Health Information Privacy and Management Act, agents and information managers, with the written agreement the Health Information General Regulation prescribes
archived copy
Read from a public archive copy, not the publisher directly. The publisher does not serve this page to automated readers, so a direct fetch was not an option here; how we access sources. Archived . Publisher's page: https://laws.yukon.ca/cms/images/LEGISLATION/PRINCIPAL/2013/2013-0016/2013-0016.pdfIn force since .
A sensitive categories rule binding public and private bodies.
- Obligation class
- Governance, Security
- Audit expectation
- none
What it requires
- Take reasonable measures to ensure your agents comply with the Act and the regulations (s. 49).
- Permit an agent to collect, use, disclose, retain, destroy or dispose of personal health information on your behalf only where you are permitted or required to, the handling is within the agent's duties and your limits, the agent uses only the information it needs for the purpose, and any prescribed requirements are met (s. 50(1)).
- If you propose to retain an information manager, enter into a written agreement with it that provides for the protection of the information that is the subject of the services and comply with the prescribed requirements (s. 51(1)).
- Make that agreement let you maintain control of the personal health information, and require the information manager to give you access at any time, forward access and correction requests, maintain safeguards that meet or exceed yours, refrain from subcontracting without your written consent, allow you to monitor compliance and terminate for breach, and on termination transfer the information to you and securely destroy what remains (O.I.C. 2016/159, s. 21).
- If you are an agent, notify the custodian at the first reasonable opportunity of a security breach in relation to personal health information you handled (s. 50(3)); if you are an information manager under a written agreement, perform the agreement's duties and notify the custodian at the first reasonable opportunity of any breach of it (s. 51(2)).
These lines are LexLint's reading of the law's text.
What it makes you log
Logging duty
Sections 49 to 51 and section 21 of the Health Information General Regulation require a custodian to supervise its agents and to bind an information manager by a written agreement, and require an agent or information manager to notify the custodian of a breach. None of them requires a custodian, agent or information manager to make, keep or produce a log or record of access or use.
- Kind
- None
- As of
What this law does
A custodian must take reasonable measures to ensure that its agents comply with the Act and the regulations.
A custodian may permit its agent to collect, use, disclose, retain, destroy or dispose of personal health information on the custodian's behalf only if the custodian is permitted or required to do so, the handling is in the course of the agent's duties and within the limits set by the custodian, the Act and any other enactment, the custodian allows the agent to use only the information the agent needs for the purpose, and any prescribed requirements are met.
An agent must notify the custodian at the first reasonable opportunity of a security breach in relation to personal health information the agent handled. A custodian that proposes to retain an information manager must enter into a written agreement with it that provides for the protection of the information that is the subject of the services, and an information manager must notify the custodian at the first reasonable opportunity of any breach of that agreement.
Under the Health Information General Regulation the agreement must allow the custodian to keep control of the information and must require the information manager to maintain safeguards that meet or exceed those the Act requires of the custodian, to forward access and correction requests, to refrain from subcontracting without the custodian's written consent, to allow the custodian to monitor compliance, and, on termination, to transfer the information to the custodian and securely destroy the records that remain in its custody.
When LexLint raises it
When your app profile says your app handles health records.
Back to the example · Lint your app
Page updated .