Handles health records, in Newfoundland and Labrador

S.N.L. 2008, c. P-7.01, ss. 13 (2) (c), 47 · Read the law's page

• Disclose personal health information collected in the province to a person outside the province only with the individual's consent or in one of the other cases section 47(1) lists: the Act or regulations permit it, the recipient performs similar functions to a person the Act lets you disclose to in the province, health planning or administration for a resident of another province or territory disclosed to that government, reasonable necessity for health care absent an express instruction not to, or payment administration and contractual or legal requirements (s. 47(1)).
• Where the individual's express request keeps you from disclosing everything you consider reasonably necessary for health care, tell the recipient so (s. 47(2)).
• Include in your information policies and procedures measures that protect the confidentiality of personal health information stored or used in a jurisdiction outside the province or disclosed to a person in another jurisdiction (s. 13(2)(c)).

S.N.L. 2008, c. P-7.01, ss. 13-15 (1)-(2), 20 (1)-(2), 24-25, 29-30, 35-36 · Read the law's page

• Establish and implement information policies and procedures on how you collect, store, transfer, copy, modify, use and dispose of personal health information, inside or outside the province, including policies that limit each employee's, agent's or contractor's access to the information needed for the purpose and that protect information stored, used or disclosed outside the province (s. 13).
• Have your employees, agents, contractors and volunteers take an oath or affirmation of confidentiality, and make them aware of the Act and of your information policies and procedures (s. 14(1), (3)).
• Take steps that are reasonable in the circumstances to protect personal health information against theft, loss and unauthorized access, use or disclosure, and against unauthorized copying or modification, and retain, transfer and dispose of records in a secure manner (s. 15(1)-(2)).
• When you collect personal health information directly from the individual, take reasonable steps to tell the individual why you collect, use and disclose it and who your contact person is; a notice posted or made readily available where it is likely to come to the individual's attention is enough (s. 20(1)-(2)).
• Do not collect personal health information unless the individual consents and the collection is necessary for a lawful purpose, or the Act permits or requires it, and do not collect it if other information will serve the purpose (s. 29(1), (3)).
• Collect personal health information directly from the individual, except in the cases section 31 lists (s. 30).
• Obtain express consent, not implied consent, where the Act requires consent to a disclosure to a person that is not a custodian (s. 25(1)(a)).
• Limit use of personal health information to the employees and agents who need to know it for the purpose for which it was collected or a purpose the Act authorizes (s. 35).
• Do not disclose personal health information unless the individual consents and the disclosure is necessary for a lawful purpose, or the Act permits or requires it, and do not disclose it if other information will serve the purpose (s. 36).

S.N.L. 2008, c. P-7.01, ss. 15 (3)-(7), 20 (3)-(4); N.L.R. 38/11, s. 5 · Read the law's page

• Notify the individual at the first reasonable opportunity if personal health information in your custody or control is stolen, lost, disposed of other than as the Act or the regulations permit, or disclosed to or accessed by an unauthorized person (s. 15(3)).
• You need not notify the individual if you reasonably believe that the theft, loss, unauthorized disposition, or improper disclosure or access will not have an adverse impact on the provision of health care or other benefits to the individual or on the individual's mental, physical, economic or social well-being; the commissioner may still recommend that you notify (s. 15(5), (7)).
• Inform the commissioner if you reasonably believe there has been a material breach involving the unauthorized collection, use or disclosure of personal health information, weighing the sensitivity of the information, the number of people involved, whether you believe the information has been or will be misused, and whether the cause or the pattern of breaches indicates a systemic problem (s. 15(4); N.L.R. 38/11, s. 5).
• If you use or disclose personal health information without consent in a manner inconsistent with your information policies and procedures, inform the individual at the first reasonable opportunity unless you would be required or permitted to refuse access to the record, note the use or disclosure and keep the note with the record (s. 20(3)).
• If you are a researcher who received the information from another custodian under section 44, do not notify the individual unless the custodian who provided the information has first obtained the individual's consent to contact by the researcher and told you so (s. 15(6)).

S.N.L. 2008, c. P-7.01, ss. 2 (1) (l), 14 (4), 22 · Read the law's page

• If you provide goods or services that enable a custodian to use electronic means to collect, use, modify, disclose, retain or dispose of personal health information, comply with the Act and the regulations (s. 14(4)).
• If you process, retrieve, store or dispose of personal health information for a custodian, or provide it information management or information technology services, enter into a written agreement with the custodian that provides for protection of the information against unauthorized access, use, disclosure, disposition, loss or modification (ss. 2(1)(l), 22(1)-(2)).
• Use or disclose the information only for the purpose the agreement authorizes, and comply with the Act, the regulations and the terms of the agreement (s. 22(3)-(4)).
• Do not let an employee or anyone acting on your behalf access the information unless that person has agreed in writing to comply with the Act and the restrictions imposed on you (s. 22(5)).

S.N.L. 2008, c. P-7.01, ss. 52, 55-56, 60-62 · Read the law's page

• Respond to a request for access to personal health information without delay and within 60 days of receiving it; you may extend that time by 30 days where meeting it would unreasonably interfere with your operations or the information is in numerous records, but only by giving the individual written notice of the extension with reasons (s. 55).
• Where you grant access, make the record available for examination and, on request, provide a copy and an explanation of any information where one is needed; where the record does not exist or cannot be found, or you refuse access, give written notice with reasons and tell the individual of the right to appeal to the Trial Division or to ask the commissioner for a review (s. 56(1)).
• Accept a request for correction of a record you have given access to, made orally or in writing, and respond within 30 days, a period you may extend by 30 days with written notice and reasons (ss. 60-61).
• Grant a request for correction where the individual demonstrates to your satisfaction that the record is incomplete or inaccurate for the purposes for which you use the information and gives you the information needed to correct it (s. 62(1)(a)).

S.N.L. 2008, c. P-7.01, ss. 65-66, 69, 74, 88-89 · Read the law's page

• Within 15 days after receiving a report of the commissioner that contains a recommendation, decide whether to comply and give the commissioner and the complainant written notice of your decision; silence is treated as a refusal to comply (s. 74(1), (3)).
• Produce to the commissioner a copy of a book, record or document relevant to a review that the commissioner demands in writing, and let the commissioner inquire into your information, records and information practices relevant to the review (s. 69(1)-(3)).
• Do not make a false statement to, mislead or obstruct the commissioner, and do not destroy or erase personal health information with the intent to evade a request for access (s. 88(1)(b)-(d)).
• Do not dismiss, suspend, discipline, demote, harass or otherwise disadvantage or penalize an individual who has, in good faith and on reasonable belief, reported to the commissioner a contravention or refused to act in contravention of the Act (s. 89).