First

Session, 46th General Assembly

Elizabeth II, 2008

BILL 7

AN ACT TO PROVIDE FOR

THE PROTECTION OF PERSONAL HEALTH INFORMATION

Received and Read the First Time ........................................................................ March 19, 2008

Second Reading .......................................................................................................... May 26, 2008

Committee ..............................................................................................

Amendment

May 27, 2008

Third Reading .............................................................................................................. May 27, 2008

Royal Assent ......................................................................................................................................

HONOURABLE ROSS

WISEMAN

Minister of Health and Community Services

Ordered

to be printed by the Honourable House of Assembly

EXPLANATORY NOTE

This Bill would establish a set of

comprehensive privacy protection rules applicable to the collection, use,

disclosure and disposition of personal health information by the public and

private sector components of the health system.

A BILL

AN ACT TO PROVIDE FOR THE PROTECTION OF

PERSONAL HEALTH INFORMATION

Analysis

Short title

Interpretation

PART

PURPOSE,

INTERPRETATION AND APPLICATION

Purpose

Custodian

Personal health information

Interpretation

Representative

Application

Act does not apply

Non-application of Act

Conflict with other Acts

Access to information legislation

PART

PRACTICES TO PROTECT PERSONAL HEALTH INFORMATION

Information practices, policies and

procedures

Obligations of employees, etc.

Security

Duty to ensure accuracy of information

Designate

Contact person

Written public statement

Duty of custodian to inform or notify

Power to transform personal health

information

Information manager

PART

III

CONSENT

Elements of consent

Consent may be express or implied

Where consent must be express

Assumption of validity

Limited consent

Withdrawal of consent

PART

COLLECTION, USE AND DISCLOSURE OF PERSONAL HEALTH INFORMATION

Collection of personal health

information with consent

Direct collection

Indirect collection

Scope of collection

Use of information

Permitted uses

Scope of use

Disclosure generally

Disclosure without consent for health

care purposes

Where individual deceased

Disclosure for health related purposes

Disclosure related to health and safety

Disclosure related to proceedings

Disclosure for enforcement purposes

Disclosure required by law

Disclosure for research purposes

Disclosure of registration information

Monitoring health care payments

Disclosure outside the province

Maintaining certain disclosure

information

Limitations on disclosure

Disclosure does not make recipient a

custodian

PART

ACCESS TO AND CORRECTION OF A RECORD OF PERSONAL HEALTH INFORMATION

Application of

Part

Individual's right of access

Exercise of right of access

Content of request

Time of response

Response of the custodian

Fees

Refusal of access

Informal access

Correction

Time of response

Response of custodian

Duty of custodian

Duty of custodian

PART

REVIEW BY COMMISSIONER

Interpretation

Complaint to commissioner

Informal resolution

Conduct of review

Investigative powers

Entry onto premises

Power to inspect records

Commissioner's recommendation

Commissioner's report

Response of custodian

Obligation to assist

Admissibility of evidence

Privileged information

Disclosure by commissioner

Additional powers of commissioner

Delegation by commissioner

Immunity from suit

Annual report of commissioner

PART

VII

APPEALS

Appeal by individual

Appeal by the commissioner

Conduct of appeal

Powers of court on appeal

PART

VIII

GENERAL MATTERS

Immunity from suit

Offences and penalties

Non-retaliation

Regulations

Review of Act

PART

CONSEQUENTIAL AMENDMENTS AND COMMENCEMENT

SNL2002 cA-1.1 Amdt.

SNL2004 cC-5.1 Amdt.

SNL2001 cC-12.01Amdt.

SNL2001 cC-14.1 Amdt.

95.1 NLR 18/08 Amdt.

Commencement

Be it enacted by the Lieutenant-Governor and

House of Assembly in Legislative Session convened, as follows:

Short title

1. This

Act may be cited as the Personal Health

Information Act .

Interpretation

(1) In

this Act

(a) "agent", in relation to a custodian,

means a person that, with the authorization of the custodian, acts for or on

behalf of the custodian in respect of personal health information for the

purposes of the custodian, and not the agent's purposes, whether or not the

agent has the authority to bind the custodian, is paid by the custodian or is

being remunerated by the custodian;

(b) "authority" means a regional health

authority established under the Regional

Health Authorities Act ;

(c) "Centre for Health Information"

means the Newfoundland and Labrador Centre for Health Information incorporated under the Centre for Health Information Act ;

(d) "collect", in relation to personal

health information, means to gather, acquire, receive or obtain the information

by any means from any source and "collection" has a corresponding meaning;

(e) "commissioner" means the Information

and Privacy Commissioner appointed under the Access to Information and Protection of Privacy Act ;

(f) "custodian" means a person described

in subsection 4(1);

(g) "disclose", in relation to personal

health information in the custody or control of a custodian or other person,

means to make the information available or to release it but does not include a

use of the information and "disclosure" has a corresponding meaning;

(h) "health care" means an observation,

examination, assessment, care, service or procedure in relation to an

individual that is carried out, provided or undertaken for one of the following

health-related purposes:

(

i) the diagnosis, treatment or maintenance of an

individual's physical or mental condition,

(ii) the prevention of disease or injury,

(iii) the promotion of health,

(iv) rehabilitation,

(

v) palliative care,

(vi) the taking of a donation of blood, blood

products, bodily parts or other bodily substances from an individual,

(vii) the compounding, dispensing or selling of a

drug, health care aid, device, product, equipment or other item to an

individual or for the use of an individual, under a prescription, or

(viii) a program or service designated as a health

care service in the regulations;

(i) "health care facility" means a

facility that provides in-patient health care, including a hospital, a

psychiatric unit under the Mental Health

Care and Treatment Act , a personal care home, a community care home, a

long-term care home or other facility designated in the regulations;

(j) "health care professional" means a

person, including a corporation, that is licensed or registered to provide

health care by a body authorized to regulate a health care professional under one

of the following enumerated Acts but does not include an employee of a health

care professional when acting in the course of his or her employment:

(

i) C hiropractors

Act,

(ii) Dental

Act,

(iii) Denturists

Act, 2005 ,

(iv) Dieticians

Act ,

(

v) Dispensing

Opticians Act, 2005 ,

(vi) Hearing

Aid Practitioners Act ,

(vii) Licensed

Practical Nurses Act, 2005 ,

(viii) Massage

Therapy Act, 2005 ,

(ix) Medical

Act, 2005 ,

(

x) Occupational

Therapists Act, 2005 ,

(xi) Optometry

Act, 2004 ,

(xii) Pharmacy

Act ,

(xiii) Physiotherapy

Act, 2006 ,

(xiv) Psychologists

Act, 2005 ,

(xv) Registered

Nurses Act , and

(xvi) Social

Workers Association Act ;

(k) "health care provider" means a

person, other than a health care professional, who is paid by MCP, another

insurer or person, whether directly or indirectly or in whole or in part, to provide

health care services to an individual;

(l) "information manager" means a person

or body, other than an employee of a custodian acting in the course of his or

her employment, that

(

i) processes, retrieves, stores or disposes of personal

health information for a custodian, or

(ii) provides information management or information

technology services to a custodian;

(m) "MCP" means the Newfoundland and

Labrador Medical Care Plan administered under the Medical Care Insurance Act, 1999 ;

(n) "minister" means the minister

appointed under the Executive Council Act

to administer this Act;

(o) "person" includes a board,

commission, tribunal, partnership, association, organization or other entity;

(p) "personal health information" means the

information described in subsection 5(1);

(q) "proceeding" means a proceeding held

before, in or under the rules of a court, a tribunal, a commission, the commissioner,

a body with the statutory authority for the discipline of health professionals,

an arbitrator or a mediator;

(r) "public body" means a public body as

defined in the Access to Information and

Protection of Privacy Act ;

(s) "record" means a record of personal

health information in any form, and includes personal health information that

is written, photographed, recorded or stored in any manner, but does not

include a computer program or a mechanism that produces records on a storage

medium;

(t) "registration information" means information about an individual

that is collected for the purpose of registering the individual for the

provision of health care, and includes a health care number and other identifier assigned to an individual;

(u) "representative", in relation to an

individual, means a person referred to in

section 7;

(v) "research" means a systematic

investigation designed to develop or establish principles or facts or to

generate knowledge, or any combination of principles, facts and knowledge, and

includes the development, testing and evaluation of research;

(w) "research ethics board" means the research

ethics board appointed by the Health Research Ethics Authority for Newfoundland and Labrador under the Health Research Ethics Authority Act ;

(x) "research ethics body" means a research

ethics body approved by the Health Research Ethics Authority for Newfoundland and Labrador under the Health Research Ethics Authority Act ;

(y) "researcher" means a person who

conducts research;

(z) "review" means a review by the

commissioner referred to in subsection 67(2); and

(aa) "use", in relation to personal

health information in the custody or control of a custodian, means to handle or

deal with the information or to apply the information for a purpose and

includes reproducing the information but does not include disclosing the information.

(2) For the purposes of this Act and the

regulations, a reference to "the individual's consent" includes the

consent of a person referred to in

section 7 that is given on an individual's

behalf in accordance with this Act.

PART I

PURPOSE,

INTERPRETATION AND APPLICATION

Purpose

3. The

purposes of this Act are

(

a) to establish rules for the collection, use and

disclosure of personal health information that protect the confidentiality of

that information and the privacy of individuals with respect to that

information;

(

b) to provide individuals with a right of access

to personal health information about themselves, subject to limited and

specific exceptions set out in this Act;

(

c) to provide individuals with a right to require

the correction or amendment of personal health information about themselves,

subject to limited and specific exceptions set out in this Act;

(

d) to establish mechanisms to ensure the

accountability of persons having custody or control of personal health information

and to safeguard the security and integrity of the personal health information

in their custody or control;

(

e) to provide for an independent review of

decisions and resolution of complaints with respect to personal health information

in the custody or control of custodians; and

(

f) to establish measures to promote the

compliance with this Act by persons having the custody or control of personal

health information.

Custodian

(1) In

this Act, "custodian" means a person described in one of the

following paragraphs who has custody or control of personal health information

as a result of or in connection with the performance of the person's powers or

duties or the work described in that paragraph:

(

a) an authority;

(

b) a board, council, committee, commission,

corporation or agency established by an authority;

(

c) a department created under the Executive Council Act , or a branch of

the executive government of the province, when engaged in a function related to

the delivery or administration of health care in the province;

(

d) the minister, where the context so requires;

(

e) a health care professional, when providing

health care to an individual or performing a function necessarily related to

the provision of health care to an individual;

(

f) a health care provider;

(

g) a person who operates

(

i) a health care facility,

(ii) a licensed pharmacy as defined in the Pharmacy Act ,

(iii) an ambulance service, or

(iv) a centre, program or service for community

health or mental health, the primary purpose of which is the provision of

health care by a health care professional or health care provider;

(

h) the Provincial Public H ealth Laboratory;

(

i) the Centre for Health Information;

(

j) with respect to Memorial University of

Newfoundland, the Faculty of Medicine, the School of Nursing, the School of

Pharmacy and the School of Human Kinetics and Recreation;

(

k) the Centre for Nursing Studies;

(

l) the Western Regional School of

Nursing;

(

m) a person who, as a result of the bankruptcy or

insolvency of a custodian, obtains complete custody or control of a record of

personal health information, held by the custodian;

(

n) a rights advisor under the Mental Health Care and Treatment Act ;

(

o) the Workplace Health, Safety and Compensation

Commission; and

(

p) a person designated as a custodian in the

regulations.

(2) Except as otherwise provided in this Act or

the regulations, a person described in one of the following classes shall not

be considered to be a custodian in respect of personal health information he or

she may collect, use, disclose or dispose of while performing the powers or duties

described:

(

a) an employee of a custodian when acting in the

course of his or her employment;

(

b) a body with statutory responsibility for the discipline of health

professionals;

(

c) the Trial Division, Unified Family Court, the

Court of Appeal or the Provincial

Court ;

(

d) a person who is authorized to act for or on

behalf of a person that is not a custodian where the scope of the duties of the

authorized person do not include the provision of health care;

(

e) a person that collects or uses an MCP number

for a purpose other than the provision of health care;

(

f) an officer of the House of Assembly;

(

g) a person who is neither a health care professional

or a health care provider and who provides fitness, weight-management, stress

management, smoking-cessation or aesthetic services;

(

h) an information manager;

(

i) the Statistics Agency;

(

j) a person referred to in

section 7, when acting

in the capacity described in that section; and

(

k) a person designated by the regulations as

excluded from the meaning of "custodian".

(3) Except as otherwise provided in subsections

(4) and (5), a custodian does not cease to be a custodian with respect to a record

of personal health information until complete custody and control of the

record, where applicable, passes to another person who is legally authorized to

hold the record and the duties imposed by this Act and the regulations on a

custodian with respect to personal health information shall continue to apply until

the passage of custody and control of the record.

(4) Where a custodian fails to carry out his or

her duties, the minister may appoint a person to act in place of the custodian

until custody and control of the record fully passes to another person and may

recover the costs and expenses of and incidental to the appointment from the

custodian.

(5) Where a custodian who is a natural person

dies, the duties and powers of a custodian under this Act shall be performed by

a personal representative of the deceased until custody and control of the

record of personal health information passes to another person who is legally

authorized to hold the record.

Personal health

information

(1) In

this Act, "personal health information" means identifying information

in oral or recorded form about an individual that relates to

(

a) the physical or mental health of the

individual, including information respecting the individual's health care

status and history and the health history of the individual's family;

(

b) the provision of health care to the

individual, including information respecting the person providing the health

care;

(

c) the donation by an individual of a body part

or bodily substance, including information derived from the testing or examination

of a body part or bodily substance;

(

d) registration information;

(

e) payments or eligibility for a health care program

or service in respect of the individual, including eligibility for coverage

under an insurance or payment arrangement with respect to health care;

(

f) an individual's entitlement to benefits under

or participation in a health care program or service;

(

g) information about the individual that is

collected in the course of, and is incidental to, the provision of a health care

program or service or payment for a health care program or service;

(

h) a drug as defined in the Pharmacy Act , a health care aid, device, product, equipment or

other item provided to an individual under a prescription or other

authorization issued by a health care professional; or

(

i) the identity of a person referred to in

section 7.

(2) For the purpose of paragraph (1)(b),

"information respecting the person providing health care" means, in

relation to that person, the following information as applicable:

(

a) the name, business title, address and

telephone number;

(

b) licence number; and

(

c) profession, job classification and employment

status.

(3) In addition to the matters referred to in

paragraphs (1)(

a) to (i), personal health information includes identifying

information about an individual that is contained in a record that contains

personal health information within the meaning of that subsection.

(4) Notwithstanding subsection (3), personal

health information does not include identifying information contained in a

record that is in the custody or under the control of a custodian where

(

a) the identifying information contained in the

record relates primarily to an employee or agent of the custodian; and

(

b) the record is created or maintained primarily

for a purpose other than the provision of health care or assistance in providing

health care to the employee or agent.

(5) For the purpose of this section,

"identifying information" means information that identifies an

individual or for which it is reasonably foreseeable in the circumstances that

it could be utilized either alone or together with other information to

identify an individual.

Interpretation

(1) A

provision of this Act that applies to the collection, use or disclosure of

personal health information about an individual by a custodian with the consent

of the individual, whether express or implied, does not affect the collection,

use or disclosure that this Act permits or requires the custodian to make of

the information without the consent of the individual.

(2) A provision of this Act that permits a

custodian to disclose personal health information about an individual without

the consent of the individual

(

a) does not compel the custodian to disclose the

information unless otherwise required to do so by law;

(

b) does not relieve the custodian from a legal

requirement to disclose the information; and

(

c) does not prevent the custodian from obtaining

the individual's consent to the disclosure.

Representative

7. A

right or power of an individual under this Act or the regulations may be exercised

(

a) by a person with written authorization from

the individual to act on the individual's behalf;

(

b) where the individual lacks the competency to

exercise the right or power or is unable to communicate and where the

collection, use or disclosure of his or her personal health information is

necessary for or ancillary to a "health care decision" as defined in

the Advance Health Care Directives Act ,

by a substitute decision maker appointed by the individual in accordance with

that Act or where a substitute decision maker has not been appointed, a

substitute decision maker determined in accordance with

section 10 of that Act;

(

c) by a court appointed guardian of a mentally

disabled person, where the exercise of the right or power relates to the powers

and duties of the guardian;

(

d) by the parent or guardian of a minor where, in

the opinion of the custodian, the minor does not understand the nature of the

right or power and the consequences of exercising the right or power;

(

e) where the individual is deceased, by the

individual's personal representative or, where there is no personal representative,

by the deceased's nearest relative, and for this purpose, the identity of the

nearest relative may be determined by reference to

section 10 of the Advance Health Care Directives Act ;

(

f) where the individual is a neglected adult

within the meaning of the Neglected

Adults Welfare Act , by the Director of Neglected Adults appointed under

that Act; or

(

g) where an individual has been certified as an

involuntary patient under the Mental

Health Care and Treatment Act , by a representative as defined in that Act, except

as otherwise provided in this Act.

Application

(1) This Act applies only

to personal health information collected, used or disclosed by a custodian or

in the custody or control of a custodian.

(2) This Act applies to personal health information

collected before or after the coming into force of this Act.

(3) Notwithstanding subsection (2), the following

provisions of this Act do not apply to personal health information collected

before the coming into force of this Act:

(

a) sections 23 to 29, with respect to the

requirement of consent to the collection of personal health information; and

(

b) sections 30 to 32, with respect to the source

and method of collection of personal health information.

Act does not

apply

9. This

Act does not apply to a record created or information held by a person under or

for the purpose of the Child, Youth and

Family Services Act or the Adoption

Act notwithstanding that the information would otherwise be considered to

be personal health information or the person would otherwise be considered to

be a custodian within the meaning of this Act.

Non-application

of Act

(1) This

Act does not apply to personal health information about an individual after the

earlier of 120 years after a record containing the information was created and

50 years after the death of the individual.

(2) This Act does not apply to personal health

information contained in

(

a) a record in a court file or a record of a

judge of the Trial Division, Unified Family Court, Court of Appeal or Provincial

Court;

(

b) a note, communication or draft decision of a

person acting in a judicial or quasi-judicial capacity; or

(

c) a constituency record of a member of the House

of Assembly.

(3) Except as otherwise specifically provided in

this Act, this Act

(

a) does not affect the law of evidence or limit

the information otherwise available by law to a party to legal proceedings;

(

b) does not affect a legal privilege, including

solicitor-client privilege;

(

c) does not affect the power of a court or

tribunal to compel a witness to testify or to compel the production of

documents;

(

d) does not interfere with the activities of a body

with statutory responsibility for the discipline of health care professionals;

(

e) does not affect a court order that prohibits a

person from making information public or from publishing information; and

(

f) does not prohibit the transfer, storage or disposition

of a record in accordance with another Act or

an Act of the Parliament of

Canada.

Conflict with

other Acts

(1) Except

as otherwise provided in this Act, where there is a conflict between this Act

or a regulation made under this Act and another Act or regulation enacted

before or after the coming into force of this Act, this Act or the regulation

made under it shall prevail.

(2) Notwithstanding subsection (1), where

(

a) access to a record of personal health

information is prohibited or restricted by;

(

b) a right of access to a record of personal

health information is provided in; or

(

c) a requirement to disclose personal health information

is imposed upon a custodian in

a provision designated in the regulations

made under

section 90 , that provision shall

prevail over this Act or a regulation made under it.

(3) For the purpose of this section, a conflict

shall not exist unless it is impossible to comply with both this Act and

regulations under this Act and another Act or regulations.

Access to information

legislation

(1) The

Access to Information and Protection of

Privacy Act does not apply to

(

a) the use, collection, disclosure, storage, disposition

or any other dealing with personal health information by or in the custody or

control of a custodian;

(

b) a request for access to or correction of a

record of personal health information in the custody or control of a custodian;

(

c) a complaint to the commissioner respecting

(

i) a denial of access to or correction of a

record of personal health information by a custodian,

(ii) a request for review or appeal of a denial of

access to or correction of a record of personal health information by a

custodian, or

(iii) a contravention or alleged contravention of

this Act or the regulations; or

(

d) the determination or prosecution of an offence

or the imposition of a penalty in respect of a breach of this Act or the

regulations.

(2) Notwithstanding subsection (1), this Act does

not limit a person's right of access under

section 7 of the Access to Information and Protection of

Privacy Act

(

a) to personal information contained in a record,

other than a record referred to in subsection 5(4), in the custody or control

of a custodian who is a public body, that contains both personal health

information as described in

section 5 and personal information but only where

the personal information can be reasonably severed from the record;

(

b) to a record of personal health information

which is in the custody or control of a public body who is not a custodian

within the meaning of subsection 4(1); or

(

c) to both personal health information and

personal information contained in a record referred to in subsection 5(4) where

the record is in the custody or control of a custodian that is a public body.

(3) For the purpose of subsection (2),

"personal information" means personal information as defined in

paragraph 2(

o) of the Access to Information

and Protection of Privacy Act , other than information referred to in

subparagraph 2(o)(

v) of that Act.

(4) Notwithstanding subsection (1), this Act does

not apply to a request for access or review or an appeal made under the Access to Information and Protection of Privacy

Act before the day this

section comes into force and that Act shall

continue to apply to that request, review or appeal.

PART II

PRACTICES TO PROTECT PERSONAL HEALTH INFORMATION

Information practices,

policies and procedures

(1) A custodian that has custody or

control of personal health information shall establish and implement information

policies and procedures to facilitate the implementation of, and ensure compliance

with, this Act and regulations respecting the manner of collection, storage,

transfer, copying, modification, use and disposition of personal information

whether within or outside the province.

(2) The information policies and procedures

referred to in subsection (1) shall include policies and procedures to

(

a) protect the confidentiality of personal health

information that is in its custody or under its control and the privacy of the

individual who is the subject of that information;

(

b) restrict access to an individual's personal

health information by an employee, agent, contractor or volunteer of the custodian

or by a health care professional who has the right to treat persons at a health

care facility operated by the custodian to only that information that the

employee, agent, contractor, volunteer or health care professional requires to

carry out the purpose for which the information was collected or will be used;

(

c) protect the confidentiality of personal health

information that will be stored or used in a jurisdiction outside the province

or that is to be disclosed by the custodian to a person in another jurisdiction

and the privacy of the individual who is the subject of that information; and

(

d) provide for the secure storage, retention and

disposal of records to minimize the risk of unauthorized access to or disclosure

of personal health information.

(3) The information policies and procedures

referred to in subsection (1) shall include appropriate measures to address the

risks associated with the storage of personal health information, taking into account

the manner and form in which the personal health information is recorded, the

location of storage and the degree of sensitivity of the personal health

information to be protected.

Obligations of

employees, etc.

(1) A custodian shall ensure that

(

a) its employees, agents, contractors and

volunteers; and

(

b) where the custodian is an operator of a health

care facility, those health care professionals who have the right to treat

persons at a health care facility operated by the custodian,

take an oath or affirmation of

confidentiality.

(2) A custodian's employees, agents, contractors

and volunteers, and those health care professionals who have the right to treat

persons at a health care facility operated by the custodian shall comply with

(

a) this Act and the regulations; and

(

b) the information policies and procedures

referred to in subsection 13(1).

(3) A custodian shall ensure that its employees,

agents, contractors and volunteers, and those health care professionals who

have the right to treat persons at a health care facility operated by the

custodian are aware of the duties imposed by this Act and the regulations and

the information policies and procedures referred to in

section 13.

(4) A person who provides goods or services for

the purpose of enabling a custodian to use electronic means to collect, use,

modify, disclose, retain or dispose of personal health information shall comply

with this Act and the regulations.

Security

(1) A

custodian shall take steps that are reasonable in the circumstances to ensure

that

(

a) personal health information in its custody or

control is protected against theft, loss and unauthorized access, use or disclosure;

(

b) records containing personal health information

in its custody or control are protected against unauthorized copying or

modification; and

(

c) records containing personal health information

in its custody or control are retained, transferred and disposed of in a secure

manner.

(2) For the purpose of paragraph (1)(c), "disposed

of in a secure manner" in relation to the disposition of a record of

personal health information does not include the destruction of a record unless

the record is destroyed in such a manner that the reconstruction of the record

is not reasonably foreseeable in the circumstances.

(3) Except as otherwise provided in subsections

(4) and (5), a custodian that has custody or control of personal health information

shall notify the individual who is the subject of the information at the first

reasonable opportunity where the information is

(

a) stolen;

(

b) lost;

(

c) disposed of, except as permitted by this Act

or the regulations; or

(

d) disclosed to or accessed by an unauthorized

person.

(3.1) Where a custodian

reasonably believes that there has been a material breach as defined in the

regulations involving the unauthorized collection, use, or disclosure of

personal health information, that custodian shall inform the commissioner of

the breach.

(3.2) Notwithstanding a

circumstance where, under subsection (5), notification of an individual by a

custodian is not required, the commissioner may recommend that the custodian,

at the first reasonable opportunity, notify the individual who is the subject

of the information.

(4) Where a custodian is a researcher who has received

personal health information from another custodian under

section 44, he or she

may not notify an individual who is the subject of the information that the

information has been stolen, lost, disposed of in an unauthorized manner or disclosed to or accessed by an unauthorized person

unless the custodian who provided the information to the researcher first obtains

the individual's consent to contact by the researcher and informs the

researcher that the individual has given consent.

(5) Subsection (3) and subsection 20(3) do not

apply where the custodian reasonably believes that the theft, loss,

unauthorized disposition, or improper disclosure or access of personal health

information will not have an adverse impact upon

(

a) the provision of health care or other benefits

to the individual who is the subject of the information; or

(

b) the mental, physical, economic or social

well-being of the individual who is the subject of the information.

(6) Notwithstanding subsection (1), a custodian

that has custody or control of personal health information that is the subject

of a request for access under subsection 53(1) or for correction under subsection

60(1) shall retain the information for as long as necessary to allow the individual

to exhaust any recourse under this Act that he or she may have with respect to

the request.

Duty to ensure

accuracy of information

16. Before

using or disclosing personal health information that is in its custody or under

its control, a custodian shall

(

a) take reasonable steps to ensure that the

information is as accurate, complete and up-to-date as is necessary for the purpose

for which the information is used or disclosed;

(

b) clearly set out for the recipient of the

disclosure the limitations, if any, on the accuracy, completeness or up-to-date

character of the information; and

(

c) make a reasonable effort to ensure that the

person to whom a disclosure is made is the person intended and authorized to

receive the information.

Designate

17. A

custodian shall designate a person to make a decision required of a custodian

under this Act.

Contact person

(1) A

custodian that is not a natural person shall designate one or more contact

persons to perform the functions set out in subsection (3).

(2) A custodian that is a natural person may designate

a contact person to perform the functions set out in subsection (3) and where

no contact person is designated, the custodian shall be considered to be the

contact person for purpose of that subsection.

(3) A contact person referred to in subsection (1)

shall

(

a) facilitate the custodian's compliance with

this Act and the regulations;

(

b) ensure that employees, contractors, agents and

volunteers of the custodian and those health care professionals who have the

right to treat persons at a health care facility operated by a custodian are

informed of their duties under this Act and the regulations;

(

c) respond to inquires from the public in respect

of the custodian's information policies and procedures; and

(

d) respond to requests by an individual for

access to or correction of personal health information about the individual

that is in the custody or under the control of the custodian.

(4) Where the contact person is a person other

than the custodian,

(

a) a collection, use or disclosure of personal

health information by the contact person is considered to be a collection, use

or disclosure by the custodian; and

(

b) a disclosure of personal health information to

the contact person is considered to be disclosure to the custodian.

Written public

statement

19. A

custodian shall, in a manner that is practical in the circumstances, make

available to those who are or who are likely to be affected by the custodian's

activities a written statement that

(

a) provides a general description of the

custodian's information policies and procedures;

(

b) where a contact person has been designated

under subsection 18(1) or 18(2), identifies the contact person and provides access

information, or where no contact person has been designated, sets out the name

and access information of the custodian;

(

c) describes how an individual may obtain access

to or request correction of a record of personal health information about the

individual that is in the custody or control of the custodian; and

(

d) describes how a complaint may be made to the

commissioner.

Duty of custodian

to inform or notify

(1) Where

a custodian collects personal health information directly from the individual

who is the subject of the information or from his or her representative, the

custodian shall take reasonable steps to inform the individual or his or her

representative

(

a) of the purpose for the collection, use and

disclosure of the information;

(

b) of the identity of and other relevant

information relating to the contact person referred to in

section 18; and

(

c) other information prescribed in the

regulations.

(2) For the purpose of subsection (1), it shall be

reasonable to believe that an individual knows the purpose of the collection,

use or disclosure of his or her personal health information by a custodian

where the custodian

(

a) posts or makes readily available a notice setting

out the permissible purpose for collection, use or disclosure where it is

likely to come to the individual's attention; or

(

b) provides the individual with such a notice.

(3) Where a custodian uses or discloses personal

health information about an individual without the individual's consent in a

manner that is inconsistent with the information policies and procedures referred

to in

section 13, the custodian shall

(

a) inform the individual who is the subject of

the information of the use or disclosure at the first reasonable opportunity

except where, under

section 58, the custodian would be required or permitted to

refuse access to the record of personal health information;

(

b) make a note of the use or disclosure; and

(

c) retain the note as

part of the record of personal health information about the individual that it

has in its custody or under its control.

(4) Subsection (3) does not apply where, following

an analysis under subsection 15(5), a custodian reasonably believes that the

use or disclosure of personal health information will not have an adverse impact

as described in that subsection.

Power to

transform personal health information

21. A

custodian may strip, encode or otherwise transform personal health information

to create non-identifying health information.

Information manager

(1) A

custodian that retains the services of an information manager for the provision

of a service described in paragraph 2(1)(

l) shall enter into an agreement with

the information manager in accordance with subsection (2).

(2) An agreement referred to in subsection

(1) shall be in writing and shall provide for the protection of the personal health

information against unauthorized access, use, disclosure, disposition, loss or

modification in accordance with this Act and the regulations.

(3) An information manager to which personal

health information is disclosed by the custodian may use or disclose that

information only for the purpose authorized by the agreement.

(4) An information manager shall comply with

(

a) this Act and the regulations; and

(

b) the terms of the agreement entered into with

the custodian

in respect of the personal health information

disclosed to it under subsection (2).

(5) An information manager shall not permit its

employee or a person acting on its behalf to access the personal health

information disclosed to it by the custodian unless the employee or person

acting on its behalf agrees in writing to comply with this Act and the

restrictions imposed upon the information manager referred to in subsection

(4).

(6) Nothing in subsection (4) or (5) relieves a

custodian from its obligations under this Act and the regulations in respect of

the personal health information disclosed by the custodian to the information

manager and the personal health information that has been disclosed to an

information manager under an agreement under subsection (2) is considered to continue

in the custody and control of the custodian for the purpose of this Act and the

regulations.

(7) An information manager may, in accordance with

the terms of an agreement with a custodian, construct or create an integrated

electronic record of personal health information comprising individual records,

the custody or control of each of which may be in one or more custodians.

PART III

CONSENT

Elements of

consent

(1) Where

this Act requires the consent of an individual for the collection, use or

disclosure of personal health information by a custodian, the consent

(

a) shall be a consent of the individual;

(

b) shall be knowledgeable; and

(

c) shall not be obtained through deception or

coercion.

(2) A consent to the collection, use or disclosure

of personal health information about an individual shall be considered to be

knowledgeable if it is reasonable in the circumstances to believe that the individual

knows

(

a) the purpose of the collection, use or

disclosure as provided for in subsection 20(2);

(

b) that he or she may give or withhold consent;

and

(

c) that the information may be only collected,

used or disclosed without his or her consent in accordance with this Act.

Consent may be

express or implied

(1) A

consent of the individual to the collection, use or disclosure of his or her personal

health information may be express or implied.

(2) Where a custodian referred to in paragraph

4(1)(e), (

f) or (g)

(

a) collects personal health information from and

with the consent of the individual who is the subject of the information; or

(

b) receives personal health information about an

individual from a custodian

for the purpose of providing health care

or assisting in the provision of health care to the individual as part of a

circle of care, that custodian is entitled to assume that he or she has the

individual's continuing implied consent to use or disclose the information to

another custodian or person for the purpose of providing health care to that

individual unless the custodian collecting or receiving the information is or becomes

aware that the individual has withdrawn his or her consent.

(3) For the purpose of subsection (2), the

expression "circle of care" means the persons participating in and

activities related to the provision of health care to the individual who is the

subject of the personal health information and includes necessarily incidental activities

such as laboratory work and professional consultation.

Where consent

must be express

(1) Notwithstanding

subsection 24(1), where a provision of this Act requires the consent of the

individual to the disclosure of his or her personal health information, the

required consent shall be express and may not be implied where

(

a) a custodian discloses the personal health

information to a person that is not a custodian; or

(

b) a custodian discloses the personal health

information to another custodian and the disclosure is not for the purpose of

providing health care or assisting in providing health care.

(2) The requirement of express consent under subsection

(1) does not apply to the disclosure of personal health information by a custodian

referred to in paragraph 4(1)(a), (

b) or (

e) to a third party who is requested

to provide payment for the medication or goods and services provided by that

custodian to the individual who is the subject of the personal health information

that is disclosed.

Assumption of

validity

26. A

custodian who has obtained the consent of the individual to the collection, use

or disclosure of his or her personal health information or who has received a

copy of a document purporting to record the individual's consent to the

collection, use or disclosure of his or her personal health information may

assume that the consent fulfils the requirements of this Act and that it has

not been withdrawn unless this assumption is not reasonable in the particular

circumstances.

Limited consent

(1) Where

a custodian discloses, with the consent of an individual, personal health

information about that individual to another custodian for the purpose of

providing health care to the individual and the disclosing custodian does not

have the consent of the individual to disclose all personal health information

about the individual that it considers reasonably necessary for that purpose,

the disclosing custodian shall notify the custodian to whom it discloses the

information of that fact.

(2) Where an individual places a condition on his

or her consent to the collection, use or disclosure of his or her personal

health information by a custodian, the condition is not effective to the extent

that it attempts or purports to prohibit or restrict a recording of personal

health information by the custodian where the recording is required by law or

by established standards of professional or institutional practice.

Withdrawal of

consent

28. Where

an individual consents to the collection, use or disclosure of his or her personal

health information, the individual may withdraw the consent, whether it is express

or implied, by providing notice to the custodian but the withdrawal of the

consent shall not have retroactive effect.

PART IV

COLLECTION, USE AND DISCLOSURE OF PERSONAL HEALTH INFORMATION

Collection of personal

health information with consent

(1) A custodian shall not collect personal

health information about an individual unless

(

a) the individual who is the subject of the

information has consented to its collection and the collection is necessary for

a lawful purpose; or

(

b) the collection is permitted or required by

this Act.

(2) Notwithstanding paragraph (1)(a), a custodian

may collect personal health information about an individual without that individual's

consent where the individual is incapable of providing consent and

(

a) there is no representative referred to in

section 7 who can provide consent on behalf of the individual or where there is

a representative, it is not reasonably possible to obtain his or her consent in

a timely manner; or

(

b) the individual has been certified as an

involuntary patient or is the subject of a community treatment order under the Mental Health Care and Treatment Act ;

and

(

c) the collection is necessary for the provision

of health care to the individual.

(3) A custodian shall not collect personal health

information if other information will serve the purpose of the collection.

(4) Subsection (3) does not apply to personal

health information that a custodian is required by law to collect.

Direct collection

30. Except

as otherwise provided in

section 31, a custodian shall collect personal health

information directly from the individual who is the subject of the information.

Indirect

collection

31. A

custodian may collect personal health information from a source other than the

individual who is the subject of the information where

(

a) the individual who is the subject of the

information authorizes collection from another source;

(

b) the information is reasonably necessary for

providing health care to the individual and it is not reasonably possible to collect

directly from the individual

(

i) personal health information that can

reasonably be relied on as accurate, or

(ii) personal health information in a timely

manner;

(

c) the individual is unable to provide the

information and the custodian collects the information from a person referred

to in

section 7 who is acting on behalf of the individual;

(

d) the custodian collects the information from a

person who is not a custodian for the purpose of carrying out a research

project that has been approved by the research ethics board or a research ethics

body;

(

e) the custodian collects the information from a

person who is permitted or required by

an Act or

an Act of Canada or by a

treaty, agreement or arrangement made under

an Act or

an Act of Canada to

disclose it to the custodian;

(

f) the custodian is permitted or required by an

Act or

an Act of Canada or by a treaty, agreement or arrangement made under an

Act or

an Act of Canada to collect the information indirectly;

(

g) the information is to be collected for the

purpose of assembling

a family or genetic history where the information collected will be used in the

context of providing a health service to the individual;

(

h) the information is collected for the purpose

(

i) determining the individual's eligibility to

participate in a health care program or to receive a benefit, product or health

care service from a custodian and the information is collected in the course of

processing an application made by or for the individual who is the subject of

the information, or

(ii) verifying the eligibility of an individual who

is participating in a health care program or receiving a benefit, product or

health care service from a custodian to participate in the program or to

receive the benefit, product or service;

(

i) the custodian is a custodian referred to in

paragraph 4(1)(a), (b), (

c) or (

d) and is collecting the information for a

purpose related to

(

i) the investigation of a breach of an agreement

or a contravention or an alleged contravention of the laws of the province or

of Canada ,

(ii) the conduct of a proceeding or a possible

proceeding, or

(iii) a statutory function of the custodian

and the method of collection is authorized

by law; or

(

j) the custodian collects information for the

purpose of analysis or compiling statistical information respecting the management,

evaluation or monitoring of the allocation of resources to, or planning for all

or part of, the health care system, including the delivery of services, and the

person from whom the information is collected has in place practices and procedures

to protect the privacy of the individuals whose personal health information it

receives and to maintain the confidentiality of the information.

Scope of

collection

(1) A

custodian shall not collect more personal health information than is reasonably

necessary to meet the purpose of the collection.

(2) Subsection (1) does not apply to personal

health information that a custodian is required by law to collect.

Use of

information

(1) A

custodian shall not use personal health information about an individual unless

(

a) it has the individual's consent under this Act

and the use is necessary for a lawful purpose; or

(

b) the use is permitted or required by this Act.

(2) A custodian shall not use personal health

information if other information will serve the purpose of the use.

(3) The use of personal health information in its

custody or under its control by a custodian shall be limited to the minimum

amount of information necessary to achieve the purpose for which it is used.

(4) This

section does not apply to personal health

information that the custodian is required by law to use.

Permitted uses

34. A

custodian may use personal health information in its custody or under its

control for one or more of the following purposes:

(

a) for the purpose for which the information was

collected or created and for all the functions reasonably necessary for

carrying out that purpose;

(

b) where

an Act or

an Act of Canada permits or

requires a person to disclose the personal health information to the custodian,

for the purpose for which the information was disclosed;

(

c) for planning or delivering health care programs

or services provided or funded by the custodian, in whole or in part, allocating

resources to those programs or services, evaluating or monitoring those programs

or services or preventing fraud or an unauthorized receipt of services or

benefits related to those programs or services;

(

d) for the purpose of risk management or error

management or for the purpose of activities to improve or maintain the quality

of care or to improve or maintain the quality of related programs or services

of the custodian;

(

e) in a manner consistent with

Part II, for the

purpose of disposing of the information or modifying it in order to conceal the

identity of the individual who is the subject of the personal health

information;

(

f) for the purpose of seeking the consent of the

individual or his or her representative, where the personal health information

used by the custodian for this purpose is limited to the name and contact

information of the individual or the individual's representative;

(

g) for the purpose of a proceeding or

contemplated proceeding in which the custodian is or is expected to be a party

or witness and where the information relates to or is a matter in issue in the

proceeding or contemplated proceeding;

(

h) where the custodian is the minister or a

department, for the purpose of obtaining health care cost recovery;

(

i) for the purpose of obtaining payment or

processing, monitoring, verifying or reimbursing claims for payment for the

provision of health care or related goods and services;

(

j) for an approved research project in accordance

with

section 44;

(

k) as permitted or required by law or by a

treaty, agreement or arrangement made under

an Act or

an Act of Canada;

(

l) to prevent or reduce a risk of serious harm to

(

i) the mental or physical health or safety of the

individual the information is about or another individual, or

(ii) public health or public safety;

(

m) where the custodian is a custodian referred to

in paragraph 4(1)(a), (b), (c), (

d) or (i), for the following functions within

the geographic area in which the custodian has jurisdiction:

(

i) planning and resource allocation,

(ii) health system management,

(iii) public health surveillance, and

(iv) health policy development;

(

n) where the custodian is a person referred to in

paragraph 4(1)(n), for the performance of a function referred to in subsection

14(2) of the Mental Health Care and

Treatment Act ;

(

o) another use to which the individual who is the

subject of the personal health

information consents; and

(

p) to produce information that does not, either

by itself or in combination with other information in the custody of or under

the control of the custodian, permit an individual to be identified.

Scope of use

35. A

custodian shall limit the use of personal health information in its custody or

under its control to those of its employees and agents who need to know the

information to carry out the purpose for which the information was collected or

a purpose authorized under this Act.

Disclosure generally

(1) A

custodian shall not disclose personal health information that is in its custody

or control unless

(

a) it has the individual's consent under this Act

and the disclosure is necessary for a lawful purpose; or

(

b) the disclosure is permitted or required by

this Act.

(2) A custodian shall not disclose personal health

information if other information will serve the purpose of the disclosure.

Disclosure

without consent for health care purposes

(1) A

custodian may disclose personal health information without the consent of the

individual who is the subject matter of the information

(

a) to a custodian referred to in paragraph 4(1)(a),

(e), (

f) or (

g) where the disclosure is necessary for the provision of health

care to the individual and

(

i) it is not possible to obtain the consent of

the individual in a timely manner, or

(ii) the individual has been certified as an

involuntary patient or is subject to a community treatment order under the Mental Health Care and Treatment Act ; or

(

b) to a person other than a custodian, for the

purpose of contacting a relative, friend or potential substitute decision-maker

of the individual, where the individual is injured, incapacitated or ill and

unable to give consent personally

unless the disclosure is contrary to an

express request of the individual.

(2) Where a custodian discloses personal health

information under subsection (1) and an express request of the individual who

is the subject of the information prevents the custodian from disclosing all

the personal health information that the custodian considers reasonably

necessary to provide or assist in the provision of health care, the custodian

shall notify the person to whom it makes the disclosure of that fact.

(3) A custodian referred to in subparagraph 4(1)(g)(

i) may disclose personal health information about an individual who is a patient

or resident in a health care facility operated by the custodian to a person

that the custodian reasonably believes is a member of the individual's

immediate family, a relative or a person with whom the individual has a close

personal relationship where

(

a) the custodian offers the individual the

option, at the first reasonable opportunity after admission to the facility, to

object to that disclosure and the individual does not do so; and

(

b) the disclosure is made in accordance with

accepted professional practice.

Where individual

deceased

38. A

custodian may disclose personal health information about an individual who is

deceased or presumed to be deceased without the consent of the individual who

is the subject of the information

(

a) for the purpose of identifying the individual;

(

b) for the purpose of informing a person whom it

is reasonable to inform in the circumstances of the fact that the individual is

deceased or presumed to be deceased and the circumstances of the death, where

appropriate;

(

c) to the personal representative of the deceased

for a purpose related to the administration of the estate;

(

d) to a spouse, partner, sibling or descendant of

the individual where the recipient of the information reasonably requires the

information to make decisions about his or her own health care or the health

care of his or her child or where the disclosure is necessary to provide health

care to the recipient; or

(

e) for research purposes under the authority of

section 44.

Disclosure for health

related purposes

(1) A

custodian may disclose personal health information without the consent of the individual

who is the subject of the information

(

a) for the purpose of determining or verifying

the eligibility of the individual to receive health care or related goods, services

or benefits provided under

an Act of the province or of Canada and funded in

whole or part by the government of the province or of Canada;

(

b) for the purpose of determining or providing

payment to the custodian for the provision of health care or for processing,

monitoring, verifying or reimbursing claims for payment for the provision of

health care;

(

c) to a department or the government of another

jurisdiction or to an agency of that government to the extent necessary to

obtain payment for health care provided to the individual who is the subject of

the personal health information;

(

d) for the purpose of delivering, evaluating or

monitoring a program of the custodian that relates to the provision of health

care or payment for heath care;

(

e) for the purpose of review and planning that

relates to the provision of health care by the custodian;

(

f) to an information manager in accordance with

section 22;

(

g) to a person who requires the personal health

information to carry out an audit for, or provide legal services, error management

services or risk management services to, the custodian;

(

h) to the Canadian Institute for Health

Information or other entity prescribed in the regulations for the purpose of compiling

and analyzing statistical information to assist in the management, evaluation

and monitoring of the allocation of resources, health system planning and

delivery of health care services in accordance with the terms of an agreement between

the Canadian Institute for Health Information or other entity and the province;

(

i) to a potential successor of the custodian for

the purpose of allowing the potential successor to assess and evaluate the

operations of the custodian, on condition that the potential successor first

enters into an agreement with the custodian to keep the information

confidential and secure and not to retain the information any longer than is

necessary for the purpose of the assessment or evaluation; and

(

j) to its successor where the custodian transfers

records to the successor as a result of the custodian ceasing to be a custodian

or ceasing to provide health care within the geographic area in which the

successor provides health care and the successor is a custodian.

(2) For the purpose of paragraph (1)(j), a custodian

who transfers a record of personal health information to its successor shall make

reasonable efforts to give notice to the individual who is the subject of the

information prior to the transfer or, where this is not possible, as soon as

possible after the transfer that it has ceased to be a custodian of the

information and identifying its successor.

(3) Where a notice provided by a custodian under

subsection (2) is in the form of a public notice, the information contained in

the notice shall be limited to the following:

(

a) that the custodian has ceased or will cease to

be a custodian within the jurisdiction;

(

b) the identity and contact information of its

successor; and

(

c) the means by which an individual whose

personal health information is in the custody or control of the custodian may access

his or her record of personal health information after the transfer.

(4) A custodian shall disclose personal health

information without the consent of the person who is the subject of the

information

(

a) where the custodian is the minister, a department

or an authority, for the purpose of obtaining health care cost recovery;

(

b) to a person conducting an audit or reviewing

an application for accreditation or reviewing an accreditation, where the audit

or review relates to the services provided by the custodian;

(

c) to or via an information network designated in

the regulations in which personal health information is recorded for the

purpose of facilitating

(

i) the delivery, evaluation or monitoring of a

program that relates to the provision of health care or payment for health

care,

(ii) review and planning that relates to the

provision of health care or payment for health care, or

(iii) the construction or creation of an integrated

electronic record of personal health information in accordance with the

regulations;

(

d) to a custodian designated in the regulations who

compiles or maintains a registry of personal health information for purposes of

facilitating or improving the provision of health care or that relates to the

storage or donation of body parts or bodily functions;

(

e) to the chief medical officer and other medical

officers where the disclosure is required by another Act or

an Act of Canada;

and

(

f) to a public health authority that is similar

to a person referred to in paragraph (

e) and that is established under a law of

Canada , another province or other jurisdiction where the disclosure is

made for a purpose substantially similar to the purpose of

an Act referred to

in paragraph (e).

Disclosure

related to health and safety

(1) A

custodian may disclose personal health information without the consent of the

individual who is the subject of the information where the custodian reasonably

believes that disclosure is required

(

a) to prevent or reduce a risk of serious harm to

the mental or physical health or safety of the individual the information is

about or another individual; or

(

b) for public health or public safety.

(2) A custodian may disclose personal health

information without the consent of the individual who is the subject of the

information to the superintendent of a correctional facility in which the

individual is lawfully detained or to the administrator of a psychiatric unit

in which the individual is detained to assist the facility or unit in making a

decision respecting

(

a) arrangements for the provision of health care

to the individual who is the subject of the information; or

(

b) the placement of the individual into custody,

detention, release, conditional release, discharge or conditional discharge

under the Mental Health Care and

Treatment Act, the Prisons Act , the Young Persons Offences Act and regulations under that Act,

Part

XX.1 of the Criminal Code , the Prisons and Reformatories Act (Canada)

and the Youth Criminal Justice Act

(Canada) .

Disclosure related

to proceedings

(1) A

custodian shall disclose personal health information without the consent of the

individual who is the subject of the information

(

a) to a body with statutory responsibility for

the discipline of a health care professional or for the quality or standards of

professional services provided by a health care professional, including an investigation by

that body; or

(

b) for the purpose of complying with a summons,

subpoena, warrant, demand, order or similar requirement issued by a court,

person or entity, including the commissioner, with jurisdiction to compel the

production of personal health information or with a rule of court concerning

the production of personal health information in a proceeding.

(2) A custodian may disclose personal health

information without the consent of the individual who is the subject of the

information

(

a) for the purpose of a proceeding or

contemplated proceeding in which the custodian is or is expected to be a party

or a witness where the information relates to or is a matter in issue in the

proceeding or contemplated proceeding;

(

b) to a committee referred to in subsection

8.1(2) of the Evidence Act for the

purpose of peer review or quality assurance activities;

(

c) to a proposed guardian or legal representative

of the individual for the purpose of appointment of the person as a guardian or

representative;

(

d) to a guardian authorized under

an Act of the

province or the Rules of the Supreme

Court, 1986 , to commence, defend or continue a proceeding on behalf of the

individual or to represent the individual in a proceeding; or

(

e) for the purpose of laying an information or

making an application for an order where the personal health information relates

to or is a matter in issue in the information or application.

Disclosure for

enforcement purposes

(1) A

custodian shall disclose personal health information, including information

relating to a person providing health care, without the consent of the

individual who is the subject of the information to a person carrying out an inspection, investigation

or similar procedure that is authorized by or under this Act, the Child, Youth and Family Services Act , another

Act or

an Act of Canada for the purpose of facilitating the inspection, investigation

or similar procedure.

(2) A custodian may disclose personal health

information, including information relating to a person providing health care,

without the consent of the individual who is the subject of the information to another custodian where the custodian

disclosing the information has a reasonable expectation that disclosure will

detect or prevent fraud, limit abuse in the use of health care or prevent the

commission of an offence under

an Act of the province or of Canada.

Disclosure

required by law

43. A

custodian shall disclose personal health information without the consent of the

individual who is the subject of the information where the disclosure is

required by another Act or

an Act of Canada or by a treaty, agreement or

arrangement made under another Act or

an Act of Canada.

Disclosure for

research purposes

44. A

custodian may disclose personal health information without the consent of the

individual who is the subject of the information for research purposes but only

where the research project has been approved by a research ethics board or

research ethics body under the Health

Research Ethics Authority Act .

Disclosure of

registration information

(1) The minister may disclose

registration information without the consent of an individual

(

a) to

a public body for the purpose of verifying the accuracy of registration

information held by the public body; or

(

b) with

the approval of the Lieutenant Governor in Council, to another public body on

the terms or conditions that the Lieutenant Governor in Council may determine.

(2) The

minister may, without the consent of the subject individuals, disclose the

names, dates of birth, telephone numbers and addresses of individuals under the

age of seven years to a board or conseil scolaire within the meaning of the Schools Act, 1997 for the purpose of

planning or administration by the board or conseil scolaire.

(3) With

the approval of the Lieutenant Governor in Council, the minister may enter into

agreements for the sharing of registration information without the consent of

the subject individual with

(

a) the

province or territory of Canada ; or

(

b) a

person or body designated in the regulations.

(4) An

agreement made under subsection (3) shall specify that the party to whom the

registration information is disclosed shall use the information only for the purposes specified in the agreement.

Monitoring health

care payments

(1) A

custodian shall, at the request of the minister, disclose to the minister

personal health information without the consent of the individual who is the

subject of the information for the purpose of monitoring or verifying claims

for payment for health care funded wholly or in part by the Department of

Health and Community Services.

(2) The minister may disclose information

collected under subsection (1) to another person for a purpose set out in that

subsection where the disclosure is reasonably necessary for that purpose.

Disclosure

outside the province

(1) A

custodian may disclose personal health information about an individual

collected in the province to a person outside the province but only where

(

a) the individual who is the subject of the

information consents to the disclosure;

(

b) the disclosure is permitted by this Act or the

regulations;

(

c) the person receiving the information performs

functions similar to the functions performed by a person to whom this Act would

permit the custodian to disclose the information in the province under subsection

40(2);

(

d) the following conditions are met:

(

i) the disclosure is for the purpose of health

planning or health administration,

(ii) the information relates to health care

provided in the province to a person who is a resident of another province or territory of Canada , and

(iii) the disclosure is made to the government of

that other province or territory of Canada ;

(

e) the disclosure is reasonably necessary for the

provision of health care to the individual and the individual has not expressly

instructed the custodian not to make the disclosure in its entirety; or

(

f) the disclosure is reasonably necessary for the

administration of payments in connection with the provision of health care to

the individual or for contractual or legal requirements in that connection.

(2) Where a custodian discloses personal health

information about an individual under paragraph (1)(

e) and an express request

of the individual who is the subject of the information prevents the custodian

from disclosing all the personal health information that the custodian

considers reasonably necessary to disclose for the provision of health care to

the individual, the custodian shall notify the person to whom it makes disclosure

of that fact.

Maintaining

certain disclosure information

(1) Except

as otherwise provided under subsection (2) or

section 37, a custodian that

discloses personal health information shall make a note of the following:

(

a) the name of the person to whom the custodian

discloses the information;

(

b) the date and purpose of the disclosure; and

(

c) a description of the information disclosed.

(2) Subsection (1) does not apply where a

custodian discloses personal health information by permitting access to the

information stored in the information system of the custodian, provided that

when the information is accessed, the database automatically keeps an electronic

log of the following information:

(

a) the user identification of the person that

accesses the information;

(

b) the date and time the information is accessed;

and

(

c) a description of the information that is

accessed or that could have been accessed.

Limitations on

disclosure

(1) The

disclosure of personal health information by a custodian shall be limited to

the minimum amount of information necessary to accomplish the purpose for which

it is used.

(2) This

section does not apply to personal health

information that a custodian is required by law to disclose.

Disclosure does

not make recipient a custodian

50. A

person who is not a custodian referred to in subsection 4(1)is authorized to

collect the personal health information that a custodian may disclose to it under

this Part but that person does not become a custodian merely by virtue of its

collection of the personal health information that the custodian has disclosed

to it.

PART V

ACCESS TO AND CORRECTION OF A RECORD OF PERSONAL HEALTH INFORMATION

Application of

Part

(1) This

Part does not apply to a record that contains raw data from a standardized

psychological test or assessment.

(2) Notwithstanding subsection (1), this Part

applies to that part of a record of personal health information that can be

severed from the part of the record that contains the information described in subsection

(1).

Individual's

right of access

(1) An

individual has a right of access to a record containing his or her personal

health information that is in the custody or under the control of a custodian.

(2) The right of access to a record of personal

health information referred to in subsection (1) does not extend to personal

health information in respect of which a custodian is authorized to refuse access

under

section 58 but where that information can be severed from a record, the

individual has a right of access to the remainder of the record in accordance

with this Act.

(3) Where a record is not a record dedicated

primarily to personal health information about the individual who is requesting

access, the individual has a right of access only to the portion of personal

health information about himself or herself in the record that can reasonably

be severed from the rest of the record for the purpose of providing access.

Exercise of right

of access

(1) An

individual may exercise a right of access to a record of his or her personal

health information by making a request for access to the custodian that the

individual believes has custody or control of the information.

(2) A custodian may require a request under

subsection (1) to be in writing unless the individual making the request

(

b) has a disability or a condition that impairs

his or her ability to make a request in writing.

Content of

request

(1) A

request referred to in subsection 53(1) shall contain sufficient detail to

permit the custodian to identify and locate the record with reasonable efforts.

(2) Where a request does not contain sufficient

detail to permit the custodian to identify and locate the record with

reasonable efforts, the custodian shall offer assistance to the person requesting

access to reformulate the request to comply with subsection (1).

Time of response

(1) A

custodian shall respond to a request under subsection 53(1) without delay and

in any event not more than 60 days after receiving the request.

(2) Notwithstanding subsection (1), a custodian

may extend the time limit set out in subsection (1) for an additional 30 days

where

(

a) meeting the time limit set out in subsection

(1) would unreasonably interfere with the operations of the custodian; or

(

b) the information consists of numerous records

or locating the information that is the subject of the request cannot be completed

within the time limit set out in subsection (1).

(3) A custodian that extends the time limit under

subsection (2) shall

(

a) give the individual making the request under

subsection (1) written notice of the extension, together with reasons for the

extension; and

(

b) grant or refuse the individual's request as

soon as possible and in any event not later than the expiration of the time

limit as extended.

Response of the

custodian

(1) In

its response under

section 55, the custodian shall, as appropriate,

(

a) where the custodian decides to grant access, make

the record available to the individual for examination and, upon request of the

individual, provide a copy of the record to the individual and an explanation,

where necessary, of any information contained in the record;

(

b) give a notice in writing to the individual

stating that, after reasonable efforts, the custodian has concluded that the record

does not exist or cannot be found; or

(

c) where the custodian is entitled to refuse the

request, in whole or in part, give a notice in writing to the individual making

the request stating that access to the record in whole or

part is refused,

together with reasons for the refusal, and that the individual may appeal the

refusal to the Trial Division under

Part VII or request a review of the refusal

by the commissioner under

Part VI.

(2) Where a custodian fails to respond to a

request for access within the period referred to in subsection 55(1) or (2) he

or she shall be considered to have refused the request for access and the

individual requesting access may appeal that refusal to the Trial Division

under

Part VII or request a review of the refusal by the commissioner under

Part VI.

Fees

(1) A

custodian may charge a reasonable fee for providing a copy of a record in

response to a request for access and the fee shall not exceed the maximum fee

set by the minister.

(2) A custodian may waive all or part of a fee referred

to in subsection (1).

Refusal of access

(1) A

custodian shall refuse to permit an individual to examine or receive a copy of

a record of his or her personal health information where

(

a) another Act,

an Act of Canada or a court order

prohibits disclosure to the individual of the record or the information

contained in the record in the circumstances;

(

b) granting access would reveal personal health

information about an individual who has not consented to disclosure; or

(

c) the information was created or compiled for

the purpose of

(

i) a committee referred to in subsection 8.1(2)

of the Evidence Act ,

(ii) review by a standards or quality assurance

committee established to study or evaluate health care practice, or

(iii) a body with statutory responsibility for the

discipline of health care professionals or for the quality or standards of

professional services provided by health care professionals.

(2) A custodian may refuse to permit an individual

to examine or receive a copy of a record of his or her personal health

information where

(

a) the record or the information in the record is

subject to a legal privilege that restricts disclosure of the record or the

information;

(

b) the information in the record was collected or

created primarily in anticipation of, or for use in, a proceeding and the

proceeding, together with all appeals or processes resulting from it, has not

been concluded;

(

c) the following conditions are met:

(

i) the information was collected or created in

the course of an inspection, investigation or similar procedure authorized by

law or undertaken for the purpose of the detection, monitoring or prevention of

the receipt of a service or benefit under

an Act or program operated by the minister,

or a payment for that service or benefit, and

(ii) the inspection, investigation or similar

procedure, together with all proceedings, appeals or processes resulting from

it, have not been concluded; or

(

d) granting access could reasonably be expected

(

i) result in a risk of serious harm to the mental

or physical health or safety of the individual who is the subject of the

information or another individual,

(ii) lead to the identification of a person who was

required by law to provide information in the record to the custodian, or

(iii) lead to the identification of a person who

provided information in the record to the custodian in confidence under

circumstances in which confidentiality was reasonably expected.

(3) In addition to the grounds set out in

subsections (1) and (2) , a custodian may refuse to grant a request for access

to a record of personal health information where the custodian believes on

reasonable grounds that the request for access to the record is

(

a) frivolous or vexatious;

(

b) made in bad faith; or

(

c) for information already provided to the

individual.

(4) Notwithstanding subparagraph (2)(d)(i), an

individual shall not be refused access to a certificate of involuntary

admission or a community treatment order issued under the Mental Health Care and Treatment Act in respect of that individual.

Informal access

(1) Nothing

in this Act prevents a custodian from

(

a) granting an individual access to a record of his

or her personal health information where the individual makes an oral request

for access or makes no request, provided that access is authorized under this

Part; or

(

b) with respect to a record of personal health

information to which an individual has a right of access, communicating with

the individual about the collection, use or disclosure of personal health

information about the individual.

(2) Nothing in this Part relieves a custodian from

a legal duty to provide, in a manner that is not inconsistent with this Act,

personal health information as expeditiously as is necessary for the provision

of health care to the individual.

Correction

(1) Where

a custodian has granted an individual access to a record of his or her personal

health information and the individual believes that the record is inaccurate or

incomplete, he or she may request that the custodian correct the information.

(2) A request under subsection (1) may be made

orally or in writing.

Time of response

(1) A

custodian shall respond to a request for correction under subsection 60(1)

without delay and in any event not more than 30 days after receiving the

request.

(2) Notwithstanding subsection (1), a custodian

may extend the time limit set out in that subsection for an additional 30 days

where

(

a) meeting the time limit set out in subsection

(1) would unreasonably interfere with the operations of the custodian; or

(

b) the information that is the subject of the

request for correction is located in numerous records so that the request cannot

be completed within the time limit set out in subsection (1).

(3) A custodian that extends the time limit under

subsection (2) shall

(

a) give the individual making the request under

subsection 60(1) written notice of the extension, together with reasons for the

extension; and

(

b) respond to the individual's request as soon as

possible and in any event not later than the expiration of the time limit as extended.

Response of custodian

(1) In

its response under

section 61, the custodian

(

a) shall grant the request for correction where

the individual making the request under subsection 60(1)

(

i) demonstrates to the satisfaction of the

custodian that the record is incomplete or inaccurate for the purposes for

which the custodian uses the information, and

(ii) gives the custodian the information necessary

to enable the custodian to correct the record; or

(

b) may refuse the request for correction where

(

i) the record was not originally created by the

custodian and the custodian does not have sufficient knowledge, expertise and

authority to correct the record,

(ii) the information which is the subject of the

request consists of a professional opinion or observation that a custodian has

made in good faith about the individual, or

(iii) the custodian believes on reasonable grounds

that the request is frivolous, vexatious or made in bad faith.

(2) Where a custodian fails to respond to a

request for correction within the time period referred to in subsection 61(1)

or (2) he or she shall be considered to have refused the request for correction

and the individual making the request may appeal that refusal to the Trial Division

under

Part VII or request a review of the refusal by the commissioner under

Part VI.

Duty of custodian

(1) Where

a custodian grants a request for a correction under paragraph 62(1)(a), he or

she shall

(

a) make the requested correction

(

i) by recording the correct information in the

record and

(

A) striking out the incorrect information in a manner

that does not obliterate the record, or

(

B) where it is not possible to strike out the

incorrect information, by labelling the information as incorrect, severing the

incorrect information from the record, storing the incorrect information

separately from the record, and maintaining a link in the record that enables a

person to trace the incorrect information, or

(ii) where it is not possible to record the correct

information in the record, by ensuring that there is a practical system in

place to inform a person accessing the record that the information in the

record is incorrect and to direct the person to the correct information;

(

b) provide written notice to the individual

making the request for correction under subsection 60(1) of an action taken under

paragraph (a); and

(

c) provide written notice of the requested

correction, to the extent reasonably possible, to a person to whom the custodian

has disclosed the information within the 12 month period immediately preceding

the request for correction unless the custodian reasonably believes that the

correction will not have an impact on the ongoing provision of health care or

other benefits to the individual or where the individual requesting the

correction has advised that notice is not necessary.

(2) Where a custodian refuses to grant a request

for correction under paragraph 62(1)(

b) he or she shall

(

a) annotate the personal health information with

the correction that was requested and not made and, where practicable, notify a

person to whom the information was disclosed within the 12 month period

immediately preceding the request for correction of the notation unless the

custodian reasonably expects that the notation will not have an impact on the ongoing

provision of health care or other benefits to the individual or the individual

requesting the correction has advised that notice is not necessary; and

(

b) provide the individual requesting the

correction with a written notice setting out the correction that the custodian

has refused to make, the refusal together with reasons for the refusal, and the

right of the individual to appeal the refusal to the Trial Division under

Part

VII or request a review of the refusal by the commissioner under

Part VI.

Duty of custodian

64. A

custodian shall not make a record of personal health information, or part of

it, available to an individual under this Part without first taking reasonable

steps to be satisfied as to the individual's identity.

PART VI

REVIEW BY COMMISSIONER

Interpretation

65. For

the purpose of this Part, "complainant" means an individual

requesting a review by the commissioner of

(

a) a denial by a custodian of a request for

access or correction; or

(

b) an alleged breach of a provision of this Act

or the regulations,

and "complaint" has a

corresponding meaning.

Complaint to commissioner

(1) Where

a custodian has refused the request of an individual for access under

subsection 53(1) or for correction under subsection 60(1), the affected

individual may file a complaint with the commissioner.

(2) A complaint under subsection (1) shall be in

writing and shall be filed with the commissioner within 60 days from the date

(

a) that the individual receives notice of the

custodian's refusal under

section 56 or paragraph 62(1)(

b) or a longer time period

permitted by the commissioner; or

(

b) that the custodian is considered to have refused

the request under subsection 56(2) or 62(2) or a longer time period as

permitted by the commissioner.

(3) Where an individual believes on reasonable

grounds that a custodian has contravened or is about to contravene a provision

of this Act or the regulations in respect of his or her personal health information

or the personal health information of another, he or she may file a complaint

with the commissioner.

(4) A complaint made under subsection (3) shall be

in writing and shall be filed with the commissioner within

(

a) one year after the subject-matter of the

complaint first came to the attention of the complainant or should reasonably

have come to the attention of the complainant; or

(

b) a longer period of time as permitted by the

commissioner where he or she is satisfied that it will not result in prejudice

to another person.

(5) The commissioner shall provide a copy of the

complaint to the custodian whose decision or action is the subject matter of

the complaint.

(6) A complaint to the commissioner under this

Part may not be made by an individual who has appealed a decision of a

custodian directly to the Trial Division under

Part VII.

Informal

resolution

(1) The

commissioner may take steps that he or she considers appropriate to resolve a complaint

under

section 66 informally to the satisfaction

of the complainant and the custodian, and in a manner consistent with this Act.

(2) Where the commissioner is unable to achieve an

informal resolution of the complaint within 60 days of receipt of the complaint,

the commissioner shall conduct a review of the subject matter of the complaint

if he or she is satisfied that there are reasonable grounds to do so.

(3) The commissioner may decide not to conduct a

review where he or she is satisfied that

(

a) the custodian has responded adequately to the

complaint;

(

b) the complaint has been or could be more

appropriately dealt with by a procedure or proceeding other than a complaint

under this Act;

(

c) the length of time that has elapsed between

the date when the subject-matter of the complaint arose and the date when the

complaint was filed is such that a review under this Part would be likely to

result in undue prejudice to a person or that a report would not serve a useful

purpose; or

(

d) the complaint is trivial, frivolous, vexatious

or is made in bad faith.

(4) Where the commissioner decides not to conduct

a review, he or she shall give notice of that decision, together with reasons,

to the complainant and the affected custodian and advise the complainant of his

or her right to appeal the refusal of the custodian to grant access or make a

correction to the Trial Division under

section 83 and the time limit for the

commencement of an appeal provided in that section.

(5) Section 8.1 of the Evidence Act does not apply to a review conducted by the

commissioner under this Part.

Conduct of review

(1) In

conducting a review, the commissioner has the powers, privileges and immunities

that may be conferred on a commissioner under the Public Inquiries Act , 2006

except as otherwise provided in this Part.

(2) A review shall be conducted in private and the

burden of proof in respect of the subject-matter of the complaint is on the

custodian.

(3) In conducting a review the commissioner may

receive and accept any evidence and other information that the commissioner

sees fit, whether on oath or by affidavit or otherwise, and whether or not it

is or would be admissible in a court of law.

(4) The complainant and the affected custodian shall

be given an opportunity to make representations to the commissioner during the

review, either in person or by counsel or agent, but neither is entitled to be

present during, to have access to, or to comment on representations made to the

commissioner by the other.

(5) The commissioner may decide whether

representations are to be made orally or in writing.

Investigative powers

(1) In

conducting a review, the commissioner may

(

a) demand from the custodian a copy of a book,

record or document or extract from a book, record or document relevant to the

subject-matter of the review;

(

b) inquire into all information, records,

information practices of the custodian and other matters that are relevant to

the subject-matter of the review; and

(

c) use a data storage, processing or retrieval

device or system belonging to the custodian under investigation in order to

produce a record in readable form of a book, record or other document relevant

to the subject-matter of the review.

(2) A demand by the commissioner for a copy of

information under paragraph (1)(

a) shall be in writing and shall include a

statement of the nature of the things that are required to be produced.

(3) Except as otherwise provided under subsection

(4), a custodian shall produce to the commissioner a copy of the information demanded

under paragraph (1)(

a) within 14 days of receipt of the demand, notwithstanding

another Act or regulations or a privilege under the law of evidence.

(4) Where it is not practicable to make a copy of

a record required under this section, the custodian may require the

commissioner to examine the original at its site.

Entry onto

premises

(1) In

conducting a review and notwithstanding another Act or regulation or a

privilege under the law of evidence the commissioner may, where he or she

reasonably believes that the premises contains a book, record or other document

relevant to the subject-matter of the review, without a warrant or court order,

(

a) enter a premises to view or inspect the premises;

(

b) demand the production of records, documents,

including documents or records maintained in electronic form, or another thing

relating to the subject-matter of the review for the purposes of examination or

copying; and

(

c) make inquiries of a person on the premises

into all matters relating to the subject-matter of the review.

(2) The commissioner shall exercise the power to

enter premises under subsection (1) only during reasonable hours for the

premises and only in such a manner so as not to interfere with health care that

is being provided to an individual on the premises at the time of entry.

(3) Notwithstanding subsection (1), where

(

a) the commissioner is refused or denied entry;

(

b) the premises to be entered are used as a

dwelling in whole or in part; or

(

c) the entry is to occur outside normal business

hours

the commissioner shall not exercise his or

her power of entry except under the authority of a warrant issued under

subsection (4).

(4) Where a judge is satisfied by evidence upon

oath or affirmation that there are reasonable grounds to believe that it is

necessary to enter premises to facilitate a review and that the commissioner cannot

exercise his powers under subsection (1) without a warrant for a reason

referred to in subsection (3), he or she may issue a warrant authorizing entry

by the commissioner or other person named in the warrant in accordance with any

conditions contained in the warrant.

Power to inspect

records

71. Notwithstanding

sections 69 and 70, the commissioner shall not examine or copy or inquire into a

record of personal health information without the consent of the individual to

whom the record relates except where

(

a) the commissioner first determines that it is

reasonably necessary to do so in order to carry out the review and that the

public interest in carrying out the review justifies dispensing with obtaining

the individual's consent in the circumstances; and

(

b) the commissioner provides a statement to the

custodian having custody or control of the record to be examined or copied or

the evidence or information to be inquired into, setting out the commissioner's

determination under paragraph (a), together with written reasons for the

determination.

Commissioner's

recommendation

(1) The

commissioner shall conclude his or her review within 120 days of receiving a

complaint under

section 66.

(2) As a result of his or her review, the

commissioner may make one of the following recommendations:

(

a) where the review relates to a complaint respecting

a refusal of access to a record of personal health information, recommend that

the custodian grant the individual access to the requested record;

(

b) where the review relates to a complaint respecting

a refusal to correct a record of personal health information, recommend that

the custodian make the requested correction;

(

c) where the review relates to a complaint under

subsection 66(3), that a custodian has contravened or is about to contravene a

provision of this Act or the regulations, recommend that the custodian

(

i) cease collecting, using or disclosing personal

health information where the commissioner determines that the custodian is

collecting, using or disclosing the information contrary to the Act or

regulations or an agreement entered into under the Act,

(ii) dispose of records of personal health

information that the commissioner determines the custodian collected, used or

disclosed in contravention of this Act, the regulations or an agreement entered

into under this Act,

(iii) modify, cease or not commence an information

practice, policy or procedure identified in the report of the commissioner

where the commissioner determines that the information practice, policy or

procedure contravenes this Act or the regulations, or

(iv) that the custodian implement an information

practice identified by the commissioner where the commissioner determines that

the information practice is reasonably necessary to achieve compliance with

this Act or the regulations; and

(

d) a recommendation on the privacy aspect of the

matter that is the subject of the review.

(3) Where the commissioner does not make a

recommendation under paragraph (2)(

a) or (b), he or she shall be considered to

have confirmed the decision of a custodian to refuse to grant access or make a

correction, as the context requires.

Commissioner's

report

(1) After

concluding his or her review, the commissioner shall prepare a report setting

out his or her findings and recommendations and where the commissioner does not

make a recommendation under paragraph 72(2)(

a) or (b), the report shall also

contain reasons for not making a recommendation and advise the complainant of

his or her right to appeal the refusal of the custodian to grant access or make

a correction to the Trial Division under

section 83 and the time limit for the

commencement of an appeal provided in that section.

(2) The commissioner shall provide a copy of his

or her report to the complainant and the affected custodian.

Response of custodian

(1) Within

15 days after receiving a report of the commissioner that contains a

recommendation under subsection 72(2), the custodian shall decide whether or

not to comply with the recommendation in whole or in part and shall give

written notice of his or her decision to the commissioner and to the complainant.

(2) Where a custodian decides not to comply with a

recommendation of the commissioner under paragraph 72(2)(

a) or (b), in whole or

in part, in addition to the matters referred to in subsection (1), the notice

of the custodian shall also advise the complainant of his or her right to

appeal to the Trial Division under

section 83 and the time limit for

commencement of an appeal provided in that section.

(3) Where the custodian does not give notice of

his or her decision to the complainant and the commissioner within the time

required by subsection (1), the custodian shall be considered to have refused

to comply with the recommendation of the commissioner.

Obligation to

assist

(1) Where

the commissioner makes a demand under paragraph 69(1 )(

a) or 70(1)(b), the person having custody of the record, book or document shall make

a copy and produce it to the commissioner and shall, on the request of the

commissioner, provide whatever assistance is reasonably necessary, including

using any data storage, processing or retrieval device to produce a record in

readable form.

(2) A person shall not obstruct the commissioner

who is exercising powers under this Part or provide the commissioner with false

or misleading information.

Admissibility of

evidence

(1) A

statement made, or answer or evidence given by a person in the course of a

review by the commissioner under this Act is not admissible in evidence against

a person in a court or at an inquiry or in another proceeding, and no evidence

respecting a review by the commissioner shall be given against a person except

(

a) in a prosecution for perjury in respect of

sworn testimony;

(

b) in a prosecution for an offence under this

Act; or

(

c) in an appeal to the Trial Division under this

Act, where the commissioner is a party to the appeal.

(2) The commissioner, and a person acting for or

under the direction of the commissioner, shall not be required to give evidence

in a court or in a proceeding about information that comes to the knowledge of

the commissioner in performing duties or exercising powers under this Act.

Privileged information

77. Where

a person speaks to, supplies information to or produces a copy of a record during

an investigation by the commissioner under this Act, what he or she says, the

information supplied and the copy of the record produced is privileged in the

same manner as if it were said, supplied or produced in a proceeding in a

court.

Disclosure by

commissioner

(1) The

commissioner and a person acting for or under the direction of the commissioner

shall not disclose information obtained in performing duties or exercising

powers under this Act, except as provided in subsections (2) to (5).

(2) The commissioner may disclose, or may

authorize a person acting for or under his or her direction to disclose,

information that is necessary to

(

a) perform a duty or exercise a power of the

commissioner under this Act; or

(

b) establish the grounds for findings and

recommendations contained in a report under this Act, except as otherwise

provided under subsection (3).

(3) In conducting a review and in performing a

duty or exercising a power under this Act, the commissioner and a person acting

for or under his or her direction, shall take reasonable precautions to avoid

disclosing and shall not disclose

(

a) information that a custodian is authorized to

refuse to disclose under

Part IV; or

(

b) information, including a record, that is

prepared for the use of, or collected, compiled or prepared by, a committee referred

to in subsection 8.1(1) of the Evidence

Act for the purpose of carrying out its duties.

(4) The commissioner may disclose to the Attorney

General information relating to the commission of an offence under this or another

Act of the province or of Canada, where the commissioner has reason to believe

an offence has been committed.

(5) The commissioner may disclose, or may

authorize a person acting for or under his or her direction to disclose

information in the course of prosecution or an appeal referred to in paragraph 76 (1)(c).

Additional powers

of commissioner

79. In

addition to the commissioner's powers and duties respecting requests for

review, the commissioner may

(

a) make recommendations to ensure compliance with

this Act;

(

b) inform the public about this Act;

(

c) receive comments from the public about matters

concerning the confidentiality of personal health information or access to that

information;

(

d) comment on the implications for access to or

confidentiality of personal health information of proposed legislative schemes

or programs or practices of custodians;

(

e) comment on the implications for the

confidentiality of personal health information of

(

i) using or disclosing personal health

information for record linkage, or

(ii) using information technology in the

collection, storage, use or transfer of personal health information; and

(

f) consult with any person with experience or

expertise in any matter related to the purposes of this Act.

Delegation by

commissioner

80. The

commissioner may delegate to a person on his or her staff a duty or power under

this Act.

Immunity from

suit

81. An

action does not lie against the commissioner, his or her delegate or a person

employed under him or her for anything he or she may do or report or say in the

course of the exercise or performance, or intended exercise or performance, of

his or her functions and duties under this Act, unless it is shown he or she

acted in bad faith.

Annual report of

commissioner

82. The

commissioner shall report annually to the House of Assembly through the Speaker

(

a) the exercise and performance of his or her

duties and functions under this Act;

(

b) the commissioner's recommendations and whether

custodians have complied with the recommendations; and

(

c) other matters about access to and protection

of personal health information that the commissioner considers appropriate.

PART VII

APPEALS

Appeal by individual

(1) Where

an individual has made a request to a custodian for access to or correction of

personal health information under this Act and

(

a) has not requested a review by the commissioner

under

Part VI; or

(

b) has requested a review by the commissioner

under

Part VI and

(

i) the commissioner has not conducted a review

or, where a review has been conducted has not made a recommendation under

paragraph 72(2)(

a) or (b), or

(ii) the commissioner has made a recommendation

under paragraph 72(2)(

a) or (

b) and the custodian has decided not to comply

with the recommendation either in whole or in part,

the individual may appeal the decision of

the custodian refusing to grant access to or make a correction of a record of

personal health information.

(2) An appeal shall be commenced as follows:

(

a) an appeal under paragraph (1)(

a) shall be made

within 30 days following receipt of a notice of refusal under paragraph 56(1)(

b) or (

c) or paragraph 62(1)(

b) or, where the custodian has not provided notice,

within 30 days of the date on which notice should have been provided under

subsection 56(2) or 62(2);

(

b) an appeal under subparagraph (1)(b)(

i) shall

be made within 30 days of receipt of

(

i) the notice of the commissioner referred to in

subsection 67(4) where the commissioner has refused to conduct a review, or

(ii) the report of the commissioner referred to in

section 73 where the commissioner has conducted a review but has not made a

recommendation under paragraph 72(2)(

a) or (b); and

(

c) an appeal under subparagraph (1)(b)(ii) shall

be made within 30 days of the receipt of the notice of the custodian under

subsection 74(1), or where the custodian has not provided notice, within 30

days of the date on which notice should have been provided.

(3) An appeal under this

section may be made by

filing a notice of appeal, naming the custodian as the respondent, with the

Registrar of the Supreme Court and a copy of the notice of appeal shall be

served by the appellant on the minister and the commissioner.

(4) The minister may become a party to an appeal

under this

section by filing a notice to that effect with the Registrar of the

Supreme Court.

(5) The record for an appeal under this

section

shall be prepared by the custodian named as the respondent in the appeal.

Appeal by the

commissioner

(1) Where

a custodian has provided notice under subsection 74(2) that he or she has decided

not to comply with a recommendation of the commissioner, the commissioner may,

with the consent of the individual who made the request for access or

correction under

Part IV, appeal that decision in accordance with paragraph 83(2)(c).

(2) The commissioner may intervene as a party to

an appeal under paragraph 83(1)(b) .

Conduct of appeal

(1) The

Trial Division shall review the decision of a custodian that relates to a

request for access or correction of personal health information under this Act

as a new matter and may receive evidence by affidavit.

(2) Notwithstanding

an Act or regulation to the

contrary or a privilege of the law of evidence, the Trial Division may order

the production of a record in the custody or under the control of a public body

for examination by the court.

(3) The Trial Division shall take reasonable

precautions, including where appropriate, receiving representations without

notice to another person, conducting hearings in private and examining records

in private, to avoid disclosure of information that a custodian is authorized

or required to refuse to disclose under

Part IV.

Powers of court

on appeal

86. On

hearing an appeal the Trial Division may

(

a) where it determines that a custodian is

authorized to refuse access to a record under

Part V, dismiss the appeal;

(

b) where it determines that a custodian is not

authorized to refuse access to all or part of a record under

Part V, order the

custodian to give the individual access to all or a part of the record; or

(

c) where it determines that there is an error or

omission in an individual's personal health information, order that a custodian

correct or annotate the information.

PART VIII

GENERAL MATTERS

Immunity from

suit

87. An

action does not lie against a custodian, or a person acting for or under the

direction of custodian for damages resulting from the use, collection or disclosure of or a failure to disclose, in

good faith, personal health information under this Act or a consequence of that

use, collection, disclosure or failure to disclose.

Offences and penalties

(1) A

person who wilfully

(

a) obtains or attempts to obtain another

individual's personal health information by falsely representing that the

person is entitled to the information;

(

b) makes a false statement to, or misleads or

attempts to mislead, the commissioner or another person performing duties or

exercising powers under this Act;

(

c) obstructs the commissioner or another person

performing duties or exercising powers under this Act; or

(

d) destroys or erases personal health information

with the intent to evade a request for access to the information,

is guilty of an offence and liable, on

summary conviction, to a fine of not more than $10,000 or to imprisonment for a

term not exceeding 6 months, or to both.

(2) A custodian or information manager who

(

a) collects, uses or discloses personal health

information contrary to this Act;

(

b) fails to protect personal health information

in a secure manner as required by this Act; or

(

c) discloses personal health information contrary

to this Act with the intent to obtain a monetary or other material benefit or

to confer such a benefit on another person,

is guilty of an offence and liable, on

summary conviction, to a fine of not more than $10,000 or to imprisonment for a

term not exceeding 6 months, or to both.

(3) A custodian or information manager shall not

be found to have contravened paragraph (2)(

a) or (

b) if the custodian or

information manager can establish that all reasonable steps were taken to

prevent the contravention.

Non-retaliation

89. A

person shall not dismiss, suspend, discipline, demote, harass or otherwise

disadvantage or penalize an individual where

(

a) the individual, acting in good faith and on

the basis of reasonable belief, has disclosed to the commissioner that another

person has contravened or is about to contravene a provision of this Act or the

regulations;

(

b) the individual, acting in good faith and on

the basis of reasonable belief has done or stated an intention of doing

an act

that is required to be done in order to avoid having a person contravene a

provision of this Act or the regulations;

(

c) the individual, acting in good faith and on

the basis of reasonable belief, has refused to do or stated an intention to refuse

to do

an act that is in contravention of this Act or the regulations; or

(

d) another person believes that the individual

will do

an act described in paragraph (a), (

b) or (c).

Regulations

(1) The

Lieutenant-Governor in Council may make regulations

(

a) designating a health care facility for the

purpose of paragraph 2(1)(i);

(

b) designating a person as a custodian for the

purpose of paragraph 4(1)(o);

(

c) designating a person as excluded from the

meaning of "custodian" for the purpose of paragraph 4(2)(j);

(

d) exempting a person or entity from the

application of this Act;

(

e) designating a provision of

an Act or

regulation that shall prevail over this Act or a regulation made under it for

the purpose of subsection 11(2);

(e.1) prescribing what constitutes a material breach

for the purpose of

section 15;

(

f) prescribing

information that must be provided by a custodian at the time of collection of

personal health information or the purpose of paragraph 20(1)(c);

(

g) respecting the form and content of an agreement

between a custodian and an information manager under

section 22 ;

(

h) respecting the creation, retention,

disposition and reproduction of records of personal health information in

electronic form, including integrated records of personal health information;

(

i) prescribing an entity for the purpose of

paragraph 39(1)(h);

(

j) designating an entity as an information

network for the purpose of paragraph 39(4)(c);

(

k) designating a custodian for the purpose of

paragraph 39(4)(d);

(

l) designating a person or body with whom the

minister may enter into agreements with under subsection 46 (3);

(

m) prescribing circumstances in which personal

health information may be stored, transferred, used or disclosed outside the

province;

(

n) prescribing the form of a notice required

under this Act;

(

o) re-defining or further defining a word or

expression defined in this Act;

(

p) defining a word or expression used but not

defined in this Act; and

(

q) generally

to give effect to this Act.

(2) For the purpose of paragraphs (1)(h), (

i) and

(k), the regulations that may be made may include provisions respecting

(

a) the technology or process that shall be used

to make or send an electronic record;

(

b) the format of an electronic record, including

the making and verification of an electronic signature;

(

c) the place where an electronic record may be

made or sent;

(

d) the time and circumstances when an electronic

document is to be considered to be sent or received and the place where it is

considered to have been sent or received; and

(

e) the procedure for responding to a request for

access to or disclosure of a record of personal health information by a person

outside the province.

Review of Act

91. After

the expiration of not more than 5 years after the coming into force of this Act

or part of it and every 5 years after that, the minister shall refer it to a

committee established by the minister for the purpose of undertaking a

comprehensive review of the provisions and operation of this Act or part of it.

PART IX

CONSEQUENTIAL AMENDMENTS AND COMMENCEMENT

SNL2002 cA-1.1 Amdt.

(1) The Access to Information and Protection of Privacy Act is amended by

adding immediately after

section 5 the following:

Relationship to Personal Health Information Act

5.1

(1) Notwithstanding

section 5, but except as provided in sections 42.7 to 42.9, this Act and the

regulations shall not apply and the Personal

Health Information Act and regulations under that Act shall apply where

(

a) a public body is a custodian; and

(

b) the information or record that is in the

custody or control of a public body that is a custodian is personal health

information.

(2) For the purpose of this

section "custodian"

and "personal health information" have the meanings ascribed to them

in the Personal Health Information Act .

(2) Sections 42.7 to 42.9 of the Act are amended

by striking out the words "this Act" wherever they occur and

substituting the words "this Act and the Personal Health Information Act ".

(3) The Access

to Information Regulations , Newfoundland and Labrador Regulation 11/07, are amended by adding immediately after

section 2

the following:

Non-application

of regulations

2.1 Sections

3 and 4 do not apply where

(

a) the public body referred to either of those

sections is a custodian within the meaning of the Personal Health Information Act ; and

(

b) the information referred to in either of those

sections is personal health information within the meaning of the Personal Health Information Act .

SNL2004 cC-5.1

Amdt.

(1) Section 2 of the Centre for Health Information Act is amended by striking out the

word "and" at the end of paragraph (

d) and adding immediately after

that paragraph the following:

(d.1) "personal health information" means

personal health information as described in the Personal Health Information Act ; and

(2) Paragraph 2(

e) of the Act is repealed and the

following substituted:

(e) "personal information" means

personal information as defined in the Access

to Information and Protection of Privacy Act , other than information

described in subparagraph 2(o)(vi) of that Act.

(3) Paragraph 4(1)(

a) of the Act is amended by

adding immediately after the words "personal information" the words

"and personal health infor