Law / Canada / Newfoundland and Labrador
Personal Health Information Act, notice of a theft, loss, unauthorized use or disclosure, and material breach
S.N.L. 2008, c. P-7.01, ss. 15 (3)-(7), 20 (3)-(4); N.L.R. 38/11, s. 5
In force since .
A breach notification rule binding public and private bodies.
- Obligation class
- Breach notice, Reporting
As of .
What it requires
- Notify the individual at the first reasonable opportunity if personal health information in your custody or control is stolen, lost, disposed of other than as the Act or the regulations permit, or disclosed to or accessed by an unauthorized person (s. 15(3)).
- You need not notify the individual if you reasonably believe that the theft, loss, unauthorized disposition, or improper disclosure or access will not have an adverse impact on the provision of health care or other benefits to the individual or on the individual's mental, physical, economic or social well-being; the commissioner may still recommend that you notify (s. 15(5), (7)).
- Inform the commissioner if you reasonably believe there has been a material breach involving the unauthorized collection, use or disclosure of personal health information, weighing the sensitivity of the information, the number of people involved, whether you believe the information has been or will be misused, and whether the cause or the pattern of breaches indicates a systemic problem (s. 15(4); N.L.R. 38/11, s. 5).
- If you use or disclose personal health information without consent in a manner inconsistent with your information policies and procedures, inform the individual at the first reasonable opportunity unless you would be required or permitted to refuse access to the record, note the use or disclosure and keep the note with the record (s. 20(3)).
- If you are a researcher who received the information from another custodian under section 44, do not notify the individual unless the custodian who provided the information has first obtained the individual's consent to contact by the researcher and told you so (s. 15(6)).
These lines are LexLint's reading of the law's text, as of .
What this law does
Except as the Act otherwise provides, a custodian must notify the individual who is the subject of personal health information at the first reasonable opportunity where the information is stolen, lost, disposed of except as the Act or the regulations permit, or disclosed to or accessed by an unauthorized person.
Where a custodian reasonably believes that there has been a material breach, as defined in the regulations, involving the unauthorized collection, use or disclosure of personal health information, it must inform the commissioner of the breach.
The regulations list as relevant factors the sensitivity of the information, the number of people whose information was involved, whether the custodian reasonably believes the information has been or will be misused, and whether the cause of the breach or the pattern of breaches indicates a systemic problem.
The duty to notify the individual does not apply where the custodian reasonably believes that the theft, loss, unauthorized disposition, or improper disclosure or access will not have an adverse impact upon the provision of health care or other benefits to the individual or upon the individual's mental, physical, economic or social well-being.
The commissioner may recommend that the custodian notify the individual at the first reasonable opportunity even where notification is not required under that exception.
Where a custodian uses or discloses personal health information without the individual's consent in a manner inconsistent with its information policies and procedures, it must inform the individual of the use or disclosure at the first reasonable opportunity, unless it would be required or permitted to refuse access to the record under section 58, make a note of the use or disclosure and retain the note as part of the record.
When LexLint raises it
When your app profile says your app handles health records.