Handles health records, in Prince Edward Island

R.S.P.E.I. 1988, c. H-1.41, s. 34 · Read the law's page

• These duties bind a custodian.
• If you disclose personal health information without the consent of the individual to whom it relates for health related purposes, record the name of the person to whom you disclose it, the date and purpose of the disclosure and a description of the information disclosed, and keep the record for at least 10 years following the disclosure unless the Act or the regulations provide otherwise (s. 34 (1)).
• You need not keep that record if you disclose by permitting access to the information stored in your information system and the system automatically keeps an electronic log of the unique user identification of the individual who accesses the information, the date and time of access and a description of the information that was or could have been accessed (s. 34 (2)).

R.S.P.E.I. 1988, c. H-1.41, s. 35 · Read the law's page

• As a custodian, do not disclose personal health information collected in Prince Edward Island to a person outside the province without the individual's consent except in the circumstances described in subsections 23(7), (10) and (13) or as the regulations specify (s. 35).

R.S.P.E.I. 1988, c. H-1.41, s. 36(1)(c), (2) · Read the law's page

• As a custodian, notify the individual to whom the personal health information relates, and the Commissioner, in writing at the first reasonable opportunity if the information is stolen, lost, disposed of except as the Act permits, or disclosed to or accessed by an unauthorized person (s. 36(1)(c)).
• You need not give that notice if you reasonably believe the theft, loss, disposition, disclosure or access will not have an adverse impact on the provision of health care or other benefits to the individual, or on the individual's mental, physical, economic or social well-being (s. 36(2)).

R.S.P.E.I. 1988, c. H-1.41, ss. 13, 17, 22, 39, 41-43 · Read the law's page

• The Act binds a custodian: a person or organization that handles personal health information to provide or assist in providing health care or treatment, to plan and manage the health care system, or to deliver a government health care program or service. It does not apply to an employer, an insurance company or another person that holds such information for other purposes (ss. 1(e), 4(1)(c)).
• As a custodian, collect personal health information only with the individual's consent where the collection is necessary for a lawful purpose, or where the Act otherwise permits or requires it (s. 17(1)).
• Collect personal health information directly from the individual unless one of the exceptions in section 18 applies (s. 18).
• Obtain the individual's express consent, and do not rely on implied consent, before disclosing personal health information to a person who is not a custodian (s. 13(6)(a)).
• Limit every use of personal health information to the minimum amount necessary for the purpose, and to the employees and agents who need to know it for that purpose (s. 22(2), (3)).
• Protect personal health information with reasonable administrative, technical and physical safeguards, based on nationally or provincially recognized information technology and security standards appropriate to its sensitivity (s. 39(1), (2)).
• Enter into a written agreement with an agent that handles personal health information for you, and with any information manager you provide it to for processing, storing, destroying or information technology services (ss. 41, 42(2)).
• If you are an information manager under such an agreement, comply with its duties and with the same protection, retention and secure destruction requirements that bind the custodian (s. 43).

R.S.P.E.I. 1988, c. H-1.41, ss. 78-79 · Read the law's page

• Do not collect, use or disclose personal health information in contravention of the Act, and do not attempt to gain or gain access to it in contravention of the Act (s. 78(1)(a), (b)).
• Do not sell personal health information or disclose it for consideration, except that a custodian may do so where essential to the sale or disposition of a health care provider's practice or a health care facility's business as a going concern, to another custodian (s. 78(3)(b), (4)).
• Do not destroy, alter, falsify or conceal personal health information with the intent to evade an access request or to affect the outcome of an audit or investigation (s. 78(1)(f), (g)).

R.S.P.E.I. 1988, c. H-1.41, ss. 8, 8.1, 11, 80(2) · Read the law's page

• As a custodian, let an individual examine or receive a copy of any record of the individual's personal health information in your custody or under your control, and respond within 30 days of receiving the request, extending the time only on the grounds in section 8.1 (ss. 8(1), (4), 8.1).
• Do not charge an individual to examine the individual's own personal health information (s. 80(2)).
• Within 30 days of a written request to correct a record, make the correction, tell the individual the information no longer exists or cannot be found, transfer the request to the custodian that has it, or refuse on a ground in section 11(3)(d) (s. 11(3)).
• If you refuse a correction, give the individual written reasons, permit a concise statement of disagreement and add it to the record (s. 11(4), (6)).