Law / Canada / Saskatchewan
Health Information Protection Act, review by the Information and Privacy Commissioner and offences
S.S. 1999, c. H-0.021, ss. 41-52, 64
In force since .
An enforcement supervision rule binding public and private bodies.
- Enforcement body
- Information and Privacy Commissioner of Saskatchewan
- Obligation class
- Governance
- Audit expectation
- on_request
- Who audits it
- Regulator
As of .
What it requires
- Within 30 days after receiving the commissioner’s report, decide whether to follow the commissioner’s recommendations and give written notice of the decision to the commissioner and the applicant (s. 49).
- Produce personal health information in your custody or control to the commissioner in a review, despite any other Act or any privilege available at law (s. 46(1)).
- Do not obtain another person’s personal health information by falsely representing that you are entitled to it, and do not wilfully destroy a record governed by the Act with the intent to evade a request for access (s. 64(1)(e), (f)).
These lines are LexLint's reading of the law's text, as of .
If you get it wrong
Criminal exposureYes
Criminal exposure note
Section 64(1) makes it an offence to knowingly contravene any provision of the Act or the regulations, and section 64(1.1) bars a trustee or information management service provider from failing to keep secure the personal health information in its custody or control. Section 64(2) sets the penalty on summary conviction.
Penalty structure
Section 64(2) caps the fine at $50,000 for an individual, who may also be imprisoned for up to one year, and at $500,000 for a corporation.
- Rule
- Fixed only
- As of
- Currency
- CAD
- Fixed cap
- 500,000
What this law does
A person may apply to the commissioner for a review of a trustee’s decision on an access request, of a refused amendment, or of a believed contravention of the Act. The commissioner may, in a review, require to be produced and examine any personal health information in the custody or control of a trustee, despite any other Act or any privilege available at law.
On completing a review the commissioner prepares a written report with recommendations and reasons and sends a copy to the trustee and the applicant. Within 30 days after receiving the report, the trustee must decide whether to follow the recommendations and give written notice of the decision to the commissioner and the applicant. An applicant may appeal the trustee’s decision to the Court of King’s Bench within 30 days after receiving it.
The commissioner may, after hearing a trustee, recommend that the trustee cease or modify a specified practice of collecting, using or disclosing information that contravenes the Act and destroy collections of personal health information collected in contravention of the Act. The commissioner may from time to time carry out investigations with respect to personal health information in the custody or control of trustees to ensure compliance with the Act.
Every person who contravenes those offence provisions is liable on summary conviction, if an individual, to a fine of not more than $50,000, to imprisonment for not more than one year or to both, and, if a corporation, to a fine of not more than $500,000. The Act is effective , except for subsections 17(1), 18(2) and 18(4), which are effective .
When LexLint raises it
When your app profile says your app handles health records.