Health Information Privacy and Management Act, contact individual, public statement of information practices and notice for knowledgeable consent
S.Y. 2013, c. 16, ss. 20-21, 41
archived copy
Read from a public archive copy, not the publisher directly. The publisher does not serve this page to automated readers, so a direct fetch was not an option here; how we access sources. Archived . Publisher's page: https://laws.yukon.ca/cms/images/LEGISLATION/PRINCIPAL/2013/2013-0016/2013-0016.pdfIn force since .
A sensitive categories rule binding public and private bodies.
- Obligation class
- Disclosure, Governance
- Audit expectation
- none
What it requires
- Designate at least one contact individual who receives and processes complaints about your information practices, answers access and correction requests, makes sure your agents know their duties, responds to individuals you have notified of a security breach and to the commissioner, and performs any prescribed functions (s. 20(1)-(2)).
- If you are an individual and designate no contact individual, you are your own contact individual and must perform those functions (s. 20(3)).
- Make available to the public a written statement that gives a general description of your information practices, says how to contact your contact individual, describes how to obtain access to or ask for an annotation correcting a record of personal health information, describes how to complain to you and to the commissioner, and meets any prescribed requirements (s. 21).
- To rely on the assumption that consent is knowledgeable, post, in a place likely to come to the individual's attention, or make readily available a notice that meets the prescribed requirements, describes the purpose of the collection, use or disclosure, says the individual may give or withhold consent and may withdraw it, and confirms that without consent the information may be collected, used or disclosed only as the Act and the regulations allow (s. 41(1)(a)-(c)).
- Do not rely on that assumption for an individual you have reasonable grounds to believe has a limited or impaired ability to understand the notice's language or its contents, and make reasonable efforts to help that individual understand the purpose of the collection, use and disclosure (s. 41(2)-(3)).
These lines are LexLint's reading of the law's text.
What it makes you log
Logging duty
Sections 20, 21 and 41 require a custodian to designate a contact individual, to publish a written statement of its information practices and to post or make available a notice for knowledgeable consent. They are duties to designate, publish and post, and none requires the custodian to make, keep or produce a log or record. The record of disclosures without consent and the record of user activity are in section 22, which this row does not cite.
- Kind
- None
- As of
What this law does
A custodian must designate at least one contact individual, who receives and processes complaints from the public about the custodian's information practices, responds to requests for access to or correction of a record of personal health information, ensures that the custodian's agents are informed of their duties, and responds about security breaches to the individuals the custodian has notified and to the commissioner.
A custodian must make available to the public a written statement that gives a general description of the custodian's information practices, says how to contact the contact individual, describes how an individual may obtain access to a record of their personal health information or request an annotation correcting it, and describes how to make a complaint to the custodian and to the commissioner.
A custodian may assume that an individual's consent is knowledgeable if it has posted, in a place where it is likely to come to the individual's attention, or made readily available, a notice that meets the prescribed requirements, describes the purpose of the collection, use or disclosure, says that the individual may give or withhold consent for health care and may withdraw it, and confirms that without consent the information can be collected, used or disclosed only as the Act and the regulations allow.
A custodian cannot rely on that assumption for an individual it has reasonable grounds to believe has a limited or impaired ability to understand the language of the notice or to read or understand its information, and must make reasonable efforts to help that individual understand the purpose.
When LexLint raises it
When your app profile says your app handles health records.
Back to the example · Lint your app
Page updated .