I have now looked through every Canadian province/territory's health information privacy acts and regulations, and here are my biggest conclusions:
1) these all suck
2) your health information isn't that protected depending on who holds it, such as employers
3) whoever wrote the Health Information Act for Northwest Territories was either on their deathbed or on crack when they wrote it, and the Hospital Insurance and Health and Social Services Administration Act is crap. The acts both have some endless looping.
4) PEI has by far the most adorable Act and attendant website/materials and is my favourite (though it seems a tad broad compared to others - not a complaint, just an observation!)

Sidebar, PIPEDA has a line to define the meaning of "should" and I feel like that was put in there passive-aggressively, and I enjoy the heck out of it.