Handles health records, in the Northwest Territories

S.N.W.T. 2014, c. 2, s. 13 · Read the law's page

• If you provide a custodian with storage, processing, retrieval, disposal, transformation, information system or information technology services for personal health information, you are an information manager: enter into a written information management agreement with the custodian before it uses your services, unless an exception in s. 13(3) applies (s. 13(2)-(3)).
• Agree in that agreement to comply with the Act, the regulations and the custodian's standards, policies and procedures, and to maintain administrative, technical and physical safeguards for the personal health information (s. 13(4)).
• Do not collect, use or disclose the personal health information except in accordance with the information management agreement, and do not contravene its terms (s. 13(8)).

S.N.W.T. 2014, c. 2, s. 84 · Read the law's page

• These duties bind a health information custodian.
• If you disclose personal health information about an individual without the individual's express consent, make a record of the name of the person or organization to which you disclose it, the date and purpose of the disclosure and a description of the information disclosed (s. 84 (1)).
• You need not make the record for a disclosure under section 43, 44 or 48, or where you disclose by permitting collection from an electronic record in an electronic health information system that automatically keeps an electronic log of the user identification of the person who collects the information, the date and time of collection and the information collected or that could have been collected (s. 84 (2)-(3)).

S.N.W.T. 2014, c. 2, s. 87 · Read the law's page

• Subject to any exceptions the regulations prescribe, give notice to the individual as soon as reasonably possible if personal health information about the individual is used or disclosed other than as the Act permits, is lost or stolen, or is altered, destroyed or otherwise disposed of without authorization (s. 87).
• Where the regulations prescribe a person or organization to be notified, give that notice as well (s. 87).

S.N.W.T. 2014, c. 2, ss. 141, 156, 192-194 · Read the law's page

• Within 30 days after receiving a report of the Information and Privacy Commissioner that sets out recommendations, decide whether to follow them, give notice of the decision to the Commissioner, the individual who requested the review and the Minister, and tell the individual of the right of appeal if you decline any recommendation (s. 156(1)).
• Answer the Information and Privacy Commissioner's review of any decision, act or failure to act relating to an individual's access request or correction request (s. 141(1)-(2)).
• Comply with the Act and the regulations; a contravention is an offence (s. 192).

S.N.W.T. 2014, c. 2, ss. 15, 27-29, 38-40 · Read the law's page

• If you are a health information custodian (the Department of Health and Social Services, a medical practitioner who is not acting as another custodian's agent, a pharmacist who is not acting as another custodian's agent, or an organization or person prescribed as a custodian), comply with the Act and its regulations in every collection, use and disclosure of personal health information (s. 27).
• Obtain a consent that is the individual's own, relates to the information, is knowledgeable and is not obtained through deception or coercion wherever the Act requires consent (s. 15(1)).
• Do not collect, use or disclose personal health information where non-identifying health information would be adequate, and do not collect, use or disclose more than is reasonably necessary for the purpose, unless the law requires it (s. 28(1)-(3)).
• Collect personal health information about an individual only on a ground s. 29 lists, the first being the individual's consent where the collection is necessary for a lawful purpose (s. 29).
• Disclose personal health information only with the individual's express consent where the disclosure is necessary for a lawful purpose, or where this or another Act, or an Act or regulation of Canada, permits or requires it (s. 38).
• Before disclosing, take reasonable steps to verify that the recipient is authorized to collect the information and is the intended recipient (s. 39).
• If you are a recipient of personal health information that a custodian disclosed to you, other than another custodian or the individual the information is about, use or disclose it only for the purpose for which the custodian was authorized to disclose it or to carry out a legal duty (s. 40(2)).

S.N.W.T. 2014, c. 2, ss. 8, 85-86, 88-89 · Read the law's page

• Establish or adopt standards, policies and procedures that implement the Act and the regulations, including the safeguard, record-security and accuracy requirements in ss. 85 to 88, give the Department a copy on request, and comply with them (s. 8(1)-(3)).
• Take reasonable measures to maintain administrative, technical and physical safeguards for personal health information, including for information stored or used outside the Northwest Territories or disclosed outside the Territories, and against unauthorized access, use, disclosure, alteration, loss, destruction, theft and other reasonably anticipated threats (s. 85(1)).
• Implement controls that limit use of personal health information to authorized persons (s. 85(2)).
• Take reasonable measures to protect the security and confidentiality of records, including secure maintenance, transfer and disposal, and address the risks of electronic health records with nationally or territorially recognized information technology security standards and processes (s. 86(1)-(2)).
• Take reasonable measures to ensure that personal health information is accurate and complete when you collect it and before you use or disclose it (s. 88).
• If you are a public custodian or a prescribed custodian, prepare a privacy impact assessment for a proposed new information system or communication technology, or a proposed change to one, relating to personal health information, and give the Information and Privacy Commissioner a copy (s. 89(2)-(3)).

S.N.W.T. 2014, c. 2, ss. 94-95, 101, 119 · Read the law's page

• Give an applicant access to a record containing personal health information about the applicant that is in your custody or control, unless an exception in ss. 110 to 118 or an authorization by the Information and Privacy Commissioner to disregard the request applies (s. 94).
• Respond in writing to an access request not later than 30 days after receiving it, subject to the time extensions the Act allows, stating whether access will be given and how, or the reasons for a refusal and the provision it rests on (s. 101(1)).
• Charge no more than the fees and disbursements set under the regulations, which may not exceed the costs of processing the access request (s. 95(1)-(2)).
• On a written request to correct an error or omission in a record about the individual, make every reasonable effort to assist the applicant and to make the correction or respond without delay, and charge no fees or disbursements for the request (s. 119(1)-(3)).