Health Information Privacy and Management Act, custodian duties on collection, use, disclosure, consent and information practices
S.Y. 2013, c. 16, ss. 13, 15-16, 19, 33-34
archived copy
Read from a public archive copy, not the publisher directly. The publisher does not serve this page to automated readers, so a direct fetch was not an option here; how we access sources. Archived . Publisher's page: https://laws.yukon.ca/cms/images/LEGISLATION/PRINCIPAL/2013/2013-0016/2013-0016.pdfIn force.
A sensitive categories rule binding public and private bodies.
- Obligation class
- Consent, Security, Disclosure
As of .
What it requires
- Collect, use, disclose or access personal health information only as the Act and the regulations allow, and not at all where other information will serve the purpose (ss. 13, 15).
- Limit each collection, use and disclosure of personal health information to the minimum amount reasonably necessary for its purpose (s. 16).
- Protect personal health information with administrative policies and technical and physical safeguards that ensure its confidentiality, security and integrity, including controls that limit use to authorized individuals whose identity is verified, secure storage, disposal and destruction of records, and all reasonable steps to prevent a security breach (s. 19(1), (3)).
- Rely on implied consent unless the Act requires express consent, and obtain and record express consent for fund-raising and in the prescribed circumstances (ss. 33, 34, 35(1)).
- Check whether you are a custodian: the Department of Health and Social Services, the operator of a hospital or health facility, a health care provider such as a medical practitioner, nurse or pharmacist, or a prescribed person (s. 2).
These lines are LexLint's reading of the law's text, as of .
What this law does
A custodian or the agent of a custodian may collect, use, disclose and access personal health information only in accordance with the Act and the regulations. A custodian or its agent must not collect, use or disclose personal health information if other information will serve the purpose of the collection, use or disclosure.
The collection, use and disclosure of personal health information must be limited to the minimum amount that is reasonably necessary to achieve the purpose for which it is collected, used or disclosed. A custodian must protect personal health information by applying information practices that include administrative policies and technical and physical safeguards that ensure the confidentiality, security and integrity of the personal health information in its custody or control.
Unless the Act requires express consent to the collection, use or disclosure of personal health information, implied consent is sufficient. Express consent is required for the collection, use or disclosure of personal health information for fund-raising activities and in prescribed circumstances or for prescribed purposes. A custodian is, among others, the Department of Health and Social Services, the operator of a hospital or health facility and a health care provider.
A health care provider includes a medical practitioner, a registered nurse or nurse practitioner, a licensed practical nurse and a pharmacist.
When LexLint raises it
When your app profile says your app handles health records.