Law / Canada / New Brunswick
Personal Health Information Privacy and Access Act, agents and information managers
S.N.B. 2009, c. P-7.05, ss. 1, 52; N.B. Reg. 2010-112, s. 21
In force since .
A sensitive categories rule binding public and private bodies.
- Obligation class
- Governance, Security
As of .
What it requires
- These duties bind a custodian that uses an agent or an information manager and an information manager that signs the agreement; an information manager is an individual or organization that processes, stores, retrieves, archives or disposes of personal health information, de-identifies or transforms it, or provides information management or information technology services on behalf of a custodian (ss. 1, 52).
- If you are a custodian, enter into a written agreement with an agent you retain for the collection, use, disclosure or retention of personal health information, requiring the agent to comply with your legal obligations (s. 52 (1)).
- If you are a custodian, enter into a written agreement with an information manager before providing it personal health information, providing for protection against unauthorized access, use or disclosure and for secure destruction or alteration, and describing the services and the safeguards the information manager employs (s. 52 (3); Reg. s. 21).
- If you are an information manager that has entered into such an agreement, comply with the duties it imposes and with the same protection, retention and secure destruction requirements that bind the custodian (s. 52 (4)).
These lines are LexLint's reading of the law's text, as of .
What this law does
An information manager is an individual or organization that on behalf of a custodian processes, stores, retrieves, archives or disposes of personal health information, de-identifies or otherwise transforms it, or provides information management or information technology services.
A custodian that retains the services of an agent for the collection, use, disclosure or retention of personal health information shall enter into a written agreement requiring the agent to comply with the custodian's legal obligations regarding the handling of that information.
A custodian that provides personal health information to an information manager shall enter into a written agreement, in accordance with the regulations, that provides for protection of the information against risks such as unauthorized access to or use or disclosure, secure destruction or alteration.
The agreement shall describe the services to be provided to the custodian and the administrative, technical and physical safeguards the information manager employs for the confidentiality, security, accuracy and integrity of the information. An information manager that enters into the agreement shall comply with the duties the agreement imposes and with the same requirements on protection, retention and secure destruction that the custodian must comply with under the Act. The Act was proclaimed and came into force on .
When LexLint raises it
When your app profile says your app handles health records or distributes a software product.