Law / Canada / New Brunswick
Personal Health Information Privacy and Access Act, information practices, security safeguards and retention
S.N.B. 2009, c. P-7.05, ss. 49 (1) (a)-(b), 50, 55 (1), 56; N.B. Reg. 2010-112, s. 20
In force since .
A sensitive categories rule binding public and private bodies.
- Obligation class
- Security, Governance, DPIA, Retention
As of .
What it requires
- These duties bind a custodian.
- Establish and implement information practices that ensure compliance with the Act, and designate a person to assist in ensuring compliance, to respond to inquiries about your information practices and to receive complaints from the public (s. 49 (1) (a)-(b)).
- Protect personal health information with information practices that include reasonable administrative, technical and physical safeguards for its confidentiality, security, accuracy and integrity, based on recognized information technology security standards and appropriate to the sensitivity of the information (s. 50 (1)-(2)).
- Limit use of personal health information to persons you have specifically authorized, verify the identity of a person seeking to use it and that the use is authorized, and prevent interception when you use electronic means to request or respond to requests for disclosure (s. 50 (3) (a)-(c)).
- Implement any additional safeguards the regulations require for personal health information kept in electronic form (s. 50 (4)).
- Keep a written policy and procedures on information practices, including measures that protect the security of the information during collection, use, disclosure, storage and destruction, and keep a record of all security breaches and the corrective procedures taken (Reg. s. 20).
- Keep and follow a written policy for the retention, archival storage, access and secure destruction of personal health information (s. 55 (1)).
- If you are a public body, or another custodian prescribed by regulation, conduct a privacy impact assessment for a new collection, use or disclosure of personal health information or a material change to one, and for the creation or modification of a personal health information system or communication technology (s. 56 (1)).
These lines are LexLint's reading of the law's text, as of .
What this law does
A custodian shall establish and implement information practices to ensure compliance with the Act and designate a person to assist in ensuring compliance, to respond to inquiries about its information practices and to receive complaints from the public about alleged contraventions.
A custodian shall protect personal health information by adopting information practices that include reasonable administrative, technical and physical safeguards that ensure the confidentiality, security, accuracy and integrity of the information. The information practices shall be based on nationally or jurisdictionally recognized information technology security standards and processes, appropriate for the level of sensitivity of the personal health information to be protected.
A custodian shall implement controls that limit use of personal health information to persons it has specifically authorized, and shall verify the identity of a person seeking to use the information and that the proposed use is authorized. A custodian that uses electronic means to request or respond to requests for disclosure of personal health information shall implement procedures to prevent the interception of the information by unauthorized persons.
A custodian that maintains personal health information in electronic form shall implement any additional safeguards required by the regulations. A custodian shall establish and comply with a written policy and procedures on information practices that include measures to protect the security of personal health information during its collection, use, disclosure, storage and destruction.
A custodian shall keep a record of all security breaches, recording the security breaches and the corrective procedures taken to diminish the likelihood of future breaches. A custodian shall establish and comply with a written policy for the retention, archival storage, access and secure destruction of personal health information.
A custodian that is a public body, or another custodian prescribed by regulation, must conduct a privacy impact assessment for a new collection, use or disclosure of personal health information or a material change to one, and for the creation or modification of a personal health information system or personal health information communication technology. The Act was proclaimed and came into force on .
When LexLint raises it
When your app profile says your app handles health records.