Personal Health Information Act, security safeguards and the Personal Health Information Regulation
C.C.S.M. c. P33.5, ss. 18-19; M.R. 245/97, ss. 2-8
In force since .
A sensitive categories rule binding public and private bodies.
- Enforcement body
- Ombudsman of Manitoba
- Obligation class
- Security, Governance
As of .
What it requires
- If you are a trustee, protect personal health information with reasonable administrative, technical and physical safeguards that ensure its confidentiality, security, accuracy and integrity, and weigh how sensitive the information is in deciding what is reasonable (ss. 18(1), 19).
- Limit use of the information to the persons you have specifically authorized, verify the identity of a person seeking to use it and that the use is authorized, and, if you request or respond to disclosure requests electronically, put procedures in place to prevent interception by unauthorized persons (s. 18(2)).
- Establish and follow a written policy and procedures on security during collection, use, disclosure, storage and destruction, on recording security breaches, and on corrective procedures (M.R. 245/97, s. 2).
- Keep the information in designated areas under appropriate safeguards, limit physical access to authorized persons, and store removable media securely when not in use (M.R. 245/97, s. 3).
- For each electronic information system that holds the information, create and keep a record of user activity for at least three years and audit it to detect security breaches (M.R. 245/97, s. 4).
- Decide what personal health information each employee and agent may access, train them on your security policy, have each sign a pledge of confidentiality, and audit your security safeguards at least every two years, correcting deficiencies as soon as practicable (M.R. 245/97, ss. 5-8).
These lines are LexLint's reading of the law's text, as of .
If you get it wrong
Criminal exposureYes
Criminal exposure note
Section 63(3)(b) makes it an offense for a trustee, information manager or health research organization to fail to protect personal health information in a secure manner as required by the Act, and section 64(1) sets the fine.
Penalty structure
Section 64(1) sets the fine for an offense under section 63 at not more than $50,000.
- Rule
- Fixed only
- As of
- Currency
- CAD
- Fixed cap
- 50,000
What this law does
A trustee must protect personal health information by adopting reasonable administrative, technical and physical safeguards that ensure its confidentiality, security, accuracy and integrity. In determining whether its safeguards are reasonable, a trustee must take into account the degree of sensitivity of the personal health information to be protected.
A trustee must establish and comply with a written policy and procedures that provide for the security of personal health information during its collection, use, disclosure, storage and destruction, for recording security breaches and for corrective procedures. For any electronic information system it uses to maintain personal health information, a trustee must create and maintain a record of user activity in accordance with the Minister's guidelines.
A trustee must keep a record of user activity for at least three years. A trustee must audit records of user activity to detect security breaches. A trustee must conduct an audit of its security safeguards at least every two years. If an audit identifies deficiencies in its security safeguards, the trustee must take steps to correct them as soon as practicable. A trustee must provide orientation and ongoing training to its employees and agents about its security policy and procedures. A trustee must ensure that each employee and agent signs a pledge of confidentiality.
When LexLint raises it
When your app profile says your app handles health records.