Health Information Privacy and Management Act, notice of a security breach and report to the commissioner
archived copy
Read from a public archive copy, not the publisher directly. The publisher does not serve this page to automated readers, so a direct fetch was not an option here; how we access sources. Archived . Publisher's page: https://laws.yukon.ca/cms/images/LEGISLATION/PRINCIPAL/2013/2013-0016/2013-0016.pdfIn force.
A breach notification rule binding public and private bodies.
- Obligation class
- Breach notice, Reporting
As of .
What it requires
- Notify the individual as soon as reasonably possible after a security breach of their personal health information in your custody or control, where there are reasonable grounds to believe the individual is at risk of significant harm (s. 30(1)).
- In the notice, describe the circumstances of the breach and the information involved, say when it occurred, describe the measures you have taken to reduce the risk of harm and identify your contact individual (s. 30(2)(a)).
- Give the commissioner a copy of the notice at the same time (s. 30(2)(b)).
- Weigh the time between the breach and its discovery, the likelihood of disclosure, unauthorized use or copying, the likelihood of identity theft or fraud, the number of people affected and the measures taken when deciding whether an individual is at risk of significant harm (s. 30(3)).
- Within a reasonable time after discovering the breach, send the commissioner a written report that assesses the risk of harm, estimates the number of individuals affected and describes the measures taken to reduce that risk (s. 31(1)).
These lines are LexLint's reading of the law's text, as of .
What this law does
If a security breach occurs in relation to an individual's personal health information in a custodian's custody or control, and there are reasonable grounds to believe that the individual is at risk of significant harm as a result of the security breach, the custodian must, as soon as reasonably possible after the security breach, notify the individual of the security breach.
The notice must describe the circumstances of the security breach and the personal health information involved, indicate when the security breach occurred, describe the measures the custodian has taken to reduce the risk of harm and identify the custodian's contact individual. The custodian must at the same time give the commissioner a copy of the notice.
A custodian that must notify an individual must, within a reasonable time after discovering the security breach, submit to the commissioner a written report that assesses the risk of harm to individuals and estimates the number of individuals affected, and describes the measures taken to reduce that risk. Harm includes identity theft, identity fraud, damage to reputation and personal humiliation or embarrassment.
A security breach includes theft or loss of personal health information, and any event that it is reasonable to believe is a security breach is deemed to be one.
When LexLint raises it
When your app profile says your app handles health records.