Personal Health Information Protection Act, 2004, access to and correction of records of personal health information
S.O. 2004, c. 3, Sched. A, ss. 52-55
In force since .
A data subject rights rule binding public and private bodies.
- Obligation class
- Data subject rights
- Audit expectation
- none
As of .
What it requires
- These duties bind a health information custodian. A person acting for a custodian handles requests through it.
- On a written request from an individual that contains enough detail to locate the record, make the individual's record of personal health information available for examination and, on request, give a copy with an explanation of any term, code or abbreviation used, unless an exception in section 52 applies.
- Respond as soon as possible and no later than 30 days after receiving the request. You may extend by not more than 30 days if meeting the limit would unreasonably interfere with your operations or the consultations needed make it impractical, and you must give the individual written notice of the extension and the reason.
- If you refuse a request in whole or in part, give written notice. Unless the refusal rests on legal proceedings, an inspection or investigation, or a risk of harm, the notice must give the reason and state that the individual may complain to the Commissioner.
- On a written request to correct a record you have granted access to, reply by written notice no later than 30 days after receiving it, and grant the correction if the individual shows the record is incomplete or inaccurate for the purposes you use it for and supplies the information needed to correct it.
- When you correct a record, record the correct information without obliterating the original, notify the individual, and on request give written notice of the correction to the persons you disclosed the information to, unless the correction cannot reasonably be expected to affect the individual's care or benefits.
What this law does
An individual has a right of access to a record of personal health information about the individual that is in the custody or under the control of a health information custodian, subject to the exceptions the Act lists. An individual exercises the right by making a written request to the custodian that has custody or control of the information, and the request must contain sufficient detail to enable the custodian to identify and locate the record with reasonable efforts.
The custodian must respond as soon as possible in the circumstances but no later than 30 days after receiving the request, and may extend that period by not more than 30 days in the cases the Act describes. A custodian that refuses a request in whole or in part must give the individual a written notice.
If an individual who has been granted access believes that the record is inaccurate or incomplete for the purposes for which the custodian collects, uses or has used the information, the individual may request in writing that the custodian correct the record. The custodian must grant, refuse or extend the time to reply to a correction request no later than 30 days after receiving it.
The custodian must grant the correction if the individual demonstrates, to the custodian's satisfaction, that the record is incomplete or inaccurate for the purposes for which the custodian uses the information and gives the custodian the information necessary to correct the record.
A custodian is not required to correct a record that it did not originally create if it lacks sufficient knowledge, expertise and authority to correct it, or a professional opinion or observation that it made in good faith about the individual.
When LexLint raises it
When your app profile says your app handles health records.