Distributes a software product, in Ontario

S.O. 2004, c. 3, Sched. A, s. 10 (4); O. Reg. 329/04, s. 6 · Read the law's page

• These duties bind a vendor or service provider that supplies goods or services enabling a health information custodian to use electronic means to collect, use, modify, disclose, retain or dispose of personal health information. A health information network provider carries further duties.
• If you are not the custodian's agent, use personal health information you can access while providing the services only as necessary to provide them, and do not disclose it.
• Do not let your employees, or anyone acting for you, have access to the information unless they agree to comply with the same restrictions.
• If you are a health information network provider (you serve two or more custodians, primarily so that they can disclose personal health information to one another electronically), notify every applicable custodian at the first reasonable opportunity if you used, disclosed or disposed of the information outside those restrictions or an unauthorized person accessed it.
• As a health information network provider, give each custodian a plain language description of your services that is suitable for sharing with patients, including the safeguards in place, and make that description and your applicable directives, guidelines and policies available to the public, other than a trade secret or confidential scientific, technical, commercial or labour relations information.
• As a health information network provider, keep, to the extent reasonably practical, an electronic record of all accesses to and transfers of custodians' information in equipment you control, identifying who accessed or transferred it and when, and make it available to a custodian on request.
• As a health information network provider, assess the threats, vulnerabilities and risks to the security and integrity of the information and how your services may affect the privacy of the individuals concerned, and give each custodian a written copy of the results.
• As a health information network provider, make sure any third party you retain to help provide the services agrees to the restrictions and conditions you need in order to comply, and sign a written agreement with each custodian that describes the services and the administrative, technical and physical safeguards and requires you to comply with the Act and the regulations.

S.O. 2004, c. 3, Sched. A, s. 54.1 · Read the law's page

• These duties bind a person who provides electronic services to individuals, at their request, primarily so that they can access, use, disclose, modify, maintain or otherwise manage their own records of personal health information, such as an app through which a person views or manages their health records.
• Comply with the requirements the regulations prescribe for consumer electronic service providers when you provide the service to an individual.
• Collect and use a health number only if the individual who requested your services authorized it, only to verify the individual's identity or for another prescribed purpose, and in accordance with the prescribed rules.