TongaPersonal Health Information Protection Act 2025, notification of theft, loss and unauthorized use or disclosure
Act 31 of 2025, ss. 14(2)-(3), 19(5)(b) and 70(6) (Personal Health Information Protection Act 2025)
A breach notification rule binding public and private bodies.
- Obligation class
- Breach notice, Reporting
- Audit expectation
- none
What it requires
- These duties bind a health information custodian, which includes a health care practitioner, a person who operates a hospital or a pharmacy, an employer, and an insurer or insurance agent, that has custody or control of personal health information, and they bind the Crown (ss. 3(1), 7(4)).
- If personal health information about a person is stolen or lost, or is used or disclosed without authority, notify the person at the first reasonable opportunity and say in the notice that they may complain to the Chief Executive Officer responsible for health (s. 14(2)).
- Notify the Chief Executive Officer responsible for health of the theft, loss or unauthorized access, use or disclosure where the circumstances meet the requirements the Regulations prescribe (s. 14(3)).
- If you are an agent of a custodian, notify the custodian at the first reasonable opportunity when personal health information you handled for it is stolen or lost, or is used or disclosed without authority (s. 19(5)(b)).
- If you are responsible for collecting personal health information without authority by means of the National Health Information System, notify the person at the first reasonable opportunity (s. 70(6)).
These lines are LexLint's reading of the law's text.
Who enforces it
Settledness
- As of
- Open questions
- Has the Personal Health Information Protection Act 2025 come into force, given that it has no commencement section and the Attorney General's legislation listing records as the date it commenced?
What it makes you log
Logging duty
Sections 14(2) and (3), 19(5)(b) and 70(6) require notices to the person, to the Chief Executive Officer and to the custodian when personal health information is stolen, lost or handled without authority. None requires the custodian or its agent to keep a record of a breach, and the notices are reports rather than records. The Act states no deadline in hours or days, only the first reasonable opportunity.
- Kind
- None
- As of
What this law does
Section 14(2) requires a custodian whose personal health information about a person is stolen or lost, or is used or disclosed without authority, to notify the person at the first reasonable opportunity and to state in the notice that the person is entitled to complain to the Chief Executive Officer responsible for health.
Section 14(3) requires the custodian to notify the Chief Executive Officer of the theft, loss or unauthorized access, use or disclosure where the circumstances meet the requirements the Regulations prescribe. Section 19(5)(b) requires an agent of a custodian to notify the custodian at the first reasonable opportunity if personal health information the agent handled for it is stolen or lost or is used or disclosed without authority.
Section 70(6) requires a custodian responsible for collecting personal health information about a person without authority by means of the National Health Information System to notify the person at the first reasonable opportunity.
When LexLint raises it
When your app profile says your app handles health records or processes personal data.
Back to the example · Lint your app
Page updated .