Personal Health Information Protection Act, 2004, health cards and health numbers
S.O. 2004, c. 3, Sched. A, s. 34
In force since .
A sensitive categories rule binding public and private bodies.
- Obligation class
- Prohibition, Consent
- Audit expectation
- none
As of .
What it requires
- These duties bind any person that is not a health information custodian or its agent, so they reach a business or app that asks people for a health card or health number.
- Do not collect or use another person's health number except for provision of provincially funded health resources to that person, for the purposes for which a custodian disclosed the number to you, or for another purpose the Act lists, such as, if you are a prescribed person acting with the individual's express consent, identifying the individual's records, verifying identity or linking records.
- Do not disclose a health number except as required by law or as the regulations allow.
- Do not require anyone to produce their health card, unless you provide a provincially funded health resource to a person who has one.
What this law does
A person who is neither a health information custodian nor acting as an agent of a custodian must not collect or use another person's health number except for the purposes the Act lists.
The listed purposes include purposes related to the provision of provincially funded health resources to that other person, the purposes for which a custodian has disclosed the number to the person, and, for a prescribed person acting with the express consent of the other person, accurately identifying that person's records of personal health information, verifying their identity or linking their records.
That person must not disclose a health number except as required by law, subject to any prescribed exceptions. No person may require the production of another person's health card, but a person who provides a provincially funded health resource to a person who has a health card may require its production. The Act applies to the collection, use or disclosure of a health number by any person.
When LexLint raises it
When your app profile says your app handles health records.