TongaPersonal Health Information Protection Act 2025, complaints, directions, penalties and offences
Act 31 of 2025, ss. 76-81, 87 and 89 (Personal Health Information Protection Act 2025, enforcement)
An enforcement supervision rule binding public and private bodies.
- Obligation class
- Governance, Reporting
- Audit expectation
- on_request
- Who audits it
- Regulator
What it requires
- These duties bind a health information custodian, which includes a health care practitioner, a person who operates a hospital or a pharmacy, an employer, and an insurer or insurance agent, that has custody or control of personal health information, and they bind the Crown (ss. 3(1), 7(4)).
- Comply with a direction the Chief Executive Officer responsible for health gives after reviewing a complaint, and produce the records and documents the Chief Executive Officer or an authorised officer demands in a review (ss. 78(2), 79(1)).
- Do not obstruct the Chief Executive Officer or an authorised officer, or give them false or misleading information (s. 78(3)).
- Do not dismiss or otherwise disadvantage a person for reporting a contravention of the Act to the Chief Executive Officer (s. 87).
These lines are LexLint's reading of the law's text.
If you get it wrong
Criminal exposureYes
Criminal exposure note
Wilfully accessing, collecting, using or disclosing personal health information in contravention of the Act, or wilfully failing to comply with a direction of the Chief Executive Officer, is an offence punishable for a natural person by a fine of up to TOP 200,000 or imprisonment of up to 7 years, or both, and for any other person by a fine of up to TOP 1,000,000 (s. 89).
Penalty structure
Section 89(2) sets a fine on conviction of up to $200,000 or imprisonment of up to 7 years, or both, for a natural person, and a fine of up to $1,000,000 for a person that is not a natural person. The highest fixed ceiling the Act states is the $1,000,000 fine. Section 80(2)(b) leaves the amount of an administrative penalty to the Regulations, so this row codes only the fines the Act itself states. The Act states these figures in dollars, understood here as Tongan pa'anga.
- Rule
- Fixed only
- As of
- Currency
- TOP
- Fixed cap
- 1,000,000
Who enforces it
Enforcement body
Chief Executive Officer responsible for health
Settledness
- As of
- Open questions
- Has the Personal Health Information Protection Act 2025 come into force, given that it has no commencement section and the Attorney General's legislation listing records as the date it commenced?
What it makes you log
Who may demand the log
Regulator
Logging duty
Part 8 provides for complaints, reviews, inspections, directions, administrative penalties and appeals, and section 89 for offences. None requires a custodian to make, keep or produce a log or record in the ordinary course. The Chief Executive Officer's power is a power to demand records and to inquire into information practices in a review (section 78(2)). The audit log duty is in section 10, which a sibling row cites.
- Kind
- None
- As of
What this law does
Section 76(1) lets a person who has reasonable grounds to believe that another person has contravened or is about to contravene the Act or its Regulations make a complaint to the Chief Executive Officer responsible for health. Section 76(2) requires the complaint to be in writing and filed within one year after the subject-matter first came, or should reasonably have come, to the complainant's attention, or a longer period the Chief Executive Officer permits.
In a review, section 78(2) lets the Chief Executive Officer or an authorised officer demand production of relevant records and documents and inquire into a custodian's information practices. Section 79(1) lets the Chief Executive Officer, after a review, direct a person to perform a duty the Act imposes, to cease accessing, collecting, using or disclosing personal health information in contravention of the Act, or to change, cease or implement an information practice.
Section 79(1)(i) lets the Chief Executive Officer require a person who has contravened the Act or its Regulations to pay an administrative penalty, and section 80(2) provides that the amount is determined as prescribed in the Regulations. Section 81 lets a person affected by most of the Chief Executive Officer's directions appeal to the Minister within 21 days after receiving a copy, and then to the Supreme Court.
Section 87 bars anyone from dismissing, suspending, demoting, disciplining, harassing or otherwise disadvantaging a person for disclosing to the Chief Executive Officer that another person has contravened or is about to contravene the Act. Section 89(1) makes it an offence to wilfully access, collect, use or disclose personal health information in contravention of the Act, or wilfully to fail to comply with a direction of the Chief Executive Officer.
On conviction under section 89, a natural person is liable to a fine not exceeding $200,000 or imprisonment of not more than 7 years, or both, and a person who is not a natural person to a fine not exceeding $1,000,000.
When LexLint raises it
When your app profile says your app handles health records or processes personal data.
Back to the example · Lint your app
Page updated .