Personal Health Information Act, Ombudsman oversight, adjudicator orders, offenses and penalties
C.C.S.M. c. P33.5, ss. 28, 39, 48.8 and 63-64
In force since .
An enforcement supervision rule binding public and private bodies.
- Enforcement body
- Ombudsman of Manitoba
- Obligation class
- Governance
As of .
What it requires
- If you are a trustee, comply with an adjudicator's order on a complaint about privacy to cease or modify a practice of collecting, using, disclosing, retaining or destroying personal health information, to destroy information collected in contravention of the Act, or to perform a duty the Act imposes (s. 48.8(3)).
- Do not obtain another person's personal health information by falsely representing that you are entitled to it, and do not knowingly falsify it (s. 63(1)(d), (f)).
- Do not, as an employee, officer or agent of a trustee, information manager or health research organization, wilfully disclose personal health information without the authorization of the trustee, information manager or organization where it could not be disclosed under the Act, or use or access another person's information without that authorization (s. 63(2)).
These lines are LexLint's reading of the law's text, as of .
If you get it wrong
Criminal exposureYes
Criminal exposure note
Section 63 makes it an offense to obtain personal health information by false representation, to falsify it, to disclose or use it without authorization as an employee, officer or agent, and to fail to notify a privacy breach, and section 64 sets the fine.
Penalty structure
Section 64(1) sets the fine for an offense under section 63 at not more than $50,000, and section 64(2) sets the same cap for a director or officer of a corporation who authorized, permitted or acquiesced in the offense.
- Rule
- Fixed only
- As of
- Currency
- CAD
- Fixed cap
- 50,000
What this law does
The Ombudsman may conduct investigations and audits and make recommendations to monitor and ensure compliance with the Act. An individual may make a complaint to the Ombudsman alleging that a trustee has collected, used or disclosed the individual's personal health information contrary to the Act or has failed to protect it in a secure manner as the Act requires.
On a review of a complaint about privacy, the adjudicator may order a trustee to cease or modify a practice of collecting, using, disclosing, retaining or destroying personal health information contrary to the Act, to destroy information collected in contravention of the Act, or to perform a duty the Act imposes.
A person who obtains another person's personal health information by falsely representing an entitlement to it, or who knowingly falsifies another person's personal health information, is guilty of an offense.
An employee, officer or agent of a trustee, information manager or health research organization who, without authorization, wilfully discloses personal health information in circumstances where the trustee would not be permitted to, or uses or gains access to another person's personal health information, is guilty of an offense. A person guilty of an offense under section 63 is liable on summary conviction to a fine of not more than $50,000.
A director or officer of a corporation that is guilty of an offense who authorized, permitted or acquiesced in the offense is also guilty of an offense and liable to a fine of not more than $50,000.
When LexLint raises it
When your app profile says your app handles health records.