Law / Canada / New Brunswick
Personal Health Information Privacy and Access Act, disclosure outside New Brunswick and storage outside Canada
S.N.B. 2009, c. P-7.05, ss. 19 (1) (d), 55 (2); N.B. Reg. 2010-112, s. 22
In force since .
A cross border transfer rule binding public and private bodies.
- Obligation class
- Transfer, Consent
As of .
What it requires
- These duties bind a custodian, and the storage and access rule binds a public body that is a custodian.
- Obtain the individual's express consent before disclosing personal health information to a person outside New Brunswick, unless the Act provides otherwise (s. 19 (1) (d)).
- If you are a public body, store personal health information in your custody or under your control only in Canada and access it only in Canada, unless the regulations provide otherwise or the individual has identified the information and consented as prescribed, the information is stored in another jurisdiction for a disclosure the Act allows, or it was disclosed for a payment to or by the Province or a public body (s. 55 (2)).
- An information manager providing a public body with information management or information technology services may store the information outside Canada (Reg. s. 22).
These lines are LexLint's reading of the law's text, as of .
What this law does
Unless the Act provides otherwise, express consent is required for a custodian to disclose personal health information to a person outside New Brunswick. Unless the regulations provide otherwise, a public body shall ensure that personal health information in its custody or under its control is stored only in Canada and accessed only in Canada.
The exceptions are that the individual has identified the information and consented as the regulations prescribe, that the information is stored in another jurisdiction for a disclosure the Act allows, or that the information was disclosed for a payment to or by the Province or a public body. Information managers providing a public body with information management or information technology services may store personal health information in their custody or control outside Canada. The Act was proclaimed and came into force on .
When LexLint raises it
When your app profile says your app handles health records.