Law / Canada / Newfoundland and Labrador
Personal Health Information Act, custodian duties on information practices, consent, collection, use and disclosure
S.N.L. 2008, c. P-7.01, ss. 13-15 (1)-(2), 20 (1)-(2), 24-25, 29-30, 35-36
In force since .
A sensitive categories rule binding public and private bodies.
- Obligation class
- Consent, Disclosure, Security, Governance
As of .
What it requires
- Establish and implement information policies and procedures on how you collect, store, transfer, copy, modify, use and dispose of personal health information, inside or outside the province, including policies that limit each employee's, agent's or contractor's access to the information needed for the purpose and that protect information stored, used or disclosed outside the province (s. 13).
- Have your employees, agents, contractors and volunteers take an oath or affirmation of confidentiality, and make them aware of the Act and of your information policies and procedures (s. 14(1), (3)).
- Take steps that are reasonable in the circumstances to protect personal health information against theft, loss and unauthorized access, use or disclosure, and against unauthorized copying or modification, and retain, transfer and dispose of records in a secure manner (s. 15(1)-(2)).
- When you collect personal health information directly from the individual, take reasonable steps to tell the individual why you collect, use and disclose it and who your contact person is; a notice posted or made readily available where it is likely to come to the individual's attention is enough (s. 20(1)-(2)).
- Do not collect personal health information unless the individual consents and the collection is necessary for a lawful purpose, or the Act permits or requires it, and do not collect it if other information will serve the purpose (s. 29(1), (3)).
- Collect personal health information directly from the individual, except in the cases section 31 lists (s. 30).
- Obtain express consent, not implied consent, where the Act requires consent to a disclosure to a person that is not a custodian (s. 25(1)(a)).
- Limit use of personal health information to the employees and agents who need to know it for the purpose for which it was collected or a purpose the Act authorizes (s. 35).
- Do not disclose personal health information unless the individual consents and the disclosure is necessary for a lawful purpose, or the Act permits or requires it, and do not disclose it if other information will serve the purpose (s. 36).
These lines are LexLint's reading of the law's text, as of .
If you get it wrong
Criminal exposureYes
Criminal exposure note
Section 88(2) makes it an offence for a custodian or information manager to collect, use or disclose personal health information contrary to the Act, or to fail to protect it in a secure manner as the Act requires, and section 88(3) is a defence where all reasonable steps were taken to prevent the contravention.
Penalty structure
Section 88(2) sets a fine of not more than $10,000 or imprisonment for a term not exceeding 6 months, or both, on summary conviction.
- Rule
- Fixed only
- As of
- Currency
- CAD
- Fixed cap
- 10,000
Who enforces it
Enforcement body
Information and Privacy Commissioner appointed under the Access to Information and Protection of Privacy Act, 2015
What this law does
A custodian must establish and implement information policies and procedures on the collection, storage, transfer, copying, modification, use and disposition of personal health information, whether within or outside the province. A custodian must ensure that its employees, agents, contractors and volunteers take an oath or affirmation of confidentiality.
A custodian must take steps that are reasonable in the circumstances to protect personal health information in its custody or control against theft, loss and unauthorized access, use or disclosure. Where a custodian collects personal health information directly from the individual, it must take reasonable steps to inform the individual of the purpose for the collection, use and disclosure of the information.
A custodian may not collect personal health information about an individual unless the individual has consented to its collection and the collection is necessary for a lawful purpose, or the collection is permitted or required by the Act. A consent to the collection, use or disclosure of personal health information may be express or implied.
Where the Act requires consent to the disclosure of personal health information, the consent must be express where a custodian discloses the information to a person that is not a custodian. A custodian must limit the use of personal health information to those of its employees and agents who need to know the information to carry out the purpose for which it was collected or a purpose authorized under the Act.
A custodian may not disclose personal health information unless it has the individual's consent and the disclosure is necessary for a lawful purpose, or the disclosure is permitted or required by the Act. A custodian or information manager is not found to have contravened the collection, use, disclosure and protection offences if it can establish that all reasonable steps were taken to prevent the contravention.
When LexLint raises it
When your app profile says your app handles health records.