Personal Health Information Protection Act, 2004, consumer electronic service providers
S.O. 2004, c. 3, Sched. A, s. 54.1
A sensitive categories rule binding public and private bodies.
- Obligation class
- Consent, Governance
- Audit expectation
- none
As of .
What it requires
- These duties bind a person who provides electronic services to individuals, at their request, primarily so that they can access, use, disclose, modify, maintain or otherwise manage their own records of personal health information, such as an app through which a person views or manages their health records.
- Comply with the requirements the regulations prescribe for consumer electronic service providers when you provide the service to an individual.
- Collect and use a health number only if the individual who requested your services authorized it, only to verify the individual's identity or for another prescribed purpose, and in accordance with the prescribed rules.
What this law does
A consumer electronic service provider is a person who provides electronic services to individuals at their request, primarily for the purpose of allowing those individuals to access, use, disclose, modify, maintain or otherwise manage their records of personal health information, or for other prescribed purposes. In providing electronic services to an individual, a consumer electronic service provider must comply with the prescribed requirements.
If authorized by the individual who requested its services, the provider may collect and use health numbers in accordance with any prescribed rules in order to verify the identity of the individual or for any other prescribed purpose. A health information custodian that provides personal health information to a consumer electronic service provider must comply with any prescribed requirements or procedures.
A custodian that receives an individual's request for access from a consumer electronic service provider is not required to provide the personal health information to the provider in responding to the request.
When LexLint raises it
When your app profile says your app handles health records, ships a mobile app or distributes a software product.