Law / Canada / Prince Edward Island
Health Information Act, records respecting disclosure without consent
R.S.P.E.I. 1988, c. H-1.41, s. 34
In force since .
A sensitive categories rule binding public and private bodies.
- Obligation class
- Governance, Disclosure, Retention
- Audit expectation
- none
As of .
What it requires
- These duties bind a custodian.
- If you disclose personal health information without the consent of the individual to whom it relates for health related purposes, record the name of the person to whom you disclose it, the date and purpose of the disclosure and a description of the information disclosed, and keep the record for at least 10 years following the disclosure unless the Act or the regulations provide otherwise (s. 34 (1)).
- You need not keep that record if you disclose by permitting access to the information stored in your information system and the system automatically keeps an electronic log of the unique user identification of the individual who accesses the information, the date and time of access and a description of the information that was or could have been accessed (s. 34 (2)).
These lines are LexLint's reading of the law's text, as of .
What it makes you log
What the log must hold
Actor identity, Event time, Access record
Log retention
Section 34 (1) has the custodian retain the record of a disclosure without consent for at least 10 years following the disclosure, unless the Act or the regulations provide otherwise. It states no maximum, and the electronic log of subsection (2) has no stated period.
- Unit
- Years
- As of
- Basis
- Fixed
- Minimum value
- 10
Logging duty
Section 34 (1) requires a custodian that discloses personal health information without consent for health related purposes to record the recipient's name, the date and purpose of the disclosure and a description of the information, and to keep the record for at least 10 years following the disclosure unless the Act or the regulations provide otherwise. Section 34 (2) replaces that record where the custodian discloses by permitting access to its information system and the system automatically logs the unique user identification, the date and time of access and a description of the information that was or could have been accessed. The recipient's name and the user identification are coded as the actor, the dates and times as the event time, and the description as the access record; the purpose has no value in the list. The ten years is a floor stated for the record of section 34 (1) only; the section sets no period for the electronic log. The section gives no one a right to inspect the record, so access is empty, and it has no territorial clause, so the hook is empty.
- Kind
- Explicit
- As of
- Provision
- R.S.P.E.I. 1988, c. H-1.41, s. 34 (1) (a record of each disclosure without consent, kept for at least 10 years) and s. 34 (2) (an automatic electronic log of access in place of the record)
- Trigger
- personal_data_processing
What this law does
A custodian that discloses personal health information without the consent of the individual to whom it relates for health related purposes must record the name of the person to whom it discloses the information, the date and purpose of the disclosure and a description of the information disclosed, and must retain the record for at least 10 years following the disclosure, unless the Act or the regulations provide otherwise.
The duty does not apply if the custodian discloses the information by permitting access to the information stored in its information system and the system automatically keeps an electronic log of the unique user identification of the individual who accesses the information, the date and time it is accessed and a description of the information that was or could have been accessed by that individual. The Act was brought into force on .
When LexLint raises it
When your app profile says your app handles health records.