Health Information Privacy and Management Act, records of disclosures without consent and of user activity
archived copy
Read from a public archive copy, not the publisher directly. The publisher does not serve this page to automated readers, so a direct fetch was not an option here; how we access sources. Archived . Publisher's page: https://laws.yukon.ca/cms/images/LEGISLATION/PRINCIPAL/2013/2013-0016/2013-0016.pdfIn force since .
A sensitive categories rule binding public and private bodies.
- Obligation class
- Governance, Disclosure
- Audit expectation
- none
As of .
What it requires
- These duties bind a custodian.
- If you disclose any of an individual's personal health information to a person without the individual's consent, record the name of the person, the date and purpose of the disclosure and a brief description of the personal health information (s. 22 (1)).
- You need not make that record for the disclosure of a record that contains only registration information or provider registry information (s. 22 (2)).
- For any electronic information system you use to maintain personal health information, create and maintain a record of user activity that holds, for each incident of access by a person through the system, the person's user identification, the date and time of the incident, a description of the information accessed or that could have been accessed and any prescribed information, and meet any prescribed requirements for it (s. 22 (3)-(4)).
These lines are LexLint's reading of the law's text, as of .
What it makes you log
What the log must hold
Actor identity, Event time, Access record
Logging duty
Section 22 (1) requires a custodian that discloses personal health information without the individual's consent to record the name of the person, the date and purpose of the disclosure and a brief description of the information, except for a record that holds only registration or provider registry information (s. 22 (2)). Section 22 (3) requires a custodian to create and maintain, for any electronic information system it uses to maintain personal health information, a record of user activity holding the user identification, the date and time and a description of the information accessed or that could have been accessed for each incident of access, with any prescribed information, and section 22 (4) makes that record meet any prescribed requirements. The recipient's name and the user identification are coded as the actor, the dates and times as the event time, and the descriptions as the access record; the purpose has no value in the list. The section names no period for keeping either record. Section 24 (3) (a), which a sibling row cites, gives the individual the right to obtain a copy of the record of user activity as part of the right of access, and this row does not borrow it, so access is empty here. The section has no territorial clause, so the hook is empty.
- Kind
- Explicit
- As of
- Provision
- S.Y. 2013, c. 16, s. 22 (1) (a record of each disclosure without consent) and s. 22 (3) (a record of user activity for each electronic information system)
- Trigger
- personal_data_processing
What this law does
If a custodian discloses any of an individual's personal health information to a person without the individual's consent, the custodian must record the name of the person, the date and purpose of the disclosure and a brief description of the personal health information. That duty does not apply to the disclosure of a record that contains only registration information or provider registry information.
A custodian must also create and maintain, or cause to be created and maintained, for any electronic information system it uses to maintain personal health information, a record of user activity that includes, for each incident of access by a person through the system, the person's user identification, the date and time of the incident, a description of the information that is accessed or that could have been accessed and any prescribed information. A record of user activity must meet the prescribed requirements, if any.
When LexLint raises it
When your app profile says your app handles health records.