MONTREAL — Like most political shorthand, “digital sovereignty” at once means a lot and very little—a zeitgeist-y bumper sticker bandied about by politicians, policy wonks and (ahem) columnists, sometimes with elbows up.

The French version of the term, la souveraineté numérique, came up no less than 17 times in Quebec’s national assembly at a recent parliamentary hearing on the funding of the province’s cybersecurity ministry. The event put the issue of digital sovereignty into visceral focus, complete with the immediate threat of U.S. legislation, the existential threat of Big Tech—and the inadvertent threat caused by a near-total lack of made-in-Canada solutions to avoid both.

In the distant past of August 2023, before those threats came into such sharp focus, Quebec chose U.S.-based Epic Systems to lead the province’s 15-year, $1.5-billion digital health transformation. At the time, then-health minister Christian Dubé declared himself “excessively encouraged” by his government’s choice. And why not? Epic was the U.S. and global market leader in the electronic health-record market, with the details of more than 305 million patients in its systems. Think of it as the Facebook of medical records, providing frictionless, off-the-shelf ubiquity to hospitals and care centres around the world. 

What was then a selling point has since become a potential headache. While Cybersecurity Minister France-Élaine Duranceau still lauds Epic as an “excellent solution” and the “Cadillac of digital health records,” her deputy, Stéphane Le Bouyonnec, holds a different view: big, ubiquitous data gatekeepers are a potential danger to the province.

Relying on U.S. tech firms like Epic, Le Bouyonnec said, leaves Quebec’s bureaucratic machinery vulnerable to the CLOUD Act, which the first Trump administration passed in 2018. The law, Le Bouyonnec noted, both gives U.S. authorities access to data held by U.S. tech companies and provides a “kill switch,” allowing those same authorities to potentially shut off access to critical data. That, right there, is why digital sovereignty probably matters. 

Quebec’s health ministry has nevertheless proceeded with two pilot projects using Epic’s software at a cost of roughly $402 million. Both are going rather swimmingly, according to the ministry’s daily updates. The ministry has also denied a Montreal Gazette report that it plans to drop Epic altogether. Epic spokesperson Jacob Wright said U.S. authorities have never asked the company to provide personal data from its non-U.S. customer systems. “If we were to receive such a request, we’d direct the requestor to the customer,” said Wright in an email to The Logic, adding that Quebecers’ data is held in Canada.

Yet even as she sang Epic’s praises in parliament, Duranceau said her government hadn’t yet decided on a full rollout of Epic’s wares across the province, despite what Dubé said three years ago. Santé Québec would refuse to send any patient data to U.S authorities were Epic to receive such a request, Duranceau claimed. 

It’s a heck of a statement, and underscores the reality and stakes of the Epic contract: a massive, arguably monopolistic U.S. tech firm could well be the gatekeeper of the medical records of every Quebecer who has ever been to a hospital. And with a provincial election in less than four months, that risks becoming a huge political liability.

All this begs the question: Does contracting with Epic—along with Microsoft, another U.S.-based gatekeeper of Quebec’s data—render the concept of digital sovereignty into just another zeitgeist-y bumper sticker?

John Kildea certainly thinks so. An associate professor of oncology at McGill University, Kildea led the research team behind Opal, a patient care app used by some 7,000 people in the province until it was shut down in 2025, ostensibly to make way for Epic. Far from being completely stuck in the fax machine era, the province’s medical system is about 60 per cent digitized already, Kildea told me. 

This is mostly thanks to Quebec IT firms like LGI Healthcare Solutions and Christie Innomed. As with Opal, these homegrown firms are at high risk of falling under Epic’s footprint if or when an all-encompassing digital health-care system is rolled out, Kildea said. “If Quebec decided tomorrow that it was going to give its roads infrastructure over to an American company, would that fly in Quebec? Of course not. That would be seen as an affront to our sovereignty. Yet that’s exactly what we’re doing in health care,” Kildea argued.

In fact, the Epic contract is doubly harmful, Kildea argued, because it also accelerates the hollowing out of Quebec’s tech sector. He used the example of Opal, which took about 100 McGill researchers to develop. Of those, about 50 have since gone into tech, with 25 of them working for “American giants,” Kildea said. 

“Why are we training the experts of tomorrow and then shipping them off to work for big American companies, who we then pay to manage our digital infrastructure?” Kildea said.

As a solution, Quebec might look to Estonia, a country of over 1.3 million pressed right up against Russia, and where digital sovereignty has been a priority for over 30 years. The result: a fully sovereign, open source digital government. Estonia developed its model as a hedge against an unpredictable, all-consuming neighbour. For Quebec, and the rest of Canada, there could be some lessons to learn in that.

Martin Patriquin is The Logic’s Quebec correspondent. He joined in 2019 after 10 years as Quebec bureau chief for Maclean’s. A National Magazine Award and SABEW winner, he has written for The New York Times, The Guardian, The Walrus, Vice, BuzzFeed and The Globe and Mail, among others. He is also a panellist on CBC’s “Power & Politics.”