Personal Health Information Protection Act, 2004, disclosure of personal health information outside Ontario
S.O. 2004, c. 3, Sched. A, s. 50
In force since .
A cross border transfer rule binding public and private bodies.
- Obligation class
- Transfer, Consent
- Audit expectation
- none
As of .
What it requires
- This duty binds a health information custodian that discloses personal health information collected in Ontario to a person outside Ontario.
- Disclose the information outside Ontario only if the individual consents, the Act permits the disclosure, the recipient performs functions comparable to those of a person the Act lets you disclose to in Ontario in the listed cases, the disclosure is reasonably necessary to provide health care to the individual and the individual has not expressly instructed you not to make it, or the disclosure is reasonably necessary to administer payments for health care or for contractual or legal requirements connected with it.
- If the individual's instruction prevents you from disclosing everything you consider reasonably necessary for the individual's care, tell the recipient that the disclosure is limited.
What this law does
A health information custodian may disclose personal health information about an individual collected in Ontario to a person outside Ontario only if one of the grounds in subsection 50 (1) is met. The grounds are the individual's consent, a disclosure that the Act permits, and a recipient that performs functions comparable to those of a person to whom the Act would permit the custodian to disclose the information in Ontario in listed cases.
A further ground covers a disclosure by a prescribed entity for health planning or health administration to the government of another province or territory about care provided in Ontario to a resident of that province or territory.
Two more grounds cover a disclosure reasonably necessary for the provision of health care to the individual, which is not available if the individual has expressly instructed the custodian not to make it, and a disclosure reasonably necessary for the administration of payments in connection with health care or for contractual or legal requirements in that connection.
If an individual's instruction prevents the custodian from disclosing all the information it considers reasonably necessary for the provision of health care, the custodian must notify the recipient of that fact.
When LexLint raises it
When your app profile says your app handles health records.