Law / Canada / Saskatchewan
Health Information Protection Act, information management service providers
In force since .
A sensitive categories rule binding public and private bodies.
- Enforcement body
- Information and Privacy Commissioner of Saskatchewan
- Obligation class
- Security, Governance
- Audit expectation
- on_request
- Who audits it
- Regulator
As of .
What it requires
- If you are a trustee, enter into a written agreement with an information management service provider before giving it personal health information; the agreement must govern access to and use, disclosure, storage, archiving, modification and destruction of the information, provide for its protection and meet the regulations (s. 18(2); Regulations, s. 7).
- If you are an information management service provider, do not use, disclose, obtain access to, process, store, archive, modify or destroy personal health information received from a trustee except to process, store, archive or destroy it for the trustee, to provide the trustee with information management or information technology services, to take custody and control of it when the trustee ceases to be a trustee, or to combine records (s. 18(1), (3)).
- If you are an information management service provider, comply with the terms of the agreement with the trustee and notify the trustee at the first reasonable opportunity of any breach of the agreement (s. 18(4); Regulations, s. 7(f)).
- Keep secure the personal health information in your custody or control as the Act requires; you do not contravene the requirement if you can establish that you took all reasonable steps to prevent the contravention (s. 64(1.1), (1.2)).
These lines are LexLint's reading of the law's text, as of .
If you get it wrong
Criminal exposureYes
Criminal exposure note
Section 64(1) makes it an offence to knowingly contravene any provision of the Act or the regulations, and section 64(1.1) bars a trustee or information management service provider from failing to keep secure the personal health information in its custody or control. Section 64(2) sets the penalty on summary conviction.
Penalty structure
Section 64(2) caps the fine at $50,000 for an individual, who may also be imprisoned for up to one year, and at $500,000 for a corporation.
- Rule
- Fixed only
- As of
- Currency
- CAD
- Fixed cap
- 500,000
What this law does
An information management service provider is a person or body that processes, stores, archives or destroys records of a trustee containing personal health information, or that provides information management or information technology services to a trustee with respect to those records.
A trustee may provide personal health information to an information management service provider to have it process, store, archive or destroy the information for the trustee or to provide the trustee with information management or information technology services, among other purposes.
Before providing personal health information to an information management service provider, a trustee must enter into a written agreement that governs access to and use, disclosure, storage, archiving, modification and destruction of the information, provides for its protection and meets the requirements of the regulations.
The written agreement must describe the specific service the provider will deliver, set out the provider’s obligations respecting the security and safeguarding of the information, and provide for destruction of the information if applicable. The agreement must also require the provider to notify the trustee at the first reasonable opportunity of any breach of the agreement.
An information management service provider shall not use, disclose, obtain access to, process, store, archive, modify or destroy personal health information received from a trustee except for the purposes the Act lists. An information management service provider must comply with the terms of the agreement.
No trustee or information management service provider, or former trustee or information management service provider, may fail to keep secure the personal health information in its custody or control as the Act requires. No person is found to have contravened that requirement if the person can establish that he or she took all reasonable steps to prevent the contravention. Subsections 18(2) and 18(4) are effective , and the rest of the Act is effective .
When LexLint raises it
When your app profile says your app handles health records or distributes a software product.