More Convenient Care Act, 2025 — Bill 11 (44th Parliament, 1st Session)

Bill 11, 44-1

Ontario — Bills

role="main" class="main-container container js-quickedit-main-content" id="main-content">

Bill 11, More Convenient Care Act, 2025

Jones, Hon. Sylvia Minister of Health

Current status:

Royal Assent received. Statutes of Ontario 2025,

chapter 7

Please select

View bill

Status

Debates

Acts affected

Votes

Royal Assent

Original

Bill 11 Royal Assent (PDF)

EXPLANATORY

NOTE

This Explanatory Note was written as a reader’s

aid to Bill 11 and does not form part of the law. Bill 11 has been enacted as

Chapter 7 of the Statutes of Ontario, 2025.

SCHEDULE 1

CITY OF HAMILTON ACT, 1999

Section

11 of the City of Hamilton Act, 1999 is re-enacted

to establish a board of health for the City. Currently the City itself has the

powers, rights and duties of a board of health under the Health

Protection and Promotion Act .

SCHEDULE 2

CONNECTING CARE ACT, 2019

The

Schedule amends the Connecting Care Act, 2019 to

provide for the application of the French Language

Services Act to the Service Organization.

SCHEDULE 3

HEALTH CARE STAFFING AGENCY REPORTING ACT, 2025

The

Schedule enacts the Health Care Staffing Agency Reporting

Act, 2025 . The major elements of the Act are described below.

Section

2 requires health care facility staffing agencies to submit reports to the

Minister containing aggregate administrative, billing or pay rate information

for health care facilities to which the agency assigns prescribed persons.

Section

3 requires health care facility staffing agencies to comply with specified

record maintenance requirements.

Section

4 authorizes the Minister of Health to publish certain information contained in

the reports submitted under

section 2.

Sections

5 and 6 describe elements of the Crown’s liability and state that no person is

entitled to compensation as a result of the enactment of the Act or other

specified actions.

Section

7 provides that the Act and the regulations prevail over any agreement to the

contrary.

Section

8 provides that contraventions of the Act or the regulations are an offence and

sets out the penalty for those offences.

Section

9 sets out regulation-making authorities for the Lieutenant Governor in

Council.

SCHEDULE 4

HEALTH PROTECTION AND PROMOTION ACT

The

Health Protection and Promotion Act is amended to

require medical officers of health to notify the Chief Medical Officer of

Health and to receive the Chief Medical Officer of Health’s written approval

before issuing a class order.

SCHEDULE 5

MANDATORY BLOOD TESTING ACT, 2006

The

Mandatory Blood Testing Act, 2006 is amended to

allow nurse practitioners to perform many of the functions in the Act that must

currently be performed by physicians.

SCHEDULE 6

PERSONAL HEALTH INFORMATION PROTECTION ACT, 2004

The

Schedule amends the Personal Health Information Protection

Act, 2004 and makes a related amendment to the Health

Information Protection Act, 2016 . The major elements of the

Schedule are

set out below.

The

Act currently provides for an organization to be prescribed as the “prescribed

organization” for the purposes of

Part V.1 of the Act. The Act is amended to

allow the prescribed organization to be prescribed for the purposes of the Act.

The prescribed organization is provided with new duties and powers for the

purposes of

Part V, the new

Part V.2 and

Part VI, which are described below.

Currently,

Part V of the Act is set to be amended by the Health

Information Protection Act, 2016 , which would have added subsections 51

(5) and (6). Those amendments are repealed and re-enacted with modifications in

this Schedule. The new amendments provide that

Part V applies to the prescribed

organization as if it were a health information custodian in respect of

specified types of information. They also remake what would have been

subsection 51 (6) as a new subsection 51 (8).

New

Part V.2 is added to the Act to govern digital health identifier activities.

These are defined activities that are all related to digital health

identifiers, which are unique identifiers created by the prescribed

organization that can be used to confirm the identity of an individual.

Part

V.2 authorizes the prescribed organization to carry out digital health

identifier activities and describes how personal health information may be

collected, used and disclosed in relation to these activities. The prescribed

organization is required to have in place privacy practices and procedures,

describe their activities under the Part to the public, take specified steps to

protect digital health identifier records and notify individuals in the event

of privacy breaches. The Part also sets out the rules that apply to persons

acting on the prescribed organization’s behalf. The Minister is given the power

to issue directives to the prescribed organization related to digital health

identifiers and digital health identifier activities. New regulation-making

powers allow the Lieutenant Governor in Council to make various regulations

related to the prescribed organization and digital health identifier

activities, including the power to modify or exclude the application of

Part

III of the Act.

Part

VI of the Act is amended to add a new provision providing that the Part applies

to the prescribed organization as if it were a health information custodian

with respect to certain records.

Section 61 is amended to give the Commissioner

new powers with respect to certain records related to the prescribed

organization.

Section

72 is amended to add a new offence for disposing of records of personal health

information under

Part V of the Act with an intent to evade a request for

access to the record.

Section

73 is amended to add new regulation-making powers related to the prescribed

organization. These include prescribing additional powers, duties and functions

of the prescribed organization, specifying provisions in the Act that apply to

the prescribed organization as if it were a health information custodian and

governing the application of specified provisions in the Act to records related

to the prescribed organization.

Bill 11 2025

Act to enact or amend various Acts related to health care

Preamble

Contents

of this Act

Commencement

Short

title

Schedule 1

City

of Hamilton Act, 1999

Schedule 2

Connecting

Care Act, 2019

Schedule 3

Health

Care Staffing Agency Reporting Act, 2025

Schedule 4

Health

Protection and Promotion Act

Schedule 5

Mandatory

Blood Testing Act, 2006

Schedule 6

Personal

Health Information Protection Act, 2004

Preamble

The

Government of Ontario:

building a more connected and convenient health-care system that provides more

people with access to the right publicly funded care, in the right place.

innovating to build a modern, integrated health-care system that better meets

the needs of patients by making it easier to conveniently access their health

information and records online and by providing better access to key services

like primary care.

building healthier communities by strengthening governance and oversight of

public health and institutions and improving transparency to provide people

consistent care across the province.

Acknowledges

the importance of advancing initiatives to enhance and support health human

resources to bolster the province’s health-care workforce today and in the

future.

Therefore,

His Majesty, by and with the advice and consent of the Legislative Assembly of

the Province of Ontario, enacts as follows:

Contents

of this Act

1 This

Act consists of this section, sections 2 and 3 and the Schedules to this Act.

Commencement

(1) Except

as otherwise provided in this section, this Act comes into force on the day it

receives Royal Assent.

(2) The

Schedules to this Act come into force as provided in each Schedule.

(3) If

Schedule to this Act provides that any of its provisions are to come into

force on a day to be named by order of the Lieutenant Governor in Council, an

order may apply to one or more of those provisions, and orders may be issued at

different times with respect to any of those provisions.

Short

title

3 The

short title of this Act is the More

Convenient Care Act, 2025 .

SCHEDULE 1

CITY OF HAMILTON ACT, 1999

Section 11 of the City of Hamilton Act, 1999 is

repealed and the following substituted:

Board of Health

Board

of health

(1) The

board of health for the city is established and it is deemed to be a board of

health established under the Health Protection and

Promotion Act .

Composition

(2) The

city shall, by by-law, establish the board’s size in accordance with subsection

49 (2) of the Health Protection and Promotion Act .

Appointment

(3) Despite

subsections 49 (1) and (3) of the Health Protection and

Promotion Act , all of the members of the board shall be appointed by the

city.

Area

of jurisdiction

(4) The

board’s area of jurisdiction is the city.

Duty

of the city

(5) Despite

the Health Protection and Promotion Act , the city

shall provide to the board the public health employees that the city considers

necessary to enable the board to carry out its functions, and those employees

are employees of the city.

Functions

of the city

(6) Despite

the Health Protection and Promotion Act , the city

has the functions that the board would otherwise have in respect of the

appointment, reappointment and dismissal of its medical officer of health, its

associate medical officers of health and its auditor.

Additional

functions of the board

(7) In

addition to its duties and responsibilities under the Health

Protection and Promotion Act , the board shall do the following things at

the request of the city:

1. Make

recommendations on any issues within the city’s jurisdiction that involve

public health considerations.

2. Make

an annual report to the city on the board’s operations.

Continued

effect of approvals, etc.

(8) On

the day that the board is established by subsection (1), every approval, by-law

and resolution of the city made under the Health

Protection and Promotion Act that was in force immediately before that

day is deemed to have been made by the board and it remains in force until it

expires or is revoked or amended to provide otherwise.

Commencement

This

Schedule comes into force on the day the More

Convenient Care Act, 2025 receives Royal Assent.

SCHEDULE 2

CONNECTING CARE ACT, 2019

Section 27.5 of the Connecting Care Act, 2019 is

amended by adding the following subsection:

French

Language Services Act

(5) The

French Language Services Act applies to the Service

Organization as though it were a government agency under that Act.

Commencement

This

Schedule comes into force on the day the More

Convenient Care Act, 2025 receives Royal Assent.

SCHEDULE 3

HEALTH CARE STAFFING AGENCY REPORTING ACT, 2025

Definitions

Reports

Record

maintenance

Publication

Crown

liability

compensation

Conflicts

Offences

Regulations

Commencement

Short

title

Definitions

1 In this Act,

“health care facility” means a public hospital,

the University of Ottawa Heart Institute / Institut de cardiologie

de l’Université d’Ottawa , a long-term care home or any other prescribed facility or

prescribed provider; (“établissement de soins de santé”)

"health

care facility staffing agency" means a temporary help agency, within the

meaning of the Employment Standards Act, 2000 , that

assigns any prescribed persons to perform work in or for a health care

facility; (“agence de placement de personnel dans les établissements de soins

de santé”)

“long-term

care home” means a long-term care home within the meaning of the Fixing Long-Term Care Act, 2021 ; (“foyer de soins de

longue durée”)

“Minister”

means the Minister of Health or such other member of the Executive Council to

whom the administration of this Act is assigned under the Executive

Council Act ; (“ministre”)

“prescribed”

means prescribed by the regulations; (“prescrit”)

“public

hospital” means a hospital within the meaning of the Public

Hospitals Act ; (“hôpital public”)

“regulations”

means the regulations made under this Act. (“règlements”)

Reports

(1) A health care facility staffing

agency shall, at least every six months or within such other time as may be

prescribed, submit a report to the Minister that contains the prescribed

aggregate administrative, billing or pay rate information for health care

facilities to which the agency assigns prescribed persons.

Submission

(2) A

report required under subsection (1) shall be submitted in the prescribed form

and manner and within the prescribed timeline.

Record

maintenance

3 A health care facility staffing agency shall

comply with the following record maintenance requirements:

1. A

true copy of any contract to assign prescribed employees to a health care

facility that was entered into or amended or modified on or after the day this

section comes into force must be retained until three years after the day the

contract expires.

2. A

true copy of any invoice relating to prescribed administrative, billing or pay

rate information that was issued on or after the day the information it

contains was prescribed for the purposes of subsection 2 (1) must be retained

until three years after the day it was issued.

Publication

4 The Minister may publish, in the prescribed

form and manner and within the prescribed timeline, any information contained

in the reports submitted under

section 2 that is prescribed.

Crown

liability

personal liability

(1) No cause of action arises

against any current or former member of the Executive Council, an employee or

agent of the Crown for any act done in good faith in the exercise or

performance, or intended exercise or performance, of the person’s powers,

duties or functions under this Act or for any alleged neglect, default or other

omission in the exercise or performance in good faith of those powers, duties

or functions.

Crown

remains vicariously liable

(2) Despite

subsection 8 (3) of the Crown Liability and Proceedings

Act, 2019 , subsection (1) does not relieve the Crown of liability to

which it would otherwise be subject as a result of the acts or omissions of a

person specified in subsection (1).

Proceedings

barred

(3) No

proceeding shall be commenced against any person specified in subsection (1) in

respect of a matter referred to in that subsection.

Same

(4) Subsection

(3) does not apply with respect to an application for judicial review, but does

apply with respect to any other court, administrative or arbitral proceeding

claiming any remedy or relief, including specific performance, an injunction,

declaratory relief, a remedy in contract, restitution, unjust enrichment or

tort, a remedy for breach of trust or fiduciary obligation or any equitable

remedy, enforcement of a judgment, order or award made outside Ontario or any

form of compensation or damages including loss of revenue or profit.

Proceedings

by Crown not prevented

(5) This

section does not apply with respect to proceedings brought by the Crown.

compensation

6 No person is entitled to compensation as a

result of the enactment of this Act, the filing of any regulation or the

collection, use, disclosure or publication of any information as authorized

under this Act.

Conflicts

7 This Act and the regulations prevail over any

agreement to the contrary, including any agreement entered into before the day

this Act came into force.

Offences

8 Every person who contravenes this Act or the

regulations is guilty of an offence and on conviction is liable to a fine,

(

a) not

exceeding $10,000, in the case of an individual; and

(

b) not

exceeding $25,000, in the case of a corporation.

Regulations

(1) The Lieutenant Governor in

Council may make regulations,

(

a) prescribing

anything that is referred to in this Act as being prescribed;

(

b) governing

the reports required under

section 2, including governing the form and manner

of the reports and the timing of submission;

(

c) governing

the publication of information under

section 4, including governing the form

and manner in which the information is published and the timing of publication;

(

d) exempting

any person or class of persons from any provision of this Act and attaching

conditions to the exemption;

(

e) respecting

any matter considered necessary or advisable to carry out effectively the

purpose of this Act.

Application

to existing agreements

(2) A

regulation made under subsection (1) may, if it so provides, specify that it

applies to an agreement that was entered into before the day the regulation is

filed, including an agreement that was entered into before the day this Act

came into force.

Commencement

10 The Act set out in this

Schedule

comes into force on a day to be named by order of the Lieutenant Governor in

Council.

Short

title

11 The

short title of the Act set out in

this

Schedule is the Health Care Staffing Agency Reporting

Act, 2025 .

SCHEDULE 4

HEALTH PROTECTION AND PROMOTION ACT

Subsection 22 (5.0.1) of the Health Protection and

Promotion Act is repealed and the following substituted:

Class

orders

(5.0.1) An

order under this

section may be directed to a class of persons who reside or

are present in the health unit served by the medical officer of health only if,

(

a) the

medical officer of health gives notice of the proposed class order to the Chief

Medical Officer of Health; and

(

b) the

Chief Medical Officer of Health approves the proposed class order in writing.

Commencement

This

Schedule comes into force on the day the More

Convenient Care Act, 2025 receives Royal Assent.

SCHEDULE 5

MANDATORY BLOOD TESTING ACT, 2006

Section 1 of the Mandatory Blood Testing Act, 2006

is amended by adding the following

definitions:

“nurse

practitioner” means a registered nurse who holds an extended certificate of

registration under the Nursing Act, 1991 ;

(“infirmière praticienne ou infirmier praticien”)

“reporting

physician or nurse practitioner” means, in respect of an applicant, the

physician or nurse practitioner who made the report required by clause 5 (1)

(e); (“médecin rapporteur ou infirmière praticienne rapporteuse ou infirmier

praticien rapporteur”)

(1) Clause 5 (1) (

e) of the Act is amended by striking out

“physician report” and substituting “physician report or nurse practitioner

report”.

(2) Clause

5 (1) (

f) of the Act is amended by striking out “physician report” and

substituting “physician report or nurse practitioner report”.

(3) Subsection

5 (2) of the Act is repealed and the following substituted:

Order

(2) If

the Board decides that the respondent should be ordered to provide a blood

sample for analysis, the Board shall, at the same time as it makes its

decision, make an order,

(

a) requiring

the respondent to allow a physician, a nurse practitioner or a person belonging

to a prescribed class of persons to take a blood sample from the respondent

within two business days after the order is provided to the respondent or the

respondent’s counsel or agent;

(

b) requiring

the physician, nurse practitioner or other person to whom the respondent goes

for the taking of a blood sample to take the blood sample and to deal with it

in the manner specified in the regulations and the order, including to deliver

it to an analyst; and

(

c) requiring

the analyst to whom the sample is delivered,

(

i) to

analyse the blood sample and report on the results of the analysis in

accordance with the regulations and the requirements specified in the order,

(ii) to

make reasonable attempts to deliver the report on the results of the analysis

to the reporting physician or nurse practitioner,

(iii) to

make reasonable attempts to deliver the report on the results of the analysis

to the respondent’s physician or nurse practitioner, if requested by the

respondent,

(iv) to

make reasonable attempts to deliver to the applicant,

(

A) a

notice that the analyst delivered the report on the results of the analysis to

the reporting physician or nurse practitioner or made reasonable attempts to do

so, and

(

B) a

recommendation that the applicant consult the reporting physician or nurse

practitioner for a proper

interpretation of the results of the analysis, and

(

v) if

the respondent requested that the report on the results of the analysis be

delivered to their physician or nurse practitioner, to make reasonable attempts

to deliver to the respondent,

(

A) a

notice that the analyst delivered the report on the results of the analysis to

the respondent’s physician or nurse practitioner or made reasonable attempts to

do so, and

(

B) a

recommendation that the respondent consult their physician or nurse

practitioner for a proper

interpretation of the results of the analysis.

Clause 6 (2) (

a) of the Act is amended by striking out “a physician or a person

belonging to a prescribed class” and substituting “a physician, a nurse

practitioner or a person belonging to a prescribed class”.

Subsection 9 (5) of the Act is amended by striking out “a physician report” and

substituting “a physician report or nurse practitioner report”.

Clause 11 (1) (

h) of the Act is repealed and the following substituted:

(

h) governing

the physician reports or nurse practitioner reports required by clause 5 (1)

(e), including,

(

i) prescribing

the classes of physicians or nurse practitioners, or the qualifications of

physicians or nurse practitioners, who may prepare the reports,

(ii) prescribing

the examination and testing, including base line testing, and counselling and

treatment, that the physicians or nurse practitioners must or may conduct to

prepare the reports, and

(iii) prescribing

the information that the reports must or may contain;

Section 12 of the Act is amended by striking out “physician reports” and

substituting “physician reports, nurse practitioner reports”.

Commencement

This

Schedule comes into force on the later of July 1, 2025 and the day the More Convenient Care Act, 2025 receives Royal Assent.

SCHEDULE 6

PERSONAL HEALTH INFORMATION PROTECTION ACT, 2004

(1) Section 2 of the Personal Health

Information Protection Act, 2004 is amended by adding the following

definitions:

“account

management services” means the services provided by the prescribed organization

that,

(

a) maintain

the confidentiality, integrity or availability of an individual’s digital

health identifier or related personal health information,

(

b) relate

to the maintenance of an individual’s digital health identifier or related

personal health information,

(

c) manage

the activation, deactivation, reactivation or disposal of an individual’s

digital health identifier or related personal health information, or

(

d) are

prescribed; (“services de gestion des comptes”)

“authentication

services” means,

(

a) services

that rely upon validation and verification services to establish confidence in

an individual’s identity, or

(

b) any

other prescribed services; (“services d’authentification”)

“digital

health identifier” means the unique identifier created by the prescribed

organization for an individual through validation and verification services

that confirm the identity of the individual; (“identifiant Santé numérique”)

“digital

health identifier activities” means,

(

a) account

management services,

(

b) authentication

services,

(

c) validation

and verification services,

(

d) any

other activities reasonably necessary for providing digital health identifiers

to persons, including activities to improve or maintain the quality or efficacy

of these activities, or

(

e) any

other prescribed activities; (“activités liées aux identifiants San té numériques”)

“digital

health identifier records” means records of personal health information that,

(

a) are

in the prescribed organization’s custody or under its control, and

(

b) are

collected or used by the prescribed organization under

Part V.2; (“dossiers

liés aux identifiants Santé numériques”)

“validation

and verification services” means services that,

(

a) validate

the health number and additional personal health information from the health

card provided by the individual, including by relying on a database for health

cards maintained by the Minister,

(

b) verify

that an individual who is providing the health number or additional personal

health information, and such other identifying information as may be requested

by the prescribed organization, is the individual to whom the health number or

personal health information relates,

(

c) rely

upon the services described in clauses (

a) and (b), or such other services as

may be prescribed, to create or renew an individual’s digital health

identifier, or

(

d) are

prescribed. (“services de validation et de vérification”)

(2) The

definition of “prescribed organization” in

section 2 of the Act is amended by

striking out “for the purposes of

Part V.1” and substituting “under clause 73

(1) (d.1)”.

The definition of “personal health information” in subsection 4 (1) of the Act

is amended by striking out “or” at the end of clause (f), by adding “or” at the

end of clause (

g) and by adding the following clause:

(

h) is

the individual’s digital health identifier or other identifying information

related to the creation of the digital health identifier.

Section 8 of the Act is amended by adding the following subsection:

Prescribed

organization

(4.1) The

Freedom of Information and Protection of Privacy Act

does not apply to personal health information in the custody or under the

control of the prescribed organization, or to personal health information that

is described in this Act as being treated as if it were in the custody or under

the control of the prescribed organization, unless this Act or the regulations

provide otherwise.

Subsection 34 (2) of the Act is amended by striking out “or” at the end of

clause (d), by adding “or” at the end of clause (

e) and by adding the following

clause:

(

f) if

the prescribed organization or any other prescribed person is collecting or

using the health number, as the case may be, for prescribed purposes related to

digital health identifier activities in accordance with any additional

prescribed requirements.

(1) Section 51 of the Act is amended by adding the following

subsection:

Application

to prescribed organization

(5) Subject

to any exceptions and additional requirements, if any, that are prescribed,

this Part applies to the prescribed organization as if it were a health

information custodian and as if it had custody or control of a record of

personal health information that is accessible to health information custodians

by means of the electronic health record developed and maintained by the

prescribed organization.

(2) Section

51 of the Act is amended by adding the following subsection:

Same

(6) Subject

to any exceptions and additional requirements, if any, that are prescribed,

this Part applies to the prescribed organization as if it were a health

information custodian and as if it had custody or control of an electronic

record kept by the prescribed organization under paragraphs 4, 5 and 6 of

section 55.3.

(3) Section

51 of the Act is amended by adding the following subsection:

Same

(7) Subject

to any exceptions and additional requirements, if any, that are prescribed,

this Part applies to the prescribed organization as if it were a health

information custodian with respect to digital health identifier records.

(4) Section

51 of the Act is amended by adding the following subsection:

Application

to record of a custodian

(8) Subject

to any exceptions and additional requirements, if any, that are prescribed,

this Part applies to a record in the custody or control of a health information

custodian respecting all instances where all or part of the personal health

information of the individual that is accessible by means of the electronic

health record developed and maintained by the prescribed organization is

viewed, handled or otherwise dealt with by the custodian.

(1) Section 55 of the Act is amended by adding the following

subsection:

Exception

(1.1) Despite

subsection (1), an individual is not entitled to request a correction by the

prescribed organization when it acts as if it were a health information

custodian with respect to the records described in subsection 51 (5).

(2) Subsection

55 (1.1) of the Act, as enacted by subsection (1), is amended by striking out

“subsection 51 (5)” at the end and substituting “subsection 51 (5) or (7)”.

(3) Subsection

55 (1.1) of the Act, as amended by subsection (2), is amended by striking out

“subsection 51 (5) or (7)” at the end and substituting “subsection 51 (5), (6)

or (7)”.

(4) Section

55 of the Act is amended by adding the following subsection:

Same

(1.2) Despite

subsection (1), an individual is not entitled to request a correction by a

health information custodian with respect to the records described in

subsection 51 (8).

(1) Clauses 55.14 (2) (

a) and (

b) of the Act are repealed.

(2) Subsection

55.14 (3) of the Act is repealed.

The Act is amended by adding the following Part:

PART V.2

DIGITAL HEALTH IDENTIFIER ACTIVITIES

Interpretation

55.15 In this Part,

“agent”,

in relation to the prescribed organization, means a person that, with the

authorization of the prescribed organization, acts for or on behalf of the

prescribed organization in respect of personal health information for the

purposes of the prescribed organization, and not the agent’s own purposes,

whether or not the agent has the authority to bind the prescribed organization,

whether or not the agent is employed by the prescribed organization and whether

or not the agent is being remunerated.

Power and Duty of

Prescribed Organization

Digital

health identifier activities

55.16 The prescribed

organization may, in accordance with this Part and the regulations, carry out

digital health identifier activities.

Collection, Use and

Disclosure of Personal Health Information

Personal

health information for digital health identifier activities

55.17

(1) The

prescribed organization may, with the express consent of the individual to whom

the personal health information relates, collect or use personal health

information for the purpose of carrying out digital health identifier

activities.

Disclosure

by prescribed organization

(2) The

prescribed organization may, with the express consent of the individual to whom

the personal health information relates, disclose personal health information

to the Minister for the purpose of carrying out validation and verification services.

Limitation

(3) Except

as otherwise required by law, the prescribed organization shall not, in

carrying out digital health identifier activities,

(

a) collect,

use or disclose personal health information if other information will serve the

purpose of the collection, use or disclosure;

(

b) collect,

use or disclose more personal health information than is reasonably necessary

to meet the purpose of the collection, use or disclosure; or

(

c) collect,

use or disclose any personal health information, except as is reasonably

necessary for the purpose of carrying out digital health identifier activities,

as applicable, in accordance with this Act or as may be permitted in the

regulations.

Application

Part III

55.18

(1) Part III

applies to the prescribed organization when it acts under this Part as if it

were a health information custodian, subject to any necessary modifications and

to any exceptions or modifications set out in the regulations.

Regulations

(2) Despite

subsection (1), the regulations may modify or exclude the application of all or

part of

Part III to the prescribed organization when it acts under this Part or

may provide that, despite any requirement in this Act, consent of the individual

to whom the personal health information relates is not required for specified

activities.

Withdrawal

of consent

(3) An

individual may withdraw a consent required under this Part by providing notice

of their withdrawal to the prescribed organization, but the withdrawal shall

not have retroactive effect.

Administration

Practices

and procedures

55.19

(1) On and

after the first anniversary of the day this

section comes into force, the

prescribed organization shall have in place and comply with practices and

procedures,

(

a) that

are for the purpose of protecting the privacy of the individuals whose personal

health information is in the digital health identifier records and for

maintaining the confidentiality of the information; and

(

b) that

are approved by the Commissioner.

Commissioner’s

review

(2) The

Commissioner shall review the practices and procedures referred to in

subsection (1) three years after they are first approved and every three years

thereafter, or at such other frequency as may be prescribed, to determine if

the practices and procedures continue to meet the requirements of this section,

the regulations and any applicable directive of the Minister.

Renewal

(3) After

the review, the Commissioner may renew the approval.

Notice

(4) The

Commissioner shall advise the Minister and the prescribed organization of the

results of their review.

Publication

(5) The

prescribed organization shall publish a

summary of the practices and procedures

on its website as soon as possible after the practices and procedures have been

approved by the Commissioner or after the approval has been renewed.

Description

to public

55.20 The prescribed

organization shall make available to the public,

(

a) a

plain language description of the activities or services it provides under this

Part, including a general description of the technical, administrative and

physical safeguards in place; and

(

b) such

other information as may be prescribed.

Protection

of information

55.21 The prescribed

organization shall take steps that are reasonable in the circumstances to

ensure that digital health identifier records are protected against theft, loss

and unauthorized use or disclosure and to ensure that the records containing

the information are protected against unauthorized copying, modification or

disposal.

Disposal

of inactive digital health identifier

55.22 The prescribed

organization shall ensure that a digital health identifier that has been

inactive for two or more years is disposed of in a secure manner.

Persons

acting on prescribed organization’s behalf

55.23

(1) The

prescribed organization shall not permit any person acting on its behalf to

collect, use, disclose, retain or dispose of digital health identifier records

unless the person agrees to comply with the restrictions and conditions that

apply to the prescribed organization when the prescribed organization carries

out those activities.

Provision

to agent

(2) Subject

to subsection (1), the prescribed organization may provide digital health

identifier records to an agent of the prescribed organization, who may use the

information to carry out digital health identifier activities on behalf of the

prescribed organization.

Same

(3) For

the purposes of this Part, the providing of personal health information between

the prescribed organization and an agent of the prescribed organization,

(

a) is

a use by the prescribed organization; and

(

b) is

not a disclosure by the prescribed organization or a collection by the person

to whom the information is provided.

Application

of s. 17

(4) Section

17 applies to the prescribed organization and its agents as if the prescribed

organization were a health information custodian, subject to any necessary

modifications.

Breach

notification

55.24

(1) If the

prescribed organization determines that digital health identifier records have

been stolen, lost or used or disclosed without authority, the prescribed

organization shall, at the first reasonable opportunity, notify the individual

to whom the personal health information relates.

Contents

(2) The

notice must include a statement that the individual is entitled to make a

complaint to the Commissioner under

Part VI.

Same,

notice to Commissioner

(3) The

prescribed organization shall, in accordance with the regulations, if any,

notify the Commissioner of a theft or loss of or an unauthorized use or

disclosure of digital health identifier records if the circumstances

surrounding the theft, loss or unauthorized use or disclosure meet the

prescribed requirements.

Prescribed

organization’s assessment

55.25

(1) The

prescribed organization shall perform, in relation to the digital health

identifier activities it carries out, an assessment with respect to,

(

a) threats,

vulnerabilities and risks to the security and integrity of digital health

identifier records; and

(

b) how

the activities may affect the privacy of the individuals to whom the

information relates.

Regulations

(2) The

assessments shall be performed in accordance with the additional requirements,

if any, that are prescribed.

Directives

55.26

(1) The

Minister may issue directives to the prescribed organization related to digital

health identifiers and digital health identifier activities, including

directives related to,

(

a) the

eligibility of individuals or groups of individuals to receive digital health

identifier activities;

(

b) requiring

the prescribed organization to undertake additional privacy or security

measures, which may include entering into agreements and conducting

assessments;

(

c) audit

log and auditing requirements; or

(

d) changes

in technologies that relate to the digital health identifier activities.

Consultation

(2) Before

making a directive under subsection (1), the Minister shall,

(

a) submit

a draft of the directive to the Commissioner and the prescribed organization

for the purpose of reviewing and making recommendations on the draft directive;

(

b) publicly

receiving public comment and review; and

(

c) consider

the recommendations or comments, if any, made by the Commissioner, the

prescribed organization and members of the public and amend the directive if

the Minister considers it appropriate to do so.

Consultation

period

(3) The

Minister shall allow the Commissioner, the prescribed organization and the

public a period of at least 45 days after the draft is submitted or posted

publicly for the purposes of review and recommendation under subsection (2).

Compliance

(4) The

prescribed organization shall carry out every directive issued under subsection

(1).

Publication

(5) The

Minister shall ensure that every directive issued under subsection (1) is made

Non-application

of Legislation Act, 2006

(6) Part

III (Regulations) of the Legislation Act, 2006 does

not apply to directives issued under this section.

Conflict

(7) For

greater certainty, in the event of a conflict between a directive issued under

this

section and another requirement under this Act, a provision of any

applicable Act or rule of any applicable law, the requirement, Act or rule

prevails.

General

or particular

(8) A

directive of the Minister may be general or particular in its application.

Regulations

55.27

(1) The

Lieutenant Governor in Council may make regulations for carrying out the

purposes and provisions of this Part.

Same

(2) Without

limiting the generality of subsection (1), the Lieutenant Governor in Council

may make regulations,

(

a) prescribing

additional circumstances in which the prescribed organization may collect, use

and disclose personal health information for purposes related to digital health

identifiers and digital health identifier activities;

(

b) establishing

and governing conditions or restrictions that apply to the collection, use and

disclosure of personal health information by the prescribed organization;

(

c) prescribing

and governing disclosures of personal health information that may be made by a

health information custodian or other person to the prescribed organization for

purposes related to digital health identifier activities;

(

d) prescribing

additional conditions or restrictions that apply to health information

custodians and other persons who use digital health identifiers, who seek to

use digital health identifiers or who otherwise receive or seek to receive

authentication services from the prescribed organization;

(

e) prescribing

additional conditions or restrictions that apply to the prescribed organization

when it carries out digital health identifier activities;

(

f) specifying

provisions in this Act that apply to the prescribed organization as if it were

a health information custodian when the prescribed organization carries out

digital health identifier activities;

(

g) respecting

the type of personal health information that is required for validation and

verification services;

(

h) governing

the application of

Part III with respect to the prescribed organization, which

may include excluding or modifying the application of the provisions in that

Part or providing that, despite anything in this Act, consent is not required

for specified activities;

(

i) governing

the privacy and security of personal health information under this Part;

(

j) governing

the circumstances in which particular types of personal health information may

or may not be collected, used or disclosed in relation to digital health

identifier activities;

(

k) governing

the modifications to the requirements of this Act described in subsection 55.23

(4);

(

l) governing

notices of theft, loss or unauthorized use or disclosure that must be provided

under subsection 55.24 (3);

(

m) prescribing

additional persons who may collect, use or disclose personal health information

for purposes related to digital health identifiers or digital health identifier

activities;

(

n) governing

any conditions or restrictions that apply to that collection, use or disclosure

of personal health information by an additional person prescribed under clause

(m), which may include providing that specified provisions in

Part III apply or

do not apply to consents that are required for the collection, use or

disclosure, subject to any specified modifications or exclusions;

(

o) clarifying or creating exceptions from

the

definitions of “account management services”, “authentication services”,

“digital health identifier activities” and “validation and verification

services”.

Public

consultation

(3) Section

74 applies, with necessary modification, to the making of a regulation under

this section.

(1) Section 56 of the Act is amended by adding the following

subsection:

Application

to prescribed organization

(5) Subject

to any exceptions and additional requirements, if any, that are prescribed,

this Part applies to the prescribed organization as if it were a health

information custodian with respect to records described in subsection 51 (5) as

if the prescribed organization has custody or control of the records.

(2) Subsection

56 (5) of the Act, as enacted by subsection (1), is repealed and the following

substituted:

Application

to prescribed organization

(5) Subject

to any exceptions and additional requirements, if any, that are prescribed,

this Part applies to the prescribed organization as if it were a health

information custodian with respect to,

(

a) records

described in subsection 51 (5), as if the prescribed organization has custody

or control of the records; and

(

b) records

described in subsection 51 (7).

(3) Clause

56 (5) (

a) of the Act, as enacted by subsection (2), is amended by striking out

“subsection 51 (5)” and substituting “subsection 51 (5) or (6)”.

(1) Subsection 61 (1) of the Act is amended by adding the following

clause:

(a.1) if

the review relates to a complaint into a request by an individual under

subsection 53 (1) for access to a record of personal health information that is

described in subsection 51 (5), (6) or (7) and in the custody or control of the

prescribed organization, or that is or that is described in this Act as being

treated as if it were in the custody or control of the prescribed organization,

make an order directing the prescribed organization to grant the individual

access to the requested record;

(2) Subsection

61 (1) of the Act is amended by adding the following clause:

(f.2) make

an order directing the prescribed organization to change its practices and

procedures under

Part V.2, if the Commissioner determines that the practices

and procedures contravene this Act or its regulations;

(3) Subsection

61 (1) of the Act is amended by adding the following clause:

(h.0.1) make

an order directing any person who is an agent of the prescribed organization

acting under

Part V or V.2 and whose activities the Commissioner reviewed and

that an order made under any of clauses (a.1), (c), (d), or (

e) directs to take

any action or to refrain from taking any action, to take the action or to

refrain from taking the action if the Commissioner considers that it is

necessary to make the order against the agent to ensure that the prescribed

organization will comply with the order made against the prescribed

organization;

(4) Section

61 of the Act is amended by striking out “or” at the end of clause (

h) and by

adding “or” at the end of clause (h.1).

Section 71 of the Act is amended by adding the following subsection:

Application

to prescribed organization

(5) Subsection

(4) applies to the prescribed organization and its agents as if the prescribed

organization were a health information custodian.

Subsection 72 (1) of the Act is amended by adding the following clause:

(d.1) disposes

of a record of personal health information in the custody or under the control

of the prescribed organization when it acts under

Part V, or that is described

in this Act as being treated as if it is in the custody or under the control of

the prescribed organization when it acts under

Part V, with an intent to evade

a request for access to the record that the prescribed organization has

received under subsection 53 (1);

(1) Subsection 73 (1) of the Act is amended by adding the following

clauses:

(d.1) prescribing

an organization as the prescribed organization for the purposes of this Act and

respecting the purposes for which the organization is prescribed, subject to

subsection (4.1);

(d.2) prescribing

additional powers, duties and functions of the prescribed organization;

(d.3) establishing

and governing reporting requirements that apply to the prescribed organization;

(d.4) prescribing

provisions of the Freedom of Information and Protection of

Privacy Act that apply, subject to any specified conditions or

modifications, to personal health information,

(

i) in

the custody or under the control of the prescribed organization, or

(ii) that

is described in this Act as being treated as if it were in the custody or under

the control of the prescribed organization;

(d.5) specifying

provisions in this Act that apply to the prescribed organization as if it were

a health information custodian when the prescribed organization carries out

specified activities under this Act, subject to any conditions or modifications

that may be prescribed;

(d.6) specifying

requirements or provisions in this Act that apply to agents of the prescribed

organization when they carry out activities on behalf of the prescribed

organization;

(d.7) governing

the application of

Part III of this Act with respect to the prescribed

organization, which may include excluding or modifying the application of the

provisions in that Part;

(d.8) prescribing

under what circumstances the prescribed organization may collect, use and

disclose personal health information, the conditions that apply to the

collection, use and disclosure of personal health information by the prescribed

organization and disclosures of personal health information that may be made by

a health information custodian or other person to the prescribed organization;

(d.9) prescribing

conditions and restrictions that apply to a person who provides goods or

services for the purpose of enabling the prescribed organization to use

electronic means to collect, use, modify, disclose, retain or dispose of

personal health information;

(2) Subsection

73 (1) of the Act is amended by adding the following clauses:

(m.2) prescribing

exceptions or additional requirements that apply with respect to the prescribed

organization and the records described in subsection 51 (5), (6) or (7), which

may include excluding,

(

i) classes

of records from the application of those subsections, or

(ii) classes

of persons from access to those records in a prescribed form or manner;

(m.3) governing

the application of

section 52 to records in the custody or control of the

prescribed organization, or that are described in this Act as being treated as

if they were in the custody or control of the prescribed organization, which

may include prescribing exceptions in subsection 52 (1) that do not apply or

permitting or requiring another person to be responsible for identifying

whether an exception applies to the records;

(m.4) establishing

and governing pilot programs with respect to records described in subsection 51

(5), including allowing the prescribed organization to specify the eligibility

of individuals or groups of individuals to receive records in a specified

format or manner;

(m.5) prescribing

the format or manner in which records described in subsection 51 (5), (6) or

(7) shall be made available;

(m.6) authorizing

the prescribed organization to deactivate digital health identifiers or block

an individual’s access to the records described in subsection 51 (5), (6) or

(7) and governing the conditions and process for reactivating the digital

health identifier or access to records;

(m.7) requiring

the prescribed organization to provide summaries of records in addition to the

records described in subsection 51 (6) or (7), and governing the circumstances

when a

summary shall be provided;

(m.8) authorizing

a health information custodian to provide summaries in response to a request

for access instead of the complete record described in subsection 51 (8) in

specified circumstances, subject to any conditions;

(3) Section

73 of the Act is amended by adding the following subsection:

Two

or more organizations prescribed

(4.1) A

regulation made under clause (1) (d.1) may prescribe more than one organization

to act as the prescribed organization for the purposes of this Act and may

provide for the respective powers, duties and functions of each organization

under this Act.

Health

Information Protection Act, 2016

Subsection 1 (10) of

Schedule 1 to the Health Information

Protection Act, 2016 is repealed.

Commencement

(1) Except as otherwise provided in this section, this

Schedule

comes into force on the day the More Convenient Care Act,

2025 receives Royal Assent.

(2) Sections

1 to 9, subsections 10 (1), (2) and (3) and sections 11 to 13 come into force

on a day to be named by order of the Lieutenant Governor in Council.

Bill 11 Original (PDF)