Handles health records, in Ontario

S.O. 2004, c. 3, Sched. A, s. 10 (4); O. Reg. 329/04, s. 6 · Read the law's page

• These duties bind a vendor or service provider that supplies goods or services enabling a health information custodian to use electronic means to collect, use, modify, disclose, retain or dispose of personal health information. A health information network provider carries further duties.
• If you are not the custodian's agent, use personal health information you can access while providing the services only as necessary to provide them, and do not disclose it.
• Do not let your employees, or anyone acting for you, have access to the information unless they agree to comply with the same restrictions.
• If you are a health information network provider (you serve two or more custodians, primarily so that they can disclose personal health information to one another electronically), notify every applicable custodian at the first reasonable opportunity if you used, disclosed or disposed of the information outside those restrictions or an unauthorized person accessed it.
• As a health information network provider, give each custodian a plain language description of your services that is suitable for sharing with patients, including the safeguards in place, and make that description and your applicable directives, guidelines and policies available to the public, other than a trade secret or confidential scientific, technical, commercial or labour relations information.
• As a health information network provider, keep, to the extent reasonably practical, an electronic record of all accesses to and transfers of custodians' information in equipment you control, identifying who accessed or transferred it and when, and make it available to a custodian on request.
• As a health information network provider, assess the threats, vulnerabilities and risks to the security and integrity of the information and how your services may affect the privacy of the individuals concerned, and give each custodian a written copy of the results.
• As a health information network provider, make sure any third party you retain to help provide the services agrees to the restrictions and conditions you need in order to comply, and sign a written agreement with each custodian that describes the services and the administrative, technical and physical safeguards and requires you to comply with the Act and the regulations.

S.O. 2004, c. 3, Sched. A, s. 34 · Read the law's page

• These duties bind any person that is not a health information custodian or its agent, so they reach a business or app that asks people for a health card or health number.
• Do not collect or use another person's health number except for provision of provincially funded health resources to that person, for the purposes for which a custodian disclosed the number to you, or for another purpose the Act lists, such as, if you are a prescribed person acting with the individual's express consent, identifying the individual's records, verifying identity or linking records.
• Do not disclose a health number except as required by law or as the regulations allow.
• Do not require anyone to produce their health card, unless you provide a provincially funded health resource to a person who has one.

S.O. 2004, c. 3, Sched. A, s. 50 · Read the law's page

• This duty binds a health information custodian that discloses personal health information collected in Ontario to a person outside Ontario.
• Disclose the information outside Ontario only if the individual consents, the Act permits the disclosure, the recipient performs functions comparable to those of a person the Act lets you disclose to in Ontario in the listed cases, the disclosure is reasonably necessary to provide health care to the individual and the individual has not expressly instructed you not to make it, or the disclosure is reasonably necessary to administer payments for health care or for contractual or legal requirements connected with it.
• If the individual's instruction prevents you from disclosing everything you consider reasonably necessary for the individual's care, tell the recipient that the disclosure is limited.

S.O. 2004, c. 3, Sched. A, ss. 10 (1)-(3), 11, 12 (1), 13, 15-20, 29-33, 49 · Read the law's page

• These duties bind a health information custodian (a health care practitioner, hospital, pharmacy, laboratory, long-term care home, ambulance service or other class the Act lists) and a person acting as its agent.
• Do not collect, use or disclose personal health information about an individual unless you have the individual's consent and, to the best of your knowledge, the collection, use or disclosure is necessary for a lawful purpose, or the Act permits or requires it.
• Make sure a consent is the individual's own, is knowledgeable, relates to the information and is not obtained through deception or coercion. A consent to disclosure to a person that is not a health information custodian must be express unless an exception in section 18 applies.
• Do not collect, use or disclose personal health information if other information will serve the purpose, and do not collect, use or disclose more than is reasonably necessary to meet the purpose.
• Do not collect, use or disclose personal health information for marketing or market research unless the individual expressly consents and you follow the prescribed requirements.
• Use or disclose personal health information for fundraising only with the individual's express consent, or with implied consent where the information is only the individual's name and the prescribed contact information.
• Take steps that are reasonable in the circumstances to protect personal health information against theft, loss and unauthorized use or disclosure, and records against unauthorized copying, modification or disposal.
• Retain, transfer and dispose of records of personal health information in a secure manner and in accordance with the prescribed requirements.
• Take reasonable steps to ensure that personal health information you use is as accurate, complete and up-to-date as is necessary for the purposes of the use, and that it is not collected without authority.
• Have information practices that comply with the Act, follow them, designate a contact person if you are not a natural person, and make available to the public a written statement describing your information practices, how to contact you, how to seek access or correction and how to complain.
• Permit an agent to collect, use, disclose, retain or dispose of personal health information only where you are permitted to do so, it is necessary in the course of the agent's duties and the prescribed requirements are met, and take reasonable steps to ensure the agent acts only within that permission. You remain responsible for what your agents do.
• If you are not a health information custodian and receive personal health information from one, use or disclose it only for the purpose for which the custodian was authorized to disclose it or to carry out a statutory or legal duty, and no more of it than is reasonably necessary.

S.O. 2004, c. 3, Sched. A, ss. 52-55 · Read the law's page

• These duties bind a health information custodian. A person acting for a custodian handles requests through it.
• On a written request from an individual that contains enough detail to locate the record, make the individual's record of personal health information available for examination and, on request, give a copy with an explanation of any term, code or abbreviation used, unless an exception in section 52 applies.
• Respond as soon as possible and no later than 30 days after receiving the request. You may extend by not more than 30 days if meeting the limit would unreasonably interfere with your operations or the consultations needed make it impractical, and you must give the individual written notice of the extension and the reason.
• If you refuse a request in whole or in part, give written notice. Unless the refusal rests on legal proceedings, an inspection or investigation, or a risk of harm, the notice must give the reason and state that the individual may complain to the Commissioner.
• On a written request to correct a record you have granted access to, reply by written notice no later than 30 days after receiving it, and grant the correction if the individual shows the record is incomplete or inaccurate for the purposes you use it for and supplies the information needed to correct it.
• When you correct a record, record the correct information without obliterating the original, notify the individual, and on request give written notice of the correction to the persons you disclosed the information to, unless the correction cannot reasonably be expected to affect the individual's care or benefits.

S.O. 2004, c. 3, Sched. A, ss. 56-64; O. Reg. 329/04, s. 35 · Read the law's page

• These powers run against any person whose activities the Commissioner reviews, including a custodian, an agent of a custodian and a supplier of services to a custodian.
• Comply with an order of the Commissioner under the Act, including an order to perform a duty, to stop collecting, using or disclosing personal health information, or to return, transfer or dispose of records.
• If ordered to pay an administrative penalty, pay it to the Minister of Finance in the manner and by the time the order specifies.

S.O. 2004, c. 3, Sched. A, ss. 65, 72 · Read the law's page

• These offences reach any person, including a custodian, an agent, a supplier to a custodian and a person who holds a health number or de-identified information.
• Do not wilfully collect, use or disclose personal health information in contravention of the Act or its regulations, and do not wilfully dispose of a record in contravention of the secure disposal duty.
• Do not contravene the health number rules in section 34 (2), (3) or (4), and do not wilfully use de-identified information to identify an individual.
• Do not make a request for access to or correction of a record of personal health information under false pretences, and do not wilfully obstruct or mislead the Commissioner or fail to comply with the Commissioner's order.

S.O. 2004, c. 3, Sched. A, ss. 12 (2)-(3), 17 (4), 17.1; O. Reg. 329/04, ss. 6.3-6.4 · Read the law's page

• These duties bind a health information custodian and, for the duty to tell the custodian, its agent.
• If personal health information in your custody or control is stolen or lost, or is used or disclosed without authority, notify the individual at the first reasonable opportunity and state in the notice that the individual is entitled to make a complaint to the Commissioner.
• Notify the Commissioner at the first reasonable opportunity when the theft, loss or unauthorized use or disclosure meets a prescribed circumstance: reasonable grounds to believe the information was used or disclosed without authority by a person who knew or ought to have known that, reasonable grounds to believe it was stolen, further unauthorized use or disclosure after an initial incident, a pattern of similar incidents, a notice you must give a College, or your own determination that the incident is significant after weighing sensitivity, volume, the number of individuals and the number of custodians or agents responsible.
• On or before March 1 each year, report to the Commissioner how many times in the previous calendar year personal health information in your custody or control was stolen, lost, used without authority or disclosed without authority.
• If you are an agent of a custodian, notify the custodian at the first reasonable opportunity if personal health information you handled for it is stolen or lost, or is used or disclosed without authority.
• If you employ a health care practitioner who is a member of a College and the practitioner is terminated, suspended or disciplined because of unauthorized collection, use, disclosure, retention or disposal of personal health information, or resigns and you have reasonable grounds to believe the resignation is related to an investigation of that conduct, give the College written notice within 30 days of the event.
• If you are the medical officer of health of a board of health and a health care practitioner who is a member of a College is employed to provide health care for the board as your agent, give the College written notice within 30 days of the event if the agent's employment is terminated or suspended or the agent is subject to disciplinary action because of unauthorized collection, use, disclosure, retention or disposal of personal health information, or the agent resigns and you have reasonable grounds to believe the resignation is related to an investigation of that conduct.
• If you extend privileges to, or are otherwise affiliated with, a health care practitioner who is a member of a College, give the College written notice within 30 days of the event if the practitioner's privileges or affiliation are revoked, suspended or restricted because of unauthorized collection, use, disclosure, retention or disposal of personal health information, or the practitioner relinquishes or restricts them and you have reasonable grounds to believe that is related to an investigation of that conduct.

S.O. 2004, c. 3, Sched. A, s. 11.2 · Read the law's page

• This duty binds any person, not only a health information custodian, who holds information that has been de-identified from personal health information.
• Do not use, or attempt to use, de-identified information to identify an individual, alone or combined with other information, unless the Act or another Act permits it. Custodians, prescribed entities, prescribed registry holders and other prescribed persons may re-identify information they de-identified themselves.

S.O. 2004, c. 3, Sched. A, ss. 51 (5)-(8), 55 (1.1)-(1.2); O. Reg. 329/04, ss. 18.1.1 and 18.1.2.3 · Read the law's page

• If you are the prescribed organization, handle a request for access to a record accessible through the electronic health record, to an electronic record kept under paragraphs 4, 5 and 6 of section 55.3, or to digital health identifier records, as a health information custodian would under Part V, subject to the prescribed exceptions and additional requirements (s. 51 (5), (6) and (7)).
• If you are a health information custodian, give access under Part V to the record of all instances in which an individual's personal health information accessible through the electronic health record was viewed, handled or otherwise dealt with by you (s. 51 (8)).
• Do not expect a correction request to be accepted by the prescribed organization for the records described in subsection 51 (5), (6) or (7), or by a health information custodian for the records described in subsection 51 (8) (s. 55 (1.1) and (1.2)).
• If you are the Agency, make available an electronic system to act as a digital means of access that permits individuals who have a digital health identifier and are specified on your website to access the records described in section 18.1.1 of the regulation, and from 1 January 2028 also make available an alternative process for individuals who cannot or do not wish to use it (O. Reg. 329/04, s. 18.1.1).
• Provide the Commissioner with an annual report on the previous calendar year on or before March 1 in each year starting in 2027 (O. Reg. 329/04, s. 18.1.2.3).

S.O. 2004, c. 3, Sched. A, s. 10.1 · Read the law's page

• This duty binds a health information custodian that uses electronic means to collect, use, disclose, modify, retain or dispose of personal health information, and so reaches the systems that supply those means.
• Maintain, or require the maintenance of, an electronic audit log that records, for every instance in which personal health information accessible by electronic means is viewed, handled, modified or otherwise dealt with, the type of information, the date and time, the identity of every person who dealt with it and the identity of the individual it relates to.
• Audit and monitor the log as often as the regulations require, comply with any prescribed requirements, and give the Commissioner a copy of the log on request, even where it contains personal health information.

S.O. 2004, c. 3, Sched. A, s. 54.1 · Read the law's page

• These duties bind a person who provides electronic services to individuals, at their request, primarily so that they can access, use, disclose, modify, maintain or otherwise manage their own records of personal health information, such as an app through which a person views or manages their health records.
• Comply with the requirements the regulations prescribe for consumer electronic service providers when you provide the service to an individual.
• Collect and use a health number only if the individual who requested your services authorized it, only to verify the individual's identity or for another prescribed purpose, and in accordance with the prescribed rules.