Law / Canada / New Brunswick
Personal Health Information Privacy and Access Act, Ombud complaints, investigations and offences
S.N.B. 2009, c. P-7.05, ss. 65.1-65.2, 68, 71, 76
In force since .
An enforcement supervision rule binding public and private bodies.
- Enforcement body
- Ombud of New Brunswick
- Obligation class
- Reporting, Governance
As of .
What it requires
- These powers and offences run against a custodian and an information manager, and in part against any person.
- Produce to the Ombud within 14 days after a request any record or copy of a record the Ombud requires for an investigation, and allow the Ombud to enter any office of a custodian and examine and copy any record (ss. 65.1, 71 (3)).
- Do not collect, use, sell or disclose personal health information contrary to the Act, and protect it in a secure manner as the Act requires; a custodian or information manager is not found to have contravened those duties if it establishes that it took all reasonable steps to prevent the contravention (s. 76 (3)-(4)).
These lines are LexLint's reading of the law's text, as of .
If you get it wrong
Criminal exposureYes
Criminal exposure note
An offence under section 76 is punishable under Part II of the Provincial Offences Procedure Act as a category F offence; a defendant with a previous conviction for the same offence may be sentenced to imprisonment of not more than ninety days (section 63 (2)).
Penalty structure
An offence under section 76 of the Act is a category F offence, and section 56 (6) of the Provincial Offences Procedure Act sets a fine of not less than $240 and not more than $10,200. Section 57 of that Act raises the maximum to $15,000 for a defendant who was sentenced to the maximum fine on a previous conviction of the same offence, and section 58 lets a judge impose a larger fine, without a stated cap, where the offence was committed for financial advantage or to avoid the financial burden of compliance.
- Rule
- Fixed only
- As of
- Currency
- CAD
- Fixed cap
- 10,200
What this law does
An individual who made a request to examine or correct personal health information may complain to the Ombud if not satisfied with a decision, act or omission of the custodian, and an individual may complain that a custodian collected, used or disclosed his or her personal health information contrary to the Act or failed to protect it in a secure manner as the Act requires.
A complaint to the Ombud shall be in writing and filed within 60 days after the date the individual was notified of the decision of the custodian or the date of the act or omission. The Ombud may extend that period, and where a custodian fails to respond in time to a request to examine or copy a record, the complaint shall be filed within 120 days following the request.
In performing duties under the Act the Ombud has the right to enter any office of a custodian and examine and make copies of any record in the custodian's custody. A custodian shall produce to the Ombud within 14 days after a request a record or a copy of a record the Ombud requires for an investigation. The Ombud may monitor how the Act is administered, conduct investigations to monitor compliance and review privacy impact assessments conducted by a custodian that is a public body.
A custodian or information manager commits an offence if it collects, uses, sells or discloses personal health information contrary to the Act or fails to protect personal health information in a secure manner as the Act requires. A custodian or information manager is not found to have contravened those duties if it can establish that it took all reasonable steps to prevent the contravention.
An offence under the Act is punishable under Part II of the Provincial Offences Procedure Act as a category F offence. A category F offence carries a fine of not less than $240 and not more than $10,200. The maximum fine is $15,000 for a defendant who was sentenced to the maximum fine on a previous conviction of the same offence. A judge may impose a larger fine where the defendant committed the offence for financial advantage or to avoid the financial burden of compliance with the law.
A judge may sentence a defendant convicted of a category F offence who has a previous conviction for the same offence to imprisonment for not more than ninety days if satisfied that no other sentence will deter the defendant from repeating the offence. No prosecution for an offence under the Act shall be commenced after 2 years from the date of the discovery of the alleged offence. The Act was proclaimed and came into force on .
When LexLint raises it
When your app profile says your app handles health records.