Handles health records, in Yukon

S.Y. 2013, c. 16, s. 18 · Read the law's page

• Do not collect, use or disclose an individual's Yukon public health insurance plan number unless the section's exceptions apply, such as providing publicly funded health care to the individual, health research or a designated investigation, a purpose related to the Yukon health information network, a proceeding, or a prescribed purpose (s. 18(1)-(2)).
• Do not request production of a YHCIP card unless you are a custodian, an agent of a custodian or a prescribed person asking in relation to the provision of publicly funded health care to the individual or for a prescribed purpose (s. 18(3)-(4)).

S.Y. 2013, c. 16, s. 22 · Read the law's page

• These duties bind a custodian.
• If you disclose any of an individual's personal health information to a person without the individual's consent, record the name of the person, the date and purpose of the disclosure and a brief description of the personal health information (s. 22 (1)).
• You need not make that record for the disclosure of a record that contains only registration information or provider registry information (s. 22 (2)).
• For any electronic information system you use to maintain personal health information, create and maintain a record of user activity that holds, for each incident of access by a person through the system, the person's user identification, the date and time of the incident, a description of the information accessed or that could have been accessed and any prescribed information, and meet any prescribed requirements for it (s. 22 (3)-(4)).

S.Y. 2013, c. 16, s. 41(1)(d) · Read the law's page

• Where you rely on a posted or readily available notice to show consent is knowledgeable, include advice that if the personal health information is disclosed outside Yukon, the law of the jurisdiction to which it is disclosed will govern its use, collection and disclosure in that jurisdiction (s. 41(1)(d)).
• In the written agreement with an information manager, require it to inform you promptly of any summons, warrant or order relating to the personal health information that may be enforceable in the jurisdiction where it operates or where the information is located (O.I.C. 2016/159, s. 21(b)(iii)(D)).

S.Y. 2013, c. 16, ss. 13, 15-16, 19, 33-34 · Read the law's page

• Collect, use, disclose or access personal health information only as the Act and the regulations allow, and not at all where other information will serve the purpose (ss. 13, 15).
• Limit each collection, use and disclosure of personal health information to the minimum amount reasonably necessary for its purpose (s. 16).
• Protect personal health information with administrative policies and technical and physical safeguards that ensure its confidentiality, security and integrity, including controls that limit use to authorized individuals whose identity is verified, secure storage, disposal and destruction of records, and all reasonable steps to prevent a security breach (s. 19(1), (3)).
• Rely on implied consent unless the Act requires express consent, and obtain and record express consent for fund-raising and in the prescribed circumstances (ss. 33, 34, 35(1)).
• Check whether you are a custodian: the Department of Health and Social Services, the operator of a hospital or health facility, a health care provider such as a medical practitioner, nurse or pharmacist, or a prescribed person (s. 2).

S.Y. 2013, c. 16, ss. 20-21, 41 · Read the law's page

• Designate at least one contact individual who receives and processes complaints about your information practices, answers access and correction requests, makes sure your agents know their duties, responds to individuals you have notified of a security breach and to the commissioner, and performs any prescribed functions (s. 20(1)-(2)).
• If you are an individual and designate no contact individual, you are your own contact individual and must perform those functions (s. 20(3)).
• Make available to the public a written statement that gives a general description of your information practices, says how to contact your contact individual, describes how to obtain access to or ask for an annotation correcting a record of personal health information, describes how to complain to you and to the commissioner, and meets any prescribed requirements (s. 21).
• To rely on the assumption that consent is knowledgeable, post, in a place likely to come to the individual's attention, or make readily available a notice that meets the prescribed requirements, describes the purpose of the collection, use or disclosure, says the individual may give or withhold consent and may withdraw it, and confirms that without consent the information may be collected, used or disclosed only as the Act and the regulations allow (s. 41(1)(a)-(c)).
• Do not rely on that assumption for an individual you have reasonable grounds to believe has a limited or impaired ability to understand the notice's language or its contents, and make reasonable efforts to help that individual understand the purpose of the collection, use and disclosure (s. 41(2)-(3)).

S.Y. 2013, c. 16, ss. 24-28 · Read the law's page

• Respond to a complete access application within 30 days, or tell the applicant before the 30 days end that you are extending by up to 60 days, why, when to expect a response and that the applicant may complain to the commissioner (s. 26(1)-(3)).
• Where you use electronic means to collect, use or disclose an individual's personal health information, give a copy of the record of user activity on request, subject to any prescribed limitations, and charge no fee for it (s. 24(3)).
• Respond to a correction request within 30 days, subject to the Act's extension, and charge no fee for the services provided on it (s. 28(2), (10)).
• Do not charge for access more than the prescribed fee (s. 24(2)).

S.Y. 2013, c. 16, ss. 29-31 · Read the law's page

• Notify the individual as soon as reasonably possible after a security breach of their personal health information in your custody or control, where there are reasonable grounds to believe the individual is at risk of significant harm (s. 30(1)).
• In the notice, describe the circumstances of the breach and the information involved, say when it occurred, describe the measures you have taken to reduce the risk of harm and identify your contact individual (s. 30(2)(a)).
• Give the commissioner a copy of the notice at the same time (s. 30(2)(b)).
• Weigh the time between the breach and its discovery, the likelihood of disclosure, unauthorized use or copying, the likelihood of identity theft or fraud, the number of people affected and the measures taken when deciding whether an individual is at risk of significant harm (s. 30(3)).
• Within a reasonable time after discovering the breach, send the commissioner a written report that assesses the risk of harm, estimates the number of individuals affected and describes the measures taken to reduce that risk (s. 31(1)).

S.Y. 2013, c. 16, ss. 42-44 · Read the law's page

• Honor an individual's withdrawal of consent given by notifying the custodian that has custody or control of the information; it does not reach collection, use or disclosure made before the custodian received the notice (s. 42(1)-(2)).
• Expect the withdrawal to be clear and unambiguous, in writing in English or French, and delivered to the custodian or its agent (O.I.C. 2016/159, s. 20).
• Where an individual refuses or withdraws consent for the purpose of providing health care, inform the individual of the reasonably foreseeable consequences, take reasonable steps to act in accordance with the decision and, on a withdrawal and on request, make reasonable efforts to tell the individual who received the information during the previous year (s. 43(1)).
• If you refuse to comply because compliance is likely to endanger the individual's health or safety, tell the individual as soon as reasonably possible, on request make reasonable efforts to identify the recipients from the previous year, provide any prescribed information, and tell the individual of the right to complain to the commissioner (s. 43(2)-(3); O.I.C. 2016/159, s. 18).
• When you disclose with consent to another custodian for health care but lack consent to disclose all the information you consider reasonably necessary, notify the other custodian of that fact (s. 44).

S.Y. 2013, c. 16, ss. 49-51 · Read the law's page

• Take reasonable measures to ensure your agents comply with the Act and the regulations (s. 49).
• Permit an agent to collect, use, disclose, retain, destroy or dispose of personal health information on your behalf only where you are permitted or required to, the handling is within the agent's duties and your limits, the agent uses only the information it needs for the purpose, and any prescribed requirements are met (s. 50(1)).
• If you propose to retain an information manager, enter into a written agreement with it that provides for the protection of the information that is the subject of the services and comply with the prescribed requirements (s. 51(1)).
• Make that agreement let you maintain control of the personal health information, and require the information manager to give you access at any time, forward access and correction requests, maintain safeguards that meet or exceed yours, refrain from subcontracting without your written consent, allow you to monitor compliance and terminate for breach, and on termination transfer the information to you and securely destroy what remains (O.I.C. 2016/159, s. 21).
• If you are an agent, notify the custodian at the first reasonable opportunity of a security breach in relation to personal health information you handled (s. 50(3)); if you are an information manager under a written agreement, perform the agreement's duties and notify the custodian at the first reasonable opportunity of any breach of it (s. 51(2)).

S.Y. 2013, c. 16, ss. 99, 121-123 · Read the law's page

• Expect a complaint to the Information and Privacy Commissioner from anyone who reasonably believes you have failed to comply with the Act or the regulations (s. 99(1)).
• Do not knowingly collect, use, disclose or access personal health information, destroy or dispose of a record of it, or collect or use another person's Yukon health care insurance plan number, in contravention of the Act (s. 121(1)(a)).
• Do not alter, falsify, conceal, destroy or erase a record, or direct another person to, with the intent to evade a request for access to it (s. 121(1)(d)).
• Do not knowingly contravene subsection 30(1), a provision of Division 2 or 3 of Part 7, or section 118 (s. 121(1)(g)-(h)).