Law / Canada / Saskatchewan
Health Information Protection Act, trustee duties: consent, safeguards, retention and limits
S.S. 1999, c. H-0.021, ss. 5-7, 16-17, 23-27
In force since .
A sensitive categories rule binding public and private bodies.
- Enforcement body
- Information and Privacy Commissioner of Saskatchewan
- Obligation class
- Consent, Security, Retention
- Audit expectation
- on_request
- Who audits it
- Regulator
As of .
What it requires
- Use or disclose personal health information about an individual only with the subject individual’s consent or in accordance with a provision of the Act that authorizes the use or disclosure (s. 5(2)).
- Obtain consent that relates to the purpose for which the information is required, is informed, is given voluntarily and is not obtained through misrepresentation, fraud or coercion; consent may be express or implied unless the Act provides otherwise (s. 6(1), (4)).
- Take all reasonable steps to comply promptly with a revocation of consent; a revocation has no retroactive effect (s. 7(2), (3)).
- Collect, use or disclose only the personal health information that is reasonably necessary for the purpose, use or disclose de-identified information where practicable if it will serve the purpose, and collect information directly from the subject individual unless the Act lists an exception (ss. 23(1), 23(4), 25(1)).
- Establish policies and procedures that restrict employees’ access to personal health information they do not need to carry out the purpose of collection or an authorized purpose (s. 23(2)).
- Establish policies and procedures that maintain administrative, technical and physical safeguards protecting the integrity, accuracy and confidentiality of the information and guarding against reasonably anticipated threats, loss and unauthorized access, use, disclosure or modification (s. 16).
- Provide employees with orientation and ongoing training on your policies and procedures for protecting personal health information, and ensure that each employee signs a pledge of confidentiality (Regulations, s. 5).
- Have a written retention and destruction policy that meets the regulations, comply with it, keep the information retrievable, readable and useable for the full retention period, and destroy it in a manner that protects the privacy of the subject individual (s. 17; Regulations, s. 6).
These lines are LexLint's reading of the law's text, as of .
If you get it wrong
Criminal exposureYes
Criminal exposure note
Section 64(1) makes it an offence to knowingly contravene any provision of the Act or the regulations, and section 64(1.1) bars a trustee or information management service provider from failing to keep secure the personal health information in its custody or control. Section 64(2) sets the penalty on summary conviction.
Penalty structure
Section 64(2) caps the fine at $50,000 for an individual, who may also be imprisoned for up to one year, and at $500,000 for a corporation.
- Rule
- Fixed only
- As of
- Currency
- CAD
- Fixed cap
- 500,000
What this law does
A trustee is, among others, a government institution, or the provincial health authority or a health care organization, that has custody or control of personal health information. A trustee also includes a proprietor as defined in The Pharmacy and Pharmacy Disciplines Act. A trustee also includes a person, other than an employee of a trustee, who is a health professional licensed or registered under an Act for which the minister is responsible.
The regulations prescribe as trustees the health quality council, every person who owns or operates a privately-owned facility in or from which health services are provided by a health professional, and hearing aid dealers.
For the purposes of the definition of personal health information, information with respect to the physical or mental health of the individual includes genetic information, meaning genetic test results, the genetic test results of family members and the individual’s family medical history.
The Act does not apply to statistical information or de-identified personal health information that cannot reasonably be expected, either by itself or when combined with other information available to the person who receives it, to enable the subject individuals to be identified. A trustee may use or disclose personal health information about an individual only with the consent of the subject individual or in accordance with a provision of the Act that authorizes the use or disclosure.
Consent must relate to the purpose for which the information is required, must be informed, must be given voluntarily and must not be obtained through misrepresentation, fraud or coercion. Consent may be express or implied unless otherwise provided, and an express consent need not be in writing. An individual may revoke consent at any time, but no revocation has retroactive effect.
A trustee that has custody or control of personal health information must establish policies and procedures that maintain administrative, technical and physical safeguards protecting the integrity, accuracy and confidentiality of the information and guarding against reasonably anticipated threats, loss and unauthorized access, use, disclosure or modification.
A trustee must provide its employees with orientation and ongoing training about its policies and procedures for protecting personal health information and must ensure that each employee signs a pledge of confidentiality. A trustee must have a written policy concerning the retention and destruction of personal health information that meets the requirements set out in the regulations.
A written retention and destruction policy must include either a requirement that personal health information be retained for at least 10 years after the date of the last episode of care, or until age 20 if the subject individual is a minor, whichever period is longer, or a retention schedule that sets out the legitimate purposes for retaining the information and the retention period and destruction schedule for each purpose.
A trustee must collect, use or disclose only the personal health information that is reasonably necessary for the purpose for which it is being collected, used or disclosed. A trustee must, where practicable, use or disclose only de-identified personal health information if it will serve the purpose. A trustee must collect personal health information directly from the subject individual, except in the circumstances the Act lists.
The Act is effective , except for subsections 17(1), 18(2) and 18(4), which are effective .
When LexLint raises it
When your app profile says your app handles health records.