Law / Canada / Prince Edward Island
Health Information Act, custodian duties
R.S.P.E.I. 1988, c. H-1.41, ss. 13, 17, 22, 39, 41-43
In force since .
A sensitive categories rule binding public and private bodies.
- Obligation class
- Consent, Disclosure, Security, Governance
As of .
What it requires
- The Act binds a custodian: a person or organization that handles personal health information to provide or assist in providing health care or treatment, to plan and manage the health care system, or to deliver a government health care program or service. It does not apply to an employer, an insurance company or another person that holds such information for other purposes (ss. 1(e), 4(1)(c)).
- As a custodian, collect personal health information only with the individual's consent where the collection is necessary for a lawful purpose, or where the Act otherwise permits or requires it (s. 17(1)).
- Collect personal health information directly from the individual unless one of the exceptions in section 18 applies (s. 18).
- Obtain the individual's express consent, and do not rely on implied consent, before disclosing personal health information to a person who is not a custodian (s. 13(6)(a)).
- Limit every use of personal health information to the minimum amount necessary for the purpose, and to the employees and agents who need to know it for that purpose (s. 22(2), (3)).
- Protect personal health information with reasonable administrative, technical and physical safeguards, based on nationally or provincially recognized information technology and security standards appropriate to its sensitivity (s. 39(1), (2)).
- Enter into a written agreement with an agent that handles personal health information for you, and with any information manager you provide it to for processing, storing, destroying or information technology services (ss. 41, 42(2)).
- If you are an information manager under such an agreement, comply with its duties and with the same protection, retention and secure destruction requirements that bind the custodian (s. 43).
These lines are LexLint's reading of the law's text, as of .
If you get it wrong
Penalty structure
Section 79(1) sets the fine at not more than $50,000 for a corporation and not more than $15,000, or imprisonment for not more than six months, or both, for an individual.
- Rule
- Fixed only
- As of
- Currency
- CAD
- Fixed cap
- 50,000
What this law does
The Act applies to personal health information that is collected, used or disclosed by a custodian or that is in the custody or control of a custodian. A custodian is a person or organization that collects, maintains, uses or discloses personal health information for the purpose of providing or assisting in the provision of health care or treatment, or of planning and managing the health care system, or of delivering a government program or service related to health care.
The Act does not apply to a person or organization that collects, maintains or uses personal health information for purposes other than health care or treatment and the planning and management of the health care system, such as an employer or an insurance company. A custodian may collect personal health information with the individual's consent where the collection is necessary for a lawful purpose, or where the collection is otherwise permitted or required by the Act.
Consent to the disclosure of personal health information must be express, and may not be implied, when a custodian proposes to disclose it to a person that is not a custodian. Every use by a custodian of personal health information is limited to the minimum amount of personal health information necessary to accomplish the purpose for which it is used.
A custodian must protect personal health information by adopting information practices that include reasonable administrative, technical and physical safeguards that ensure the confidentiality, security, accuracy and integrity of the information. A custodian that retains the services of an agent for the collection, use, disclosure, retention or secure destruction of personal health information must enter into a written agreement with the agent.
An information manager that enters into a written agreement with a custodian must comply with the duties imposed on it under the agreement and with the same requirements concerning the protection, retention and secure destruction of personal health information that the custodian must comply with. The Act was brought into force on .
When LexLint raises it
When your app profile says your app handles health records.