Law / Canada / Newfoundland and Labrador
Personal Health Information Act, information managers and suppliers of electronic means
S.N.L. 2008, c. P-7.01, ss. 2 (1) (l), 14 (4), 22
In force since .
A sensitive categories rule binding public and private bodies.
- Obligation class
- Governance, Security
As of .
What it requires
- If you provide goods or services that enable a custodian to use electronic means to collect, use, modify, disclose, retain or dispose of personal health information, comply with the Act and the regulations (s. 14(4)).
- If you process, retrieve, store or dispose of personal health information for a custodian, or provide it information management or information technology services, enter into a written agreement with the custodian that provides for protection of the information against unauthorized access, use, disclosure, disposition, loss or modification (ss. 2(1)(l), 22(1)-(2)).
- Use or disclose the information only for the purpose the agreement authorizes, and comply with the Act, the regulations and the terms of the agreement (s. 22(3)-(4)).
- Do not let an employee or anyone acting on your behalf access the information unless that person has agreed in writing to comply with the Act and the restrictions imposed on you (s. 22(5)).
These lines are LexLint's reading of the law's text, as of .
If you get it wrong
Criminal exposureYes
Criminal exposure note
Section 88(2) makes it an offence for a custodian or information manager to collect, use or disclose personal health information contrary to the Act, or to fail to protect it in a secure manner as the Act requires, and section 88(3) is a defence where all reasonable steps were taken to prevent the contravention.
Penalty structure
Section 88(2) sets a fine of not more than $10,000 or imprisonment for a term not exceeding 6 months, or both, on summary conviction.
- Rule
- Fixed only
- As of
- Currency
- CAD
- Fixed cap
- 10,000
What this law does
A person who provides goods or services for the purpose of enabling a custodian to use electronic means to collect, use, modify, disclose, retain or dispose of personal health information must comply with the Act and the regulations.
An information manager is a person or body, other than an employee of a custodian acting in the course of employment, that processes, retrieves, stores or disposes of personal health information for a custodian or provides information management or information technology services to a custodian.
A custodian that retains the services of an information manager must enter into a written agreement that provides for the protection of the personal health information against unauthorized access, use, disclosure, disposition, loss or modification. An information manager may use or disclose the information only for the purpose the agreement authorizes. An information manager must comply with the Act, the regulations and the terms of its agreement with the custodian.
An information manager may not permit an employee or a person acting on its behalf to access the information unless that person agrees in writing to comply with the Act and the restrictions imposed on the information manager. The custodian remains responsible under the Act for information disclosed to an information manager, which is considered to continue in the custody and control of the custodian.
When LexLint raises it
When your app profile says your app handles health records or distributes a software product.