Canada’s Health-Data Standard Is Open for Comment
Matthew Leo · Published November 6, 2026 · Canada Tech
Canada has opened a public review of a proposed healthcare data-governance specification, giving patients, clinicians, administrators and technology vendors until December 4 to comment.
The Digital Governance Standards Institute posted draft D3 of DGSI/PAS 142 on November 3. Its working title is Data Governance Framework for Healthcare Organizations. The project is funded by the Standards Council of Canada and is intended to help healthcare delivery organizations clarify responsibility for data across clinical care, operations, research and other uses.
The distinction between a draft specification and a binding rule matters. The catalogue lists PAS 142 as “in development” and “not published.” It is not legislation, and the public-review notice does not make it a mandatory procurement requirement. Its immediate value is that it exposes a proposed governance baseline before the wording is finalized.
What the review should test
Healthcare data governance can become a collection of broad principles unless every responsibility has an owner, a decision path and evidence. Reviewers should ask whether the draft gives organizations enough precision in seven areas:
- Accountability: Who approves new data uses, who can stop them, and what evidence reaches the board?
- Patient and community rights: How are access, correction, consent, notice and challenge handled in practice?
- Indigenous data governance: Does the framework respect First Nations, Inuit and Métis authority and established data-sovereignty principles rather than treating all health data as institutionally interchangeable?
- Secondary use: What separates direct care from research, quality improvement, commercial analytics and model training?
- Vendors and cloud services: Which contract terms cover location, subcontractors, deletion, portability, audit rights and incident response?
- Data quality and provenance: Can a clinician or researcher tell where a field came from, when it changed and whether it is fit for the proposed use?
- Security and continuity: Are recovery, identity, logging and emergency access treated as governance responsibilities rather than only technical controls?
Those questions are especially important for smaller clinics and community organizations. A framework that works only for large hospitals with dedicated privacy, legal and data offices will not meet the notice’s stated aim of adapting to different sizes and maturity levels.
The AI question belongs inside data governance
DGSI’s announcement describes a broad healthcare data framework, not an AI-only standard. That is useful because an AI system inherits the permissions, gaps and ambiguities of the data environment around it.
A strong comment can ask the draft to make model training, retrieval, automated recommendations and vendor reuse explicit. Organizations need to know whether the same approval covers bedside care and training a commercial model, how representative data is evaluated, how outputs are monitored and how a patient can challenge an automated result.
Mapletechie’s Canadian health-AI procurement checklist addresses the contract and assessment steps that begin before a tool is purchased. PAS 142 could provide a broader organizational layer: who owns the underlying data decisions before any particular system is selected.
How to submit a useful comment
The public-review notice invites healthcare professionals, patients, families, community representatives and other interested parties. Reviewers can use the linked document viewer to comment on the draft.
Specific comments are more useful than general approval or opposition. Identify the clause, describe the real workflow it affects, explain the risk or ambiguity and propose alternate wording. State whether the problem affects a hospital, clinic, research institution, patient group, vendor or another setting.
Where a requirement creates cost or staffing demands, quantify them if possible. Where a provision seems too flexible, name the evidence an auditor or patient should be able to see. Where a term overlaps provincial privacy or health-information law, identify the jurisdiction rather than assuming one Canadian rule applies everywhere.
What remains unconfirmed
No independent report on the November 3 public-review opening was located before this article was prepared. The dates, status and description therefore come from DGSI’s own catalogue and announcement. The underlying project is not new: DGSI announced work on the framework in June, and specialist legal coverage reported that development at the time.
The review closes December 4. The more consequential milestone will be the final text and the organizations that choose to adopt, require or assess against it. Until then, PAS 142 should be read as a proposal that Canadians can still change.
Tags: Canada, digital health, data governance, privacy