Law / Canada / Nova Scotia
Personal Health Information Act, custodian duties
S.N.S. 2010, c. 41, ss. 11, 25, 61-68
archived copy
Read from a public archive copy, not the publisher directly. The publisher does not serve this page to automated readers, so a direct fetch was not an option here; how we access sources. Archived . Publisher's page: https://nslegislature.ca/sites/default/files/legc/statutes/personal%20health%20information.pdfIn force since .
A sensitive categories rule binding public and private bodies.
- Obligation class
- Consent, Security, Disclosure, Governance
As of .
What it requires
- As a custodian (a regulated health professional or group practice, the Minister, a health authority, a pharmacy, a licensed or approved continuing-care facility, Canadian Blood Services or a prescribed custodian), do not collect, use or disclose personal health information about an individual unless you have the individual's consent under the Act and the collection, use or disclosure is reasonably necessary for a lawful purpose, or the Act permits or requires it (ss. 3(f), 11).
- Limit the collection, use and disclosure of personal health information to the minimum amount necessary to achieve the purpose, and limit use to the agents who need to know the information (s. 25).
- Protect the confidentiality of personal health information in your custody or under your control and the privacy of the individual it concerns (s. 61).
- Implement, maintain and comply with information practices that meet the Act, are reasonable in the circumstances and protect the information against theft, loss and unauthorized access, use, disclosure, copying or modification, and implement, maintain and comply with a complaints policy (s. 62).
- Create and maintain, or have created and maintained, a record of user activity for any electronic information system you use to maintain personal health information, and give an individual the record of user activity for their information, without charge, within thirty days after the request (s. 63).
- Designate a contact person and make available to the public a written statement that describes your information practices, how to reach the contact person, how to obtain access to or request correction of a record, and how to complain to you and to the Review Officer (ss. 67, 68).
- Do not permit an agent to collect, use, disclose, retain, destroy or dispose of personal health information on your behalf except as the Act permits and within the limits you set (s. 28(1)).
These lines are LexLint's reading of the law's text, as of .
What this law does
A custodian must not collect, use or disclose personal health information about an individual unless the custodian has the individual's consent under the Act and the collection, use or disclosure is reasonably necessary for a lawful purpose, or the Act permits or requires it. The collection, use and disclosure of personal health information must be limited to the minimum amount necessary to achieve the purpose for which it is collected, used and disclosed.
A custodian must implement, maintain and comply with information practices that are reasonable in the circumstances and that protect the information against theft or loss and against unauthorized access, use, disclosure, copying or modification. A custodian must create and maintain a record of user activity for any electronic information system it uses to maintain personal health information. A custodian must designate one or more individuals as a contact person.
A custodian must make available to the public a written statement that provides a general description of its information practices. The Act does not apply to an employer, an insurance company or another individual or organization that collects, uses or discloses personal health information for purposes other than health care and the planning and management of the health system.
When LexLint raises it
When your app profile says your app handles health records.