Handles health records, in Nova Scotia

S.N.S. 2010, c. 41, s. 44 · Read the law's page

• As a custodian, disclose personal health information collected in the Province to a person outside the Province only where the individual consents, the Act or the regulations permit it, the disclosure meets another jurisdiction's prescription monitoring program or is for health-system planning and goes to another province's government, or it is reasonably necessary for the individual's health care and they have not expressly instructed you not to make it (s. 44(1)).
• If an express request of the individual stops you disclosing everything you consider reasonably necessary for their health care, tell the person to whom you disclose that fact (s. 44(2)).

S.N.S. 2010, c. 41, ss. 11, 25, 61-68 · Read the law's page

• As a custodian (a regulated health professional or group practice, the Minister, a health authority, a pharmacy, a licensed or approved continuing-care facility, Canadian Blood Services or a prescribed custodian), do not collect, use or disclose personal health information about an individual unless you have the individual's consent under the Act and the collection, use or disclosure is reasonably necessary for a lawful purpose, or the Act permits or requires it (ss. 3(f), 11).
• Limit the collection, use and disclosure of personal health information to the minimum amount necessary to achieve the purpose, and limit use to the agents who need to know the information (s. 25).
• Protect the confidentiality of personal health information in your custody or under your control and the privacy of the individual it concerns (s. 61).
• Implement, maintain and comply with information practices that meet the Act, are reasonable in the circumstances and protect the information against theft, loss and unauthorized access, use, disclosure, copying or modification, and implement, maintain and comply with a complaints policy (s. 62).
• Create and maintain, or have created and maintained, a record of user activity for any electronic information system you use to maintain personal health information, and give an individual the record of user activity for their information, without charge, within thirty days after the request (s. 63).
• Designate a contact person and make available to the public a written statement that describes your information practices, how to reach the contact person, how to obtain access to or request correction of a record, and how to complain to you and to the Review Officer (ss. 67, 68).
• Do not permit an agent to collect, use, disclose, retain, destroy or dispose of personal health information on your behalf except as the Act permits and within the limits you set (s. 28(1)).

S.N.S. 2010, c. 41, ss. 28(3), 69-70 · Read the law's page

• As a custodian, notify the individual at the first reasonable opportunity if you believe on a reasonable basis that their personal health information is stolen, lost or subject to unauthorized access, use, disclosure, copying or modification and there is potential for harm or embarrassment to the individual as a result (s. 69).
• If you decide not to notify the individual because it is unlikely that a breach has occurred or there is no potential for harm or embarrassment, notify the Review Officer as soon as possible (s. 70).
• As an agent of a custodian, notify the custodian at the first reasonable opportunity if personal health information you handle for the custodian is stolen, lost or accessed by unauthorized persons (s. 28(3)).

S.N.S. 2010, c. 41, ss. 5(1)(c), 27 · Read the law's page

• Do not collect or use an individual's health card number unless you are a custodian or the regulations authorize you to do so (s. 27).

S.N.S. 2010, c. 41, ss. 71-90 · Read the law's page

• As a custodian, grant an individual access to a record of personal health information about the individual in your custody or under your control, unless one of the grounds in section 72 lets you refuse, and give access to any part of the record that can reasonably be severed from the part you may withhold (ss. 71, 72).
• Respond in writing to a request for access or correction no later than thirty days after receiving it, by granting it, refusing it or extending the deadline by up to thirty days, or longer with the Review Officer's permission (s. 84).
• Grant a request to correct a record if the individual demonstrates that it is not complete, accurate or up-to-date and gives you the information needed to correct it, and give written notice if you do not grant it under section 87(2) (s. 87).
• Do not charge a fee to an individual accessing their own personal health information from the Minister, and give an estimate before charging any other fee (ss. 82, 83).

S.N.S. 2010, c. 41, ss. 91-92, 100-101, 106-108 · Read the law's page

• As a custodian, expect the Review Officer to review complaints and to investigate a suspected contravention of the privacy provisions, and decide within thirty days of receiving the Review Officer's report whether to follow its recommendations and give written notice of the decision (ss. 92, 100, 101).
• Do not wilfully collect, use or disclose health information in contravention of the Act, fail to protect personal health information in a secure manner as the Act requires, or use individually identifying health information to market a service for a commercial purpose or to solicit money without the individual's express consent (s. 106).