Law / Canada / New Brunswick
Personal Health Information Privacy and Access Act, notice of theft, loss or unauthorized disclosure
S.N.B. 2009, c. P-7.05, s. 49 (1) (c), (2); N.B. Reg. 2010-112, s. 19
In force since .
A breach notification rule binding public and private bodies.
- Obligation class
- Breach notice, Reporting
As of .
What it requires
- These duties bind a custodian.
- Notify the individual to whom the information relates and the Ombud at the first reasonable opportunity if personal health information is stolen, lost, disposed of except as the Act permits, or disclosed to or accessed by an unauthorized person (s. 49 (1) (c)).
- You need not notify if you reasonably believe that the theft, loss, disposition, disclosure or access will not have an adverse impact on the provision of health care or other benefits to the individual, will not have an adverse impact on the individual's mental, physical, economic or social well-being, or will not lead to the identification of the individual (s. 49 (2)).
- Give the individual notice in person, by telephone or in writing (Reg. s. 19 (1)).
- State in the notice your name, the name and contact information of the person you designated to respond to inquiries about your information practices, the nature of the breach, its date and location, and the date it came to your attention (Reg. s. 19 (2)).
These lines are LexLint's reading of the law's text, as of .
What this law does
A custodian shall notify the individual to whom the information relates and the Ombud at the first reasonable opportunity if personal health information is stolen, lost, disposed of except as the Act permits, or disclosed to or accessed by an unauthorized person.
The duty does not apply if the custodian reasonably believes that the theft, loss, disposition, disclosure or access will not have an adverse impact on the provision of health care or other benefits to the individual, will not have an adverse impact on the individual's mental, physical, economic or social well-being, or will not lead to the identification of the individual.
The regulation requires the custodian to give notice to the person to whom the information relates in person, by telephone or in writing. The notice shall state the name of the custodian and the name and contact information of the person the custodian designated to respond to inquiries about its information practices. The notice shall also describe the nature of the breach of privacy, state its date and location and state the date it came to the custodian's attention. The regulation came into force on .
When LexLint raises it
When your app profile says your app handles health records.