HSA Security and Data Protection for Canadian Employers
Employers remain legally liable for HSA data breaches even when vendors manage the plans.
A Health Spending Account holds a running, digital record of an employee's health, identity, and financial details, managed by a third party. That makes it a different category of risk than a laminated insurance card in a wallet.
The mechanics explain why. An employer sets an annual budget for each employee. The employee submits a medical receipt. A third-party administrator, or TPA, reviews the claim and sends the reimbursement. By the time a single claim clears, the file behind it holds the employee's full name, date of birth, mailing address, income level, a health condition implied by the type of expense claimed, and banking details needed for the electronic transfer. Multiply that by every employee, every claim, every year a plan runs, and you don't get a benefits file. It's a growing database of some of the most personal information a person has.
Employers don't just store this data passively, either. Plan management runs through an online portal. The data moves, is queried, and gets touched by multiple user accounts across multiple systems. The TPA holds all of it on the employer's behalf, and that arrangement makes the TPA a custodian of records the employer remains legally responsible for. Part of the TPA's job is to design the plan, manage it, reimburse claims, and keep the whole thing compliant with the tax authority, and doing that well requires keeping detailed health and financial records on file, not deleting them the moment a claim clears.
The value of that combination hasn't gone unnoticed. Laurie Gatch of Norton LifeLock has described employee benefits data as "really high value identity data," precisely because it brings health information, income data, and identity details together in one place. Health records alone are sensitive. Financial records alone are sensitive. An HSA holds both, tied to a verified identity, and it sits with a vendor the employer chose on the workforce's behalf. When a system holds that much, an employer needs to give it the same scrutiny it would give any system holding sensitive personal records.
The three ways HSA and benefits data gets compromised in Canada
HSA and benefits data in Canada is compromised through three documented vectors: credential compromise by external attackers, insider access, and supply-chain exposure through subcontractors. Each has already happened, with a name attached and a mechanism that employers can study.
Start with credential compromise. In April 2026, the extortion group ShinyHunters got into a major group benefits carrier's Salesforce environment using a single employee's account, and that one foothold exposed personal information belonging to tens of thousands of people, most of them covered under one large corporate group plan. ShinyHunters works a repeatable pattern: get credentials through phishing, reused passwords, or vishing calls that trick an employee into handing over access, then export customer records in bulk before demanding payment to prevent a leak. What the group pulled out included full names, dates of birth, mailing addresses, gender, and annual income levels, enough detail to run targeted phishing campaigns, fake identity verification, or benefits-related social engineering against the people affected.
Insider access works differently but does just as much damage. In plenty of organizations, the biggest privacy risk comes from inside. It comes from people who already have authorized access and choose to misuse it. The Office of the Privacy Commissioner of Canada backs this up with data: across 2025 and 2026, mishandling of information was the leading cause of Privacy Act breaches, and employee snooping appears in the data as its own distinct, documented category. Curiosity, carelessness, or outright misconduct can each produce a serious breach, and no outside attacker needs to be involved.
Supply-chain exposure rounds out the three. In October 2025, attackers got into Freedom Mobile's account management platform through a subcontractor's compromised account, exposing customer personal details, a breach publicly disclosed that December. Around the same time, a phishing-originated breach at the Canadian Investment Regulatory Organization, first detected and disclosed in August 2025, turned out to be far bigger than first reported once the full scope was confirmed in January 2026, compromising personal and financial data for hundreds of thousands of investors. Both incidents point to the same lesson: the attack surface for any employer's benefits data runs through every vendor and subcontractor the TPA relies on, in addition to the TPA's own servers.
Knowing these three paths matters only if an employer also knows who answers for the damage once one of them is used. That's a legal question, not a technical one, and it's the question the next section takes on.
Outsourcing HSA administration to a TPA does not transfer the employer's legal responsibility
Employers often assume that when you hire a TPA to run the HSA, legal responsibility for protecting the data inside it goes with it. That assumption is wrong. No matter who administers the plan day to day, the employer stays responsible for that data.
An employer can outsource the work of adjudicating claims and issuing reimbursements. It cannot outsource the legal obligation attached to that data. Under frameworks like PIPEDA, employers carry obligations around how employee information gets handled, shared, and protected, and a breach at the vendor's end can still bring regulatory scrutiny down on the employer that chose the vendor. If leaked HSA data leads to a breach or a wave of identity theft, an employer can face a civil negligence claim, even when none of its own internal systems were touched. And when a benefits provider gets breached, the people affected are the employer's own employees, so the plan sponsor faces reputational fallout whether or not its own operations played any part in the failure.
The contract between an employer and a TPA is where this responsibility either becomes something an employer can act on, or stays a vague expectation with no teeth. A solid TPA agreement should spell out confidentiality and data protection terms, breach notification timelines that match regulatory deadlines, audit rights the employer can actually use with reasonable notice, disclosure requirements covering any subcontractors the TPA brings in, clear data ownership clauses, terms for returning or destroying data with certificates to prove it happened, and a transition plan for what happens if the employer ever switches providers. Without those terms, an employer has nothing to point to when something goes wrong, no lever to pull, no clause to enforce.
Responsibility staying with the employer raises the next question directly: if the employer is on the hook regardless, what should it actually look for before signing with a TPA in the first place?
The regulatory framework employers are operating under, including what has changed in 2026
Canadian employers managing HSA data in 2026 face a regulatory picture that has grown more demanding over the past two years, and the obligations aren't uniform. They shift depending on where employees are located.
At the federal level, PIPEDA is still the law of the land. Bill C-27 would have replaced it, but it died on the Order Paper in January 2025, and no replacement federal privacy statute has taken its place since. A new attempt is in motion: Bill C-36, the proposed Protecting Privacy and Consumer Data Act, was tabled on June 15, 2026, and currently sits at first reading in the House of Commons, with second reading not yet underway. It is not law yet. If it eventually passes, C-36 would repeal Part 1 of PIPEDA and introduce administrative penalties scaled to whichever is greater: a substantial fixed maximum, or a percentage of a company's gross global revenue. Until then, PIPEDA's existing safeguards principle already requires measures proportionate to how sensitive the information is, and benefits data, which combines health details with financial records, is near the top of that sensitivity scale.
A second layer has also arrived. The Critical Cyber Systems Protection Act, known as Bill C-8, received Royal Assent on June 15, 2026, and it introduces a cybersecurity-program obligation for designated critical systems. If you operate in a sector this act covers, check whether it applies to your own systems and vendors.
The Office of the Privacy Commissioner's enforcement posture starts with one question: were reasonable safeguards in place at the time of the breach? Documenting that due diligence beforehand is what determines how an employer fares once a regulator comes asking.
Reasonable safeguards for evaluating an HSA provider
Understanding what reasonable safeguards look like in practice is the single most useful thing an employer can do to meet its legal obligations, and a handful of concrete signals separate providers who can back up their security claims from those who can only assert them.
Start with independent verification over self-reported assurances. A SOC 2 Type 2 report is one of the more useful documents an employer can request from a prospective TPA. A vendor can fill out a security questionnaire itself, but a SOC 2 Type 2 reflects independent auditor testing of the vendor's controls against the AICPA Trust Services Criteria, carried out over a defined audit period. A self-attested questionnaire is a representation, not evidence, so an employer that relies on one alone hasn't done its due diligence.
Digital infrastructure matters just as much as the paperwork behind it. Look for electronic claim submission, receipt capture, expense categorization aligned to CRA rules, audit trails recorded on every claim action, secure document storage, and reporting built for payroll and finance teams to actually use. These aren't convenience features. An employer needs them on hand to demonstrate plan compliance to the CRA, and they show regulators what controls were actually running if a breach does occur.
Access control deserves direct questions. Ask how a provider limits internal access to employee health records. One compromised employee account was enough to get into the April 2026 breach, so role-based access controls and multi-factor authentication need to be baseline expectations, not advanced features. Confirm, too, that the contract's breach notification timeline lines up with regulatory windows. PIPEDA and Law 25 both require prompt notification, so if a provider's contract gives them an extended period to notify, it's out of step with the regulator's expectations.
Subcontractor transparency closes the list. Both the Freedom Mobile and CIRO breaches started through a subcontractor, not through the primary company's own systems. Before you sign with any TPA, ask which subcontractors will touch employee data, and whether the contract requires those subcontractors to carry the same data protection obligations down the chain. A provider built around plain documentation and digital administration, with no hidden complexity in how claims move through the system, makes all of this far easier to verify than one whose processes stay opaque.
Preparation before a breach as the only viable posture in 2026
A fair objection to everything above runs like this: when a criminal group like ShinyHunters is willing to invest real time and money into social engineering and credential theft at scale, no checklist an employer runs through is going to stop them. That objection mixes up two different goals. Due diligence was never going to guarantee prevention. What the law asks for is preparation, and you can control preparation even when you cannot stop a sophisticated attacker outright.
The threat itself is not shrinking. CIRA's 2025 Cybersecurity Survey found that most Canadian organizations are already concerned about AI-powered cyberattacks, and most worry phishing attempts will become more convincing as a result. OPC data covering 2025 and 2026 shows that a large majority of reported federal breach incidents were assessed as carrying a real risk of significant harm.
None of that means safeguards are pointless. It means the standard a TPA or carrier is held to has to be preparation, not perfection. Carriers and TPAs do invest in security, some even hire outside firms to test their own defenses, and breaches still happen anyway. The April 2026 incident hit a provider that had security protocols in place at the time. One commentator, drawing on the experience of the Casino Windsor breach, put the lesson this way: the only workable response is to have protective tools and contracts in place before a breach happens, rather than scrambling to assemble them after the fact. Regulators ask whether reasonable safeguards were in place at the time of the breach, and a documented due-diligence process, a contract that actually spells out obligations, and a breach response plan that's been tested in advance are what "reasonable" looks like when a regulator is reviewing the record.
Employees hand over some of their most sensitive health and financial information to an HSA because their employer built the plan and picked the provider administering it. That choice is not one employees get to make for themselves, and the trust it depends on exists whether or not any particular law requires it.
