Handles health records, in Tonga

Mental Health Act [Cap 12.10] (Act 8 of 2001), ss. 92(4) and 93 (confidentiality of mental health patient records) · Read the law's page

• If you keep records for a mental health facility or a health care agency, do not disclose, directly or indirectly, information that identifies a person as a patient of, or as having received treatment from, the facility or agency and that relates to the nature or other details of admission or treatment, except to fulfil a requirement under the Act or other legislation (s. 92(4)).
• You may disclose such information with the person's prior consent (or the next of kin's consent if the person has died), as a court requires in criminal proceedings, for continuing care of a closely involved relative where disclosure is necessary to protect the person, for medical or social research the Minister is satisfied is necessary and not detrimental to the person, or where the Minister considers it in the public interest (s. 93).

Act 14 of 2025, s. 15 · Read the law's page

• It reaches you only once the Minister responsible for cybersecurity policy and regulation (Minister CPR) has designated your physical, electronic or virtual infrastructure assets, systems or networks as critical infrastructure under section 11 and published that designation in the Government Gazette.
• Within 24 hours of becoming aware of it, report to the Computer Emergency Response Team (CERT) a cybersecurity incident relating to the information systems of your designated critical infrastructure, an incident relating to any information system interconnected with or communicating with those systems, or any other cybersecurity incident or occurrence the Minister CPR has designated as requiring notification.
• File that report in the form the Minister CPR prescribes.

Act 14 of 2025, ss. 11-14, 16-17 · Read the law's page

• It reaches you only once the Minister responsible for cybersecurity policy and regulation (Minister CPR) has designated your physical, electronic or virtual infrastructure assets, systems or networks as critical infrastructure under section 11 and published that designation in the Government Gazette; grounds for designation include infrastructure necessary for electronic communications, banking or other financial services, electrical energy, public transportation, other public utilities, or public safety and public health including emergency services.
• Once designated, register with the Minister CPR, notify the Minister CPR of any change in your legal ownership or in the person or entity operating the infrastructure, and conduct and submit periodic cybersecurity self-assessments to the Ministry CPR in the form and manner it prescribes.
• Comply with any minimum standards the Minister CPR issues for critical infrastructure, submit to the Minister CPR's periodic and ad hoc audits and inspections of your compliance, and comply with any order the Minister CPR makes to take remedial, protective or preventative action following an audit, an assessment, or a reported incident.
• Develop, maintain and implement policies, practices and procedures to detect, share information about, mitigate and respond to cybersecurity threats and incidents, communicate them to your staff, and keep records evidencing your compliance available to the Minister CPR on request.

Act 31 of 2025, s. 54 (Personal Health Information Protection Act 2025, disclosure outside Tonga) · Read the law's page

• These duties bind a health information custodian, which includes a health care practitioner, a person who operates a hospital or a pharmacy, an employer, and an insurer or insurance agent, that has custody or control of personal health information, and they bind the Crown (ss. 3(1), 7(4)).
• Disclose personal health information collected in Tonga to a person outside Tonga only with the person's consent, where the Act permits the disclosure, where the recipient performs functions comparable to those of a person to whom the Act permits disclosure in Tonga, or where the disclosure is reasonably necessary for the person's health care (unless they have expressly instructed you not to) or for payments in connection with it (s. 54(1)).
• Where the person's instruction stops you disclosing all the information reasonably necessary for their care, tell the recipient so (s. 54(2)).

Act 31 of 2025, ss. 10, 14(1), 31-32, 40 and 55 (Personal Health Information Protection Act 2025) · Read the law's page

• These duties bind a health information custodian, which includes a health care practitioner, a person who operates a hospital or a pharmacy, an employer, and an insurer or insurance agent, that has custody or control of personal health information, and they bind the Crown (ss. 3(1), 7(4)).
• Collect, use or disclose personal health information only with the person's consent where it is necessary for a lawful purpose, or where the Act permits or requires it, and never where other information will serve or beyond what is reasonably necessary (ss. 31-32).
• Take reasonable steps to protect personal health information against theft, loss and unauthorized access, use or disclosure (s. 14(1)).
• If you use electronic means to handle personal health information, keep an electronic audit log of each time a record is viewed, handled or modified, and audit and monitor it as often as the Regulations prescribe (s. 10).
• Keep genetic test information in a separate record from the rest of the person's personal health information (s. 40).
• Before disclosing sensitive personal health information, such as genetic test information, HIV or AIDS, a sexually transmitted disease, a mental disorder, a pregnancy, sexual assault or abuse, or anything the person has marked sensitive, tell the person, the recipient and the reason, consider the person's views and note the record, and disclose none if other information will serve and no more than is necessary (s. 55).

Act 31 of 2025, ss. 14(2)-(3), 19(5)(b) and 70(6) (Personal Health Information Protection Act 2025) · Read the law's page

• These duties bind a health information custodian, which includes a health care practitioner, a person who operates a hospital or a pharmacy, an employer, and an insurer or insurance agent, that has custody or control of personal health information, and they bind the Crown (ss. 3(1), 7(4)).
• If personal health information about a person is stolen or lost, or is used or disclosed without authority, notify the person at the first reasonable opportunity and say in the notice that they may complain to the Chief Executive Officer responsible for health (s. 14(2)).
• Notify the Chief Executive Officer responsible for health of the theft, loss or unauthorized access, use or disclosure where the circumstances meet the requirements the Regulations prescribe (s. 14(3)).
• If you are an agent of a custodian, notify the custodian at the first reasonable opportunity when personal health information you handled for it is stolen or lost, or is used or disclosed without authority (s. 19(5)(b)).
• If you are responsible for collecting personal health information without authority by means of the National Health Information System, notify the person at the first reasonable opportunity (s. 70(6)).

Act 31 of 2025, ss. 57-60 (Personal Health Information Protection Act 2025, access and correction) · Read the law's page

• These duties bind a health information custodian, which includes a health care practitioner, a person who operates a hospital or a pharmacy, an employer, and an insurer or insurance agent, that has custody or control of personal health information, and they bind the Crown (ss. 3(1), 7(4)).
• Give a person who asks in writing access to the record of personal health information about them that you hold, subject to the exceptions in section 57(1), in an electronic format that meets the Regulations where they ask for one (ss. 57-58).
• Respond to a request for access no later than 30 days after receiving it, or within the time the person specifies if they show an urgent need and you can reasonably meet it, and extend the limit only by up to 30 days, on written notice (s. 59(3)-(6)).
• If you refuse access in whole or in part, give the person a written notice with the reason and say that they may complain to the Chief Executive Officer responsible for health (s. 59(1)(c)).
• On a written request, correct a record of personal health information that the person shows you is incomplete or inaccurate, and reply by written notice no later than 30 days after receiving the request (s. 60(1), (2), (7)).
• If you refuse a correction, give reasons and tell the person they may attach a statement of disagreement to their records and complain to the Chief Executive Officer (s. 60(10)).

Act 31 of 2025, ss. 76-81, 87 and 89 (Personal Health Information Protection Act 2025, enforcement) · Read the law's page

• These duties bind a health information custodian, which includes a health care practitioner, a person who operates a hospital or a pharmacy, an employer, and an insurer or insurance agent, that has custody or control of personal health information, and they bind the Crown (ss. 3(1), 7(4)).
• Comply with a direction the Chief Executive Officer responsible for health gives after reviewing a complaint, and produce the records and documents the Chief Executive Officer or an authorised officer demands in a review (ss. 78(2), 79(1)).
• Do not obstruct the Chief Executive Officer or an authorised officer, or give them false or misleading information (s. 78(3)).
• Do not dismiss or otherwise disadvantage a person for reporting a contravention of the Act to the Chief Executive Officer (s. 87).