Prince Edward Island

A custodian must notify the individual to whom the personal health information relates, and the Commissioner, in writing at the first reasonable opportunity if the information is stolen, lost, disposed of except as permitted by the Act, or disclosed to or accessed by an unauthorized person.

The duty does not apply if the custodian reasonably believes that the theft, loss, disposition, disclosure or access will not have an adverse impact on the provision of health care or other benefits to the individual, or on the individual's mental, physical, economic or social well-being. Section 36 was amended by chapter 47 of the Statutes of Prince Edward Island, 2018. The Act was brought into force on July 1, 2017.

A custodian may disclose personal health information collected in the province to a person outside the province without the individual's consent only in the circumstances described in subsections 23(7), (10) and (13) or as specified in the regulations. The Act was brought into force on July 1, 2017.

An individual has a right, on request, to examine or receive a copy of any record of the individual's personal health information that is in the custody or under the control of a custodian. A custodian must respond to an access request within 30 days of receiving it, and the response must be open, accurate and complete. A custodian may extend the time to respond by up to 30 days on the grounds listed in section 8.1.

A custodian must permit an individual to examine the individual's personal health information free of charge. An individual may request a custodian, in writing, to correct any record of the individual's personal health information. Within 30 days after receiving a request to correct a record, the custodian must do one of the things listed in section 11(3).

A custodian that refuses to make a requested correction must permit the individual to file a concise statement of disagreement and add it to the record. The Act was brought into force on July 1, 2017.

No person may collect, use or disclose personal health information in contravention of the Act, or attempt to gain or gain access to personal health information in contravention of the Act. A person commits an offence by selling personal health information, or disclosing it for consideration, subject to subsection 78(4). Every person who contravenes a provision of the Act or the regulations, or fails to comply with an order of the Commissioner, is guilty of an offence.

On summary conviction an individual is liable to a fine of not more than $15,000 or imprisonment for not more than six months, or both. On summary conviction a corporation is liable to a fine of not more than $50,000. A continuing contravention is a separate offence for each day or part of a day on which it continues. No prosecution may be commenced more than two years after the discovery of the alleged offence. The Act was brought into force on July 1, 2017.

A consumer reporting agency is a person who for gain or profit, or on a regular co-operative non-profit basis, furnishes consumer reports. No person may operate or act as a consumer reporting agency or personal information investigator unless registered under the Act.

No consumer reporting agency may knowingly furnish information from its files except in response to a court order, in accordance with the written instructions of the consumer, in response to an order or direction made under the Act, or in a consumer report given to a person it has reason to believe meets a condition in section 8(1)(d). A consumer reporting agency must adopt all procedures reasonable for ensuring the greatest possible accuracy and fairness in the contents of its consumer reports.

A consumer reporting agency may not report information as to the bankruptcy of the consumer after seven years from the date of the discharge, except where the consumer has been bankrupt more than once. A user who denies a benefit to a consumer, or increases a charge, because of information from a consumer reporting agency must advise the consumer of that fact at the time the action is communicated.

At the written request of a consumer, a consumer reporting agency must disclose without charge the nature and substance of all information in its files pertaining to the consumer. A person who contravenes a provision of the Act or the regulations is liable on summary conviction to a fine of not more than $2,000 or imprisonment for not more than one year, or both. Where a corporation is convicted, the maximum penalty that may be imposed upon it is $25,000.

The Act applies to personal health information that is collected, used or disclosed by a custodian or that is in the custody or control of a custodian. A custodian is a person or organization that collects, maintains, uses or discloses personal health information for the purpose of providing or assisting in the provision of health care or treatment, or of planning and managing the health care system, or of delivering a government program or service related to health care.

The Act does not apply to a person or organization that collects, maintains or uses personal health information for purposes other than health care or treatment and the planning and management of the health care system, such as an employer or an insurance company. A custodian may collect personal health information with the individual's consent where the collection is necessary for a lawful purpose, or where the collection is otherwise permitted or required by the Act.

Consent to the disclosure of personal health information must be express, and may not be implied, when a custodian proposes to disclose it to a person that is not a custodian. Every use by a custodian of personal health information is limited to the minimum amount of personal health information necessary to accomplish the purpose for which it is used.

A custodian must protect personal health information by adopting information practices that include reasonable administrative, technical and physical safeguards that ensure the confidentiality, security, accuracy and integrity of the information. A custodian that retains the services of an agent for the collection, use, disclosure, retention or secure destruction of personal health information must enter into a written agreement with the agent.

An information manager that enters into a written agreement with a custodian must comply with the duties imposed on it under the agreement and with the same requirements concerning the protection, retention and secure destruction of personal health information that the custodian must comply with. The Act was brought into force on July 1, 2017.

Unless the parties agree otherwise, an offer or the acceptance of an offer, or any other matter that is material to the formation or operation of a contract, may be expressed by means of an electronic document. A contract shall not be denied legal effect or enforceability solely by reason that an electronic document was used in its formation. A contract may be formed by the interaction of an electronic agent and an individual or by the interaction of electronic agents.

An electronic agent is a computer program or any electronic means used to initiate an action or to respond to electronic documents or actions in whole or in part without review by an individual at the time of the response or action. An electronic document made by an individual with the electronic agent of another person has no legal effect and is not enforceable by the other person if the individual made a material error in the document and the four conditions of section 21 are met.

Nothing in the Act limits the operation of any provision of any enactment that expressly authorizes, prohibits or regulates the use of electronic documents.