Law / Canada / Northwest Territories
Health Information Act, record of disclosures without express consent
archived copy
Read from a public archive copy, not the publisher directly. The publisher does not serve this page to automated readers, so a direct fetch was not an option here; how we access sources. Archived . Publisher's page: https://www.justice.gov.nt.ca/en/files/legislation/health-information/health-information.a.pdfIn force since .
A sensitive categories rule binding public and private bodies.
- Obligation class
- Governance, Disclosure
- Audit expectation
- none
As of .
What it requires
- These duties bind a health information custodian.
- If you disclose personal health information about an individual without the individual's express consent, make a record of the name of the person or organization to which you disclose it, the date and purpose of the disclosure and a description of the information disclosed (s. 84 (1)).
- You need not make the record for a disclosure under section 43, 44 or 48, or where you disclose by permitting collection from an electronic record in an electronic health information system that automatically keeps an electronic log of the user identification of the person who collects the information, the date and time of collection and the information collected or that could have been collected (s. 84 (2)-(3)).
These lines are LexLint's reading of the law's text, as of .
What it makes you log
What the log must hold
Actor identity, Event time, Access record
Logging duty
Section 84 (1) requires a custodian that discloses personal health information without the individual's express consent to make a record of the recipient's name, the date and the purpose of the disclosure and a description of the information. Section 84 (2) excepts disclosures under sections 43, 44 and 48, and section 84 (3) excepts a disclosure made by permitting collection from an electronic health information system that automatically logs the user identification, the date and time of collection and the information collected or that could have been collected. The recipient's name and the user identification are coded as the actor, the dates and times as the event time, and the description as the access record; the purpose has no value in the list. The section names no period for keeping the record and does not give the individual or any authority a right to see it, so retention and access are empty. The section has no territorial clause, so the hook is empty.
- Kind
- Explicit
- As of
- Provision
- S.N.W.T. 2014, c. 2, s. 84 (1) (a record of each disclosure without express consent) and s. 84 (3) (an automatic electronic log of collection in place of the record)
- Trigger
- personal_data_processing
What this law does
A health information custodian that discloses personal health information about an individual without his or her express consent must make a record of the name of the person or organization to which the information is disclosed, the date and purpose of the disclosure and a description of the information disclosed. The duty does not apply to a disclosure under section 43, 44 or 48.
It also does not apply where the custodian discloses by permitting collection of information from an electronic record stored in an electronic health information system, if the system automatically keeps an electronic log of the user identification of the person who collects the information, the date and time of collection and the information that is collected or that could have been collected.
When LexLint raises it
When your app profile says your app handles health records.