Health Information Protection Act, 2016 Hoskins, Hon. Eric Minister of Health and Long-Term Care — Bill 119 (41st Parliament, 1st Session)

Bill 119, 41-1

Ontario — Bills

role="main" class="main-container container js-quickedit-main-content" id="main-content">

Bill 119, Health Information Protection Act, 2016

Hoskins, Hon. Eric Minister of Health and Long-Term Care

Please select

View bill

Status

Debates

Acts affected

Original

As Amended by Standing Committee

Royal Assent

[41] Bill 119 Royal Assent (PDF)

Bill 119 2016

An Act to amend the

Personal Health Information Protection Act, 2004,to make certain related

amendments and to repeal and replace the Quality of Care Information Protection

Act, 2004

Her

Majesty, by and with the advice and consent of the Legislative Assembly of the

Province of Ontario, enacts as follows:

Contents

of Act

1. This

Act consists of this section, sections 2 and 3 and the Schedules to this Act.

Commencement

(1) Subject

to subsections (2) and (3), this Act comes into force on the day it receives

Royal Assent.

Same

(2) The Schedules to this Act come into

force as provided in each Schedule.

Same

(3) If a

Schedule to this Act provides that

any provisions are to come into force on a day to be named by proclamation of

the Lieutenant Governor, a proclamation may apply to one or more of those provisions,

and proclamations may be issued at different times with respect to any of those

provisions.

Short

title

3. The

short title of this Act is the Health Information

Protection Act, 2016 .

Schedule 1

Amendments to the Personal Health Information Protection act, 2004 and to

certain related statutes

Personal Health Information Protection Act, 2004

(1) Section

2 of the Personal Health Information Protection Act, 2004

is amended by adding the following

definitions:

"Ministry"

means the Ministry of Health and Long-Term Care; ("ministère")

"prescribed organization" means the organization prescribed

for the purposes of

Part V.1 and, if more than one organization is prescribed,

means every applicable prescribed organization; ("organisation prescrite")

(2) The definition of "use" in

section 2 of

the Act is amended by striking out "means to handle or deal with the information"

and substituting "means to view, handle or otherwise deal with the

information".

(3) The Act is amended by adding the

following section:

Steps

to ensure collection

11.1 A

health information custodian shall take steps that are reasonable in the

circumstances to ensure that personal health information is not collected

without authority.

(4) Subsections 12 (2) and (3) of the Act

are repealed and the following substituted:

Notice

of theft, loss, etc. to individual

(2) Subject to subsection (4) and to the

exceptions and additional requirements, if any, that are prescribed, if

personal health information about an individual that is in the custody or control

of a health information custodian is stolen or lost or if it is used or

disclosed without authority, the health information custodian shall,

(

a) notify

the individual at the first reasonable opportunity of the theft or loss or of

the unauthorized use or disclosure; and

(

b) include

in the notice a statement that the individual is entitled to make a complaint

to the Commissioner under

Part VI.

Notice

to Commissioner

(3) If the circumstances surrounding a

theft, loss or unauthorized use or disclosure referred to in subsection

(2) meet the prescribed requirements, the health information custodian shall notify

the Commissioner of the theft or loss or of the unauthorized use or disclosure.

Exception

(4) If the health information custodian is

a researcher who has received the personal health information from another

health information custodian under subsection 44 (1), the researcher shall not

notify the individual if the information is stolen or lost or if it is used or

disclosed without authority, unless the health information custodian that

disclosed the personal health information under subsection 44 (1),

(

a) first

obtains the individual's consent to having the researcher contact the

individual; and

(

b) informs

the researcher that the individual has given the consent.

(5) Clause 17 (1) (

b) of the Act is

repealed and the following substituted:

(

b) the

collection, use, disclosure, retention or disposal of the information, as the

case may be, is necessary in the course of the agent's duties and is not contrary

to this Act or another law; and

(6) Section 17 of the Act is amended by

adding the following subsection:

Same

(1.1) A permission granted to an agent

under subsection (1) may be subject to such conditions or restrictions as the

health information custodian may impose.

(7) Subsections 17 (2) and (3) of the Act

are repealed and the following substituted:

Restriction,

collection, use, etc. by agents

(2) Subject to any exception that may be

prescribed, an agent of a health information custodian may collect, use,

disclose, retain or dispose of personal health information only if,

(

a) the

collection, use, disclosure, retention or disposal of the information, as the

case may be,

(

i) is

permitted by the custodian in accordance with subsection (1),

(ii) is

necessary for the purpose of carrying out his or her duties as agent of the

custodian,

(iii) is

not contrary to this Act or another law, and

(iv) complies

with any conditions or restrictions that the custodian has imposed under subsection

(1.1); and

(

b) the

prescribed requirements, if any, are met.

Responsibilities of

health information custodian

(3) A

health information custodian shall,

(

a) take

steps that are reasonable in the circumstances to ensure that no agent of the

custodian collects, uses, discloses, retains or disposes of personal health

information unless it is in accordance with subsection (2); and

(

b) remain

responsible for any personal health information that is collected, used,

disclosed, retained or disposed of by the custodian's agents, regardless of

whether or not the collection, use, disclosure, retention or disposal was

carried out in accordance with subsection (2).

Responsibilities

of the agent

(4) An agent of a health information

custodian shall,

(

a) comply

with the conditions or restrictions imposed by the health information custodian

on the agent's collection, use, disclosure, retention or disposal of personal

health information under subsection (1.1); and

(

b) notify

the custodian at the first reasonable opportunity if personal health

information that the agent collected, used, disclosed, retained or disposed of

on behalf of the custodian is stolen or lost or if it is used or disclosed

without authority.

(8) The Act is amended by adding the

following section:

Notice to governing

College

Definition

17.1

(1) In

this section,

"College"

means,

(

a) in

the case of a member of health profession regulated under the Regulated Health Professions Act, 1991 , a College of the

health profession named in

Schedule 1 to that Act, and

(

b) in

the case of a member of the Ontario College of Social Workers and Social

Service Workers, that College.

Termination,

suspension, etc. of employed members

(2) Subject to any exceptions and

additional requirements, if any, that are prescribed, if a health information

custodian employs a health care practitioner who is a member of a College, the

health information custodian shall give written notice of any of the following

events to the College within 30 days of the event occurring:

1. The

employee is terminated, suspended or subject to disciplinary action as a result

of the unauthorized collection, use, disclosure, retention or disposal of

personal health information by the employee.

2. The

employee resigns and the health information custodian has reasonable grounds to

believe that the resignation is related to an investigation or other action by

the custodian with respect to an alleged unauthorized collection, use, disclosure,

retention or disposal of personal health information by the employee.

Same,

custodian's agent

(3) Subject to any exceptions and

additional requirements, if any, that are prescribed, a health information custodian

shall give written notice of an event described in subsection (4) to a College

if,

(

a) the

health information custodian is a medical officer of health of a board of

health within the meaning of the Health Protection and

Promotion Act ; and

(

b) a

health care practitioner, who is a member of the College, is employed to

provide health care for the board of health and is an agent of the custodian.

Same

(4) The health information custodian shall

give written notice of any of the following events to a College within 30 days

of the event occurring:

1. The

agent's employment is terminated or suspended, or the agent is subject to

disciplinary action with respect to his or her employment, as a result of his

or her unauthorized collection, use, disclosure, retention or disposal of

personal health information.

2. The

agent resigns from his or her employment and the health information custodian

has reasonable grounds to believe that the resignation is related to an

investigation or other action by the custodian with respect to an alleged

unauthorized collection, use, disclosure, retention or disposal of personal

health information by the agent.

Member's

privileges revoked, etc.

(5) Subject to any exceptions and

additional requirements, if any, that are prescribed, if a health information

custodian extends privileges to, or is otherwise affiliated with, a health care

practitioner who is a member of a College, the custodian shall give written

notice of any of the following events to the College within 30 days of the

event occurring:

1. The

member's privileges are revoked, suspended or restricted, or his or her

affiliation is revoked, suspended or restricted, as a result of the

unauthorized collection, use, disclosure, retention or disposal of personal

health information by the member.

2. The

member relinquishes or voluntarily restricts his or her privileges or his or

her affiliation and the health information custodian has reasonable grounds to

believe that the relinquishment or restriction is related to an investigation

or other action by the custodian with respect to an alleged unauthorized

collection, use, disclosure, retention or disposal of personal health

information by the member.

Contents

of notice

(6) A notice made under this

section shall

meet the prescribed requirements, if any.

(9) Subsection 34 (2) of the Act is amended

by striking out "or" at the end of clause (c), by adding "or" at the end of

clause (

d) and by adding the following clause:

(

e) if

the person is prescribed and is collecting or using the health number, as the

case may be, for purposes related to the electronic health record developed and

maintained by the prescribed organization.

(10) Section 51 of the Act is amended by

adding the following subsections:

Application

to prescribed organization

(5) Subject to any exceptions and

additional requirements, if any, that are prescribed, this Part applies to the

prescribed organization as if it were a health information custodian with respect

to the following records and as if the prescribed organization has custody or

control of the records:

1. A

record of personal health information that is accessible to health information

custodians by means of the electronic health record developed and maintained by

the prescribed organization.

2. The

electronic records kept by the prescribed organization under paragraphs 4, 5

and 6 of

section 55.3.

Application

to record of a custodian

(6) Subject to any exceptions and

additional requirements, if any, that are prescribed, this Part applies to a

record in the custody or control of a health information custodian respecting

all instances where all or part of the personal health information of the

individual that is accessible by means of the electronic health record

developed and maintained

Document details

Collection	Ontario — Bills
Citation	Bill 119, 41-1
Type	bill
Volume / chapter	p41 s1 bill 119 html
Language	en
Format	html
Source	PROVINCIAL
Identifier	27a335e9fa17f9b70f485f6c3f1d69a6538b1ac6

Source file is stored in the law ingest library (html).