FIRST R EPORT OF THE STANDI NG CO MMITTEE ON LAW AM ENDM ENTS Third Ses sion Fifty -six th Legislative Assembly of the Provi nce of New Brunsw ick April 3, 2009 MEM BERS OF THE CO MMITTEE Hon. Mr. Burke, Q.C., Chair Mr. Kennedy, Vice-Chair Ms. Lavoie Mr. McGinley, Q.C. Mr. Frase r Mrs. MacA lpine- Stiles Mr. C. Landry Mr. M acDonald Mr. Urquhart

April 3, 2009 To The Honourable The Legislative Assembly of The Province of New Brunswick Mr. Speaker: I have the pleasure to present he rewith the First Report of the Standing Committee on L aw Amendments for the session. The report is the result of y our Committee’s deliberations on Bill 82, Access to Information and Protection of Privacy Act, and the discussion paper entitled “Personal Health Information Access and Privacy Legislation” which were referred to your Committee during the previous session.

On behalf of the Committee, I wish to thank those individuals and groups who appeared before the Committee or submitted written briefs. In addition, I would like to express my appreciation to the members of the Committee for their contribution in carrying out our mandate. Your Committee begs leave to make a further report. I move, seconded by the Member for Victoria-Tobique, that the report be concurred in by the House. Respectfully submitted, Hon. Thomas J. Burke, M.L.A. Chair

1 April 3, 2009 To The Honourable The Legislative Assembly of The Province of New Brunswick Mr. Speaker: Your Standing Committee on L aw Amendments begs leave to submit their F irst Report of the session. On J une 5, 2008 , during the Second Session of the F ifty-sixth Legislature, B ill 82, Access t o Information and Protection of Privacy A ct, was introduced in the L egislative Assembly by the Minister of Supply and Services, Hon. Jack Keir. The proposed legislation is intended to improve and modernize the existing right to information and protection of personal information legislation in the province.

Bill 82 provides a framework for how public bodies must respond to requests for information, and applies to all recor ds held in any form by government departments; provincial agencies, boards and commissions; universities; and municipalities. The Bill also provides greater clarity on the use and protection of personal information held by these public bodies. On June 11, 2008, by resolution of the House, consideration of Bill 82 was referred to the Standing Committee on Law Amendments.

On September 29, 2008, a discussion paper entitled “Personal Health Information Acce ss and Privacy Legislation” was filed with the Office of the Clerk of the Legislative Assembly. Pursuant to Motion 86, adopted June 3, 2008, the discussion pape r was deemed referred to the Standing Committee on Law Amendments. The purpose of the discussion paper is to present the basis of new personal health information access and privacy legislation in the prov ince.

The paper highlights specific components of new legislation and proposes questions for consideration, such as deciding how individuals can ensure their health information is treated with discretion and confidentiality and, at the same time, readily available to health care workers. On September 30, 2008, your Committee met and determined that members of the public should be invited to provide input and advice to the Committee with respect to the issues raised by Bill 82 and the discussion paper.

A public hearing was held on October 28, 2008, at the Legislature and a total of 39 wr itten submissions wer e re ceived by y our Committ ee. Y our Committ ee he ld further deliberations on the Bill and discussion paper, which included meeting with representatives from the Executive Council Office, Department of Health, and Office of the Ombudsman. Your Committee wishes to note that Bill 82 died on the Order and Notice Paper when the Second Session o f the Fifty-sixth Legislature was prorogued on Nove mber 25, 2008.

None theless, the mandate of y our Committee to re view the subjec t matter of the B ill remains in effe ct. Your Committee is pleased to offer its recommendations.

2 Your Committee expresses appreciation to the presenters who appeared at the public hearings and to those individuals and organizations who submitted written briefs. I. BILL 82, ACCESS TO INFORMATION AND PROTECTION OF PRIVACY ACT

SUMMARY OF FINDINGS Respondents we re g enerally of the vie w t hat th e int ent o f B ill 82 to m odernize the ri ght t o information and protection of personal information legislation in the province is a sound initiative and long overdue. Respondents acknowledged that the Right to Information Act was at the forefront when it was introduced in 1978, but it is now out-of-date compared to other provincial jurisdictions.

Respondents specifically applauded the “duty to assist” provision in the new legislation and were pleased the Bill provides for electronic requests for information and requests for electronic records. Respondents, however, suggested Bill 82 represents a departure from the existing legislation and, while supportive of ma ny of the provisions in the B ill, recomm ended certain re visions. Your Committee reviewed the provisions of the Access to Information and Protection of Privacy Act and considered the written submissions received and the presentations made at the public hearings.

While many issues were raised during the public consultation process, your Committee determined that the following matters should be addressed with respect to Bill 82: Title and Purpose; Application of Act to Universities and Municipalities;

Definitions; Records Excluded from Application; Time Limit for Responding to Reque sts; Ex ceptions to Disclosure a nd Public I nterest Overr ide; Protection of Privacy; Collection of Information; Disclosure of Information; Access to Information and Privacy Commissioner; Permanent Status of Open Records and Mandatory Reporting of Breaches; Privacy Assessment Review Committee; Fees; Regulations; Mandatory Review; and Time for Compliance. Title and Purpose Some respondents took issue with the use of the word “Access”, versus the word “Right”, as found in the title of the Bill.

It was suggested that the original Act legislated a “right” to information, while the Bill appears to only provide a mechanism to “access” information. With respect to the purpose of the Bill, respondents suggested that the focus should be placed on the right or entitlement to information, and not on the accountability of public bodies. Respondents also took issue with the term “allowing” a right, as found in

section 2. Application of Act to Universities and Municipalities Bill 82 is applicable to “ public bodies” which is defined to include such e ntities as gove rnment departments and offices, Crown corporations, municipalities, and certain universities and community colleges. Some respondents submitted that the Bill should only apply to “government” entities, and suggested that unive rsities are not part of g overnment. While universities may receive financial assistance f rom g overnment, it w as su bmitted th at th ey a re no t a br anch o f g overnment, the ir employees are not public ser vants, and it is important that uni versities remain independent from government.

3 In contra st, respondents we re suppor tive of the inclusion of municipalities in the leg islation. Representatives of municipalities were committed to the principles of accountability, openness and transparency, and believed the Bill would provide them with a framework to formalize policies and procedures aimed at providing access to municipal records, while protecting the privacy of citizens. It was suggested, however, that the Bill could be expanded to address meetings of municipal councils and all docume nts considere d at such mee tings, whic h are curr ently reg ulated und er the Municipalities Act.

Representatives of municipalities also requested that the provincial government provide investment in education, training and additional resources to ensure municipalities have the capacity to adopt the new responsibilities and properly integrate them into the daily operations.

Definitions Respondents had concerns with the

definitions of certain terms in the Bill. It was suggested that the definition of “employee” may require further ref inement; the def inition of “rec ord” ma y be inconsistent with other legislation; and the definition of “government body” should be similar to the one found i n the Ombudsman Act, which applies to bodies whe re a “majority” of members are appointed by government, not “all” members as required by Bill 82. There was also concern that the

definitions of certain terms in the Bill may be inconsistent with the

definitions of the same terms in such legi slation as the Archives Act, Public Records Act, Municipalities Act, and Community Planning Act. Several respondents submitted the definition of “head” should be revised. It was submitted that the Deputy Minister should be desig nated as the “head” of a government department, instead of the Minister, to avoid any appea rance of p olitical interfe rence.

Repre sentatives of municipa lities suggested the municipal Clerk should be designated as the “head” of a municipality, instead of the Mayor or other elec ted member , as the Clerk is require d to maintain the rec ords and ha s the necessary access to car ry out the duties require d under the Act. Repre sentatives of unive rsities suggested that each university should have the authority to designate its own head. In the case of a university, Bill 82 designates the chancellor or president as the “head”.

It was submitted that in certain circ umstances, these positions do not have the proper a uthority to make the ne cessary decisions required by the Act. Records Excluded from Application Respondents submitted that

section 4 of the B ill contains too many exclusions, meaning records which are excluded from application of the Act. It was submitted that the list of exclusions should be reduced, or in the alternative, the matters could be addressed in the mandatory or discretionary exceptions to disclosure provisions in the Bill. Responden ts specific ally questioned the appropriateness of paragraph 4(b), which excludes many of the records held by the Office of the Attorney General. It was submitted that a provision of this nature is unique in Canada and cannot be justified.

Representatives of univer sities also commented on par agraph 4(h), whic h excludes teac hing materials or research information of an employee of an educational institution from the application of the Act. It was submitted that these records are not in the custody and control of a university and

4 belong to the employee. Referring to these records in the Bill implies that such records would be in the custody and control of a university. It was proposed that the Bill should clearly state that records owned by academic employees of a univer sity are not rec ords in the custody and contr ol of the university, and, as such, are not subject to the legislation. Time Limit for Responding to Requests Respondents requested that if a public body does not respond to a request for information within the time prescribed, certain penalties should be in place.

Exceptions to Disclosure and Public Interest Override Respondents submitted that the exception provisions (sections 15-31) ar e too broa d in nature compared to the current Act. These provisions describe the circumstances in which the head of a public body may refuse to disclose ce rtain information. Specifically, it was submitted that the exception in subsection 24(1) to allow for the refusal to disclose information that may reveal advice, recommendations or policy options developed by or for a public body or Minister may be too broadly worded.

In addition, it was submitted that this provision should not pertain to reports prepared by consultants or third parties. Respondents also characterized subsection 24(3), which permits for the refusal to disclose financial research undertaken in connection with the formulation of a tax policy or other economic policy of government, as too broad in nature. Respondents questioned why the business interests of a third party exception, found in

section 20, was th e on ly pr ovision wi th a pu blic int erest o verride to a llow f or the dis closure of c ertain information. It was suggested that all exceptions should be subject to a general public interest override clause to allow the head of a public body to disclose information if it is clearly in the public interest. Representatives o f u niversities r equested a dditional d isclosure e xceptions s pecific t o t heir circumstances.

These exceptions were in relation to the following: records of private citizens held in archives; the administration of private trusts; records of donations by those who wish to remain anonymous; records related to the awarding of scholarships, awards, bursaries, or honours; records related to academic offences, investigations, and disciplinary measures; records determining student eligibility for admission; records pertaining to university programs operated and administered outside of the province; records of partners or affiliates of a university; agreements with third parties for research and deve lopment purposes; rec ords of c losed-door me etings of university boards a nd committees; assessment records for tenure and promotion, personnel evaluations and peer reviews; and records of administration where disclosure is demonstrated to be contrary to material interests or undertakings of confidentiality.

Representatives of municipalities suggested the wording of certain exception provisions may require clarification to ensure there are no conflicts with the disclosure provisions of the Municipalities Act. In addition, a municipality that has relations with a native council submitted that

section 22 should

5 be expanded to exclude fr om disclos ure any information that may harm re lations between the municipality and council. Protection of Privacy Respondents submitted that

Part 3 of the Bill, which deals with the protection of privacy, does not adequately capture the principles found in t he current Protection of Personal Information Act , viewed by many as the gold standard in privacy legislation. Specifically, it was suggested that the Bill does not adequately capture the accountability or openness principles protected by the existing legislation. Respondents also noted a ne ed to addr ess potential conf licts betwee n the cur rent retention of personal information guidelines and the new legislation.

Collection of Information Some respondents had concerns with the requirement to inform each individual of the purpose, when personal information is requested. It was submitted this may be too onerous in certain circumstances. Disclosure of Information Representatives of universities submitted that

section 41 prohibits the disclosure o f p ersonal information to individuals who are not employees or agents of a university. It was submitted that universities often disclose personal information to board members and other individuals who are not employees, and it was suggested that the provision may require clarification. Access to Information and Privacy Commissioner Bill 82 creates the Office of the Access to Information and Privacy Commissioner and provides it with the power to make recommendations to the head of a public body.

Some respondents submitted that this role should be strengthened to provide the Commissioner with the power to make binding decisions and issue orders to public bodies. It was suggested this approach would reduce the burden on the c ourts, re duce the nu mber o f c ostly jud icial reviews a nd a ppeals, min imize p ublic expenditure, and ensure a consistent application of the law. Currently, right to information matters may be referred to the Office of the Ombudsman, which can make recommendations to government.

It was submitted that if the new Commissioner only has the power to make recommendations as well, it may be more efficient and cost effective, at this time, to leave the responsibilities under the new legislation with the Office of the Ombudsman. If this was the result, the Ombudsman’s Office would require additional resources. Respondents also noted that the Commissioner may be appointed for a term between 5 and 10 years. It was submitted this may leave the Office of the Commissioner open to the appearance of influence from government, so a fixed term may be more appropriate.

The salary of the Commissioner is to be determined by the Lieutenant-Governor in Council. Some respondents suggested it may be more appropriate to fix the salary to that of a provincial court judge, or similar position, to again avoid the appearance of influence from government.

6 Permanent Status of Open Records and Mandatory Reporting of Breaches Respondents submitted that once a request for information is made and complied with by the public body, the information could be deemed public, with no further access requests necessary, where it is shown a privacy issue does not exist. This process could be formalized with the public registration of information requests.

It was also suggested that the Bill should require public bodies to register their personal information data banks with the Commissioner, to describe the type of information collected, and to demonstrate approved usage and storage practices. Some respondents requested that the Bill require mandatory reporting of breaches of the legislation to allow the province to shift from a complaints based system to a more proactive approach, and to allow for earlier and better enforcement of the legislation.

Privacy Assessment Review Committee One respondent questioned the necessity of creating a Privacy Assessment Review Committee, as provided for in

section 74, and suggested similar initiatives in other jurisdictions were found to be unwarranted as the Committee was never active. Fees Respondents were unanimous in their belief that the current fee structure for requests should not be increased under the new legislation. It was submitted that the right to information is a fundamental component of de mocracy, the cost of whic h should be rea sonable for all citizens to afford.

Representatives of municipalities and universities did request a realistic fee structure to reflect the complexity of the task, the time spent by staff, and the number of copies produced. It was also suggested that no fe e should be c harged for an individual to acc ess his or her own per sonal information. Regulations Representatives of municipalities and univer sities requested tha t they be consulted prior to the implementation of any reg ulations under the ne w legislation. Respondents also sug gested the regulation-making authority provision,

section 82, could be improved to provide for on-line access to information, to regulate data-sharing practices, to regulate the use of biometric data, and to restrict data-mining and privacy invasion technologies. Mandatory Review The Bill requires that it be reviewed within 8 years after coming into force. Respondents suggested the legislation should be reviewed every 5 years, and the first review should take place within the first 3 years for legislation of this importance.

Time for Compliance Representatives of municipalities were concerned about the July 2010 timeline for compliance with the legislation and requested an extension. In addition, municipalities with boards and commissions requested an extended deadline for compliance by these entities.

7 RECOMMENDATIONS Your Committee supports the intent of Bill 82 to modernize the right to information and protection of personal information legislation in the province. The right of New Brunswickers to acc ess information in order to hold all public bodies accountable is an important staple of a n open and transparent society. The Bill protects this right and provides the necessary access while ensuring that personal information is proper ly protected. Your Committee, howeve r, does not re commend the enactment of Bill 82 in its current form.

Your Committee is in agreement that Bill 82 may require certain revisions and makes the following recommendations: 1. That Bill 82 not be proceeded with in its current form. 2. That the government consider the issues and concerns outlined in this report before a revised Access to Inf ormation and Pr otection of Pr ivacy Ac t is i ntroduced in t he Legislative Assembly. 3. That a revised Access to Information and Protection of Privacy Act contain a provision that requires all fees charged to be “fair and reasonable”. 4.

That a revised Access to Information and Protection of Privacy Act contain a provision that requires the Act to be reviewed every 4 years. 5. That, upon the first review of the Act, the government consider whether the extension of the Access to Information and Privacy Commissioner's authority to make orders that are binding on public bodies would enhance the effectiveness and efficiency of the legislation.

8 II. DISCUSSION PAPER ON PERSONAL HEALTH INFORMATION ACCESS AND PRIVACY LEGISLATION

SUMMARY OF FINDINGS The purpose of the discussion paper is to present the basis of new personal health information access and privacy legislation in the province. The paper highlights specific components of new legislation and proposes questions for consideration. Respondents supported the provisions outlined in the paper and were generally of the opinion that the legislation is comprehensive in nature and adequately addresses the relevant issues. Your Committee reviewed the discussion paper and considered the written submissions.

While many issues were raised during the public consultation proce ss, your Committee determined that the following matters should be addressed with respect to the discussion paper: Purpose of Legislation; Application of L egislation; R ight a nd Acc ess to I nformation; Consent; Coll ection, Use and Disclosure of Personal Health Information; Information Security; Independent Oversight; Offences and Penalties; and Review of Legislation. Purpose of Legislation Respondents su bmitted th e pu rpose provision c ould b e e xpanded to inc lude a n a ccountability statement.

The statement would specify that one of the purposes of the legislation is to establish mechanisms t o e nsure the a ccountability of custo dians of pe rsonal he alth inf ormation a nd to safeguard the security and integ rity of the infor mation. Other respondents took exception to the phrase “management of the health system” being included in the purpose provision. Application of Legislation The legislation applies to personal health information collected, used or disclosed by a custodian.

Some respondents suggested the definition of “personal health information” should not be limited to information in recorded form. New technologies allow images to be transmitted and viewed, but not nece ssarily rec orded, to whic h the leg islation would not apply . It was suggested that the legislation should be applicable to unrecorded information as well. One respondent submitted the identification of an individual’s substitute decision maker should be included in the definition of “personal health information”.

The term “health care” is define d to include a pr ocedure that is perf ormed for a he alth-related purpose. One respondent submitted this definition should include specific reference to the procedure used for the donation of blood. Another respondent submitted that the definition should expressly exclude fitness-to-work assessments and independent medical evaluations. The legislation contains an extensive list of custodians and non-custodians. It was suggested that the Canadian Institute for Health Information, Canadian Institutes of Health Research, and Statistics Canada should not be defined as “custodians”.

It was also suggested that the legislation, or its regulations, should address the role of retired physicians, who often maintain custody of health

9 records, and the Coll ege of Phy sicians and Surg eons, who may assume re sponsibility over the caseload of a physician in certain circumstances. Respondents did support the approach not to limit the application of the legislation to public bodies, by including such entities as nursing homes. It was also submitted that the legislation should govern the treatment of all personal health information in the public sector. Specific mention was made of the Department of Educ ation and individual schools, who often posses sig nificant quantities of personal health information.

One respondent suggested the definition of “custodian” should be expanded to include the Canadian Blood Services, or, alternatively, that Canadian Blood Services be designated as a custodian in the regulations. It was also sug gested the list of custodians should include unr egulated health care providers who document personal health information. The legislation is not intended to apply to non-custodians, which includes employers and insurance companies.

It was suggested the application of the legislation should be gradually expanded to include these entities, who often collect large amounts of personal health information. Right and Access to Information The legislation provides individuals with the right, upon request to a custodian, to examine their own personal health information. A custodian may refuse the request in certain situations. Respondents suggested the legislation should be clear that the information belongs to the individual, and should expressly limit a custodian’s proprietary interest in the information.

The legislation permits a request for information to be refused if knowledge of the information could reasonably be expected to r esult in harm to the individual who requested the information. Respondents were concerned this could lead to a p hysician withholding a diagnosis in e xtreme medical cases for fear the individual would cause harm to him- or herself. Respondents suggested that if information is to be withheld, that dec ision should be made in consultation with an independent third party.

Other respondents suggested the requirement should be revised to allow refusal only if it may result in “serious” harm to the individual. A re quest for information may be refused if the custodian believes the request is frivolous or vexatious. Respondents were of the opinion this reason to refuse a request should be removed from the legislation. Others submitted that the list of situations allowing a request to be refused, as a whole, is excessive.

When a record is not available in an individual’s official language, a custodian is required to make “reasonable efforts” to ac commodate the ne eds of the individual. One option contained in the legislation is to have the record translated. Some respondents submitted the issue of translation of records does not belong in personal health information legislation, as it is a complex issue with liability and saf ety is sues. Other r espondents disagreed and sug gested the c ustodian should be required to do more than make “reasonable efforts”.

10 Consent The knowledgeable consent of an individual is required in order to collect, use or disclose personal health informa tion. The leg islation uses an implied knowledg eable cons ent model, which respondents supported. It was suggested that express consent should be required if disclosure is not to another custodian, or if the disclosure is to another custodian but not for the purpose of providing, or assisting in the pr ovision of, hea lth care . I n addition, it was sugg ested that the implied knowledgeable consent model should only apply to certain classes of custodians.

Individuals cannot withhold consent in certain situations, including for the purposes of an electronic health record. Respondents questioned the policy of not allowing individuals to opt out of electronic health records. Respondents suggested the term “electronic health record” should be defined. It was also suggested that data-sharing agreements should be implemented to deter mine who will have access to an ele ctronic health record system, to what extent, and who will be responsible f or the information maintained in the system.

Respondents submitted that other instances where consent cannot be withheld should be limited. One respondent submitted that the provisions describing when consent cannot be withheld should be expanded to include instances where personal health information is provided for the purpose of donating or attempting to donate a body part or bodily substance. It was submitted that it may be necessary to disclose information in these instances for the protection of public health or the health of the individual who has received the donation.

Collection, Use and Disclosure of Personal Health Information A custodian may collect, use or disclose personal health information about an individual with his or her consent. The legislation requires a custodian to collect the information directly from the individual to whom it relates, except in certain circumstances, including when the custodian is a Regional Hea lth Authority or g overnment depar tment eng aged in a f unction rela ted to the administration of health care. Respondents expressed the opinion that this provision appears broad in nature.

In certain situations, consent is not required f or a c ustodian to disclose information. One suc h situation is for the purpose of research. This was applauded by some respondents wh o require personal health information to conduct research, education and disease prevention programs. Other respondents believed research is a secondary use of the information and express consent should be required. A custodian may disclose information without consent for certain legal proceedings.

It was suggested the term “proceeding” should be broadly defined in the leg islation to i nclude civil, criminal and quasi-judicial proceedings that have been commenced or are anticipated to be commenced. One respondent suggested the legislation should include a provision to ensure that nothing in the Act prevents or discourages the secure and reasonable disclosure of information between custodians if it is in the best interest of a child. Other respondents suggested the legislation should clearly provide

11 that custodians may disclose information, without consent, in e lectronic form to l ife and health insurers for the purpose of obtaining payment for services. With respect to the donation of blood, it was submitted that the legislation should expressly authorize a blood operator to collect or disclose personal health information from another blood operator when the information relates to an individual who donated or attempted to donate blood. It was submitted that blood operators need to be able to share an individual’s health information in the interest of public safety and confidence in the blood supply.

In addition, it was submitted that the legislation should provide authority to indirectly collect personal health information about an individual who donated or attempted to donate blood, if the information is necessary to ensure the safety of the blood supply and it is not possible to collect, directly from the individual, information that can be relied upon as accurate. It was submitted that the legislation should expressly permit physicians to use personal health information for the purpose of obtaining legal or risk management advice.

It was suggested that a physician’s ability to communicate freely with his or her mutual defense organization is crucial to the pra ctice of medicine a nd it would not be prac ticable f or conse nt to be required prior to a physician using the information for this purpose. It was submitted that the exchang e of personal health information between a custodian and an agent of a custodian should be considered a “use” and not a “disclosure”. The legislation requires that only a custodian may request the production of an individual’s medicare number.

Respondents were concerned about the acc ess to medicar e numbers and sug gested the Department of Health should govern the use of medicare numbers and reduce the instances in which they may be disclosed. Moose license applications were cited as an inappropriate use. It was also suggested that certain entities should not be authorized to ask an individual for his or her medicare number unless it is require d for the pr ovision of health ca re. Other respondents noted t hat the legislation should also pertain to any other health care identification number.

Information Security The legislation requires that certain physical, technical and security safeguards are in place for the protection of persona l health information. I f there is a brea ch of the legislation, meaning an individual’s information is lost or unlawfully disclosed, the custodian is re quired to notify the individual and the Ac cess to I nformation and Priva cy Commi ssioner of the br each only if the custodian reasonably believes the breach will have a n adverse impact upon the indiv idual or the provision of his or her health care.

Many respondents were of the opinion that this provision provides a c ustodian with too much discretion. I n a ddition, it wa s su bmitted th at of ten a c ustodian ma y no t be the be st p erson to determine if a breach will have an adverse impact upon an individual. Respondents suggested the legislation should adopt a reasonable standard of “significant or substantial breach” as the measure for breach notification. In addition, it was submitted that all breaches, however trivial, should be documented and reported on a quarterly basis to the Commissioner.

12 The legislation requires a custodian to have and comply with a written policy on the re tention, archival storage, access, and destruction of personal health information. Respondents submitted the legislation should contain spec ific timefra mes for the rete ntion of information for c onsistency purposes, as well as guidelines for destruction. Some respondents submitted the requirement to maintain a record of destruction of information may be onerous on a small medical practice.

The legislation requires a custodian to conduct privacy impact assessments in certain situations, including for each change to th e collection, use, or disclosure of inf ormation, or cha nge to an existing personal health information system. It was suggested that this requirement is too onerous and should be limited to the creation of new administrative practices and health information systems. Independent Oversight The legislation designates the Ac cess to I nformation and Priva cy Commi ssioner as the pe rson responsible for providing independent oversight.

Similar to the comments made with respect to Bill 82, respondents submitted that this role should be strengthened to provide the Commissioner with the power to make binding decisions and issue orders to public bodies. In addition, respondents requested th at t he Co mmissioner b e g iven th e n ecessary r esources to p roperly a dminister the legislation and to educate the public and health care workers on its contents. Offences and Penalties A person who is guilty of an offence under the legislation is liable to a fine of not more than $25,000.

Some respondents submitted that the maximum fine appeared to be too low and suggested that it should be doubled. A separate fine structure for natural persons and legal entities was also suggested. One respondent submitted that the legislation should include a provision which wo uld make it unlawful for one health information custodian to distribute, for consideration or financial reward, personal health information that another custodian had collected, used or disclosed. Review of Legislation The legislation requires that it be reviewed within 5 years after coming into force.

Most respondents agreed with this review per iod, but suggested it should occur every 5 years, with the first revie w occurring within the first 3 years. One respondent suggested the legislation should be reviewed every 3 years, with the first review taking place within the first 2 years. Respondents also suggested that the proclamation of any personal health information legislation should be preceded by a public education campaign led by the Minister of Health. RECOMMENDATION Your Committee supports the components of new legislation contained in the discussion paper.

It forms th e ba sis of le gislation th at w ill e nsure pe rsonal he alth inf ormation is treated w ith confidentiality, while at the same time accessible to the appropriate health care workers. Your Committee looks forward to the introduction of personal health information access and privacy

13 legislation in the province. Your Committee wishes to make the following recommendation: That the government consider the issues and concerns ou tlined in t his report before any personal health information access and privacy legislation is i ntroduced in the Legislative Assembly.