Personal Health Information Act, information managers
In force since .
A sensitive categories rule binding public and private bodies.
- Enforcement body
- Ombudsman of Manitoba
- Obligation class
- Governance, Security
As of .
What it requires
- If you provide information management or information technology services to a trustee, or process, store or destroy personal health information for one, use the information only for the purposes and activities the trustee itself may undertake (s. 25(2)).
- Comply with the same protection, retention and destruction requirements the Act places on the trustee, and with the duties in your written agreement with the trustee (s. 25(4)).
- If you are a trustee, enter into a written agreement that provides for protection of the information against unauthorized access, use, disclosure, destruction or alteration before you give an information manager the information (s. 25(3)).
These lines are LexLint's reading of the law's text, as of .
If you get it wrong
Criminal exposureYes
Criminal exposure note
Section 63(3) makes it an offense for a trustee, information manager or health research organization to collect, use, sell or disclose personal health information contrary to the Act or to fail to protect it in a secure manner as the Act requires, and section 64(1) sets the fine.
Penalty structure
Section 64(1) sets the fine for an offense under section 63 at not more than $50,000.
- Rule
- Fixed only
- As of
- Currency
- CAD
- Fixed cap
- 50,000
What this law does
An information manager is a person or body that processes, stores or destroys personal health information for a trustee, or provides information management or information technology services to a trustee. A trustee may provide personal health information to an information manager for the purpose of processing, storing or destroying it or providing the trustee with information management or information technology services.
An information manager may use the information only for those purposes and activities, which must be purposes and activities that the trustee itself may undertake. A trustee must enter into a written agreement with the information manager that provides for the protection of the information against such risks as unauthorized access, use, disclosure, destruction or alteration, in accordance with the regulations.
An information manager must comply with the same requirements concerning the protection, retention and destruction of personal health information that the trustee must comply with under the Act, and with the duties the agreement imposes. Information provided to an information manager under such an agreement is deemed to be maintained by the trustee.
When LexLint raises it
When your app profile says your app handles health records or distributes a software product.