Privacy Rules for Moving Confidential Files in an Office Move

Privacy law does not stop applying while your files sit in a moving truck. In Canada, PIPEDA and the provincial private sector laws (including Quebec's Law 25) keep your organization accountable for personal information it hands to a mover, and in the US the HIPAA Security Rule expects covered entities to track where records and devices go. If a box of client files or an unencrypted laptop goes missing between buildings, it is your breach to report, not the mover's.

This guide walks through what the main laws actually require during a relocation, and the practical controls that let you show you met them. It is general information, not legal advice.

Why a move is a high risk week for records

An ordinary office keeps confidential paper behind locked cabinets and digital data behind logins. A move strips both away at once. Cabinets get emptied into crates, crates sit in hallways and loading docks, devices are unplugged and stacked, and people who do not normally have access (movers, building staff, cleaners, IT contractors) are suddenly in the room. Old filing rooms also tend to surface records nobody has looked at in years.

What Canadian privacy law expects

PIPEDA (federal, most private sector organizations)

PIPEDA applies to commercial activity in most provinces, and its safeguards principle asks for security appropriate to the sensitivity of the information. The law names physical measures specifically, such as locked filing cabinets and restricted access to offices. During a move, that translates to sealed containers and controlled access instead of open boxes.

Two other points matter here:

• Accountability for third parties. When you transfer personal information to a service provider, you stay responsible for it and are expected to use contractual or other means to protect it. A mover handling client files is a third party, so the moving contract or a confidentiality agreement should cover it.
• Breach reporting. If a breach of security safeguards creates a real risk of significant harm, you must report it to the Office of the Privacy Commissioner, notify affected individuals, and keep a record of every breach (reportable or not) for 24 months.

Alberta and British Columbia have their own private sector laws (each called PIPA) with similar safeguard duties, and Alberta also has mandatory breach reporting.

Quebec's Law 25

Since its phased rollout from 2022 to 2024, Law 25 has made Quebec's private sector privacy act one of the stricter regimes in Canada. Every organization has a person in charge of the protection of personal information (by default, the head of the business). If a "confidentiality incident" presents a risk of serious injury, you must notify the Commission d'accès à l'information and the people affected, and you must keep a register of all incidents. Loss of a file box during a move qualifies as an incident, even if nobody ever reads the contents.

For a Montréal office relocation, it is worth telling that person about the move schedule early, so the plan for confidential records has an owner.

Ontario's PHIPA and other health laws

Clinics, dental offices, pharmacies and other health information custodians in Ontario fall under PHIPA, which requires reasonable steps to protect records from theft, loss and unauthorized use, and notification of patients when records are lost or stolen. Certain incidents must also be reported to the Information and Privacy Commissioner of Ontario. Other provinces have comparable health information statutes.

What US rules expect

HIPAA

For covered entities and business associates, the HIPAA Security Rule includes device and media controls under 45 CFR 164.310(d). Among them: maintaining a record of the movements of hardware and electronic media and the person responsible, backing up data before equipment is moved, and proper disposal or re-use of media. A relocation is exactly the event these specifications were written for.

Whether a mover needs a business associate agreement depends on access. HHS treats pure transport services that do not access the information as conduits, but many practices still sign a BAA or a confidentiality agreement with movers who will handle charts or devices. If records are lost, the HIPAA Breach Notification Rule requires notice to individuals within 60 days of discovery, and to HHS (and media, for larger breaches in a state).

State laws and the FTC Disposal Rule

Most states have data breach notification laws, and many have record disposal laws requiring that personal information be shredded or made unreadable before it is thrown out. The FTC Disposal Rule does the same for consumer report information. These matter most for the pile of old files and hardware you decide not to move.

Controls that hold up if anyone asks

The laws above rarely prescribe exact steps. What regulators look for is a reasonable, documented process. For most offices that means:

1. Classify before you pack. Mark which cabinets hold personal, health, financial or HR records. Those go into confidential containers. Everything else can travel in standard crates.
2. Use locking or sealed containers. Lidded plastic crates closed with numbered, tamper evident seals are the usual choice. Record each seal number against its contents and department.
3. Keep a chain of custody log. Sign the containers out at the old site and in at the new one, with names and times. That log is your evidence under PIPEDA accountability or the HIPAA movement record.
4. Never leave confidential loads unattended. Plan the schedule so sensitive containers ship on the same day they are packed, and are not stored overnight on a dock or in an unlocked truck.
5. Deliver into a locked room. Have a secure staging space at the new office, and check seal numbers on arrival before anyone breaks a seal.
6. Encrypt and back up devices. Laptops and desktops with local data should be encrypted, and servers backed up and verified before they are powered down. Our server room moving guide covers the IT side in more detail.
7. Destroy what you are not moving, properly. Shred paper with a provider that issues a certificate of destruction, and wipe or destroy drives using a recognized method such as the NIST SP 800-88 guidelines. Keep the certificates.

Do not shred what you still have to keep

The move is a good chance to cut volume, but retention rules still apply. The Canada Revenue Agency generally expects business records to be kept for six years from the end of the last tax year they relate to, and US retention periods for tax, payroll and health records vary by federal and state rule. Anything under a litigation hold must be kept regardless. Check your retention schedule before the shredding bins arrive.

What to put in the moving contract

Ask any commercial mover to address, in writing:

• who on their crew will handle confidential containers, and whether they are the same people at both ends
• how loaded trucks are secured and whether they will ever be left unattended
• how seal numbers and the custody log will be checked at delivery
• what happens, and who is told, if a container is missing or a seal is broken
• confidentiality terms (and a BAA where your counsel thinks one is needed)

Frequently asked questions

Is losing a box of files during a move a reportable privacy breach?

It can be. Under PIPEDA you must report a breach of safeguards that creates a real risk of significant harm, and Law 25 uses a similar risk of serious injury test. Sensitivity of the records and whether they could be misused drive the answer, and every incident should still be recorded.

Does the moving company become responsible for our clients' personal information?

Not in place of you. Canadian law keeps the organization that collected the information accountable when it transfers that information to a service provider. A contract with the mover helps, but responsibility for the breach response stays with you.

Do medical offices need a business associate agreement with movers?

It depends on whether the mover will have access to protected health information. Transport services that only carry sealed containers are often treated as conduits, but many practices sign a BAA or confidentiality agreement anyway. Confirm with your compliance officer before the move.

Should old hard drives be moved or destroyed?

If a device is being retired, wipe or destroy it before the move and get a certificate of destruction. Moving a drive you plan to discard only adds risk, and record disposal laws in many states and provinces expect the data to be made unreadable.

Plan the confidential part of your move

Tell us about your headcount, the records and equipment involved, and both addresses, and we will follow up in writing with a move plan and a free quote. Use the quote request form, or see our service areas for Montréal and Toronto.