Handles health records, in New Brunswick

S.N.B. 2009, c. P-7.05, s. 46 · Read the law's page

• These duties bind a custodian.
• If you disclose personal health information without consent for health related purposes, make a note of the name of the person to whom you disclose it, the date and purpose of the disclosure and a description of the information disclosed (s. 46 (1)).
• You need not make the note if you disclose by permitting access to the information stored in your information system and the database automatically keeps an electronic log of the user identification of the person who accesses the information, the date and time it is accessed and a description of the information accessed or that could have been accessed (s. 46 (2)).

S.N.B. 2009, c. P-7.05, s. 48 · Read the law's page

• Do not require the production of an individual's Medicare number, or collect or use it, unless you need it for the provision of health care, to verify eligibility for a health care program or service, for the payment and management of the health care system, to verify eligibility for the drug insurance plan, to obtain proof of immunization, or to establish or maintain the immunization registry or the notifiable disease registry (s. 48 (1)).
• If you are a public body, you may also collect and use a Medicare number, including to perform data matching, for a research project approved by a research review body or in accordance with an agreement referred to in paragraph 43.1 (a), and for a purpose prescribed by regulation (s. 48 (1.1)-(1.2)).when it serves a public body
• If you request a Medicare number, advise the individual of your authority to do so; the individual may refuse to provide it to a person not authorized to require, collect or use it (s. 48 (2)-(3)).
• These duties bind any person, not only a custodian.

S.N.B. 2009, c. P-7.05, s. 49 (1) (c), (2); N.B. Reg. 2010-112, s. 19 · Read the law's page

• These duties bind a custodian.
• Notify the individual to whom the information relates and the Ombud at the first reasonable opportunity if personal health information is stolen, lost, disposed of except as the Act permits, or disclosed to or accessed by an unauthorized person (s. 49 (1) (c)).
• You need not notify if you reasonably believe that the theft, loss, disposition, disclosure or access will not have an adverse impact on the provision of health care or other benefits to the individual, will not have an adverse impact on the individual's mental, physical, economic or social well-being, or will not lead to the identification of the individual (s. 49 (2)).
• Give the individual notice in person, by telephone or in writing (Reg. s. 19 (1)).
• State in the notice your name, the name and contact information of the person you designated to respond to inquiries about your information practices, the nature of the breach, its date and location, and the date it came to your attention (Reg. s. 19 (2)).

S.N.B. 2009, c. P-7.05, ss. 1, 52; N.B. Reg. 2010-112, s. 21 · Read the law's page

• These duties bind a custodian that uses an agent or an information manager and an information manager that signs the agreement; an information manager is an individual or organization that processes, stores, retrieves, archives or disposes of personal health information, de-identifies or transforms it, or provides information management or information technology services on behalf of a custodian (ss. 1, 52).
• If you are a custodian, enter into a written agreement with an agent you retain for the collection, use, disclosure or retention of personal health information, requiring the agent to comply with your legal obligations (s. 52 (1)).
• If you are a custodian, enter into a written agreement with an information manager before providing it personal health information, providing for protection against unauthorized access, use or disclosure and for secure destruction or alteration, and describing the services and the safeguards the information manager employs (s. 52 (3); Reg. s. 21).
• If you are an information manager that has entered into such an agreement, comply with the duties it imposes and with the same protection, retention and secure destruction requirements that bind the custodian (s. 52 (4)).

S.N.B. 2009, c. P-7.05, ss. 17-19, 27-29, 32, 35 · Read the law's page

• These duties bind a custodian, which is an individual or organization that collects, maintains or uses personal health information to provide or assist in providing health care or treatment, to plan and manage the health care system or to deliver a government program or service; an employer, an insurance company or a regulatory body of health care providers that handles the information for other purposes is outside the Act (ss. 1, 3 (2) (c)).
• Collect personal health information about an individual only with the individual's consent where the collection is necessary for a lawful purpose, or where the Act permits or requires it, and collect no more than is reasonably necessary to meet the purpose, nothing where other information would serve the same purpose (ss. 27 (1), 29).
• Obtain consent that is knowledgeable, can be withdrawn or withheld, relates to the information and is not obtained through deception or coercion; you may assume implied consent to collect or use the information, or to disclose it to another custodian or person, for the purpose of providing health care to the individual unless that is not reasonable in the circumstances (ss. 17 (1), 18 (1)).
• Obtain the individual's express consent before disclosing personal health information to the media, for fundraising, to a visitor to a health care facility, to a person outside New Brunswick or for research, unless the Act provides otherwise (s. 19 (1)).
• Use and disclose personal health information only as the Act authorizes, and limit each use and each disclosure to the minimum amount of information necessary for its purpose (ss. 32, 35).

S.N.B. 2009, c. P-7.05, ss. 19 (1) (d), 55 (2); N.B. Reg. 2010-112, s. 22 · Read the law's page

• Obtain the individual's express consent before disclosing personal health information to a person outside New Brunswick, unless the Act provides otherwise (s. 19 (1) (d)).
• If you are a public body, store personal health information in your custody or under your control only in Canada and access it only in Canada, unless the regulations provide otherwise or the individual has identified the information and consented as prescribed, the information is stored in another jurisdiction for a disclosure the Act allows, or it was disclosed for a payment to or by the Province or a public body (s. 55 (2)).when it serves a public body
• An information manager providing a public body with information management or information technology services may store the information outside Canada (Reg. s. 22).
• These duties bind a custodian, and the storage and access rule binds a public body that is a custodian.

S.N.B. 2009, c. P-7.05, ss. 49 (1) (a)-(b), 50, 55 (1), 56; N.B. Reg. 2010-112, s. 20 · Read the law's page

• Establish and implement information practices that ensure compliance with the Act, and designate a person to assist in ensuring compliance, to respond to inquiries about your information practices and to receive complaints from the public (s. 49 (1) (a)-(b)).
• Protect personal health information with information practices that include reasonable administrative, technical and physical safeguards for its confidentiality, security, accuracy and integrity, based on recognized information technology security standards and appropriate to the sensitivity of the information (s. 50 (1)-(2)).
• Limit use of personal health information to persons you have specifically authorized, verify the identity of a person seeking to use it and that the use is authorized, and prevent interception when you use electronic means to request or respond to requests for disclosure (s. 50 (3) (a)-(c)).
• Implement any additional safeguards the regulations require for personal health information kept in electronic form (s. 50 (4)).
• Keep a written policy and procedures on information practices, including measures that protect the security of the information during collection, use, disclosure, storage and destruction, and keep a record of all security breaches and the corrective procedures taken (Reg. s. 20).
• Keep and follow a written policy for the retention, archival storage, access and secure destruction of personal health information (s. 55 (1)).
• If you are a public body, or another custodian prescribed by regulation, conduct a privacy impact assessment for a new collection, use or disclosure of personal health information or a material change to one, and for the creation or modification of a personal health information system or communication technology (s. 56 (1)).for a public body
• These duties bind a custodian.

S.N.B. 2009, c. P-7.05, ss. 65.1-65.2, 68, 71, 76 · Read the law's page

• These powers and offences run against a custodian and an information manager, and in part against any person.
• Produce to the Ombud within 14 days after a request any record or copy of a record the Ombud requires for an investigation, and allow the Ombud to enter any office of a custodian and examine and copy any record (ss. 65.1, 71 (3)).
• Do not collect, use, sell or disclose personal health information contrary to the Act, and protect it in a secure manner as the Act requires; a custodian or information manager is not found to have contravened those duties if it establishes that it took all reasonable steps to prevent the contravention (s. 76 (3)-(4)).

S.N.B. 2009, c. P-7.05, ss. 7, 10, 12-13, 15 · Read the law's page

• These duties bind a custodian.
• On an individual's request, let the individual examine or receive a copy of his or her personal health information, subject to the Act (s. 7 (1)).
• Respond no later than 30 business days after receiving the request unless the time limit is extended or the request is transferred; a failure to respond within that time is treated as a refusal (s. 10 (1)-(2)).
• If you maintain the information in electronic form, produce a record in a form the individual can use if you can do so with your normal computer hardware and software and technical expertise (s. 10 (5)).
• Be satisfied as to the identity of the requester before permitting information to be examined or copied, and take reasonable steps to ensure the information is received only by the individual it is intended for (s. 12).
• Permit an individual to examine a record free of charge; any fee for search, preparation, copying and delivery must be fair and reasonable and fixed under the regulations (s. 13 (1)).
• Within 30 business days of a request to correct information, make the correction, say that the information no longer exists or cannot be found, transfer the request, or refuse in writing with the reason and notice of the individual's right to add a statement of disagreement and to complain; do not charge a fee for a correction request (s. 15 (3), (8)).