Law / Canada / New Brunswick
Personal Health Information Privacy and Access Act, consent, collection, use and disclosure by custodians
S.N.B. 2009, c. P-7.05, ss. 17-19, 27-29, 32, 35
In force since .
A sensitive categories rule binding public and private bodies.
- Obligation class
- Consent, Disclosure
As of .
What it requires
- These duties bind a custodian, which is an individual or organization that collects, maintains or uses personal health information to provide or assist in providing health care or treatment, to plan and manage the health care system or to deliver a government program or service; an employer, an insurance company or a regulatory body of health care providers that handles the information for other purposes is outside the Act (ss. 1, 3 (2) (c)).
- Collect personal health information about an individual only with the individual's consent where the collection is necessary for a lawful purpose, or where the Act permits or requires it, and collect no more than is reasonably necessary to meet the purpose, nothing where other information would serve the same purpose (ss. 27 (1), 29).
- Obtain consent that is knowledgeable, can be withdrawn or withheld, relates to the information and is not obtained through deception or coercion; you may assume implied consent to collect or use the information, or to disclose it to another custodian or person, for the purpose of providing health care to the individual unless that is not reasonable in the circumstances (ss. 17 (1), 18 (1)).
- Obtain the individual's express consent before disclosing personal health information to the media, for fundraising, to a visitor to a health care facility, to a person outside New Brunswick or for research, unless the Act provides otherwise (s. 19 (1)).
- Use and disclose personal health information only as the Act authorizes, and limit each use and each disclosure to the minimum amount of information necessary for its purpose (ss. 32, 35).
These lines are LexLint's reading of the law's text, as of .
What this law does
A custodian is an individual or organization that collects, maintains or uses personal health information to provide or assist in providing health care or treatment, to plan and manage the health care system or to deliver a government program or service. The Act does not apply to an individual or organization that handles personal health information for other purposes, including employers, insurance companies and regulatory bodies of health care providers.
A custodian may collect personal health information about an individual if it has the individual's consent and the collection is necessary for a lawful purpose, or if the Act permits or requires the collection. Unless required to do so by law, a custodian shall not collect personal health information if other information will serve the same purpose, or more of it than is reasonably necessary to meet the purpose of the collection.
Consent must be the consent of the individual or of a substitute decision-maker, must be knowledgeable, must be able to be withdrawn or withheld, must relate to the personal health information, must not be obtained through deception or coercion, and may be express or implied.
Unless it is not reasonable in the circumstances to make the assumption, a custodian is entitled to assume that it has the individual's implied consent to collect or use the personal health information or to disclose it to another custodian or person for the purpose of providing health care to the individual.
Unless the Act provides otherwise, express consent is required for a custodian to disclose personal health information to the media, for fundraising, to a visitor to a health care facility, to a person outside New Brunswick or for research. A custodian shall not use personal health information except as the Act authorizes, and every use is limited to the minimum amount of information necessary to accomplish its purpose.
A custodian shall not disclose personal health information except as the Act authorizes, and every disclosure is limited to the minimum amount of information necessary to accomplish its purpose. The Act was proclaimed and came into force on .
When LexLint raises it
When your app profile says your app handles health records.