Handles health records, in Saskatchewan

S.S. 1999, c. H-0.021, s. 11 · Read the law's page

• Do not require an individual to produce a health services number as a condition of receiving any product or service, unless the number is for the provision of publicly funded health services to that individual, for a health service or program provided by a trustee, or an Act or regulation authorizes it (s. 11(2), (3)).
• Respect an individual’s right to refuse to produce a health services number or another prescribed identifying number as a condition of receiving a service, unless you are a trustee providing a health service (s. 11(1)).

S.S. 1999, c. H-0.021, s. 18 · Read the law's page

• If you are a trustee, enter into a written agreement with an information management service provider before giving it personal health information; the agreement must govern access to and use, disclosure, storage, archiving, modification and destruction of the information, provide for its protection and meet the regulations (s. 18(2); Regulations, s. 7).
• If you are an information management service provider, do not use, disclose, obtain access to, process, store, archive, modify or destroy personal health information received from a trustee except to process, store, archive or destroy it for the trustee, to provide the trustee with information management or information technology services, to take custody and control of it when the trustee ceases to be a trustee, or to combine records (s. 18(1), (3)).
• If you are an information management service provider, comply with the terms of the agreement with the trustee and notify the trustee at the first reasonable opportunity of any breach of the agreement (s. 18(4); Regulations, s. 7(f)).
• Keep secure the personal health information in your custody or control as the Act requires; you do not contravene the requirement if you can establish that you took all reasonable steps to prevent the contravention (s. 64(1.1), (1.2)).

S.S. 1999, c. H-0.021, ss. 41-52, 64 · Read the law's page

• Within 30 days after receiving the commissioner’s report, decide whether to follow the commissioner’s recommendations and give written notice of the decision to the commissioner and the applicant (s. 49).
• Produce personal health information in your custody or control to the commissioner in a review, despite any other Act or any privilege available at law (s. 46(1)).
• Do not obtain another person’s personal health information by falsely representing that you are entitled to it, and do not wilfully destroy a record governed by the Act with the intent to evade a request for access (s. 64(1)(e), (f)).

S.S. 1999, c. H-0.021, ss. 5-7, 16-17, 23-27 · Read the law's page

• Use or disclose personal health information about an individual only with the subject individual’s consent or in accordance with a provision of the Act that authorizes the use or disclosure (s. 5(2)).
• Obtain consent that relates to the purpose for which the information is required, is informed, is given voluntarily and is not obtained through misrepresentation, fraud or coercion; consent may be express or implied unless the Act provides otherwise (s. 6(1), (4)).
• Take all reasonable steps to comply promptly with a revocation of consent; a revocation has no retroactive effect (s. 7(2), (3)).
• Collect, use or disclose only the personal health information that is reasonably necessary for the purpose, use or disclose de-identified information where practicable if it will serve the purpose, and collect information directly from the subject individual unless the Act lists an exception (ss. 23(1), 23(4), 25(1)).
• Establish policies and procedures that restrict employees’ access to personal health information they do not need to carry out the purpose of collection or an authorized purpose (s. 23(2)).
• Establish policies and procedures that maintain administrative, technical and physical safeguards protecting the integrity, accuracy and confidentiality of the information and guarding against reasonably anticipated threats, loss and unauthorized access, use, disclosure or modification (s. 16).
• Provide employees with orientation and ongoing training on your policies and procedures for protecting personal health information, and ensure that each employee signs a pledge of confidentiality (Regulations, s. 5).
• Have a written retention and destruction policy that meets the regulations, comply with it, keep the information retrievable, readable and useable for the full retention period, and destroy it in a manner that protects the privacy of the subject individual (s. 17; Regulations, s. 6).

S.S. 1999, c. H-0.021, ss. 8-10, 12-13, 32-40 · Read the law's page

• Take reasonable steps to inform an individual of the anticipated uses and disclosures of the information when you collect personal health information from that individual, and establish policies and procedures that promote awareness of the individual’s rights of access and amendment (s. 9(2), (3)).
• Take reasonable steps to be able to tell an individual about any disclosure of the individual’s personal health information made without consent (s. 10(1)).
• Respond to a written request for access within 30 days by making the information available, saying that it does not exist or cannot be found, refusing in whole or in part with reasons and notice of the right to a review, or transferring the request to another trustee (s. 36(1)).
• Charge no more than a reasonable fee, not exceeding the prescribed amount, for access to a record (s. 39).
• On a request to amend personal health information, advise the individual in writing within 30 days that the amendment or a notation has been made, and where practicable notify any trustee or person to whom the information was disclosed in the previous year (s. 40(3), (4)).