Bill C-22 is being debated as a question about encryption. It's actually a question about consent.
In healthcare, the entire framework of data sharing is built on informed consent. A client consents to share information with their care team: specific people, specific purposes, with the right to withdraw. That's not a technical detail. It's the foundation everything else sits on.
A backdoor doesn't just weaken encryption. It breaks that model. If a ministerial order can compel access, and the company is legally barred from telling anyone it received one, then the person whose data it is has no visibility, no consent, and no recourse.
That's not lawful access. That's just access.
And once a backdoor exists, it doesn't stay open only for the people it was built for. Every cybersecurity expert who has weighed in on C-22 has said the same thing: a vulnerability built for law enforcement is still a vulnerability. In a sector already being hit by ransomware against health and community care orgs, that's not hypothetical.
The real argument isn't whether police should have lawful tools. It's who decides.
Who decides who can access it? Who decides what it can be accessed for? Who decides when those rules change? Who decides when the public finds out any of this happened?
Right now, all four questions have the same answer. And it's not the person whose data it is.
What this means for health organizations
Whatever happens with the bill, it's worth knowing where your data is hosted, which laws apply to your vendors, and what you would tell clients if the rules about who can access their information changed.
