New Brunswick

A custodian shall notify the individual to whom the information relates and the Ombud at the first reasonable opportunity if personal health information is stolen, lost, disposed of except as the Act permits, or disclosed to or accessed by an unauthorized person.

The duty does not apply if the custodian reasonably believes that the theft, loss, disposition, disclosure or access will not have an adverse impact on the provision of health care or other benefits to the individual, will not have an adverse impact on the individual's mental, physical, economic or social well-being, or will not lead to the identification of the individual.

The regulation requires the custodian to give notice to the person to whom the information relates in person, by telephone or in writing. The notice shall state the name of the custodian and the name and contact information of the person the custodian designated to respond to inquiries about its information practices. The notice shall also describe the nature of the breach of privacy, state its date and location and state the date it came to the custodian's attention. The regulation came into force on September 1, 2010.

Unless the Act provides otherwise, express consent is required for a custodian to disclose personal health information to a person outside New Brunswick. Unless the regulations provide otherwise, a public body shall ensure that personal health information in its custody or under its control is stored only in Canada and accessed only in Canada.

The exceptions are that the individual has identified the information and consented as the regulations prescribe, that the information is stored in another jurisdiction for a disclosure the Act allows, or that the information was disclosed for a payment to or by the Province or a public body. Information managers providing a public body with information management or information technology services may store personal health information in their custody or control outside Canada. The Act was proclaimed and came into force on September 1, 2010.

An end-user who relies on a credit report shall give notice to the consumer when the contents of the report play a role in the denial of a benefit, product or service, an increase in its cost, or a change of its terms to be less favourable to the consumer. The end-user shall give the notice within 15 days after taking the action, in person or by mail to the consumer's last known address.

A credit reporting agency shall, within a reasonable time after a consumer's written request, disclose the nature and substance of all information it holds about the consumer, the sources of credit information, the names of end-users to whom it provided a credit report in the preceding year, all written credit reports provided in that year and particulars of all oral credit reports provided in that year. A consumer is entitled to receive that information free of charge once per calendar year.

If a consumer disputes the accuracy or completeness of an item of information in his or her file, the credit reporting agency shall within a reasonable time use its best endeavours to confirm or complete the information and shall correct, supplement or delete it in accordance with good practice.

A consumer may provide a statement declaring that a dispute exists about the accuracy or completeness of an item in his or her file, and the credit reporting agency must include the statement in all subsequent credit reports that include the item, subject to the limits in the section. A consumer may request a credit reporting agency to include a security alert in his or her file.

If a consumer's file includes a security alert, the agency shall give the alert to every end-user to whom it provides a credit report about the consumer, and an end-user that receives a report with a security alert shall not proceed with a transaction without first taking reasonable steps to verify that the person involved is the consumer and recording the steps taken. The Act, with the exception of one paragraph of section 10, was proclaimed and came into force on October 1, 2018.

A person who violates a provision of the Act listed in its Schedule A commits an offence and is liable on conviction, for each offence, to a fine of not more than $50,000 or to imprisonment for a term of not more than one year, or to both, if an individual, and to a fine of not more than $250,000 if a person other than an individual.

A custodian is a person who holds, maintains, processes, receives or stores a digital asset of an account holder. A digital asset is a record that is created, recorded, transmitted or stored in digital or other intangible form by electronic, magnetic, optical or other similar means. The Act does not apply to a digital asset of an employer that is used by an employee in the ordinary course of the employer's business.

Subject to subsections (2) to (4) of the section and consistent with the fiduciary's authority, the fiduciary of an account holder has the right to access a digital asset of the account holder. A fiduciary who has the right to access a digital asset is deemed to have the consent of the account holder for the custodian to disclose the content of the digital asset to the fiduciary.

Unless the account holder agrees to a limit by an affirmative act separate from agreeing to the other provisions of the service agreement, a provision of a service agreement that limits a fiduciary's right to access a digital asset is void. A provision in a service agreement that purports to restrict jurisdiction or venue to a forum outside New Brunswick is void with respect to a dispute about a fiduciary's right to access a digital asset under the Act.

A fiduciary who has a right to access a digital asset may request access from the custodian by making a request in writing accompanied by proof of the fiduciary's identity and the documents the Act lists. A custodian that receives a request shall provide the fiduciary with access to the digital asset within 30 days after receiving the request and the relevant accompanying documents. Subject to the regulations, a custodian may charge a reasonable fee for providing access to a digital asset. The Act contains no commencement provision, so it came into force on the date of Royal Assent, December 16, 2022.

An individual has a right, on request and subject to the Act, to examine or receive a copy of his or her personal health information maintained by a custodian. A custodian shall respond to a request as promptly as required in the circumstances, but no later than 30 business days after receiving it, unless the time limit is extended or the request is transferred to another custodian.

The failure of a custodian to respond within 30 business days is treated as a decision to refuse to permit the personal health information to be examined or copied. If personal health information is maintained in electronic form, the custodian shall produce a record of it in a form usable by the individual if it can be produced using the custodian's normal computer hardware and software and technical expertise.

A custodian shall not permit information to be examined or copied without being satisfied as to the identity of the individual making the request, and shall take reasonable steps to ensure that information intended for an individual is received only by that individual. A custodian shall permit an individual to examine a record free of charge and may, in accordance with the regulations, require a fair and reasonable fee for search, preparation, copying and delivery services.

For purposes of accuracy or completeness, an individual may make a request to correct any personal health information that the individual may examine and copy. Within 30 business days after receiving a request to correct, the custodian shall make the correction, say that the information no longer exists or cannot be found, transfer the request or refuse in writing, giving the reason and the individual's right to add a statement of disagreement and to complain.

A custodian shall not charge a fee in connection with a request for a correction. The Act was proclaimed and came into force on September 1, 2010.

An individual who made a request to examine or correct personal health information may complain to the Ombud if not satisfied with a decision, act or omission of the custodian, and an individual may complain that a custodian collected, used or disclosed his or her personal health information contrary to the Act or failed to protect it in a secure manner as the Act requires.

A complaint to the Ombud shall be in writing and filed within 60 days after the date the individual was notified of the decision of the custodian or the date of the act or omission. The Ombud may extend that period, and where a custodian fails to respond in time to a request to examine or copy a record, the complaint shall be filed within 120 days following the request.

In performing duties under the Act the Ombud has the right to enter any office of a custodian and examine and make copies of any record in the custodian's custody. A custodian shall produce to the Ombud within 14 days after a request a record or a copy of a record the Ombud requires for an investigation. The Ombud may monitor how the Act is administered, conduct investigations to monitor compliance and review privacy impact assessments conducted by a custodian that is a public body.

A custodian or information manager commits an offence if it collects, uses, sells or discloses personal health information contrary to the Act or fails to protect personal health information in a secure manner as the Act requires. A custodian or information manager is not found to have contravened those duties if it can establish that it took all reasonable steps to prevent the contravention.

An offence under the Act is punishable under Part II of the Provincial Offences Procedure Act as a category F offence. A category F offence carries a fine of not less than $240 and not more than $10,200. The maximum fine is $15,000 for a defendant who was sentenced to the maximum fine on a previous conviction of the same offence. A judge may impose a larger fine where the defendant committed the offence for financial advantage or to avoid the financial burden of compliance with the law.

A judge may sentence a defendant convicted of a category F offence who has a previous conviction for the same offence to imprisonment for not more than ninety days if satisfied that no other sentence will deter the defendant from repeating the offence. No prosecution for an offence under the Act shall be commenced after 2 years from the date of the discovery of the alleged offence. The Act was proclaimed and came into force on September 1, 2010.

No person shall carry on business as a credit reporting agency unless the person has been licensed as provided by the Act and the regulations. A credit reporting agency is a person who, for gain or profit, provides credit reports or creates and maintains files from which credit reports are directly generated and provided.

No credit reporting agency shall knowingly provide information from its files to a person except in response to a court warrant or order or an order under the Act, in a credit report to an end-user that has obtained the consumer's consent or to a third party at the end-user's direction or to an end-user in accordance with section 18 (5), or to the consumer to whom the information pertains.

No person shall knowingly obtain information from a consumer's file held by a credit reporting agency except in those circumstances. A credit reporting agency shall adopt all procedures reasonable for ensuring accuracy and fairness in the contents of its credit reports. A credit reporting agency shall not maintain in its files or include in a credit report information about a consumer's health or medical history, including a physical or mental disability.

It shall also not maintain or include information about a consumer's gender identity or expression, sex, sexual orientation, political belief or activity, creed or religion, race, colour, ancestry or national origin.

A credit reporting agency shall not include information in a credit report unless the source of the information is included in the report, the source's contact information is included or can be readily ascertained by the consumer, and the source and its contact information are recorded in the consumer's file.

An end-user obtaining consent to the release of a credit report shall inform the consumer of the purpose for obtaining the report and how it will be used, the purpose of any release to a third party, the date the consent is effective, and whether the consent expires on a specified date or continues during the term of an agreement. The consent is void if the end-user obtains it by providing false or misleading information respecting the consent or by using deceptive or misleading practices.

An end-user obtaining a consumer's consent shall take reasonable steps to verify the identity of the consumer and record the steps taken. The Act, with the exception of one paragraph of section 10, was proclaimed and came into force on October 1, 2018.

A person who violates a provision of the Act listed in its Schedule A commits an offence and is liable on conviction, for each offence, to a fine of not more than $50,000 or to imprisonment for a term of not more than one year, or to both, if an individual, and to a fine of not more than $250,000 if a person other than an individual.

The Tribunal may order a person who has violated or failed to comply with the Act to pay an administrative penalty of not more than $25,000 for an individual and not more than $100,000 for a person other than an individual.

An information manager is an individual or organization that on behalf of a custodian processes, stores, retrieves, archives or disposes of personal health information, de-identifies or otherwise transforms it, or provides information management or information technology services.

A custodian that retains the services of an agent for the collection, use, disclosure or retention of personal health information shall enter into a written agreement requiring the agent to comply with the custodian's legal obligations regarding the handling of that information.

A custodian that provides personal health information to an information manager shall enter into a written agreement, in accordance with the regulations, that provides for protection of the information against risks such as unauthorized access to or use or disclosure, secure destruction or alteration.

The agreement shall describe the services to be provided to the custodian and the administrative, technical and physical safeguards the information manager employs for the confidentiality, security, accuracy and integrity of the information. An information manager that enters into the agreement shall comply with the duties the agreement imposes and with the same requirements on protection, retention and secure destruction that the custodian must comply with under the Act. The Act was proclaimed and came into force on September 1, 2010.

A custodian is an individual or organization that collects, maintains or uses personal health information to provide or assist in providing health care or treatment, to plan and manage the health care system or to deliver a government program or service. The Act does not apply to an individual or organization that handles personal health information for other purposes, including employers, insurance companies and regulatory bodies of health care providers.

A custodian may collect personal health information about an individual if it has the individual's consent and the collection is necessary for a lawful purpose, or if the Act permits or requires the collection. Unless required to do so by law, a custodian shall not collect personal health information if other information will serve the same purpose, or more of it than is reasonably necessary to meet the purpose of the collection.

Consent must be the consent of the individual or of a substitute decision-maker, must be knowledgeable, must be able to be withdrawn or withheld, must relate to the personal health information, must not be obtained through deception or coercion, and may be express or implied.

Unless it is not reasonable in the circumstances to make the assumption, a custodian is entitled to assume that it has the individual's implied consent to collect or use the personal health information or to disclose it to another custodian or person for the purpose of providing health care to the individual.

Unless the Act provides otherwise, express consent is required for a custodian to disclose personal health information to the media, for fundraising, to a visitor to a health care facility, to a person outside New Brunswick or for research. A custodian shall not use personal health information except as the Act authorizes, and every use is limited to the minimum amount of information necessary to accomplish its purpose.

A custodian shall not disclose personal health information except as the Act authorizes, and every disclosure is limited to the minimum amount of information necessary to accomplish its purpose. The Act was proclaimed and came into force on September 1, 2010.

A custodian shall establish and implement information practices to ensure compliance with the Act and designate a person to assist in ensuring compliance, to respond to inquiries about its information practices and to receive complaints from the public about alleged contraventions.

A custodian shall protect personal health information by adopting information practices that include reasonable administrative, technical and physical safeguards that ensure the confidentiality, security, accuracy and integrity of the information. The information practices shall be based on nationally or jurisdictionally recognized information technology security standards and processes, appropriate for the level of sensitivity of the personal health information to be protected.

A custodian shall implement controls that limit use of personal health information to persons it has specifically authorized, and shall verify the identity of a person seeking to use the information and that the proposed use is authorized. A custodian that uses electronic means to request or respond to requests for disclosure of personal health information shall implement procedures to prevent the interception of the information by unauthorized persons.

A custodian that maintains personal health information in electronic form shall implement any additional safeguards required by the regulations. A custodian shall establish and comply with a written policy and procedures on information practices that include measures to protect the security of personal health information during its collection, use, disclosure, storage and destruction.

A custodian shall keep a record of all security breaches, recording the security breaches and the corrective procedures taken to diminish the likelihood of future breaches. A custodian shall establish and comply with a written policy for the retention, archival storage, access and secure destruction of personal health information.

A custodian that is a public body, or another custodian prescribed by regulation, must conduct a privacy impact assessment for a new collection, use or disclosure of personal health information or a material change to one, and for the creation or modification of a personal health information system or personal health information communication technology. The Act was proclaimed and came into force on September 1, 2010.

No person may require the production of an individual's Medicare number or collect or use it, except a person that requires its production, collection or use for the provision of health care, to verify eligibility for a health care program or service, for the payment and management of the health care system, to verify eligibility for the drug insurance plan, to obtain proof of immunization, or to establish or maintain the immunization registry or the notifiable disease registry.

A public body may collect and use a Medicare number, including to perform data matching, for a research project approved by a research review body or in accordance with an agreement referred to in paragraph 43.1 (a). A public body may also collect and use a Medicare number for a purpose prescribed by regulation. An individual may refuse to provide his or her Medicare number to any person not authorized to require its production or to collect or use it.

A person who requests a Medicare number from an individual shall advise the individual of his or her authority to do so. The Act was proclaimed and came into force on September 1, 2010.

Information shall not be denied legal effect or enforceability solely on the ground that the information is electronic. A contract or other transaction may be entered into by the interaction of an electronic agent and an individual or by the interaction of electronic agents.

An electronic agent is a computer program or any electronic means used to initiate an action or to respond to an electronic document or action, in whole or in part, without review by an individual at the time of the response or action.

An individual may cancel a contract or other transaction made with the electronic agent of another person if the individual made a material error in the information provided to the electronic agent and the electronic agent did not provide the individual with an opportunity to prevent or correct the error. Nothing in the Act requires a person to use or accept electronic information. The Act was proclaimed and came into force on September 1, 2011.