TongaPersonal Health Information Protection Act 2025, consent, security, genetic and sensitive personal health information
Act 31 of 2025, ss. 10, 14(1), 31-32, 40 and 55 (Personal Health Information Protection Act 2025)
A sensitive categories rule binding public and private bodies.
- Obligation class
- Consent, Security, Governance, Disclosure
- Audit expectation
- periodic
- Who audits it
- Self
What it requires
- These duties bind a health information custodian, which includes a health care practitioner, a person who operates a hospital or a pharmacy, an employer, and an insurer or insurance agent, that has custody or control of personal health information, and they bind the Crown (ss. 3(1), 7(4)).
- Collect, use or disclose personal health information only with the person's consent where it is necessary for a lawful purpose, or where the Act permits or requires it, and never where other information will serve or beyond what is reasonably necessary (ss. 31-32).
- Take reasonable steps to protect personal health information against theft, loss and unauthorized access, use or disclosure (s. 14(1)).
- If you use electronic means to handle personal health information, keep an electronic audit log of each time a record is viewed, handled or modified, and audit and monitor it as often as the Regulations prescribe (s. 10).
- Keep genetic test information in a separate record from the rest of the person's personal health information (s. 40).
- Before disclosing sensitive personal health information, such as genetic test information, HIV or AIDS, a sexually transmitted disease, a mental disorder, a pregnancy, sexual assault or abuse, or anything the person has marked sensitive, tell the person, the recipient and the reason, consider the person's views and note the record, and disclose none if other information will serve and no more than is necessary (s. 55).
These lines are LexLint's reading of the law's text.
Who enforces it
Settledness
- As of
- Open questions
- Has the Personal Health Information Protection Act 2025 come into force, given that it has no commencement section and the Attorney General's legislation listing records as the date it commenced?
What it makes you log
What the log must hold
Event time, Actor identity, Access record, Affected person reference
Logging duty
Section 10(2) requires the audit log to show, for every instance in which an electronically accessible record or part of one is viewed, handled, modified or otherwise dealt with, the type of information, the date and time, the identity of every person who dealt with it and the identity of the person it relates to. The custodian must audit and monitor the log as often as the Regulations prescribe, so the cadence is set by regulation and no period for keeping the log is stated.
- Kind
- Explicit
- As of
- Provision
- Section 10 (electronic audit log of personal health information)
- Trigger
- personal_data_processing
What this law does
A health information custodian includes a health care practitioner, a person who operates a hospital or a pharmacy, an employer, and an insurer or insurance agent, that has custody or control of personal health information in connection with its powers, duties or work. The Act binds the Crown, including all ministries, agencies and employees of the Crown.
Section 31 bars a custodian from collecting, using or disclosing personal health information about a person unless it has the person's consent under the Act and the collection, use or disclosure is necessary for a lawful purpose, or the Act permits or requires it. Section 32 bars a custodian from collecting, using or disclosing personal health information if other information will serve the purpose, and from collecting, using or disclosing more than is reasonably necessary to meet it.
Section 14(1) requires a custodian to take steps that are reasonable in the circumstances to protect personal health information in its custody or control against theft, loss and unauthorized access, use or disclosure. Section 10 requires a custodian that uses electronic means to handle personal health information to maintain an electronic audit log of each time a record is viewed, handled or modified, and to audit and monitor the log as often as the Regulations prescribe.
Section 40 requires a custodian to keep genetic test information that relates to a person in a separate record from the rest of the person's personal health information. Section 55 treats as sensitive personal health information what a person has identified to the custodian as sensitive, and information about genetic test information, HIV or AIDS, a sexually transmitted disease, a mental disorder, a pregnancy, or sexual assault or abuse.
Before disclosing sensitive personal health information, section 55(3) requires a custodian to inform the person to whom it relates, the recipient and why the disclosure is necessary, to consider the person's views and to note the record, though the duty to inform and consider views does not apply where the need is urgent, the disclosure is required by law or the person has consented.
Section 55(5) bars a custodian from disclosing sensitive personal health information if other personal health information will serve the same purpose.
When LexLint raises it
When your app profile says your app handles health records or processes personal data.
Back to the example · Lint your app
Page updated .