Personal Health Information Act, trustee duties on collection, use, disclosure, retention and sale
C.C.S.M. c. P33.5, ss. 13-15, 17, 20-22 and 27
In force since .
A sensitive categories rule binding public and private bodies.
- Enforcement body
- Ombudsman of Manitoba
- Obligation class
- Consent, Disclosure, Retention
As of .
What it requires
- If you are a health professional, health care facility, public body or health services agency that collects or maintains personal health information, collect it only for a lawful purpose connected with one of your functions or activities and only where the collection is necessary for that purpose (s. 13(1)).
- Collect no more personal health information than is reasonably necessary for the purpose, and collect it directly from the individual whenever possible (ss. 13(2), 14(1)).
- When you collect the information directly from the individual, take reasonable steps to tell the individual why it is being collected before it is collected or as soon as practicable afterwards, and, if you are not a health professional, how to reach someone who can answer questions about the collection (s. 15(1)).
- Use the information only for the purpose for which it was collected or received, unless an exception in section 21(1) applies, such as a directly related purpose or the individual's consent (s. 21(1)).
- Limit every use and disclosure to the minimum amount of information necessary, and limit use to the employees and agents who need to know it (s. 20(2)-(3)).
- Disclose the information only to the individual or their representative, with the individual's consent, or in a circumstance listed in section 22(2) (s. 22(1)-(2)).
- Keep a written policy on retention and destruction, comply with it, and destroy the information in a manner that protects the individual's privacy (s. 17(1), (3)).
- Do not sell, or otherwise dispose of or disclose for consideration, personal health information except as section 27(1) allows (s. 27).
These lines are LexLint's reading of the law's text, as of .
If you get it wrong
Criminal exposureYes
Criminal exposure note
Section 63(3) makes it an offense for a trustee, information manager or health research organization to collect, use, sell or disclose personal health information contrary to the Act, and section 64(1) sets the fine.
Penalty structure
Section 64(1) sets the fine for an offense under section 63 at not more than $50,000, and section 64(2) sets the same cap for a director or officer of a corporation who authorized, permitted or acquiesced in the offense.
- Rule
- Fixed only
- As of
- Currency
- CAD
- Fixed cap
- 50,000
What this law does
The Personal Health Information Act binds a trustee, which is a health professional, health care facility, public body or health services agency that collects or maintains personal health information. A trustee may collect personal health information about an individual only for a lawful purpose connected with a function or activity of the trustee, and only if the collection is necessary for that purpose.
A trustee must collect only as much personal health information about an individual as is reasonably necessary to accomplish the purpose for which it is collected. Whenever possible, a trustee must collect personal health information directly from the individual the information is about. A trustee that collects the information directly from the individual must take reasonable steps to inform the individual of the purpose for which it is being collected.
A trustee must establish a written policy on the retention and destruction of personal health information and must comply with it. A trustee may use personal health information only for the purpose for which it was collected or received, unless an exception in the Act applies. Every use and disclosure by a trustee must be limited to the minimum amount of information necessary to accomplish the purpose for which it is used or disclosed.
A trustee may disclose personal health information only to the individual or the individual's representative or with the individual's consent, except where the Act permits disclosure without consent. No trustee may sell or otherwise dispose of or disclose for consideration personal health information unless the sale is essential to facilitate the sale of a practice or business as a going concern and is to another trustee.
The restriction to a sale to another trustee does not apply to a change in ownership of a pharmacy in compliance with The Pharmaceutical Act. The Act does not apply to statistical health information, or to health information that does not allow an individual to be readily identified. The Act came into force by proclamation on .
When LexLint raises it
When your app profile says your app handles health records.