TongaPersonal Health Information Protection Act 2025, access to and correction of personal health information
Act 31 of 2025, ss. 57-60 (Personal Health Information Protection Act 2025, access and correction)
A data subject rights rule binding public and private bodies.
- Obligation class
- Data subject rights, Disclosure
- Audit expectation
- none
What it requires
- These duties bind a health information custodian, which includes a health care practitioner, a person who operates a hospital or a pharmacy, an employer, and an insurer or insurance agent, that has custody or control of personal health information, and they bind the Crown (ss. 3(1), 7(4)).
- Give a person who asks in writing access to the record of personal health information about them that you hold, subject to the exceptions in section 57(1), in an electronic format that meets the Regulations where they ask for one (ss. 57-58).
- Respond to a request for access no later than 30 days after receiving it, or within the time the person specifies if they show an urgent need and you can reasonably meet it, and extend the limit only by up to 30 days, on written notice (s. 59(3)-(6)).
- If you refuse access in whole or in part, give the person a written notice with the reason and say that they may complain to the Chief Executive Officer responsible for health (s. 59(1)(c)).
- On a written request, correct a record of personal health information that the person shows you is incomplete or inaccurate, and reply by written notice no later than 30 days after receiving the request (s. 60(1), (2), (7)).
- If you refuse a correction, give reasons and tell the person they may attach a statement of disagreement to their records and complain to the Chief Executive Officer (s. 60(10)).
These lines are LexLint's reading of the law's text.
Who enforces it
Settledness
- As of
- Open questions
- Has the Personal Health Information Protection Act 2025 come into force, given that it has no commencement section and the Attorney General's legislation listing records as the date it commenced?
What it makes you log
Logging duty
Sections 57 to 60 give a person a right of access to, and correction of, a record of personal health information, with the custodian's response deadlines and refusal notices. They require no record of requests or responses and name no audit. The audit log is in section 10, which a sibling row cites.
- Kind
- None
- As of
What this law does
Section 57(1) gives a person a right of access to a record of personal health information about them that is in the custody or under the control of a health information custodian, subject to the exceptions the section lists, including legal privilege, a prohibition in another Act or a court order, and a risk of serious harm. Section 57(2) extends the right of access to access in an electronic format that meets the requirements the Regulations prescribe.
Section 58(1) lets a person exercise the right by making a written request to the custodian that has custody or control of the information. Section 59(3) requires the custodian to respond to a request for access as soon as possible and no later than 30 days after receiving it.
Section 59(4) lets the custodian extend that limit by up to a further 30 days, on written notice to the person, where meeting it would unreasonably interfere with its operations or the consultations needed would make a timely reply not reasonably practical. If the custodian refuses a request for access in whole or in part, section 59(1)(c) requires a written notice giving the reason and stating that the person may complain to the Chief Executive Officer under Part 8.
Section 60(1) lets a person to whom access has been granted request in writing that the custodian correct a record they believe is inaccurate or incomplete. Section 60(2) requires the custodian to grant or refuse a correction request, or extend the deadline by up to 30 days in the cases it lists, by written notice no later than 30 days after receiving it.
Section 60(7) requires the custodian to grant a correction request if the person demonstrates, to its satisfaction, that the record is incomplete or inaccurate for the purposes for which the custodian uses the information and gives it the information needed to correct the record.
If a custodian refuses a correction, section 60(10) requires it to give reasons and to tell the person that they may prepare a statement of disagreement, require the custodian to attach and disclose it, and complain to the Chief Executive Officer.
When LexLint raises it
When your app profile says your app handles health records or processes personal data.
Back to the example · Lint your app
Page updated .