Handles health records, in Manitoba

C.C.S.M. c. P33.5, s. 25 · Read the law's page

• If you provide information management or information technology services to a trustee, or process, store or destroy personal health information for one, use the information only for the purposes and activities the trustee itself may undertake (s. 25(2)).
• Comply with the same protection, retention and destruction requirements the Act places on the trustee, and with the duties in your written agreement with the trustee (s. 25(4)).
• If you are a trustee, enter into a written agreement that provides for protection of the information against unauthorized access, use, disclosure, destruction or alteration before you give an information manager the information (s. 25(3)).

C.C.S.M. c. P33.5, s. 26 · Read the law's page

• Do not require another person to produce their PHIN, and do not collect or use another person's PHIN, unless you are a trustee or an exception in section 26(2) applies (s. 26(1)).
• The exceptions are purposes related to providing publicly funded health care to that person, a health research project approved under section 24, and circumstances the regulations permit (s. 26(2)).

C.C.S.M. c. P33.5, ss. 13-15, 17, 20-22 and 27 · Read the law's page

• If you are a health professional, health care facility, public body or health services agency that collects or maintains personal health information, collect it only for a lawful purpose connected with one of your functions or activities and only where the collection is necessary for that purpose (s. 13(1)).
• Collect no more personal health information than is reasonably necessary for the purpose, and collect it directly from the individual whenever possible (ss. 13(2), 14(1)).
• When you collect the information directly from the individual, take reasonable steps to tell the individual why it is being collected before it is collected or as soon as practicable afterwards, and, if you are not a health professional, how to reach someone who can answer questions about the collection (s. 15(1)).
• Use the information only for the purpose for which it was collected or received, unless an exception in section 21(1) applies, such as a directly related purpose or the individual's consent (s. 21(1)).
• Limit every use and disclosure to the minimum amount of information necessary, and limit use to the employees and agents who need to know it (s. 20(2)-(3)).
• Disclose the information only to the individual or their representative, with the individual's consent, or in a circumstance listed in section 22(2) (s. 22(1)-(2)).
• Keep a written policy on retention and destruction, comply with it, and destroy the information in a manner that protects the individual's privacy (s. 17(1), (3)).
• Do not sell, or otherwise dispose of or disclose for consideration, personal health information except as section 27(1) allows (s. 27).

C.C.S.M. c. P33.5, ss. 18-19; M.R. 245/97, ss. 2-8 · Read the law's page

• If you are a trustee, protect personal health information with reasonable administrative, technical and physical safeguards that ensure its confidentiality, security, accuracy and integrity, and weigh how sensitive the information is in deciding what is reasonable (ss. 18(1), 19).
• Limit use of the information to the persons you have specifically authorized, verify the identity of a person seeking to use it and that the use is authorized, and, if you request or respond to disclosure requests electronically, put procedures in place to prevent interception by unauthorized persons (s. 18(2)).
• Establish and follow a written policy and procedures on security during collection, use, disclosure, storage and destruction, on recording security breaches, and on corrective procedures (M.R. 245/97, s. 2).
• Keep the information in designated areas under appropriate safeguards, limit physical access to authorized persons, and store removable media securely when not in use (M.R. 245/97, s. 3).
• For each electronic information system that holds the information, create and keep a record of user activity for at least three years and audit it to detect security breaches (M.R. 245/97, s. 4).
• Decide what personal health information each employee and agent may access, train them on your security policy, have each sign a pledge of confidentiality, and audit your security safeguards at least every two years, correcting deficiencies as soon as practicable (M.R. 245/97, ss. 5-8).

C.C.S.M. c. P33.5, ss. 28, 39, 48.8 and 63-64 · Read the law's page

• If you are a trustee, comply with an adjudicator's order on a complaint about privacy to cease or modify a practice of collecting, using, disclosing, retaining or destroying personal health information, to destroy information collected in contravention of the Act, or to perform a duty the Act imposes (s. 48.8(3)).
• Do not obtain another person's personal health information by falsely representing that you are entitled to it, and do not knowingly falsify it (s. 63(1)(d), (f)).
• Do not, as an employee, officer or agent of a trustee, information manager or health research organization, wilfully disclose personal health information without the authorization of the trustee, information manager or organization where it could not be disclosed under the Act, or use or access another person's information without that authorization (s. 63(2)).

C.C.S.M. c. P33.5, ss. 5-12 · Read the law's page

• If you are a trustee, on request let an individual examine and receive a copy of their personal health information that you maintain, subject to the refusal grounds in section 11 (s. 5(1)).
• Respond as promptly as the circumstances require and no later than 24 hours for a hospital in-patient's current care, 72 hours for current care of a person who is not a hospital in-patient, and 30 days in any other case; a late response counts as a refusal (s. 6).
• Make every reasonable effort to assist the individual and to respond without delay, openly, accurately and completely, and give a written response if the information does not exist or cannot be found or the request is refused, stating the reason (ss. 6(2), 7).
• Take reasonable steps, in accordance with the regulations, to tell individuals about their right of access and how to exercise it (s. 9.1).
• On a written request to correct personal health information for accuracy or completeness, respond within 30 days by adding the correcting information to the record, saying the information no longer exists or is held by another trustee, or refusing in writing with reasons and the right to file a statement of disagreement (s. 12).

C.C.S.M. c. P33.5, s. 19.0.1; M.R. 245/97, ss. 8.7-8.9 · Read the law's page

• If you are a trustee that maintains personal health information about an individual, notify the individual about a privacy breach relating to it (theft or loss, or access, use, disclosure, destruction or alteration in contravention of the Act) if, after weighing the factors in section 8.7 of the regulation, the breach could reasonably be expected to create a real risk of significant harm to the individual (s. 19.0.1(1)-(2)).
• Give the notice as soon as practicable after you become aware of the breach, directly to the individual except in the circumstances the regulation sets out (s. 19.0.1(3)).
• Make the notice in writing and include a description of the circumstances of the breach, when it occurred, the trustee that had the information, a description of the information, what you have done and will do to reduce the risk of harm and of a repeat, what the individual can do, and a statement that the Ombudsman has been or will be notified (M.R. 245/97, s. 8.8(1)).
• When you are required to notify an individual, also notify the Ombudsman at the time and in the form and manner the Ombudsman requires (s. 19.0.1(4)).