Yukon

If a security breach occurs in relation to an individual's personal health information in a custodian's custody or control, and there are reasonable grounds to believe that the individual is at risk of significant harm as a result of the security breach, the custodian must, as soon as reasonably possible after the security breach, notify the individual of the security breach.

The notice must describe the circumstances of the security breach and the personal health information involved, indicate when the security breach occurred, describe the measures the custodian has taken to reduce the risk of harm and identify the custodian's contact individual. The custodian must at the same time give the commissioner a copy of the notice.

A custodian that must notify an individual must, within a reasonable time after discovering the security breach, submit to the commissioner a written report that assesses the risk of harm to individuals and estimates the number of individuals affected, and describes the measures taken to reduce that risk. Harm includes identity theft, identity fraud, damage to reputation and personal humiliation or embarrassment.

A security breach includes theft or loss of personal health information, and any event that it is reasonable to believe is a security breach is deemed to be one.

Subject to Part 3 of the Act, an individual has the right to obtain access to their personal health information contained in a record in the custody or control of a custodian. A custodian may charge a fee, not exceeding the prescribed fee, for access to personal health information contained in a record in the custody or control of the custodian. A custodian must respond to a complete application for access within 30 days after receiving it.

A custodian may extend the 30 day period by an additional 60 days in the circumstances the Act lists. An individual who believes that there is an error or omission in their personal health information may make a correction request asking the custodian to annotate the record to reflect a correction of the error or omission. A custodian must not charge a fee for the services provided on a correction request.

Any person may make a complaint to the commissioner if the person reasonably believes that a custodian has failed to comply with the Act or the regulations. A person who, in knowing contravention of the Act or the regulations, collects, uses, discloses or accesses personal health information is guilty of an offence.

A person who is guilty of an offence under subsection 121(1) is liable on summary conviction to a fine of not more than $25,000 if the person is an individual and not more than $100,000 in any other case. A person who otherwise knowingly contravenes the Act or a regulation is guilty of an offence and is liable on summary conviction to a fine of not more than $500.

Where a corporation commits an offence, every officer, member, employee or other agent who authorized the offence, or who had the authority to prevent it and knowingly refrained from doing so, is a party to and guilty of the offence.

A custodian or the agent of a custodian may collect, use, disclose and access personal health information only in accordance with the Act and the regulations. A custodian or its agent must not collect, use or disclose personal health information if other information will serve the purpose of the collection, use or disclosure.

The collection, use and disclosure of personal health information must be limited to the minimum amount that is reasonably necessary to achieve the purpose for which it is collected, used or disclosed. A custodian must protect personal health information by applying information practices that include administrative policies and technical and physical safeguards that ensure the confidentiality, security and integrity of the personal health information in its custody or control.

Unless the Act requires express consent to the collection, use or disclosure of personal health information, implied consent is sufficient. Express consent is required for the collection, use or disclosure of personal health information for fund-raising activities and in prescribed circumstances or for prescribed purposes. A custodian is, among others, the Department of Health and Social Services, the operator of a hospital or health facility and a health care provider.

A health care provider includes a medical practitioner, a registered nurse or nurse practitioner, a licensed practical nurse and a pharmacist.

Unless the parties agree otherwise, an offer or the acceptance of an offer, or any other matter that is material to the formation or operation of a contract, may be expressed by an action in electronic form, including touching or clicking on an appropriately designated icon or place on a computer screen. A contract shall not be denied legal effect or enforceability solely by reason that an electronic document was used in its formation.

A contract may be formed by the interaction of an electronic agent and an individual or by the interaction of electronic agents. An electronic agent is a computer program or any electronic means used to initiate an action or to respond to electronic documents or actions in whole or in part without review by an individual at the time of the response or action.

An electronic document made by an individual with the electronic agent of another person has no legal effect and is not enforceable by the other person if the individual made a material error in the document and the conditions in section 22 are met.