Social Affairs, Science and Technology.

What the Bill Actually Does

At its core, Bill S-5 does two things: it requires interoperability and prohibits data blocking.

The interoperability requirement obliges every health information technology (HIT) vendor that licenses, sells, or supplies software-as-a-service in Canada to ensure that their product allows users to "easily, completely, and securely access, use, and exchange all electronic health information" with other systems. The technical standards that define what "interoperable" actually means (the specific protocols and specifications) will be set through regulations after royal assent, giving Health Canada flexibility to align with emerging international frameworks.

The government claims that only 29 per cent of Canada's primary care providers make patient information available digitally outside their own practice.

Additionally, Canada's health system has no equivalent to the pan-European My Health EU portal or the US interoperability rules under the 21st Century Cures Act, both of which the federal government has cited as models.

The data-blocking prohibition is a direct response to a pattern the Competition Bureau of Canada had flagged: vendors imposing excessive wait times, delivering data in unreadable formats, or erecting contractual barriers to make it difficult for health-care providers to switch systems or share records. Under Bill S-5, any practice or act that "prevents, discourages, or interferes" with access to or exchange of electronic health information would be explicitly prohibited.

Enforcement would be handled through a complaint-and-compliance-verification mechanism, with the government empowered to issue administrative monetary penalties against non-compliant vendors, the exact amounts to be set by regulation.

A Deliberately Limited Federal Footprint

Bill S-5 is designed to apply only where provinces and territories have not already enacted substantially similar or stronger legislation. The Governor in Council may, by order, trigger the Act's application in a given province if satisfied that the jurisdiction's own requirements fall short of the federal standard.

The bill's real-world impact will vary considerably by region. Provinces with advanced digital health frameworks may opt out entirely, while others in earlier stages of health IT adoption would fall under federal rules.