Counterparties that have signed a BAA are directly liable under HIPAA rules. I am concerned that some of the information on Nova Scotia`s legislation is imprecise. The restriction that health information must be stored in Canada applies only to public bodies and not to private companies. For Canadian organizations, it is important to recognize that PIPEDA only regulates the collection, use and disclosure of employees` personal data for federal plants, businesses and businesses. These are usually employers such as airlines, banks, shipping companies, and other state-regulated employers. However, this covers a very limited subset of the Canadian economy. The vast majority of employers are governed by provincial legislation. It depends on the services they provide. Remember that HIPAA only applies to certain healthcare companies in the United States.