Law / Canada / Northwest Territories
Health Information Act, safeguards, electronic health records and privacy impact assessments
S.N.W.T. 2014, c. 2, ss. 8, 85-86, 88-89
archived copy
Read from a public archive copy, not the publisher directly. The publisher does not serve this page to automated readers, so a direct fetch was not an option here; how we access sources. Archived . Publisher's page: https://www.justice.gov.nt.ca/en/files/legislation/health-information/health-information.a.pdfIn force since .
A sensitive categories rule binding public and private bodies.
- Obligation class
- Security, Governance, DPIA
As of .
What it requires
- Establish or adopt standards, policies and procedures that implement the Act and the regulations, including the safeguard, record-security and accuracy requirements in ss. 85 to 88, give the Department a copy on request, and comply with them (s. 8(1)-(3)).
- Take reasonable measures to maintain administrative, technical and physical safeguards for personal health information, including for information stored or used outside the Northwest Territories or disclosed outside the Territories, and against unauthorized access, use, disclosure, alteration, loss, destruction, theft and other reasonably anticipated threats (s. 85(1)).
- Implement controls that limit use of personal health information to authorized persons (s. 85(2)).
- Take reasonable measures to protect the security and confidentiality of records, including secure maintenance, transfer and disposal, and address the risks of electronic health records with nationally or territorially recognized information technology security standards and processes (s. 86(1)-(2)).
- Take reasonable measures to ensure that personal health information is accurate and complete when you collect it and before you use or disclose it (s. 88).
- If you are a public custodian or a prescribed custodian, prepare a privacy impact assessment for a proposed new information system or communication technology, or a proposed change to one, relating to personal health information, and give the Information and Privacy Commissioner a copy (s. 89(2)-(3)).
These lines are LexLint's reading of the law's text, as of .
What this law does
A custodian shall establish or adopt standards, policies and procedures to implement the Act and the regulations, including the requirements under sections 85 to 88. A custodian shall take reasonable measures to maintain administrative, technical and physical safeguards for the protection of personal health information, including for protection of information that is to be stored or used outside the Northwest Territories or disclosed to a person or organization outside the Territories.
A custodian shall implement controls that limit the persons who may use the information to those authorized to do so. The measures for the security of records must include measures to address the risks of electronic health records that are based on nationally or territorially recognized information technology security standards and processes.
A custodian shall take reasonable measures to ensure that personal health information is accurate and complete in collecting it and before using or disclosing it. A public custodian and a prescribed custodian shall prepare a privacy impact assessment for a proposed new information system or communication technology, or a proposed change to one, that relates to the collection, use or disclosure of personal health information.
When LexLint raises it
When your app profile says your app handles health records.