Personal Health Information Act, notice of a privacy breach by trustees
C.C.S.M. c. P33.5, s. 19.0.1; M.R. 245/97, ss. 8.7-8.9
In force since .
A breach notification rule binding public and private bodies.
- Enforcement body
- Ombudsman of Manitoba
- Obligation class
- Breach notice, Reporting
As of .
What it requires
- If you are a trustee that maintains personal health information about an individual, notify the individual about a privacy breach relating to it (theft or loss, or access, use, disclosure, destruction or alteration in contravention of the Act) if, after weighing the factors in section 8.7 of the regulation, the breach could reasonably be expected to create a real risk of significant harm to the individual (s. 19.0.1(1)-(2)).
- Give the notice as soon as practicable after you become aware of the breach, directly to the individual except in the circumstances the regulation sets out (s. 19.0.1(3)).
- Make the notice in writing and include a description of the circumstances of the breach, when it occurred, the trustee that had the information, a description of the information, what you have done and will do to reduce the risk of harm and of a repeat, what the individual can do, and a statement that the Ombudsman has been or will be notified (M.R. 245/97, s. 8.8(1)).
- When you are required to notify an individual, also notify the Ombudsman at the time and in the form and manner the Ombudsman requires (s. 19.0.1(4)).
These lines are LexLint's reading of the law's text, as of .
If you get it wrong
Criminal exposureYes
Criminal exposure note
Section 63(1)(g) makes it an offense to fail to comply with the privacy breach notification duty, and section 64(1) sets the fine.
Penalty structure
Section 64(1) sets the fine for an offense under section 63 at not more than $50,000.
- Rule
- Fixed only
- As of
- Currency
- CAD
- Fixed cap
- 50,000
What this law does
A privacy breach, in relation to personal health information, is theft or loss, or access, use, disclosure, destruction or alteration in contravention of the Act. A trustee that maintains personal health information about an individual must notify the individual about a privacy breach if, after considering the relevant factors prescribed in the regulations, the breach could reasonably be expected to create a real risk of significant harm to the individual.
The notice must be given as soon as practicable after the privacy breach becomes known to the trustee. A trustee that is required to notify an individual must also notify the Ombudsman at the time and in the form and manner that the Ombudsman requires. The regulation requires the notice to the individual to be in writing and to describe the circumstances of the breach, the information involved and the steps taken and the steps the individual can take.
The factors the regulation lists include the sensitivity of the personal health information involved and the probability that it could be used to cause significant harm to the individual. The factors also include whether the information was adequately encrypted, anonymized or otherwise not easily accessible. A person who fails to comply with the notification duty is guilty of an offense. The notification duty came into force on .
When LexLint raises it
When your app profile says your app handles health records.