[37] Bill 159 Original (PDF)
Bill 159
Bill 1592000
An Act respecting
personal health information
and related matters
CONTENTS
PART I
PURPOSES, DEFINITIONS AND INTERPRETATION
1.Purposes
2.Definitions and interpretation
3.Interpretation, health information custodian
PART II
APPLICATION OF ACT
4.Crown bound
5.Information affected
6.Freedom of information legislation
7.Non-application of this Act
8.Other rights and Acts
9.Solicitor-client privilege
10.Law of evidence
11.Conflict
PART III
GENERAL LIMITATIONS
12.Limitations with respect to information
13.Electronic use of information
14.Computer matching
15.Delegation by Ministers
16.Employees, etc., of health information custodians
17.Information manager
PART IV
PRACTICES TO PROTECT
PERSONAL HEALTH INFORMATION
18.Security
19.Retention and disposal of records
20.Information for public
PART V
CONSENT CONCERNING
PERSONAL HEALTH INFORMATION
21.Elements of consent
PART VI
COLLECTION, USE AND
DISCLOSURE OF PERSONAL
HEALTH INFORMATION
22.Limits on collection
23.Confidentiality
24.Limits on use and disclosure
25.Information about uses and disclosures
26.Limits on marketing
27.Permitted uses
28.Disclosure with consent
29.Disclosures related to the individual
30.Disclosures for health or other programs
31.Disclosure directed by Minister
32.Research project or program
33.Disclosures related to risks and custody of the
individual
34.Disclosures in proceedings
35.Transfer of records
36.Disclosures related to this or other Acts
37.Use or disclosure outside Ontario
38.Health cards and health numbers
39.Fees
PART VII
QUALITY OF CARE INFORMATION
40.Definitions
41.Non-disclosure in proceeding
42.Reporting permitted
43.Immunity
PART VIII
ACCESS TO RECORDS OF
PERSONAL HEALTH INFORMATION
44.Non-application of Part
45.Right of access
46.Access by person making decision
47.Procedure for access
48.Refusal of access
49.Freedom of information legislation
50.Amendment of record
PART IX
SUBSTITUTE DECISIONS
CONCERNING PERSONAL
HEALTH INFORMATION
51.Definitions
52.Interpretation
53.Consent to collection, use or disclosure
54.Capacity
55.Presumption of capacity
56.Consent given by parent, etc.
57.Incapable individual: persons who may consent
58.Deceased individual
59.Transition, representative appointed by individual
60.Transition, representative appointed by Board
61.Factors to consider re consent
62.Application for review of determination of incapacity
63.Application for appointment of representative
PART X
POWERS AND DUTIES OF THE COMMISSIONER
64.Powers
65.Delegation
66.Confidentiality
67.Immunity
PART XI
ADMINISTRATION AND ENFORCEMENT
68.Complaints
69.Inquiry
70.Burden of proof
71.Order
72.Appeal
73.Offences
PART XII
MISCELLANEOUS
74.Annual report by institution
75.Protection from liability
76.Regulations
77.Review of Act
PART XIII
COMPLEMENTARY AMENDMENTS
AND REPEALS
78.Charitable Institutions Act
79.Child and Family Services Act
80.Drug and Pharmacies Regulation Act
81.Education Act
82.Freedom of Information and Protection of Privacy Act
83.Health Cards and Numbers Control Act, 1991
84.Health Care Consent Act, 1996
85.Health Insurance Act
86.Health Protection and Promotion Act
87.Homes for the Aged and Rest Homes Act
88.Long-Term Care Act, 1994
89.Mental Health Act
90.Nursing Homes Act
91.Ontario Drug Benefit Act
92.Public Hospitals Act
93.Substitute Decisions Act, 1992
PART XIV
COMMENCEMENT AND SHORT TITLE
94.Commencement
95.Short title
______________
Her Majesty, by and with the advice and consent of the Legislative Assembly of the Province of Ontario, enacts as follows:
PART I
PURPOSES, DEFINITIONS AND INTERPRETATION
Purposes
1. The purposes of this Act are,
(a)to establish duties and mechanisms to protect the confidentiality and security of personal health information and the privacy of the individual to which the information relates;
(b)to establish rules for the collection, use, disclosure, retention and disposal of personal health information;
(c)to protect individuals, whether living or deceased, from the unauthorized collection, use, disclosure, retention and disposal of personal health information relating to themselves;
(d)to facilitate the exchange of personal health information for authorized purposes;
(e)to control the collection, use and disclosure of an individual's health number;
(f)to establish restrictions on the disclosure in proceedings of quality of care information as defined in Part VII;
(g)to provide individuals with a right of access to records of personal health information relating to themselves, subject to limited and specific exceptions as set out in this Act;
(h)to provide individuals entitled to access to records of personal health information relating to themselves with a right to request to have the records amended;
(i)to provide who may act on behalf of an individual with respect to personal health information and in what circumstances;
(j)to provide mechanisms, including independent review, for investigating and settling complaints under this Act and for reviewing information practices; and
(k)to establish remedies for violations of this Act.
Definitions and interpretation
2. (1) In this Act, "
Assistant Commissioner" means the Assistant Commissioner for Personal Health Information appointed under the Freedom of Information and Protection of Privacy Act\; ("commissaire adjoint") "
attorney for personal care" means an attorney under a power of attorney for personal care made in accordance with the Substitute Decisions Act, 1992\; ("procureur au soin de la personne") "
attorney for property" means an attorney under a continuing power of attorney for property made in accordance with the Substitute Decisions Act, 1992\; ("procureur aux biens") "
Board" means the Consent and Capacity Board; ("Commission") "
collect", in relation to personal health information, means to gather, acquire or obtain the information from any source by any means, and "collection" has a corresponding meaning; ("recueillir", "collecte") "
Commissioner" means the Information and Privacy Commissioner appointed under the Freedom of Information and Protection of Privacy Act\; ("commissaire") "
disclose", in relation to personal health information in the custody or under the control of a health information custodian, means to release the information or to make it available to a person who is not employed by or in the service of the custodian, and "disclosure" has a corresponding meaning; ("divulguer", "divulgation") "
guardian of property" means a guardian of property or a statutory guardian of property under the Substitute Decisions Act, 1992\; ("tuteur aux biens") "
guardian of the person" means a guardian of the person appointed under the Substitute Decisions Act, 1992\; ("tuteur la personne") "
health care" means anything that is done for a therapeutic, preventive, palliative, diagnostic, cosmetic or other health-related purpose and includes,
(a)a service that is related to health care and that is,
(i)a personal support service, or
(ii)a community service that is described in subsection 2 (3) of the Long-Term Care Act, 1994 and provided by a service provider within the meaning of that Act,
(b)the observation, examination or assessment of an individual to determine or monitor his or her physical or mental health or well-being, and
(c)the compounding, dispensing or selling of a drug, a device, equipment or any other item to an individual, or for the use of an individual, pursuant to a prescription; ("soins de sant") "
health care practitioner" means,
(a)an individual who practises a health profession within the meaning of the Regulated Health Professions Act, 1991,
(b)an individual who practises as a drugless practitioner registered under the Drugless Practitioners Act,
(c)a social worker who provides health care and who is a certified member of the Ontario College of Certified Social Workers before the day section 18 of the Social Work and Social Service Work Act, 1998 comes into force or a member of the Ontario College of Social Workers and Social Service Workers on or after the day that section comes into force, or
(d)an individual who treats the physical or mental health or well-being of an individual for payment; ("praticien des soins de sant") "
health information custodian" means, subject to subsections (2) to (5), a person described in one of the following paragraphs who has custody or control of personal health information as a result of or in connection with performing the person's powers or duties or the work described in the paragraph, if any, but not otherwise:
1.A health care practitioner.
2.A service provider within the meaning of the Long-Term Care Act, 1994 who provides a service to which that Act applies.
3.A service provider within the meaning of the Child and Family Services Act who provides a service to which that Act applies.
4.A person who operates one of the following facilities, programs or services:
i.a hospital within the meaning of the Public Hospitals Act, a private hospital within the meaning of the Private Hospitals Act, a psychiatric facility within the meaning of the Mental Health Act, an institution within the meaning of the Mental Hospitals Act or a regional cancer centre,
ii.an independent health facility within the meaning of the Independent Health Facilities Act,
iii.an approved charitable home for the aged within the meaning of the Charitable Institutions Act, a home or joint home within the meaning of the Homes for the Aged and Rest Homes Act or a nursing home within the meaning of the Nursing Homes Act,
iv.a home for special care within the meaning of the Homes for Special Care Act,
v.a home for retarded persons within the meaning of the Homes for Retarded Persons Act,
vi.a retirement home for elderly persons,
vii.a pharmacy within the meaning of Part VI of the Drug and Pharmacies Regulation Act,
viii.a laboratory or a specimen collection centre as defined in section 5 of the Laboratory and Specimen Collection Centre Licensing Act,
ix.an ambulance service within the meaning of the Ambulance Act,
x.a community health program or service,
xi.a program or service funded under the Developmental Services Act, or
xii.a program of employment supports within the meaning of the Ontario Disability Support Program Act, 1997.
5.An evaluator within the meaning of the Health Care Consent Act, 1996.
6.An assessor within the meaning of the Substitute Decisions Act, 1992.
7.A medical officer of health within the meaning of the Health Protection and Promotion Act.
8.The Minister.
9.A district health council established under the Ministry of Health Act.
10.A College within the meaning of the Regulated Health Professions Act, 1991 or the Board of Regents continued under the Drugless Practitioners Act.
11.Cancer Care Ontario.
12.A person who maintains a registry of personal health information that relates to a specific disease or condition or that relates to the storage or donation of body parts or bodily substances.
13.A person or a class of persons prescribed by the regulations who maintains a repository of personal health information for the primary purpose of data analysis or research.
14.Any other person or class of persons prescribed by the regulations as health information custodians if they have custody or control of personal health information as a result of or in connection with performing their powers or duties or the work prescribed by the regulations; ("dpositaire de renseignements sur la sant") "
health number" means the number and version code assigned to an insured person within the meaning of the Health Insurance Act by the General Manager of the Ontario Health Insurance Plan; ("numro de la carte Sant") "
individual" means, in relation to personal health information, the individual, whether living or deceased, with respect to whom the information was or is being collected or created; ("particulier") "
information practices", in relation to a health information custodian, means the actions of the custodian in relation to personal health information and includes,
(a)when and how the custodian collects, creates, uses, modifies, discloses, retains and disposes of the information, and
(b)the administrative, technical and physical safeguards and practices that the custodian maintains with respect to the information; ("pratiques relatives aux renseignements")
"
Minister" means the Minister of Health and Long-Term Care; ("ministre") "
Ministry" means the Ministry of Health and Long-Term Care; ("ministre") "
person" means an individual, a corporation, partnership, association or other entity; ("personne") "
person who is employed by or in the service of a health information custodian" includes a person, whether or not the person receives remuneration from the custodian in that connection, and includes one of the following persons:
1.An agent, a solicitor, a student or a volunteer acting for or on behalf of the custodian.
2.A member of the medical or other staff of the custodian.
3.A person under the direction or supervision of the custodian; ("personne employe par un dpositaire de renseignements sur la sant ou son service") "
personal health information" means information relating to an individual, whether or not the information is recorded, if the information,
(a)is information that,
(i)identifies the individual,
(ii)can be used or manipulated by a reasonably foreseeable method to identify the individual, or
(iii)can be linked or matched by a reasonably foreseeable method to other information that identifies the individual or that can be used or manipulated by a reasonably foreseeable method to identify the individual, and
(b)is information that,
(i)relates to the physical or mental health or well-being of the individual,
(ii)relates to the providing of health care to the individual,
(iii)is a plan of service within the meaning of the Long-Term Care Act, 1994 for the individual,
(iv)relates to payments or eligibility for health care in respect of the individual,
(v)relates to the donation by the individual of any body part or bodily substance of the individual or is derived from the testing or examination of any such body part or bodily substance,
(vi)is the individual's health number,
(vii)is registration information relating to the individual, or
(viii)relates to a provider of health care to the individual or a person who is authorized under Part IX to consent on behalf of the individual and is linked to information relating to the individual's health or health care,
and includes personal information within the meaning of the Freedom of Information and Protection of Privacy Act or the Municipal Freedom of Information and Protection of Privacy Act if it comes within this definition; ("renseignements personnels sur la sant") "
personal support service" means assistance with or supervision of hygiene, washing, dressing, grooming, eating, drinking, elimination, ambulation, positioning or any other routine activity of living; ("service de soutien personnel") "
proceeding" includes a proceeding held in, before or under the rules of a court, a tribunal, a commission, a justice of the peace, a coroner, a committee of a College within the meaning of the Regulated Health Professions Act, 1991, a committee of the Board of Regents continued under the Drugless Practitioners Act, a committee of the Ontario College of Social Workers and Social Service Workers under the Social Work and Social Service Work Act, 1998 or an arbitrator or a mediator selected by the parties to the proceeding, but does not include an inspection, investigation or similar procedure during which a health information custodian is entitled to disclose personal health information under clause 36 (1) (h); ("instance") "
record" means a record of information in any form or in any medium and includes information that is written, photographed, copied, recorded, digitized or stored in any manner, but does not include a computer program or other mechanism that can produce a record; ("dossier") "
registration information" means information relating to an individual that is collected or created for the purpose of registration of the individual in connection with services or benefits that a health information custodian provides to the individual and includes,
(a)the individual's name, home address and home telephone number, gender, date of birth, date of death if applicable, residency status, family association and marital status,
(b)the individual's signature or electronic or photographic image,
(c)any identification number for the individual, other than a health number, and
(d)information about the individual's employment status,
but does not include information about the health status of the individual or health care provided to the individual; ("renseignements en matire d'inscription") "
regulations" means the regulations made under this Act; ("rglements") "
research project or program" means a project or program that involves compiling, for the purpose of scientific research, personal health information that has previously been recorded; ("projet ou programme de recherche") "
use", in relation to actions of a health information custodian who has custody or control of personal health information or a person who is employed by or in the service of the custodian, means to handle or deal with the information, but does not include to disclose the information. ("utilisation", "utiliser")
Exception, health information custodian
(2) A person described in one of paragraphs 1, 5, 6, 12 and 13 of the definition of "health information custodian" in subsection (1) is not a health information custodian with respect to personal health information of which the person has knowledge as a result of or in connection with being employed by or in the service of another health information custodian.
Same, freedom of information legislation
(3) A person is not a health information custodian if,
(a)the person is described in one of paragraphs 1 to 7, 12 and 13 of the definition of "health information custodian" in subsection (1);
(b)the person is employed by or in the service of an institution within the meaning of the Freedom of Information and Protection of Privacy Act or the Municipal Freedom of Information and Protection of Privacy Act that is not a health information custodian; and
(c)the person does not provide health care.
Same
(4) An institution within the meaning of the Freedom of Information and Protection of Privacy Act or the Municipal Freedom of Information and Protection of Privacy Act that is a person described in paragraph 12 or 13 of the definition of "health information custodian" in subsection (1) but that does not provide health care is not a health information custodian.
Same, persons prescribed by regulation
(5) Despite subsection (3) or (4), if a person or a class of persons is prescribed by the regulations as a health information custodian under paragraph 14 of the definition of "health information custodian" in subsection (1), the person or class of persons, as the case may be, is a health information custodian.
Other exceptions
(6) A health information custodian does not include a person described in one of the following paragraphs who has custody or control of personal health information as a result of or in connection with performing the work described in the paragraph:
1.An aboriginal healer who provides traditional healing services to aboriginal persons or members of an aboriginal community.
2.An aboriginal midwife who provides traditional midwifery services to aboriginal persons or members of an aboriginal community.
3.A person who treats another person by prayer or spiritual means in accordance with the tenets of the religion of the person giving the treatment.
4.A person or class of persons prescribed by the regulations who performs its powers or duties or the work prescribed by the regulations.
Interpretation, health information custodian
3. (1) Except as specified in the regulations, a health information custodian who operates more than one facility, program or service described in one of the subparagraphs of paragraph 4 of the definition of "health information custodian" in subsection 2 (1) shall be deemed to be a separate custodian with respect to personal health information of which it has custody or control as a result of or in connection with operating each of the facilities, programs or services that it operates.
Duration
(2) Subject to subsection (3), a health information custodian does not cease to be a health information custodian with respect to personal health information until custody or control of the information passes to another health information custodian.
Death of custodian
(3) If the health information custodian with respect to personal health information dies, the estate trustee of the custodian becomes the health information custodian with respect to the information until custody or control of the information passes to another health information custodian.
PART II
APPLICATION OF ACT
Crown bound
4. This Act binds the Crown.
Information affected
5. This Act applies to personal health information and quality of care information as defined in Part VII, if the information is held on or after the day this section comes into force, even if the information was collected or created before that day.
Freedom of information legislation
6. (1) Subject to subsection (2), the Freedom of Information and Protection of Privacy Act and the Municipal Freedom of Information and Protection of Privacy Act do not apply to personal health information collected by a health information custodian or in the custody or under the control of a health information custodian unless this Act specifies otherwise.
Transition
(2) This Act does not apply to a disclosure of personal health information made under the Freedom of Information and Protection of Privacy Act or the Municipal Freedom of Information and Protection of Privacy Act before the day this section comes into force and the applicable Act, as the case may be, continues to apply to the disclosure.
Same, request for access
(3) If, before the day this section comes into force, under the Freedom of Information and Protection of Privacy Act or the Municipal Freedom of Information and Protection of Privacy Act, a person requests access to a record of personal information within the meaning of the applicable Act that is personal health information under this Act,
(a)this Act does not apply to the request; and
(b)the applicable Act, including the right of appeal under it, continues to apply to the request.
Same, appeal
(4) If, before the day this section comes into force, a person commences an appeal under the Freedom of Information and Protection of Privacy Act or the Municipal Freedom of Information and Protection of Privacy Act with respect to a request described in subsection (3), this Act does not apply to the appeal and the applicable Act continues to apply to the appeal.
Exceptions
(5) Sections 31, 32, 33, 35, 36, 44 and 45 of the Freedom of Information and Protection of Privacy Act and sections 24, 25 and 34 of the Municipal Freedom of Information and Protection of Privacy Act apply to a health information custodian that is an institution within the meaning of either of those Acts, as the case may be, and that has custody or control of records of personal health information.
Same
(6) For the purpose of subsection (5), references in sections 44 and 45 of the Freedom of Information and Protection of Privacy Act and section 34 of the Municipal Freedom of Information and Protection of Privacy Act to personal information under the control of the institution or maintained in a personal information bank in the custody or under the control of the institution shall be deemed to include personal health information in the custody or under the control of the institution.
Non-application of this Act
7. This Act does not apply to,
(a)personal health information relating to an individual who has been dead for more than 30 years;
(b)recorded information that is more than 150 years old;
(c)anonymous or statistical information or information derived from personal health information if it does not, either by itself or when combined with other information, permit an individual to be identified;
(d)personal health information relating to an individual that is collected or created for the purpose of,
(i)a proceeding or anticipated proceeding relating to labour relations affecting the individual or to the employment of the individual,
(ii)negotiations or anticipated negotiations relating to labour relations affecting the individual or to the employment of the individual, or
(iii)meetings, consultations, discussions or communications about labour relations or employment-related matters in which the individual has an interest;
(e)the child abuse register maintained under subsection 75 (5) of the Child and Family Services Act\;
(f)the adoption disclosure register maintained under clause 163 (2) (a) of the Child and Family Services Act or information related to adoptions under Part VII of that Act;
(g)information to which the English and Wabigoon River Systems Mercury Contamination Settlement Agreement Act, 1986 applies;
(h)information that relates to an adoption order, judgment or decree and that is sealed in a file kept by the Registrar General under section 28 of the Vital Statistics Act\; or
(i)records to which the Young Offenders Act (Canada) applies.
Other rights and Acts
8. (1) Nothing in this Act shall be construed to interfere with,
(a)a right of subrogation;
(b)anything governed by the Human Tissue Gift Act\; or
(c)anything governed by the Occupational Health and Safety Act.
Same, copyright
(2) Nothing in this Act affects the law of copyright.
(3) Subsection (4) applies only if Bill 142 (An Act to amend the Human Tissue Gift Act, introduced on November 16, 2000) receives Royal Assent.
(4) On the later of the day this section comes into force and the day section 1 of Bill 142, as set out in the version on first reading of the Bill, comes into force, clause (1) (b) is amended by striking out "Human Tissue Gift Act" and substituting "Trillium Gift of Life Network Act".
Solicitor-client privilege
9. This Act does not override a solicitor-client privilege.
Law of evidence
10. Except as otherwise specified in sections 34, 41, 66 and 71, this Act does not affect the law of evidence or the information otherwise available by law to a party to a proceeding.
Conflict
11. (1) In the event of a conflict between a provision in this Act respecting confidentiality and one in any other Act, this Act prevails unless this Act or the other Act specifically provides otherwise.
Exceptions
(2) The following provisions respecting confidentiality prevail over this Act:
1.Subsections 45 (8), (9) and (10), 54 (4) and (5) and 74 (5) of the Child and Family Services Act.
2.Subsection 28.38 (2) of the Public Service Act.
3.Subsections 83 (1) to (4) of the Health Professions Procedural Code that is Schedule 2 to the Regulated Health Professions Act, 1991.
4.Subsection 4 (2) of the Statistics Act.
Same
(3) In the event of a conflict between this Act and either of the Ontario Disability Support Program Act, 1997 or the Ontario Works Act, 1997, the applicable Act of those two Acts prevails.
PART III
GENERAL LIMITATIONS
Limitations with respect to information
12. (1) This section applies to every collection, use and disclosure of personal health information that is governed by this Act.
Other information
(2) A health information custodian shall not collect, use or disclose personal health information if information that is not personal health information will serve the purpose of the collection, use or disclosure, as the case may be.
Registration information
(3) A health information custodian shall not collect, use or disclose personal health information that is not registration information if registration information will serve the purpose of the collection, use or disclosure, as the case may be.
Extent of information
(4) A health information custodian shall not collect, use or disclose more personal health information than is reasonably necessary to meet the purpose of the collection, use or disclosure, as the case may be.
Protecting identity of individual
(5) To the extent reasonably possible, a health information custodian who collects, uses or discloses personal health information relating to an individual shall do so in a manner that conceals the identity of the individual, that keeps identifiers of the individual separate from the information or that deletes the identifiers from the information, while still meeting the purpose of the collection, use or disclosure, as the case may be.
Standards
(6) For the purposes of any of subsections (2) to (5), a health information custodian shall comply with the standards prescribed by the regulations.
Standards for registration information
(7) A health information custodian who collects, uses or discloses registration information shall comply with the standards prescribed by the regulations.
Exception
(8) This section does not apply to personal health information that a health information custodian is required to disclose under this Act or another law.
Delivery of health care
(9) Nothing in this section shall be construed to restrict the collection, use or disclosure of personal health information by a person described in one of paragraphs 1 to 4, 11 and 12 of the definition of "health information custodian" in subsection 2 (1) for the purpose of providing, or assisting in providing, health care to an individual.
Electronic use of information
13. A health information custodian shall comply with the requirements prescribed by the regulations with respect to the electronic transfer of personal health information.
Computer matching
14. (1) In this section, "
computer matching" means a computerized comparison of two or more databases, where the comparison is done for the purposes of determining what individuals meet the criteria that are specified as the criteria for the matching, but does not include a comparison involving a single identified individual; ("comparaison informatise") "
participant" means a person having custody or control of a database involved in a computer matching. ("participant")
Application
(2) This section applies to a computer matching if,
(a)at least one of the databases involved in the matching includes records of personal health information and is in the custody or under the control of a health information custodian that is an institution within the meaning of the Freedom of Information and Protection of Privacy Act or the Municipal Freedom of Information and Protection of Privacy Act\; and
(b)the results of the matching will be used for a purpose that directly affects an individual.
Exceptions
(3) This section does not apply to a computer matching if,
(a)the matching does not involve personal health information;
(b)the matching is performed for a research or statistical purpose;
(c)the purpose of the matching is to audit, evaluate or review a program or service;
(d)the data to be compared is collected for the same purpose or program;
(e)the purpose of the matching is to ensure that personal information is accurate and current and to update the information;
(f)the purpose of the matching is to reconcile financial information; or
(g)the purpose of the matching is one that is prescribed by the regulations.
Condition for custodians
(4) A health information custodian shall not engage in a computer matching unless the collection, use and disclosure by the custodian of the records of personal health information involved in the matching are otherwise permitted by this Act.
Prescribed requirements
(5) A health information custodian shall comply with the requirements prescribed by the regulations when engaging in a computer matching.
Designated participant
(6) The participants shall designate, for the purpose of subsection (7), one of the participants that is a health information custodian and an institution within the meaning of the Freedom of Information and Protection of Privacy Act or the Municipal Freedom of Information and Protection of Privacy Act.
Assessment
(7) The designated participant shall ensure that an assessment relating to the computer matching is prepared and submitted to the Commissioner at least 45 days before the matching is implemented unless the assessment that would be prepared is substantially similar to an assessment that the designated participant has already had prepared and submitted to the Commissioner.
Contents of assessment
(8) The assessment shall,
(a)name the participants in the computer matching or describe the class to which they belong in a manner that is sufficient to identify them;
(b)describe the type of records to be compared by the computer matching;
(c)describe the type of records that will result from the computer matching;
(d)set out the purpose or purposes, as the case may be, for which the records resulting from the computer matching will be used;
(e)set out the authority under this Act for each collection, use and disclosure of records of personal health information that the computer matching will involve;
(f)state the duration of the computer matching;
(g)set out the administrative, technical and physical safeguards and practices that the participants in the computer matching will implement in relation to the matching to ensure the security, accuracy and integrity of the records of personal health information involved in the matching;
(h)set out an analysis of the expected costs and benefits of the computer matching; and
(i)describe when and how individuals who may be directly affected by the computer matching have been or will be notified about the matching or explain why individuals who may be directly affected by the matching will not be notified.
Comments by Commissioner
(9) On receiving an assessment under subsection (7), the Commissioner may review it and may offer comments respecting the proposed computer matching.
Delegation by Ministers
15. For the purposes of this Act, the Minister or any other Minister who is a health information custodian may in writing delegate a power granted to him or her under this Act, except for the power described in section 31, or a duty imposed on him or her under this Act to any person who is employed by or in the service of him or her, subject to the conditions, limitations, restrictions and requirements specified in the delegation.
Employees, etc., of health information custodians
16. (1) For the purposes of this Act, a person who is employed by or in the service of a health information custodian shall be deemed to be acting on behalf of the custodian when exercising powers or performing duties for or on behalf of the custodian, and not on the person's own behalf.
Limitation
(2) A health information custodian shall not permit any person who is employed by or in the service of the custodian to collect, use, disclose, retain or dispose of personal health information unless,
(a)the custodian is permitted or required to collect, use, disclose, retain or dispose of the information, as the case may be; and
(b)the collection, use, disclosure, retention or disposal of the information is in the course of the person's duties for or on behalf of the custodian and not contrary to the limits imposed by the custodian, this Act or another law.
Information manager
17. (1) In this section, "
information manager" means a person who, on behalf of a health information custodian,
(a)processes, stores or disposes of records of the custodian that contain personal health information, or
(b)provides information management or information technology services to the custodian with respect to records of the custodian that contain personal health information,
and includes a health information custodian who carries out any of the activities described in clause (a) or (b) on behalf of another health information custodian, but does not include a health information custodian who carries out any of those activities on the custodian's own behalf.
Not a health information custodian
(2) A health information custodian who receives personal health information as a result of acting as an information manager for another health information custodian is not a health information custodian with respect to the information.
Agreement required
(3) Subject to subsection (4), a health information custodian shall not provide personal health information to an information manager unless the custodian has entered into an agreement with the manager that,
(a)sets out the scope of and conditions for the activities that the manager is permitted or required to carry out on behalf of the custodian;
(b)provides for administrative, technical and physical safeguards relating to the confidentiality and security of the information;
(c)requires the manager not to provide access to or to use, disclose or dispose of the information except in accordance with the agreement;
(d)requires the manager to notify the custodian in writing immediately upon becoming aware that,
(i)a person has obtained access to the information other than in accordance with the agreement, or
(ii)the manager has used, disclosed or disposed of the information other than in accordance with the agreement; and
(e)meets the requirements prescribed by the regulations.
Transition
(4) If a health information custodian has provided personal health information to an information manager before the day this section comes into force, subsection (3) does not apply to the custodian until one year after this section comes into force.
PART IV
PRACTICES TO PROTECT
PERSONAL HEALTH
INFORMATION
Security
18. (1) A health information custodian who has custody or control of personal health information shall take reasonable steps to establish and maintain administrative, technical and physical safeguards and practices to,
(a)protect the integrity, accuracy and confidentiality of the information;
(b)protect against any reasonably foreseeable threat or hazard to the security or integrity of the information;
(c)protect against any reasonably foreseeable risk of loss of the information or unauthorized use, access to, disclosure or modification of the information; and
(d)ensure that persons who are employed by or in the service of the custodian will comply with this Act when acting for or on behalf of the custodian.
Prescribed safeguards and practices
(2) A health information custodian shall comply with the safeguards and practices prescribed by the regulations for the purposes described in clauses (1) (a) to (d).
Retention and disposal of records
19. (1) A health information custodian shall have in place a written policy concerning the retention and disposal of records of personal health information.
Policy
(2) The policy shall comply with the regulations and the health information custodian shall comply with the policy.
Method of disposal
(3) A health information custodian shall ensure that records of personal health information relating to an individual are disposed of in a manner that protects the privacy of the individual.
Application
(4) This section does not override or modify the requirements concerning the retention or disposal of records under an Act of Canada or another Act of Ontario.
Information for public
20. (1) A health information custodian shall designate an individual or individuals who are employed by or in the service of the custodian to,
(a)facilitate the custodian's compliance with this Act;
(b)ensure that all persons who are employed by or in the service of the custodian are appropriately informed of their duties under this Act while employed by or in the service of the custodian;
(c)respond to inquiries from the public about the custodian's information practices; and
(d)receive complaints from the public about the custodian's alleged contravention of this Act or the regulations.
Statement
(2) The health information custodian shall make available to the public upon request a statement that,
(a)describes the custodian's information practices;
(b)describes how to contact the individual or individuals mentioned in subsection (1);
(c)describes how an individual may obtain access to records of personal health information relating to the individual that is in the custody or control of the custodian; and
(d)describes how to make a complaint to the Commissioner with respect to the custodian's alleged contravention of this Act, the regulations or the custodian's information practices.
PART V
CONSENT CONCERNING
PERSONAL HEALTH
INFORMATION
Elements of consent
21. (1) Where this Act or any other Act requires the consent of an individual for the collection, use or disclosure of personal health information, the consent,
(a)must relate to the information;
(b)must be informed;
(c)must be given voluntarily; and
(d)must not be obtained through misrepresentation or fraud.
Informed consent
(2) A consent to the collection, use or disclosure of personal health information is informed if the individual who gives the consent has, at the time of giving the consent, the information that a reasonable person would require in the circumstances to make a decision about the collection, use or disclosure, as the case may be.
Same
(3) The information mentioned in subsection (2) that a reasonable person would require may include,
(a)the identity of the person who will collect, use, disclose or receive the information;
(b)the purpose of the collection, use or disclosure, as the case may be;
(c)the nature and extent of the information to be collected, used or disclosed, as the case may be;
(d)the reasonably foreseeable consequences of giving or withholding consent to the collection, use or disclosure, as the case may be; and
(e)if the information will be used or disclosed outside Ontario, the fact that it will be so used or disclosed and that the confidentiality and privacy protection provided with respect to the information outside Ontario may be different from the protection provided within Ontario.
Voluntary consent
(4) A consent for the collection, use or disclosure of personal health information relating to an individual shall not be deemed to have been given involuntarily solely because it was given so that the individual would be eligible to receive a statutory benefit.
Time-limited consent
(5) A consent to a collection, use or disclosure of personal health information may specify a time after which the consent will cease to be effective.
Form of consent
(6) A consent to a collection, use or disclosure of personal health information may be in the form approved by the Minister.
Revocation of consent
(7) The individual who gives a consent to a collection, use or disclosure of personal health information may revoke it at any time but the revocation shall not have retroactive effect.
Assumption of validity
(8) A health information custodian who receives a consent to a collection, use or disclosure of personal health information relating to an individual that the individual gives is entitled to assume that the consent fulfils the requirements of this section, unless it is not reasonable to assume so.
PART VI
COLLECTION, USE AND
DISCLOSURE OF PERSONAL
HEALTH INFORMATION
Limits on collection
22. (1) A health information custodian shall not collect personal health information unless the collection is expressly authorized by or under an Act or necessary for a lawful purpose related to a function or activity of the custodian.
Documenting purpose
(2) A health information custodian who collects personal health information shall document the purpose for which the custodian collects the information but the custodian is not required to do so if the custodian is collecting the information for the purpose of providing or assisting in providing health care.
Lawful means of collection
(3) A health information custodian shall not collect personal health information by any unlawful means.
Direct collection
(4) A health information custodian shall collect personal health information relating to an individual directly from the individual unless,
(a)the individual consents to another manner of collection;
(b)collection of the information directly from the individual is not reasonably practicable or could reasonably be expected to result in the collection of inaccurate information;
(c)another Act of Ontario or Canada permits another manner of collection;
(d)the information is collected from a person who is permitted or required by this Act or any other Act of Ontario or Canada to disclose the information to the custodian;
(e)the information is collected for a purpose related to investigating a breach of an agreement or a contravention or an alleged contravention of the laws of Ontario or Canada; or
(f)the information is collected for the purpose of the conduct of a proceeding or a possible proceeding.
Notice of purpose
(5) If a health information custodian collects personal health information relating to an individual directly from the individual, the custodian shall take reasonable steps, before or while collecting the information or as soon as practicable afterwards, to inform the individual of the purpose or purposes for which the information is being collected unless it is reasonable to infer them in the circumstances.
Confidentiality
23. (1) Subject to subsection (2), a health information custodian shall maintain the confidentiality of the personal health information in the custody or under the control of the custodian.
Records kept in individual's home
(2) Subject to the regulations, a health information custodian may keep a record of personal health information relating to an individual in the individual's home if the custodian takes steps that are reasonable in the circumstances to inform the individual, and if applicable all persons who provide care to the individual in the home, that the information contained in the record is confidential.
Limits on use and
disclosure
24. (1) A health information custodian shall not use or disclose the personal health information in the custodian's custody or control except as permitted or required under this Act and in accordance with the custodian's lawful purposes.
Accuracy of information
(2) Before using or disclosing personal health information, a health information custodian shall take steps that are reasonable in the circumstances to ensure that the information is accurate, complete and not misleading.
Limits on recipient
(3) Unless this Act or some other law specifically provides otherwise, a person to whom a health information custodian discloses personal health information relating to an individual, other than that individual or another health information custodian, shall not use or disclose the information for any purpose other than,
(a)the purpose for which the custodian was authorized to disclose the information under this Act;
(b)a purpose directly related to the purpose for which the custodian was authorized to disclose the information;
(c)a purpose to which the individual consents; or
(d)a purpose authorized under some other law.
Unlawful use or disclosure
(4) No person who obtains personal health information in contravention of this Act may use or disclose it.
Information about uses and disclosures
25. (1) In the circumstances prescribed by the regulations, a health information custodian who uses or discloses personal health information relating to an individual shall give the individual information about the uses and disclosures that the custodian expects to make.
Same, unanticipated uses or disclosures
(2) If, in the circumstances prescribed by the regulations, a health information custodian makes an unanticipated use or disclosure of personal health information relating to an individual, the custodian shall make a note of the use or disclosure in accordance with the requirements prescribed by the regulations.
Note
(3) The note shall form part of the records of personal health information relating to the individual or be in a form that is linked to the records.
Limits on marketing
26. (1) A health information custodian who has custody or control of personal health information relating to an individual shall not use or disclose the information to market services or for market research unless the individual consents.
Limits on fundraising
(2) A health information custodian who has custody or control of personal health information relating to an individual shall not use or disclose the information for the purpose of fundraising activities unless the individual consents.
Exception re fundraising
(3) Despite subsection (2), a health information custodian that is a facility or organization that provides health care may, without the consent of the individual, use or disclose the individual's name and address for the purpose of fundraising activities if all of the following conditions are met:
1.The fundraising activities are undertaken for a charitable or philanthropic purpose related to the custodian's operations.
2.The custodian gives written notice to the individual that his or her personal health information may be used or disclosed for fundraising purposes unless the individual, or the person who is authorized under Part IX to consent on behalf of the individual, expressly requests the custodian not to do so.
3.The individual, or the person who is authorized under Part IX to consent on behalf of the individual, has not made the request described in paragraph 2.
4.The custodian meets the requirements prescribed by the regulations with respect to the use or disclosure.
5.The use or disclosure is not prohibited by the regulations.
Permitted uses
27. A health information custodian may use personal health information relating to an individual,
(a)for the purpose for which the information was collected or created;
(b)for a purpose that is directly related to the purpose for which it was collected or created;
(c)if the individual consents to the use;
(d)for the purpose for which a person may disclose, or is required to disclose, the information to the custodian under this Act;
(e)for planning or delivering programs or services of the custodian, allocating resources to any of them, evaluating or monitoring any of them or detecting, monitoring or preventing fraud related to any of them;
(f)for the purpose of risk management, error management or other activities to improve the quality of care or to improve the quality of any related programs or services of the custodian;
(g)for educating persons employed by or in the service of the custodian who provides health care;
(h)for concealing the identity of the individual, separating out identifiers of the individual from the information or deriving anonymous or statistical information from the information;
(i)for a research project or program conducted by a researcher who is employed by or in the service of the custodian, if the requirements of section 32 are met in the same way that those requirements would apply to information being disclosed under that section;
(j)in the circumstances described in clause 42 (d) of the Freedom of Information and Protection of Privacy Act, if other records in the custody or under the control of the custodian are subject to that Act; or
(k)subject to this Act, if permitted or required under any other Act of Ontario or an Act of Canada or a treaty, agreement or arrangement made under any of those Acts.
Disclosure with consent
28. Unless this Act expressly provides otherwise, a health information custodian may disclose personal health information relating to an individual if the individual consents to the disclosure.
Disclosures related to the individual
29. (1) A health information custodian may disclose personal health information relating to an individual,
(a)to a person described in one of paragraphs 1 to 4, 11 and 12 of the definition of "health information custodian" in subsection 2 (1), if the disclosure is made for the purpose of providing, or assisting in providing, health care to the individual;
(b)for the purpose of determining or verifying the eligibility of the individual under an Act of Ontario or Canada to receive health care or health-related benefits or other benefits provided by a health information custodian, where the health care or benefits are provided or funded by the Government of Ontario or Canada or a municipality, including a regional municipality, The District Municipality of Muskoka or the County of Oxford;
(c)for the purpose of obtaining payment for health care provided to the individual; or
(d)for the purpose of contacting a relative or friend of the individual, if the individual is injured, incapacitated or ill.
Facility that provides health care
(2) A health information custodian that is a facility that provides health care may disclose to any person the following personal health information relating to an individual who is a patient or a resident in the facility if the disclosure is not contrary to the express request of the individual, or the person who is authorized under Part IX to consent on behalf of the individual:
1.Confirmation that the individual is a patient or resident in the facility.
2.The individual's general health status described as critical, poor, fair, stable or satisfactory, or in terms indicating similar conditions.
3.The location of the individual in the facility.
Deceased individual
(3) A health information custodian may disclose personal health information relating to an individual who is deceased,
(a)for the purpose of identifying the individual;
(b)for the purpose of informing any person whom it is reasonable to inform in the circumstances that the individual is deceased and informing that person of the circumstances of the individual's death;
(c)to the estate trustee of the individual or, if the individual does not have an estate trustee, the person who has assumed responsibility for the administration of the individual's estate, if the information relates to the administration of the individual's estate; or
(d)to the spouse, partner or relative, within the meaning of Part IX, of the individual to allow the recipients of the information to make decisions about their own health care or their children's health care, if the custodian reasonably believes the disclosure does not constitute an unreasonable invasion of the individual's privacy.
Disclosures for health
or other programs
30. (1) A health information custodian may disclose personal health information,
(a)to the Chief Medical Officer of Health or a medical officer of health within the meaning of the Health Protection and Promotion Act or a similar public health authority established under the laws of Canada, a province other than Ontario or a territory, if the disclosure is made for the purpose of public health protection and promotion;
(b)to Cancer Care Ontario;
(c)subject to the regulations, for the purposes of a health screening program designated in the regulations if,
(i)the custodian has given notice to the individual informing him or her that the custodian may disclose personal health information for the purposes of the program unless the individual, or the person who is authorized under Part IX to consent on behalf of the individual, expressly requests the custodian not to disclose the information for the purposes of the program, and
(ii)the individual, or the person who is authorized under Part IX to consent on behalf of the individual, has not requested the custodian not to disclose the information for the purposes of the program; or
(d)to a person conducting an audit, reviewing an application for accreditation or reviewing an accreditation, if the audit or the review relates to services provided by the custodian and the person does not remove any records of personal health information from the custodian's premises.
Management
(2) A health information custodian may disclose personal health information to a person for the purpose of the management of the custodian's programs or services, including the delivery of services, the evaluation and monitoring of any of the programs or services, the allocation of resources, future planning and the detection, monitoring and prevention of fraud.
Safeguards
(3) If a health information custodian discloses personal health information to a person under subsection (2), the custodian shall take steps that are reasonable in the circumstances to ensure that the person has in place, at the time of the disclosure, administrative, technical and physical safeguards relating to the confidentiality and security of the information.
Disclosure to Minister
(4) A health information custodian may disclose personal health information to the Minister,
(a)for the purpose of the management of the health system, including the delivery of services, the evaluation and monitoring of the system or part of it, the allocation of resources, future planning and the detection, monitoring and prevention of fraud;
(b)for the purpose of verifying the accuracy of information that the Ministry holds;
(c)for the purpose of verifying the accuracy of information that a person holds for a health-related purpose or a purpose related to other benefits provided by a health information custodian; or
(d)for a purpose related to the administration, operation or enforcement of an Act administered by the Minister.
Disclosure by Minister
(5) The Minister may disclose personal health information,
(a)to a person or a member of a class of persons designated by the Minister in a regulation made by the Minister, for the purpose of the management of the health system, including the delivery of services, the evaluation and monitoring of the system or part of it, the allocation of resources, future planning and the detection, monitoring and prevention of fraud;
(b)for the purpose of verifying the accuracy of information that the Ministry holds;
(c)for the purpose of verifying the accuracy of information that a person holds for a health-related purpose or a purpose related to other benefits provided by a health information custodian; or
(d)for a purpose related to the administration, operation or enforcement of an Act administered by the Minister.
Safeguards
(6) Upon disclosing personal health information to a person under subsection (5), the Minister shall take steps that are reasonable in the circumstances to ensure that the person has in place, at the time of the disclosure, administrative, technical and physical safeguards relating to the confidentiality and security of the information.
Disclosure directed by Minister
31. (1) The Minister may direct a person described in one of paragraphs 1 to 4, 7, 9, 11, 12 and 13 of the definition of "health information custodian" in subsection 2 (1) to disclose personal health information collected in connection with the provision of a program or service if the disclosure is for a purpose described in clause 30 (4) (a), (b) or (c).
Limitation
(2) Before issuing a direction under subsection (1), the Minister shall allow the Commissioner an opportunity to review the direction and to comment on it within 30 days of receiving a written copy of it if the program or service mentioned in that subsection is health related but not paid for, in whole or in part, by the Ministry or not provided using physical, financial or human resources that the Ministry provides, administers or pays for, in whole or in part.
Privacy interest of individual
(3) Before issuing a direction under subsection (1), the Minister shall consider the public interest served by the direction and the privacy interest of the individual to whom the personal health information relates in the circumstances.
Same, Commissioner
(4) In commenting on a direction mentioned in subsection (1), the Commissioner shall consider the public interest served by the direction and the privacy interest of the individual to whom the personal health information relates in the circumstances.
Form, manner and time of disclosure
(5) In issuing the direction, the Minister may specify the form and manner in which and the time at which the health information custodian is required to disclose the personal health information.
Person to whom disclosure made
(6) The Minister may not direct a health information custodian to disclose personal health information under this section to a person other than,
(a)the Minister;
(b)a Ministry official designated by the Minister who requires the information in exercising powers or performing duties within the Ministry; or
(c)a person who is designated by the Minister in a regulation made by the Minister and who enters into an agreement with the Minister agreeing,
(i)to use or disclose the information only for a purpose specified in clause 30 (4) (a), (b) or (c) or a purpose that is consistent with that purpose, and
(ii)to establish and implement the administrative, technical and physical safeguards relating to the confidentiality and security of the information that the agreement specifies.
Compliance
(7) A person to whom a direction is issued in accordance with this section shall comply with it.
Research project or program
32. (1) A health information custodian may disclose personal health information to a researcher, being a person conducting a research project or program, only if a research ethics review body designated by regulation has approved the project or program in accordance with this section.
Exception
(2) Subsection (1) does not apply to a disclosure made under section 30 or 31.
Power of research ethics review body
(3) A research ethics review body may approve a research project or program, with or without conditions, and, upon approving a project or program, may specify that the researcher is required to obtain consent to the disclosure of the personal health information for the purposes of the project or program from the individuals to whom the information relates.
Conditions for approval
(4) When deciding whether to approve a research project or program, a research ethics review body shall assess whether, in its opinion,
(a)the objective of the project or program cannot reasonably be accomplished without using the personal health information that is to be disclosed;
(b)the researcher is qualified to conduct the project or program; and
(c)at the time the project or program is conducted, adequate safeguards will be in effect to protect the privacy of the individuals to whom the personal health information relates and to protect the confidentiality of the information.
Conditions for requiring consent
(5) When determining whether to specify that a researcher is required to obtain the consent of the applicable individuals, a research ethics review body shall consider the matters that are prescribed by the regulations.
Application for disclosure
(6) After obtaining the approval of a research ethics review body for a research project or program, the researcher may apply in writing to one or more health information custodians for the disclosure of the personal health information to be used for the project or program.
Same
(7) The application for disclosure of personal health information must be accompanied by a copy of the decision of the research ethics review body about the research project or program.
Decision to disclose
(8) A health information custodian may, but is not required, to disclose the personal health information in respect of which the application is made.
Same
(9) If the research ethics review body specifies that the researcher is required to obtain the prior consent of the individuals to whom the personal health information relates and that is to be disclosed for the purposes of the research project or program, the health information custodian shall not disclose the personal health information in respect of which consent has not been obtained.
Agreement respecting disclosure
(10) Before a health information custodian discloses personal health information to a researcher, the researcher must enter into an agreement with the custodian in which the researcher agrees,
(a)to comply with any conditions or restrictions specified by the research ethics review body in respect of the research project or program;
(b)to comply with the conditions or restrictions that the custodian imposes relating to the use, protection, disclosure, return or disposal of the information;
(c)not to publish information in a form that could reasonably enable a person to ascertain the identity of an individual to whom the information relates;
(d)not to disclose the name of an individual or any identifiers of an individual; and
(e)not to make contact with an individual to whom the information relates, unless the custodian contacts the individual to obtain his or her consent to being contacted or the custodian authorizes the researcher in writing to contact the individual.
Freedom of information legislation
(11) The Freedom of Information and Protection of Privacy Act and the Municipal Freedom of Information and Protection of Privacy Act do not apply to personal information within the meaning of those Acts that a researcher requires for the purpose of conducting a research project or program if the researcher has entered into an agreement described in subsection (10) with respect to the project or program and, in that case, the agreement applies to that personal information as well as to personal health information with respect to the project or program.
Use for additional project
or program
(12) A health information custodian who has disclosed information to a researcher under this section for the purpose of a research project or program shall not give the researcher permission to use the same information for another research project or program unless a research ethics review body approves the latter project or program in accordance with this section and the researcher complies with any requirements imposed by the review body.
Same
(13) If personal health information is disclosed to a researcher for the purpose of one research project or program, the researcher shall not use it for the purposes of another project or program until a research ethics review body approves the latter project or program in accordance with this section.
Disclosure under other Acts
(14) Despite any other Act that allows a health information custodian to disclose personal health information to a researcher for the purpose of a research project or program, this section applies to the disclosure as if it were made under this Act.
Transition
(15) A health information custodian who disclosed personal health information to a researcher for the purpose of a research project or program before the day this section comes into force and that discloses personal health information to the researcher for that purpose after that day is not required to enter into the agreement described in subsection (10) until the later of the time at which the custodian discloses the information and one year after the day on which this section comes into force.
Disclosures related to risks and custody
of the individual
33. A health information custodian may disclose personal health information relating to an individual,
(a)for the purpose of eliminating or reducing a risk to an individual's safety if the custodian believes on reasonable grounds that the risk is significant; or
(b)to the head of a penal or other custodial institution in which the individual is being lawfully detained or to the officer in charge of a psychiatric facility within the meaning of the Mental Health Act in which the individual is being lawfully detained, to assist the institution or the facility in managing the individual's physical or mental health or making a decision concerning the placement of the individual into custody, detention or release under Part IV of the Child and Family Services Act, the Mental Health Act, the Ministry of Correctional Services Act, the Corrections and Conditional Release Act (Canada), Part XX.1 of the Criminal Code (Canada) or the Young Offenders Act (Canada).
Disclosures in proceedings
34. (1) Subject to this section, a health information custodian may disclose personal health information relating to an individual,
(a)for the purpose of a proceeding to which the custodian is a party;
(b)to a person who is or was employed by or in the service of the custodian, or a solicitor acting on the person's behalf, if the information relates to a proceeding,
(i)that has been commenced or that is reasonably in contemplation, and
(ii)to which the individual is a party or is likely to be a party;
(c)to a litigation guardian or legal representative who is authorized under the Rules of Civil Procedure, or by a court order, to commence, defend or continue a proceeding on behalf of the individual or to represent the individual in a proceeding;
(d)to the Children's Lawyer to enable him or her to prepare a report mentioned in section 112 of the Courts of Justice Act\; or
(e)for the purpose of complying with,
(i)a summons, order or similar requirement issued in a proceeding by a person having jurisdiction to compel the production of information, or
(ii)a procedural rule that relates to the production of information in a proceeding.
Exception
(2) Nothing in subsection (1) permits a health information custodian to disclose personal health information in a proceeding where the custodian acts as a tribunal or adjudicator or to which section 35, 86.1 or 102 of the Health Protection and Promotion Act applies.
Application of subss. (4) to (10)
(3) Despite any other Act that allows a health information custodian to disclose personal health information in a proceeding, subsections (4) to (10) apply to the disclosure as if it were made under this Act.
Limitation on certain providers
(4) No person described in one of paragraphs 1 to 4 of the definition of "health information custodian" in subsection 2 (1) and no person who is or was employed by or in the service of one of those custodians shall disclose, in a proceeding, personal health information relating to an individual who has received services from them unless,
(a)the court or other body holding the proceeding,
(i)holds a hearing, from which the public is excluded and of which notice is given to the individual to whom the personal health information relates or the person who is authorized under Part IX to consent on behalf of the individual, and
(ii)determines that the disclosure is essential in the interests of justice and orders the disclosure;
(b)the individual consents;
(c)the individual or the person who is legally authorized to act on the individual's behalf is a party to the proceeding and relies on the individual's physical or mental health as an element of the claim or defence in the proceeding;
(d)the proceeding is one in which the competency, capacity, conduct, actions, licensing or registration of a person are in issue;
(e)the proceeding is before the Consent and Capacity Board, the Ontario Review Board or the Health Services Appeal and Review Board or is an appeal from a decision of any of those Boards;
(f)the proceeding is for an order to be made under the Substitute Decisions Act, 1992 with respect to the individual;
(g)the proceeding is a proceeding under Part III of the Child and Family Services Act\;
(h)the proceeding is for an order to be made under Part VI of the Child and Family Services Act with respect to the commitment of the individual to a secure treatment program or the extension or termination of the commitment;
(i)the proceeding is one in which the information was collected or created in the course of an examination or assessment of the physical or mental condition of the individual ordered by the court or other body holding the proceeding and the disclosure is made for the purpose for which the examination or assessment was ordered; or
(j)the proceeding is a proceeding before the Commissioner.
Statement by health care practitioner
(5) If,
(a)a summons, order or similar requirement mentioned in clause (1) (e) requires a health information custodian within the meaning of one of paragraphs 1 to 4 of the definition of "health information custodian" in subsection 2 (1) to disclose a record of personal health information relating to an individual in a proceeding; and
(b)the custodian receives a statement in writing from a physician, psychologist or other appropriate health care practitioner that the disclosure of the record or a specified part of the record is likely to result in harm to the treatment or recovery of the individual, injury to the mental condition of another individual or bodily harm to another individual,
the custodian shall not disclose the record unless the court or other body holding the proceeding orders the disclosure.
Hearing
(6) The court or other body holding the proceeding shall not make an order mentioned in subsection (5) until it has held a hearing, from which the public is excluded and of which notice is given to the custodian and the person who provided the statement.
Consent irrelevant
(7) Subsections (5) and (6) apply even if the individual to whom the personal health information contained in the record relates has consented to the disclosure.
Examination of record
(8) At the request of the court or other body holding a hearing under subsection (6), the custodian of the record of personal health information to which the hearing relates shall disclose it to the court or other body for the purpose of the hearing.
Order
(9) The court or other body holding a hearing under subsection (6) may order a person to comply with the summons, order or other requirement, as regards the record or a part of the record,
(a)if the court or other body is satisfied that the disclosure is not likely to result in harm to the treatment or recovery of the individual to whom the personal health information contained in the record relates, injury to the mental condition of another individual or bodily harm to another individual; or
(b)if, despite being satisfied that the disclosure is likely to result in harm to the treatment or recovery of the individual to whom the personal health information contained in the record relates, injury to the mental condition of another individual or bodily harm to another individual, the court or other body is satisfied that the disclosure is essential in the interests of justice.
Return of record
(10) If a health information custodian discloses a record of personal health information in a proceeding as authorized by this section, the court or other body holding the proceeding shall return it to the custodian immediately after the court or other body has determined the matter with respect to which the disclosure was made.
Transition
(11) References in this section to a proceeding do not include a proceeding commenced before the day this section comes into force.
Transfer of records
35. A health information custodian may disclose personal health information,
(a)to a person for the purpose of transferring records of personal health information to the custodian's successor; or
(b)to a person whose functions include the conservation of records of historical or archival importance, if the disclosure is made for the purpose of conserving records of personal health information.
Disclosures related to this
or other Acts
36. (1) A health information custodian may disclose personal health information,
(a)for the purpose of determining, assessing or confirming capacity under the Health Care Consent Act, 1996, the Substitute Decisions Act, 1992 or this Act;
(b)to a College within the meaning of the Regulated Health Professions Act, 1991 for the purpose of the administration or enforcement of the Drug and Pharmacies Regulation Act, the Regulated Health Professions Act, 1991 or an Act named in Schedule I to that Act;
(c)to the Board of Regents continued under the Drugless Practitioners Act for the purpose of the administration or enforcement of that Act;
(d)to the Ontario College of Social Workers and Social Service Workers for the purpose of the administration or enforcement of the Social Work and Social Service Work Act, 1998\;
(e)to the Public Guardian and Trustee or a children's aid society so that they can carry out their statutory functions;
(f)in the circumstances described in section 11 or clause 21 (1) (c), 42 (g), (h), (j), (k) or (n) of the Freedom of Information and Protection of Privacy Act or section 5 or clause 14 (1) (c), 32 (d), (g), (h) or (l) of the Municipal Freedom of Information and Protection of Privacy Act, if other records in the custody or under the control of the custodian are subject to either of those two Acts;
(g)to a person so that the person can decide whether to carry out an inspection, investigation or similar procedure that is authorized under an Act of Ontario or Canada or by a warrant if the custodian has reasonable grounds to suspect that the inspection, investigation or similar procedure is likely to produce evidence that an offence has been committed against an enactment of Ontario or Canada;
(h)to a person carrying out an inspection, investigation or similar procedure that is authorized under an Act of Ontario or Canada or by a warrant; or
(i)subject to this Act, if permitted or required under any other Act of Ontario or an Act of Canada or a treaty, agreement or arrangement made under any of those Acts.
(2) Subsection (3) applies only if Bill 155 (An Act to provide civil remedies for organized crime and other unlawful activities, introduced on December 5, 2000) receives Royal Assent.
(3) On the later of the day this section comes into force and the day subsection 19 (4) of Bill 155, as set out in the version on first reading of the Bill, comes into force, subsection (1) is amended by striking out "or" at the end of clause (h) and by adding the following clause:
(h.1)to the Attorney General, if the custodian believes that the disclosure would assist in determining whether a proceeding should be commenced under the Remedies for Organized Crime and Other Unlawful Activities Act, 2000, in conducting a proceeding under that Act or in enforcing an order made under that Act; or
. . . . .
Use or disclosure outside Ontario
37. (1) A health information custodian shall not use personal health information collected in Ontario outside Ontario unless,
(a)this Act would permit the custodian to make the same use of the information in Ontario; and
(b)the custodian takes appropriate steps to preserve the confidentiality of the information.
Disclosure
(2) A health information custodian shall not disclose personal health information collected in Ontario to a person outside Ontario unless,
(a)the person receiving the information performs functions comparable to the functions performed by a person to whom this Act would permit the custodian to disclose the information in Ontario; and
(b)the custodian believes on reasonable grounds that the person receiving the information will take appropriate steps to preserve the confidentiality of the information.
Exception
(3) Nothing in this section affects a use or disclosure of personal health information that another Act requires be made.
Health cards and health numbers
38. (1) In this section, "
health card" means a card provided to an insured person within the meaning of the Health Insurance Act by the General Manager of the Ontario Health Insurance Plan; ("carte Sant") "
publicly funded health resource" means a service,
thing, subsidy or other benefit that is,
(a)health related or prescribed by the regulations, and
(b)funded, in whole or in part, directly or indirectly by the Government of Ontario or Canada or a municipality, including a regional municipality, The District Municipality of Muskoka or the County of Oxford. ("ressource en matire de sant financement public")
Non-health information
custodians
(2) A person who is not a health information custodian shall not collect, use or disclose another person's health number except,
(a)for purposes related to the provision of publicly funded health resources to that other person;
(b)for the purposes for which a health information custodian may disclose the number to that other person;
(c)if another Act specifically authorizes the collection, use or disclosure; or
(d)if the person is prescribed by the regulations and is collecting, using or disclosing the health number, as the case may be, in the circumstances prescribed by the regulations.
Privacy of health cards
(3) No person shall require the production of another person's health card, except that a person who provides a publicly funded health resource to a person who has a health card may require the production of the health card.
Fees
39. A health information custodian shall not charge fees that differ from those permitted by the regulations when collecting, using or disclosing personal health information to a person under this Act.
PART VII
QUALITY OF CARE INFORMATION
Definitions
40. In this Part, "
committee", subject to the regulations, means a committee consisting of one or more individuals that,
(a)is established, appointed or approved by a hospital or by another prescribed facility, organization or person that provides health care or that is established under an Act, and
(b)has the responsibility of examining, evaluating, studying or researching the health care and related services provided to individuals in the hospital or by the facility, organization or person for the purpose of,
(i)improving the quality of the health care and related services provided, or
(ii)educating the persons who provide the health care or related services,
which purpose may include quality assurance, error and risk management, peer review, ethics review, utilization review, outcome review or a medical or other professional audit; ("comit") "
quality of care information" means information, whether or not recorded, that,
(a)has been collected, prepared or disclosed to a committee exclusively for the use of the committee in realizing its purpose,
(b)has been considered by a committee exclusively in realizing its purpose, or
(c)results from any activity that a committee carries on in order to realize its purpose,
but does not include an original or a copy of,
(d)a record about health care or related services provided to an individual in a hospital or by another prescribed facility, organization or person that provides health care, or
(e)any other record of a hospital or of another prescribed facility, organization or person that provides health care; ("renseignements sur la qualit des soins") "
witness" includes a person who, in the course of a proceeding, whether or not a party to it,
(a)is examined for discovery, orally or in writing,
(b)makes an affidavit that is submitted as evidence in the proceeding,
(c)is cross-examined on an affidavit that the person has made and that is submitted as evidence in the proceeding, or
(d)is called upon, whether under oath or not, to answer a question or to produce a document. ("tmoin")
Non-disclosure in proceeding
41. (1) Despite any law, no person may ask a witness in a proceeding and no court or other body holding a proceeding shall permit a witness in the proceeding to,
(a)answer any question or make any statement with respect to any activity of a committee; or
(b)produce quality of care information.
Same, witness
(2) Despite any law, no witness shall, in a proceeding,
(a)answer any question or make any statement with respect to any activity of a committee; or
(b)produce quality of care information.
Non-admissibility of evidence
(3) Despite any law, no quality of care information is admissible in evidence in a proceeding.
Other situations unaffected
(4) Nothing in this section affects,
(a)anything in subsection 83 (5) of the Health Professions Procedural Code that is Schedule 2 to the Regulated Health Professions Act, 1991\; or
(b)any legal requirement for a person to produce quality of care information or to answer questions or make statements with respect to that information in any situation that is not a proceeding.
Reporting permitted
42. Despite any other provision of this Act, a committee may disclose quality of care information to the management of the hospital, facility or organization that established, appointed or approved the committee if the committee considers it appropriate to do so.
Immunity
43. (1) No action or other proceeding for damages may be instituted against a person who in good faith discloses quality of care information to a committee for the purpose of an activity that the committee carries on in order to realize its purpose if the disclosure was reasonable in the circumstances.
Same, committee member
(2) No action or other proceeding for damages may be instituted against a member of a committee who, in good faith in the course of carrying on an activity designed to realize the committee's purpose, discloses quality of care information to another person or takes any other measure if the disclosure or the other measure was reasonable in the circumstances.
PART VIII
ACCESS TO RECORDS OF
PERSONAL HEALTH INFORMATION
Non-application of Part
44. This Part does not apply to records of,
(a)personal health information that is quality of care information as defined in Part VII;
(b)personal health information collected or created in the course of conducting a quality assurance program within the meaning of the Health Professions Procedural Code that is Schedule 2 to the Regulated Health Professions Act, 1991\;
(c)personal health information that, under the Regulated Health Professions Act, 1991 is not admissible in evidence in a civil proceeding;
(d)personal health information of a type prescribed by the regulations; or
(e)personal health information in the custody or under the control of a class or classes of health information custodians prescribed by the regulations.
Right of access
45. (1) Subject to this Part, an individual is entitled, in accordance with this Part, to obtain access to records of personal health information relating to the individual that is in the custody or under the control of a health information custodian.
Informal access
(2) Nothing in this Part prevents a health information custodian from granting an individual access to a record of personal health information, to which the individual is entitled to access, if the individual makes an oral request for access or does not make any request for access.
Communications
(3) Nothing in this Part prevents a health information custodian and an individual from communicating with each other with respect to personal health information relating to the individual that is in the custody or under the control of the custodian.
Access by person making decision
46. (1) A person who is authorized under this or any other Act to consent or to make a decision on behalf of or in the place of an individual, or to participate in planning for an individual's care, is entitled to access to a record of personal health information relating to the individual in accordance with this Part if the record is needed to make the decision or to participate effectively in planning for the individual's care.
Access by parent, etc.
(2) A parent of a child who is less than 16 years of age or a children's aid society or other person who is lawfully entitled to give or refuse consent to a treatment in the place of the parent is entitled, under subsection (1), to access to a record of personal health information relating to the child unless the record relates to,
(a)treatment within the meaning of the Health Care Consent Act, 1996, about which the child has made a decision on his or her own in accordance with that Act; or
(b)counselling in which the child has participated on his or her own under the Child and Family Services Act.
Definition
(3) In subsection (2), "
parent" includes an individual who has lawful custody of the child or a right of access to the child, unless a court order or a separation agreement within the meaning of Part IV of the Family Law Act made between the individuals described in this definition provides otherwise.
Access by child
(4) Nothing in subsection (2) affects the right of a child to obtain access to a record of personal health information relating to the child in accordance with this Part, in addition to a person who under subsection (2) is entitled to access.
Access after decision
(5) A person who has made a decision on behalf of or in the place of an individual, as is authorized under this or any other Act, is entitled to access to a record of personal health information relating to the individual that relates to the decision.
Procedure for access
(6) Section 47 applies with necessary modifications to a request for access to a record of personal health information relating to an individual if the request is made by a person entitled to access under subsection (1), (2), (4) or (5).
Procedure for access
47. (1) A request for access to a record of personal health information must,
(a)be in writing accompanied by the fee that the health information custodian charges for that purpose, which fee shall comply with the regulations;
(b)contain sufficient detail to enable the health information custodian to identify it upon reasonable efforts; and
(c)if the record is located in a personal information bank within the meaning of the Freedom of Information and Protection of Privacy Act or the Municipal Freedom of Information and Protection of Privacy Act, identify the bank or otherwise identify the location of the record.
Sufficiency of detail
(2) If the request does not contain sufficient detail to enable the health information custodian to identify the record upon reasonable efforts, the custodian shall offer assistance to the person requesting access in reformulating the request to comply with clause (1) (b).
Custodian's response
(3) Subject to subsections (4) and (6), a health information custodian who receives a request from an individual for access to a record of personal health information relating to the individual shall, as soon as possible in the circumstances but no later than within 30 days after receiving the request,
(a)make the record available to the individual for examination and, at the request of the individual, provide a copy to the individual of the record made available;
(b)give a written notice to the individual stating that the record does not exist or cannot be found, if that is the case; or
(c)if the custodian is entitled to refuse the request, in whole or in part, give a written notice to the individual stating that the custodian is refusing the request, in whole or in part, specifying the reason for the refusal and stating that the individual is entitled to make a complaint about the refusal to the Commissioner under Part XI.
Extension of time
(4) The custodian may, within 30 days after receiving the request, extend the time limit set out in subsection (3) for a further period of time of not more than 30 days if,
(a)meeting the time limit would unreasonably interfere with the operations of the custodian because the record consists of a large number of pieces of information or locating the record would necessitate a lengthy search; or
(b)consultations with a person outside the custodian are necessary to comply with the request and cannot reasonably be completed within the time limit.
Notice of extension
(5) If the custodian extends the time limit under subsection (4), the custodian shall give the person who made the request written notice of the extension setting out the length of the extension and the reason for the extension.
Repeated requests
(6) A health information custodian who responds under subsection (3) to a request for access to a record of personal health information is not required to respond under that subsection to a subsequent request for access to the record from the same individual who made the initial request.
Right to complain
(7) If the custodian refuses the request, in whole or in part, the individual is entitled to make a complaint about the refusal to the Commissioner under Part XI.
Identity of individual
(8) A health information custodian shall not grant an individual access to a record of personal health information under this section without first taking reasonable steps to be satisfied as to the individual's identity.
Fee for copy
(9) A health information custodian who makes a record of personal health information or a part of it available to an individual for inspection or provides a copy of it to an individual under clause (3) (a) may charge the individual a reasonable fee for that purpose in accordance with the regulations, but shall first give the individual an estimate of the fee.
Waiver of fees
(10) A health information custodian mentioned in subsection (9) may waive the payment of all or any part of the fee that an individual is required to pay under that subsection if, in the custodian's opinion, it is fair and equitable to do so after considering the matters specified in the regulations.
Refusal of access
48. (1) A health information custodian may refuse to grant an individual access to a record of personal health information relating to the individual that is in the custody or under the control of the custodian if,
(a)the access could reasonably be expected to result in harm to the treatment or recovery of the individual, injury to the mental condition of another individual or bodily harm to another individual;
(b)the information in the record was collected or created,
(i)in the course of an inspection, investigation or similar procedure that is authorized by law or that is undertaken for the purpose of the detection, monitoring or prevention of fraud related to the custodian's resources, programs or services, or
(ii)primarily in anticipation of or use in a proceeding;
(c)the access could reasonably be expected to interfere with an inspection, investigation or similar procedure that is authorized by law or that is undertaken for the purpose of the detection, monitoring or prevention of fraud related to the custodian's resources, programs or services;
(d)the record contains raw data from standardized psychological tests or assessments;
(e)the record is subject to solicitor-client privilege;
(f)another Act or rule of law prohibits the disclosure;
(g)the access could reasonably be expected to constitute an unjustified invasion of another individual's personal privacy;
(h)the access could reasonably be expected to reveal industrial, commercial, scientific or technical secrets; or
(i)the access could reasonably be expected to reveal the identity of an individual who, as required by law, supplied the information to the custodian.
Consultation with health care practitioner
(2) The custodian may consult with a health care practitioner before deciding to refuse to grant the individual access to a record of personal health information under clause (1) (a).
Disclosure of opinion
(3) If the practitioner formulates an opinion with respect to the individual during the consultation, the practitioner may disclose the opinion to the custodian.
Return of information
(4) If the custodian discloses a record of personal health information to the practitioner during the consultation, the practitioner shall return it to the custodian upon request.
Severance of record
(5) A health information custodian who refuses to grant an individual access to part of a record of personal health information under subsection (1) shall, to the extent possible, sever the part from the rest of the record and grant the individual access to the rest of the record.
Freedom of information legislation
49. (1) A health information custodian may refuse access to all or part of a record of personal health information if other records in the custody or under the control of the custodian are subject to the Freedom of Information and Protection of Privacy Act or the Municipal Freedom of Information and Protection of Privacy Act and a request for access to the record of personal health information could be refused or would be required to be refused,
(a)under clause 49 (a), (c) or (e) of the Freedom of Information and Protection of Privacy Act, if the request were made under that Act and that Act applied to the record of personal health information; or
(b)under clause 38 (a) or (c) of the Municipal Freedom of Information and Protection of Privacy Act, if the request were made under that Act and that Act applied to the record of personal health information.
Appeal
(2) If a health information custodian refuses access to a record of personal health information under this section, the individual may appeal the refusal to the Information and Privacy Commissioner appointed under the Freedom of Information and Protection of Privacy Act and the custodian shall specify the right of appeal in the notice of refusal of access that the custodian gives under clause 47 (3) (c).
Disclosure of personal health information
(3) The custodian may disclose personal health information relating to the individual to the Information and Privacy Commissioner for the purpose of the appeal.
Application of other Act
(4) If the custodian refused access under the Freedom of Information and Protection of Privacy Act, Part IV of that Act applies with necessary modifications to the appeal.
Same
(5) If the custodian refused access under the Municipal Freedom of Information and Protection of Privacy Act, Part III of that Act applies with necessary modifications to the appeal.
Application of other subsections
(6) If the Information and Privacy Commissioner orders the custodian to grant the individual access to a record of personal health information, subsections 47 (8), (9) and (10) apply to the custodian with necessary modifications.
Amendment of record
50. (1) An individual who is granted access to a record of personal health information under this Part and who believes that there is an error or omission in the record may in writing request the health information custodian who has custody or control of the record to amend the record in order to improve its accuracy or completeness.
Oral request
(2) Nothing in this Part prevents a health information custodian from complying with an oral request that an individual makes to have the custodian amend a record of personal health information relating to the individual.
Duty of custodian
(3) Subject to subsection (4), within 30 days after receiving a request from an individual under subsection (1), the custodian shall,
(a)amend the record as requested by the individual, give written notice of the amendment to the individual and comply with subsection (5); or
(b)attach a concise statement of disagreement to the record indicating that the custodian has not made the amendment requested by the individual and give a copy of the statement to the individual.
Repeated requests
(4) A health information custodian who responds under subsection (3) to a request for an amendment to the record is not required to respond under that subsection to a subsequent request for the same amendment from the same individual who made the initial request.
Notice of amendment
(5) If the custodian makes the amendment requested, the custodian shall, at the request of the individual, give written notice of the amendment, to the extent practicable, to the persons to whom, within the lesser of the year preceding the amendment and the time since this section came into force, the custodian disclosed the information with respect to which the individual requested the amendment of the record, except if the amendment cannot reasonably be expected to have an effect on the ongoing provision of health care or other benefits to the individual.
Method of amendment
(6) A health information custodian who makes an amendment to a record of personal health information under this section shall make it without destroying or obliterating any information in the record, and may make it by attaching to the record the information that was omitted from it or that corrects an error in it.
Amendment becomes part of record
(7) An amendment that a health information custodian makes to a record of personal health information under this section becomes part of the record when the custodian makes it.
Statement of disagreement
(8) The statement of disagreement mentioned in clause (3) (b) must,
(a)set out the amendment requested by the individual;
(b)indicate that the custodian has not made the amendment;
(c)be in the form prescribed by the regulations; and
(d)be attached to the record so that it forms part of the record or the record contains an adequate cross-reference to it.
Right to complain
(9) The individual is entitled to make a complaint to the Commissioner under Part XI if the custodian does not make the amendment requested by the individual and does not comply with clause (3) (b), but is not entitled to make a complaint to the Commissioner under Part XI if the custodian does not make the amendment requested by the individual but complies with clause (3) (b).
PART IX
SUBSTITUTE DECISIONS
CONCERNING PERSONAL
HEALTH INFORMATION
Definitions
51. In this Part, "
capable" means mentally capable, and "capacity" has a corresponding meaning; ("capable", "capacit") "
incapable" means mentally incapable, and "incapacity" has a corresponding meaning. ("incapable", "incapacit")
Interpretation
52. (1) Subject to subsection (2), two persons are spouses for the purposes of this Part if they are of the opposite sex and,
(a)are married to each other; or
(b)are living in a conjugal relationship outside marriage and,
(i)have cohabited for at least one year,
(ii)are together the parents of a child, or
(iii)have together entered into a cohabitation agreement under section 53 of the Family Law Act.
Not spouses
(2) Two persons are not spouses for the purposes of this section if they are living separate and apart within the meaning of the Divorce Act (Canada).
Partners
(3) Two persons are partners for the purposes of this Act if they have lived together for at least one year and have a close personal relationship that is of primary importance in both persons' lives.
Relatives
(4) Two individuals are relatives for the purposes of this Act if they are related by blood, marriage or adoption.
Consent to collection,
use or disclosure
53. (1) If this Act or any other Act refers to a consent given by an individual to a collection, use or disclosure of personal health information relating to the individual, a person described in one of the following paragraphs may give the consent:
1.If the individual is capable with respect to the information for which the consent is given, the individual or any person whom the individual has authorized in writing to act on his or her behalf.
2.If the individual is incapable with respect to the information for which the consent is given, the person who is authorized under section 57 to consent on behalf of the individual.
3.If the individual has died, the person who is authorized under section 58 to consent in the place of the individual.
4.A person whom an Act of Ontario or Canada authorizes or requires to act on behalf of the individual.
Power to refuse consent
(2) A person who is authorized by this Act to consent on behalf of an individual is also entitled to refuse consent on behalf of the individual.
Transition
(3) Subsection (1) does not apply to a consent that an individual gives under another Act, before the day that subsection comes into force, to a collection, use or disclosure of information that is personal health information.
Capacity
54. (1) An individual is capable with respect to personal health information if the individual is able to understand the subject matter of the information and to appreciate the reasonably foreseeable consequences of giving or withholding consent to its collection, use or disclosure.
Different information
(2) An individual may be incapable with respect to some parts of personal health information, but capable with respect to other parts.
Different times
(3) An individual may be incapable with respect to personal health information at one time and capable at another.
Presumption of capacity
55. (1) An individual is presumed to be capable with respect to personal health information.
Non-application
(2) A person may rely on the presumption described in subsection (1) unless the person has reasonable grounds to believe that the individual is incapable with respect to personal health information.
Consent given by parent, etc.
56. (1) A parent of a child who is less than 16 years of age or a children's aid society or other person who is lawfully entitled to give or refuse consent in the place of the parent may consent to the collection, use or disclosure of personal health information relating to the child unless the information relates to,
(a)treatment within the meaning of the Health Care Consent Act, 1996, about which the child has made a decision on his or her own in accordance with that Act; or
(b)counselling in which the child has participated on his or her own under the Child and Family Services Act.
Definition
(2) In subsection (1), "
parent" does not include a parent who has only a right of access to the child.
Consent given by child
(3) Nothing in this section prevents a child who is capable with respect to personal health information from consenting to the collection, use or disclosure of personal health information relating to the child, in addition to a person who under subsection (1) is entitled to consent to the collection, use or disclosure.
Incapable individual:
persons who may consent
57. (1) If an individual is incapable with respect to personal health information, a person described in one of the following paragraphs may, on the individual's behalf, consent to a collection, use or disclosure of the information:
1.The individual's guardian of the person or guardian of property, if the consent relates to the guardian's authority to make a decision on behalf of the individual.
2.The individual's attorney for personal care or attorney for property, if the consent relates to the attorney's authority to make a decision on behalf of the individual.
3.The individual's representative appointed by the Board under section 63, if the representative has authority to give the consent.
4.The individual's spouse or partner.
5.A child or parent of the individual, or a children's aid society or other person who is lawfully entitled to give or refuse consent in the place of the parent. This paragraph does not include a parent who has only a right of access to the individual. If a children's aid society or other person is lawfully entitled to consent in the place of the parent, this paragraph does not include the parent.
6.A parent of the individual with only a right of access to the individual.
7.A brother or sister of the individual.
8.Any other relative of the individual.
Requirements
(2) A person described in subsection (1) may consent only if the person,
(a)is capable with respect to personal health information;
(b)in the case of an individual, is at least 16 years old or is the parent of the individual to whom the personal health information relates;
(c)is not prohibited by court order or separation agreement from having access to the individual to whom the personal health information relates or from giving or refusing consent on the individual's behalf;
(d)is available; and
(e)is willing to assume the responsibility of consenting.
Meaning of "available"
(3) For the purpose of clause (2) (d), a person is available if it is possible, within a time that is reasonable in the circumstances, to communicate with the person and obtain a consent.
Ranking
(4) A person described in a paragraph of subsection (1) may consent only if no person described in an earlier paragraph meets the requirements of subsection (2).
Same
(5) Despite subsection (4), a person described in a paragraph of subsection (1) who is present or has otherwise been contacted may consent if the person believes that,
(a)no other person described in an earlier paragraph or the same paragraph exists; or
(b)although such other person exists, the other person is not a person described in paragraph 1, 2 or 3 of subsection (1) and would not object to the person who is present or has otherwise been contacted making the decision.
Public Guardian and Trustee
(6) If no person described in subsection (1) meets the requirements of subsection (2), the Public Guardian and Trustee may make the decision to consent.
Conflict between persons in same paragraph
(7) If two or more persons who are described in the same paragraph of subsection (1) and who meet the requirements of subsection (2) disagree about whether to consent, and if their claims rank ahead of all others, the Public Guardian and Trustee may make the decision in their stead.
Deceased individual
58. If an individual to whom personal health information relates is deceased, a person described in one of the following paragraphs may consent to a collection, use or disclosure of the information:
1.The deceased's estate trustee.
2.The person who has assumed responsibility for the administration of the deceased's estate, if the deceased does not have an estate trustee.
Transition, representative appointed by individual
59. (1) This Act applies to a representative whom an individual, to whom personal health information relates, appointed under section 36.1 of the Mental Health Act before the day this section comes into force, as if the representative were the individual's attorney for personal care.
Limited authority
(2) The authority conferred on the representative by subsection (1) is limited to the purposes for which the representative was appointed.
Revocation
(3) An individual who is capable with respect to personal health information may revoke the appointment in writing.
Transition, representative appointed by Board
60. (1) This Act applies to a representative whom the Board appointed under section 36.2 of the Mental Health Act before the day this section comes into force for an individual to whom personal health information relates, as if the representative were the individual's representative appointed by the Board under section 63.
Limited authority
(2) The authority conferred on the representative by subsection (1) is limited to the purposes for which the representative was appointed.
Factors to consider re consent
61. A person who consents under this Act or any other Act on behalf of or in the place of an individual, to a collection, use or disclosure of personal health information shall take into consideration,
(a)the wishes, values and beliefs that,
(i)if the individual is capable, the person knows the individual holds and believes the individual would want reflected in decisions made concerning personal health information relating to him or her, or
(ii)if the individual is incapable or deceased, the person knows the individual held when capable or alive and believes the individual would have wanted reflected in decisions made concerning personal health information relating to him or her;
(b)whether the benefits that the person expects from the collection, use or disclosure of the information outweigh the risk of negative consequences occurring as a result of the collection, use or disclosure;
(c)whether the purpose for which the collection, use or disclosure is sought can be accomplished without the collection, use or disclosure; and
(d)whether the collection, use or disclosure is necessary to satisfy any legal obligation.
Application for review of determination of incapacity
62. (1) An individual to whom personal health information relates and who is determined to be incapable with respect to personal health information may apply to the Board for a review of the determination.
Parties
(2) The parties to the application are:
1.The individual applying for the review.
2.The custodian of the personal health information.
3.All other persons whom the Board specifies.
Powers of Board
(3) The Board may confirm the determination of incapacity or may determine that the individual is capable with respect to personal health information.
Restriction on repeated applications
(4) If a determination that an individual is incapable with respect to personal health information is confirmed on the final disposition of an application under this section, the individual shall not make a new application under this section within six months after the final disposition of the earlier application, unless the Board gives leave in advance.
Grounds for leave
(5) The Board may give leave for the new application to be made if it is satisfied that there has been a material change in circumstances that justifies reconsideration of the individual's capacity.
Procedure
(6) Sections 73 to 81 of the Health Care Consent Act, 1996 apply with necessary modifications to an application under this section.
Application for appointment of representative
63. (1) An individual who is 16 years old or older and who is incapable with respect to personal health information may apply to the Board for appointment of a representative to consent on his or her behalf to a collection, use or disclosure of the information.
Application by proposed representative
(2) If an individual is incapable with respect to personal health information, another individual who is 16 years old or older may apply to the Board to be appointed as a representative to consent on behalf of the incapable individual to a collection, use or disclosure of the information.
Exception
(3) Subsections (1) and (2) do not apply if the individual to whom the personal health information relates has a guardian of the person, a guardian of property, an attorney for personal care, or an attorney for property, who has authority to give or refuse consent to the collection, use or disclosure.
Parties
(4) The parties to the application are:
1.The individual to whom the personal health information relates.
2.The proposed representative named in the application.
3.Every person who is described in paragraph 4, 5, 6 or 7 of subsection 57 (1).
4.All other persons whom the Board specifies.
Appointment
(5) In an appointment under this section, the Board may authorize the representative to consent, on behalf of the individual to whom the personal health information relates, to,
(a)a particular collection, use or disclosure at a particular time;
(b)a collection, use or disclosure of the type specified by the Board in circumstances specified by the Board, if the individual is determined to be incapable with respect to personal health information at the time the consent is sought; or
(c)any collection, use or disclosure at any time, if the individual is determined to be incapable with respect to personal health information at the time the consent is sought.
Criteria for appointment
(6) The Board may make an appointment under this section if it is satisfied that the following requirements are met:
1.The individual to whom the personal health information relates does not object to the appointment.
2.The representative consents to the appointment, is at least 16 years old and is capable with respect to personal health information.
3.The appointment is in the best interests of the individual to whom the personal health information relates.
Powers of Board
(7) Unless the individual to whom the personal health information relates objects, the Board may,
(a)appoint as representative a different individual than the one named in the application;
(b)limit the duration of the appointment;
(c)impose any other condition on the appointment;
(d)on any person's application, remove, vary or suspend a condition imposed on the appointment or impose an additional condition on the appointment.
Termination
(8) The Board may, on any person's application, terminate an appointment made under this section if,
(a)the individual to whom the personal health information relates or the representative requests the termination;
(b)the representative is no longer capable with respect to personal health information;
(c)the appointment is no longer in the best interests of the individual to whom the personal health information relates; or
(d)the individual to whom the personal health information relates has a guardian of the person, a guardian of property, an attorney for personal care, or an attorney for property, who has authority to give or refuse consent to the types of collections, uses and disclosures for which the appointment was made in the circumstances to which the appointment applies.
Procedure
(9) Sections 73 to 81 of the Health Care Consent Act, 1996 apply with necessary modifications to an application under this section.
PART X
Powers and duties of the COMMISSIONER
Powers
64. The Commissioner may,
(a)engage in or commission research into matters affecting the carrying out of the purposes of this Act;
(b)conduct public education programs and provide information concerning this Act and the Commissioner's role and activities;
(c)receive representations from the public concerning the operation of this Act; or
(d)offer comment on the privacy protection implications of proposed legislative schemes or programs of health information custodians.
Delegation
65. (1) The Commissioner may in writing delegate any of the Commissioner's powers, duties or functions under this Act, including the power to make orders, to,
(a)the Assistant Commissioner; or
(b)an officer or employee of the Commissioner if there is no Assistant Commissioner.
Subdelegation by Assistant Commissioner
(2) The Assistant Commissioner may in writing delegate any of the powers, duties or functions delegated to him or her under subsection (1) to any other officers or employees of the Commissioner, subject to the conditions and restrictions that the Assistant Commissioner specifies in the delegation.
Exception, power re disclosure
(3) The Assistant Commissioner shall not delegate any of the duties of the Commissioner under section 31.
Exception, person
(4) The Assistant Commissioner shall not delegate any powers, duties or functions to the Minister or the Minister's agents.
Confidentiality
66. (1) The Commissioner and persons acting on behalf of or under the direction of the Commissioner shall not disclose any information that comes to their knowledge in the course of exercising their functions under this Act unless,
(a)the disclosure is required for the purpose of exercising those functions;
(b)the information relates to a health information custodian, the disclosure is made to a body that is legally entitled to regulate or review the activities of the custodian and the person disclosing the information is of the opinion that the disclosure is justified;
(c)the disclosure is made to the Attorney General, the information relates to the commission of an offence against an enactment of Ontario or Canada and the Commissioner is of the opinion that there is evidence of such an offence;
(d)the disclosure is required in a prosecution for an offence under this Act or for an offence under section 131 of the Criminal Code (Canada) in respect of sworn testimony; or
(e)the disclosure is required in an application for judicial review or an appeal from a decision made by a court, tribunal or other person in a proceeding with respect to that application.
Not compellable witness
(2) The Commissioner and persons acting on behalf of or under the direction of the Commissioner shall not be required to give evidence in a court or in a proceeding of a judicial nature concerning anything coming to their knowledge in the exercise of their functions under this Act that they are prohibited from disclosing under subsection (1).
Immunity
67. No action or other proceeding for damages may be instituted against the Commissioner or any person acting on behalf of or under the direction of the Commissioner for,
(a)anything done, reported or said in good faith in the exercise or intended exercise of their powers or duties under this Act that was reasonable in the circumstances; or
(b)any alleged neglect or default in the exercise in good faith of their powers or duties under this Act that was reasonable in the circumstances.
PART XI
ADMINISTRATION AND ENFORCEMENT
Complaints
68. (1) Any person may make a complaint to the Commissioner with respect to any matter under this Act or the regulations or with respect to the information practices of a health information custodian, but not with respect to what constitutes quality of care information within the meaning of section 40.
Form of complaint
(2) A complaint that a person makes to the Commissioner under this Act must be in writing and the person making it shall pay the fee prescribed by the regulations for the purpose.
Settlement attempt
(3) Upon receiving a complaint made under subsection (1), the Commissioner may,
(a)inquire as to what means, other than the complaint, that the complainant is using or has used to resolve the subject matter of the complaint;
(b)require the complainant to try to effect a settlement with the person about whom the complaint is made within the time period that the Commissioner specifies; or
(c)authorize a mediator to review the complaint and to try to effect a settlement between the complainant and the person about whom the complaint is made within the time period that the Commissioner specifies.
Dealings without prejudice
(4) If the Commissioner takes an action described in clause (3) (b) or (c) but no settlement is effected within the time period specified,
(a)none of the dealings between the parties to the attempted settlement shall prejudice the rights and duties of the parties under this Act;
(b)none of the information disclosed in the course of trying to effect a settlement shall prejudice the rights and duties of the parties under this Act; and
(c)none of the information disclosed in the course of trying to effect a settlement shall be used outside the attempted settlement, including in a review of a complaint under this section or in an inquiry under section 69, unless all parties expressly consent.
Commissioner's review
(5) If the Commissioner does not take an action described in clause (3) (b) or (c) or if the Commissioner takes an action described in one of those clauses but no settlement is effected within the time period specified, the Commissioner may review the complaint if he or she is satisfied that there are reasonable grounds to do so.
Information as a complaint
(6) Upon receiving information with respect to any matter for which a person would be entitled to make a complaint under subsection (1), the Commissioner may treat the information as a complaint and may review it if he or she has reasonable grounds to believe that a person has contravened any provision of this Act or the regulations.
Notice of complaint
(7) Before starting to review a complaint under subsection (5) or (6), the Commissioner shall give written notice to the person about whom the complaint is made,
(a)stating that the Commissioner will conduct a review; and
(b)describing the subject matter of the complaint.
No review
(8) The Commissioner may decide not to review a complaint or may discontinue a review of a complaint for whatever reason the Commissioner considers proper, including if satisfied that,
(a)the person about whom the complaint is made has responded adequately to the complaint;
(b)other legal procedures are otherwise reasonably available or more appropriate;
(c)the length of time that has elapsed between the date of the subject matter of the complaint and the date the complaint was made is such that a review would serve no useful purpose; or
(d)the complaint is trivial, frivolous or vexatious or is made in bad faith.
Other review process
(9) In reviewing a complaint made under subsection (1), the Commissioner may inquire whether the complainant has applied to use any review process, procedure or mechanism, other than the complaint, and whether that process, procedure or mechanism has been completed.
Suspension of review
(10) The Commissioner may suspend the review of the complaint if the complainant has applied to use any review process, procedure or mechanism, other than the complaint, and that process, procedure or mechanism has not been completed.
Discretionary mediation
(11) In reviewing a complaint made under subsection (1), the Commissioner may authorize a mediator to investigate the circumstances of the complaint and to try to effect a settlement of the matter if it appears to the Commissioner that a settlement may be possible.
Non-application
(12) The Ombudsman Act does not apply to a complaint to the Commissioner under this section and the Statutory Powers Procedure Act does not apply to a review by the Commissioner of a complaint under this section.
Conduct of review
(13) In reviewing a complaint under this section, the Commissioner shall conduct the review in accordance with the procedure prescribed by the regulations.
Powers of Commissioner
(14) After reviewing a complaint, the Commissioner may,
(a)make comments and recommendations on the privacy protection implications of any matter that is the subject of the complaint; or
(b)make an order directing the health information custodian affected by the complaint to,
(i)cease collecting personal health information if the Commissioner determines that the custodian is collecting the information in contravention of this Act, the regulations or an agreement entered into under this Act, or
(ii)dispose of records of personal health information that the Commissioner determines was collected by the custodian in contravention of this Act, the regulations or an agreement entered into under this Act.
Order against employer
(15) An order made under clause (14) (b) that directs a health information custodian to take any action or to refrain from so acting may also direct the employer of the custodian or the person who retains the custodian's services to take the action or to refrain from so acting if the Commissioner considers it advisable in the circumstances.
Copy of order
(16) The Commissioner shall provide a copy of the order made under clause (14) (b) to,
(a)the person who made the complaint, if not the Commissioner, and the person about whom the complaint was made; and
(b)the body or bodies that are legally entitled to regulate or review the activities of the persons directed in the order.
Inquiry
69. (1) If a complaint relates to a request by an individual under section 45 to obtain access to a record of personal health information relating to the individual or under section 50 to amend the record, the Commissioner may conduct an inquiry under this section.
Conduct of inquiry
(2) The Commissioner may make the rules of procedure that he or she considers necessary to conduct an inquiry and the Ombudsman Act and the Statutory Powers Procedure Act do not apply to the inquiry.
Requirement for production
(3) Despite this Act or any other Act or privilege, the Commissioner may require a person to produce to the Commissioner any document or thing that the Commissioner specifies as relevant to the subject matter of the inquiry and that is in the custody or under the control of the person about whom the complaint was made.
Inspection
(4) For the purpose of conducting the inquiry, the Commissioner may, at any reasonable time,
(a)enter the premises occupied by the person about whom the complaint was made;
(b)enter any premises at which the Commissioner believes, on reasonable grounds, the person keeps documents or things, including records of personal health information, that the Commissioner considers relevant to the subject matter of the inquiry;
(c)demand the production of and inspect any document or thing, including a record of personal health information, that the Commissioner considers relevant to the subject matter of the inquiry and that are kept at the premises that the Commissioner has entered; or
(d)use any data storage, processing or retrieval device or system at the premises that the Commissioner has entered in order to produce a record in readable form.
Notice of entry
(5) Before entering any premises under this section, the Commissioner shall notify the person occupying the premises of the purpose of the entry.
Dwelling
(6) The Commissioner shall not enter premises that are being used as a dwelling, except with the consent of the person occupying the premises.
Identification
(7) While in premises that the Commissioner has entered under subsection (4), the Commissioner shall produce, on request, identification that provides evidence of his or her authority.
Compliance
(8) A person to whom the Commissioner issues a requirement for production under subsection (3) or clause (4) (c) shall comply with it and the Commissioner may review the documents and things produced.
Copying without removal
(9) The Commissioner may require the person who has custody or control of the documents and things produced to the Commissioner to provide the Commissioner with a photocopy of all or part of them.
Same
(10) The person shall comply with the Commissioner's requirement and the Commissioner shall pay the person the amount prescribed by the regulations for the copies in excess of 20 pages.
Admissibility of copies
(11) A copy made under subsection (9) that the Commissioner certifies as being a true copy of the original is admissible in evidence at the inquiry to the same extent as the original and has the same evidentiary value as the original.
Examination under oath
(12) The Commissioner may summon and examine on oath any person who, in the Commissioner's opinion, may have information relating to the subject matter of the inquiry and, for that purpose, the Commissioner may administer an oath.
Exception
(13) The Commissioner shall not require a health information custodian or a person acting on behalf of the custodian to disclose, in the presence of a complainant or another party to the inquiry,
(a)information that, under Part VIII, the custodian would refuse to disclose if the custodian had received an access request for it; or
(b)information that the Commissioner in his or her discretion requires the custodian not to disclose.
Submissions
(14) The person who made the complaint, the person about whom the complaint was made and any other affected person shall be given an opportunity to make submissions to the Commissioner.
Privacy of submissions
(15) No person is entitled to be present during, to have access to, or to comment on, the testimony given or the submissions made to the Commissioner by any other person and the Commissioner shall not, in any way, authorize or permit any person to contravene this subsection.
Right to counsel
(16) A person who must be given an opportunity to make submissions to the Commissioner may be represented by counsel or an agent.
Privilege
(17) A document or thing produced by a person in the course of an inquiry is privileged in the same manner as if the inquiry were a proceeding in a court.
No disclosure
(18) The Commissioner shall not disclose, in the presence of a complainant or another party to the inquiry information that, under Part VIII, the custodian would refuse to disclose if the custodian had received an access request for it.
Inadmissible evidence
(19) A statement made or an answer given by a person in the course of an inquiry or evidence of the existence of an inquiry is not admissible in evidence in a proceeding except,
(a)in a prosecution for an offence under this Act or for an offence under section 131 of the Criminal Code (Canada) in respect of sworn testimony; or
(b)in an application for judicial review or an appeal from a decision made by a court, tribunal or other person in a proceeding with respect to that application.
Protection under federal Act
(20) The Commissioner shall inform a person giving a statement or answer in the course of an inquiry that the person is entitled to object to answer any question under section 5 of the Canada Evidence Act.
Burden of proof
70. If a health information custodian refuses, in whole or in part, the request of an individual under section 45 for access to a record of personal health information, the burden of proof that the individual is not entitled to access to the record lies on the custodian.
Order
71. (1) After conducting an inquiry under section 69, the Commissioner may, by order, direct the person about whom the complaint was made,
(a)to make a record of personal health information available to the individual who requested it if the Commissioner determines that the individual is entitled to access to the record; or
(b)to attach a concise statement of disagreement to a record of personal health information in accordance with clause 50 (3) (b) and to give a copy of the statement to the individual who requested an amendment of the record.
Order against employer
(2) An order made under this section that directs a health information custodian to take any action or to refrain from so acting may also direct the employer of the custodian or the person who retains the custodian's services to take the action or to refrain from so acting if the Commissioner considers it advisable in the circumstances.
Time for compliance
(3) An order made under this section may,
(a)specify a period of time within which the person directed in the order shall comply with it; or
(b)require the person to report to the Commissioner within 30 days of the making of the order, or such other period of time that the order specifies, describing how the person intends to comply with the order or has complied with it.
Copy of order
(4) The Commissioner shall provide a copy of the order made under this section to,
(a)the person who made the complaint and the person about whom the complaint was made; and
(b)the body or bodies that are legally entitled to regulate or review the activities of the persons directed in the order.
Appeal
72. (1) A person affected by an order made under clause 68 (14) (b) or section 71 or by a matter of procedure in the Commissioner's conduct of a review of a complaint under section 68 or an inquiry under section 69 may appeal it to the Divisional Court on a question of law only.
Final decision
(2) The decision of the Divisional Court on an appeal made under subsection (1) is final.
Offences
73. (1) A person is guilty of an offence if the person,
(a)knowingly collects, uses or discloses personal health information in contravention of this Act;
(b)contravenes subsection 38 (2) or (3);
(c)knowingly obtains or attempts to obtain personal health information to which the person is not entitled to access;
(d)knowingly disposes of a record of personal health information with an intent to evade a request for access to the record;
(e)knowingly obstructs the Commissioner or an authorized delegate of the Commissioner in the performance of his or her duties or powers under this Act;
(f)knowingly makes a false statement to the Commissioner, or knowingly misleads or attempts to mislead the Commissioner, in the course of the Commissioner's performance of his or her duties or powers under this Act;
(g)knowingly fails to comply with an order made by the Commissioner under this Act; or
(h)in connection with the collection, use or disclosure of, or access to, personal health information under this Act, makes an assertion, knowing that it is untrue, to the effect that the person,
(i)is a person entitled to access to a record of personal health information under section 46,
(ii)is a person who is entitled under paragraph 1 of subsection 53 (1), subsection 56 (1) or 57 (1) or section 58 to consent to the collection, use or disclosure of personal health information relating to another individual,
(iii)meets the requirement of clauses 57 (2) (b) and (c), or
(iv)holds the beliefs described in subsection 57 (5).
Prosecution
(2) No person other than the Attorney General or a counsel or agent acting on behalf of the Attorney General may commence a prosecution for an offence under subsection (1).
Penalty
(3) A person who is guilty of an offence under subsection (1) is liable, on conviction,
(a)if the person is an individual, to a fine of not more than $50,000; and
(b)if the person is not an individual, to a fine of not more than $500,000.
Directors, officers, etc.
(4) If a corporation commits an offence under this Act, every director, officer, member, employee or agent of the corporation who authorized the offence is a party to and guilty of the offence and is liable, on conviction, to the penalty for the offence whether or not the corporation has been prosecuted or convicted.
No prosecution
(5) No person is liable to prosecution for an offence against this or any other Act by reason of complying with a requirement of the Commissioner under this Part.
PART XII
MISCELLANEOUS
Annual report by institution
74. (1) A health information custodian that is an institution within the meaning of the Freedom of Information and Protection of Privacy Act or the Municipal Freedom of Information and Protection of Privacy Act shall make an annual report to the Commissioner at the time specified by the Commissioner.
Contents
(2) A report made under subsection (1) shall specify, with respect to the time period since the last report made by the health information custodian,
(a)the number of requests that the custodian has received under this Act for access to a record of personal health information;
(b)the number of refusals that the custodian has given under this Act to requests for access to a record of personal health information;
(c)the uses or purposes for which the custodian has disclosed personal health information under this Act;
(d)the amount of fees that the custodian has collected under this Act; and
(e)all other information indicating an effort by the custodian to put into practice the purposes of this Act.
Protection from liability
75. (1) No action or other proceeding for damages may be instituted against a health information custodian or a person who is employed by or in the service of a health information custodian for,
(a)anything done, reported or said in good faith in the exercise or intended exercise of the powers or duties of the custodian or the person under this Act that was reasonable in the circumstances; or
(b)any alleged neglect or default in the exercise in good faith of the powers or duties of the custodian or the person under this Act that was reasonable in the circumstances.
Crown liability
(2) Despite subsections 5 (2) and (4) of the Proceedings Against the Crown Act, subsection (1) does not relieve the Crown of liability in respect of a tort committed by a person mentioned in subsection (1) to which it would otherwise be subject.
Person giving or refusing consent
(3) A person who gives or refuses consent to a collection, use or disclosure of personal health information on behalf of or in the place of the individual to whom the information relates is not liable for damages for giving or refusing consent if the person acts reasonably in the circumstances, in good faith and in accordance with this Act.
Reliance on assertion
(4) Unless it is not reasonable to do so in the circumstances, a person is entitled to rely on the accuracy of an assertion made by a person, in connection with a collection, use or disclosure of, or access to, the information under this Act, to the effect that the person,
(a)is a person entitled to access to a record of personal health information under section 46;
(b)is a person who is entitled under paragraph 1 of subsection 53 (1), subsection 56 (1) or 57 (1) or section 58 to consent to the collection, use or disclosure of personal health information relating to another individual;
(c)meets the requirement of clauses 57 (2) (b) and (c); or
(d)holds the beliefs described in subsection 57 (5).
Regulations
76. (1) The Lieutenant Governor in Council may make regulations,
1.exempting individuals or classes of individuals from the individuals described in clause (d) of the definition of "health care practitioner" in subsection 2 (1);
2.exempting persons or classes of persons from the persons described in paragraph 12 of the definition of "health information custodian" in subsection 2 (1);
3.prescribing that certain types of information shall be or shall not be included in the definition of "personal health information" in subsection 2 (1);
4.specifying that subsection 3 (1) does not apply to a health information custodian or a class of health information custodian that the regulations specify;
5.specifying the standards described in subsection 12 (6) or (7), or a process for setting them, including prohibitions against the collection, use or disclosure of personal health information or classes of personal health information in the circumstances specified in the regulations and conditions that a health information custodian is required to comply with when collecting, using or disclosing personal health information or classes of personal health information;
6.specifying the circumstances in which a health information custodian is required to comply with the standards described in clause 5;
7.specifying standards, or a process for setting standards, with which a health information custodian shall comply when engaged in the electronic transfer of records of personal health information, including standards for transactions, data elements for transactions, code sets for data elements and procedures for the transmission and authentication of electronic signatures;
8.specifying the circumstances in which a health information custodian is required to comply with the standards described in clause 7;
9.establishing or designating a body or bodies that may set or adopt the standards described in clause 5 or 7 or the prescribed safeguards and practices mentioned in subsection 18 (2) or specifying a process for setting those standards or those safeguards and practices;
10.governing a computer matching for the purpose of section 14, including the circumstances in which the regulations made under this clause apply;
11.governing the retention and disposal of records of personal health information, including the times for which a health information custodian shall retain the records, the times at which the custodian shall dispose of them and the forms that the disposal shall take;
12.prohibiting a health information custodian from using or disclosing personal health information for the purpose described in subsection 26 (1) or specifying conditions that the custodian is required to fulfil in using or disclosing personal health information for that purpose;
13.designating health screening programs for the purpose of clause 30 (1) (c) and specifying conditions, restrictions or requirements that apply with respect to the disclosure of personal health information under that clause;
14.specifying the conditions under which the Minister may issue a direction under subsection 31 (1), including specifying persons or classes of persons to whom the Minister is required to allow the opportunity to review the direction and to comment on it;
15.designating a body or a class of bodies as a research ethics review body for the purpose of section 32;
16.prescribing the circumstances in which a research ethics review body shall require the consent of an individual under section 32;
17.prescribing that certain types of committees shall be or shall not be included in the definition of "committee" in section 40;
18.prescribing the facilities, organizations or persons mentioned as prescribed in the definitions of "committee" and "quality of care information" in section 40;
19.prescribing the amount of fees that a health information custodian may charge for collecting, using or disclosing personal health information to a person under this Act, providing access to a record of personal health information or providing the copy described in subsection 47 (9);
20.prescribing circumstances in which a health information custodian shall not charge a fee for any of the purposes mentioned in clause 19 or is entitled not to charge such a fee;
21.governing the manner in which the fees mentioned in clause 19 shall be paid and the time period during which they shall be paid;
22.specifying matters that a health information custodian shall consider for the purpose of subsection 47 (10);
23.specifying the matters on which a person is entitled to rely to conclude that an individual meets the test of capacity with respect to personal health information that is set out in subsection 54 (1) and specifying the circumstances in which a person is entitled to rely on those matters for that purpose;
24.prescribing additional duties of health information custodians with respect to personal health information;
25.making any provision of this Act or the regulations, that applies to some but not all health information custodians, applicable to a person described in paragraph 14 of the definition of "health information custodian" in subsection 2 (1);
26.exempting a health information custodian or a class of them from any provision of this Act or the regulations;
27.permitting notices or other documents required to be given in writing under this Act to be given in electronic or other form instead, subject to the conditions or restrictions that are prescribed by the regulations;
28.prescribing or specifying anything that this Act mentions as being prescribed or specified in the regulations;
29.for the purpose of this Act or the regulations, defining any term that is used in this Act or the regulations and that is not defined in this Act;
30.respecting any matter necessary or advisable to carry out effectively the purposes of this Act.
Ministerial regulations
(2) The Minister may make regulations designating persons or classes of persons for the purpose of clause 30 (5) (a) or 31 (6) (c).
General or specific application
(3) A regulation may be of general application or specific to any person or persons or class or classes in its application.
Classes
(4) A class described in the regulations may be described according to any characteristic or combination of characteristics and may be described to include or exclude any specified member, whether or not with the same characteristics.
Review of Act
77. A committee of the Legislative Assembly shall begin a comprehensive review of this Act and the operation of the Commissioner's office in relation to this Act not later than the third anniversary of the day on which this section comes into force and, within one year after beginning that review, shall make recommendations to the Assembly concerning amendments to this Act.
PART XIII
COMPLEMENTARY AMENDMENTS
AND REPEALS
Charitable Institutions Act
78. (1) Section 9.7 of the Charitable Institutions Act, as enacted by the Statutes of Ontario, 1993, chapter 2, section 6, is repealed.
(2) The definition of "record" in subsection 10.1 (1) of the Act, as enacted by the Statutes of Ontario, 1993, chapter 2, section 8, is amended by striking out "medical record, drug record" and substituting "record of personal health information within the meaning of the Personal Health Information Privacy Act, 2000".
(3) Section 12 of the Act, as amended by the Statutes of Ontario, 1993, chapter 2, section 10, 1994, chapter 26, section 70, 1996, chapter 2, section 61 and 1997, chapter 15, section 3, is further amended by adding the following subsection:
Exception
(4) A regulation made under clause (1) (z.6) shall not apply to a record of personal health information within the meaning of the Personal Health Information Privacy Act, 2000.
Child and Family Services Act
79. (1) Subsection 74 (7) of the Child and Family Services Act, as re-enacted by the Statutes of Ontario, 1999, chapter 2, section 24, is repealed and the following substituted:
Matters to be considered by court
(7) Where an application under subsection (2) concerns a record that is a record of personal health information within the meaning of the Personal Health Information Privacy Act, 2000, subsection 34 (5) (statement by health care practitioner) of that Act applies and the court shall give equal consideration to,
(a)the matters to be considered under subsection 34 (9) of that Act; and
(b)the need to protect the child's health and safety.
(2) Subsection 74 (8) of the Act, as enacted by the Statutes of Ontario, 1999, chapter 2, section 24, is repealed.
(3) Subsections 74.1 (8) and (9) of the Act, as enacted by the Statutes of Ontario, 1999, chapter 2, section 25, are repealed.
(4) Clauses 179 (2) (e), (f) and (g) of the Act are repealed and the following substituted:
(e)that is a record of personal health information within the meaning of the Personal Health Information Privacy Act, 2000.
(5) Subsection 179 (3) of the Act is amended by striking out "(e), (f) and (g)" and substituting "and (e)".
(6) Section 183 of the Act is repealed.
Transition, disclosure
pursuant to summons
(7) Despite its repeal by subsection (6), section 183 of the Act, as it read immediately before the coming into force of subsection (6), continues to apply to a record of a mental disorder if, before the coming into force of subsection (6), a physician made the statement described in subsection 183 (2) of the Act with respect to the record.
Drug and Pharmacies
Regulation Act
80. Section 157 of the Drug and Pharmacies Regulation Act is amended by adding the following subsection:
Subs. (1) prevails
(1.1) Subsection (1) applies despite anything to the contrary in the Personal Health Information Privacy Act, 2000.
Education Act
81. Subsection 266 (2.1) of the Education Act, as enacted by the Statutes of Ontario, 1991, chapter 10, section 7, is amended by adding the following paragraph:
4.The health number and version code assigned by the General Manager of the Ontario Health Insurance Plan to the pupil, as an insured person within the meaning of the Health Insurance Act.
Freedom of Information
and Protection of Privacy Act
82. (1) Section 4 of the Freedom of Information and Protection of Privacy Act is amended by adding the following subsection:
Assistant Commissioner for
Personal Health Information
(5) The Commissioner shall appoint an officer of his or her staff to be the Assistant Commissioner for Personal Health Information under the Personal Health Information Privacy Act, 2000.
(2) Subsection 58 (1) of the Act is amended by striking out "subsection (2)" and substituting "subsections (2) and (3)".
(3) Section 58 of the Act is amended by adding the following subsection:
Same, personal health information
(3) A report made under subsection (1) shall include a report prepared in consultation with the Assistant Commissioner for Personal Health Information on the exercise of the Commissioner's powers and duties under the Personal Health Information Privacy Act, 2000, including,
(a)information related to the number and nature of complaints received by the Commissioner under section 68 of that Act and the disposition of them;
(b)information related to the number and nature of reviews conducted by the Commissioner under section 68 of that Act and the disposition of them;
(c)information related to the number and nature of inquiries conducted by the Commissioner under section 69 of that Act and the disposition of them;
(d)all other information prescribed by the regulations made under that Act; and
(e)all other matters relating to personal health information within the meaning of that Act that the Commissioner considers appropriate.
(4) Subsection 65 (2) of the Act is repealed.
Health Cards and
Numbers Control Act, 1991
83. The Health Cards and Numbers Control Act, 1991 is repealed.
Health Care Consent Act, 1996
84. (1) Section 22 of the Health Care Consent Act, 1996 is amended by adding the following subsection:
Subs. (1) prevails
(2) Subsection (1) applies despite anything to the contrary in the Personal Health Information Privacy Act, 2000.
(2) Section 43 of the Act is amended by adding the following subsection:
Same
(2) Subsection (1) applies despite anything to the contrary in the Personal Health Information Privacy Act, 2000.
(3) Subsection 44 (2) of the Act is repealed and the following substituted:
Collection and disclosure of information
(2) A decision concerning the collection and disclosure of information relating to the incapable person is a decision that is necessary and ancillary to the admission, if the information is required for the purpose of the admission and is not personal health information within the meaning of the Personal Health Information Privacy Act, 2000.
(4) Section 60 of the Act is amended by adding the following subsection:
Subs. (1) prevails
(2) Subsection (1) applies despite anything to the contrary in the Personal Health Information Privacy Act, 2000.
(5) Subsection 76 (2) of the Act is repealed and the following substituted:
Health record
(2) The party who is the subject of the treatment, the admission or the personal assistance service, as the case may be, and his or her counsel or agent are entitled to examine and to copy, at their own expense, any medical or other health record prepared in respect of the party, subject to subsections 34 (5) to (9) (disclosure in proceedings where statement by health care practitioner) of the Personal Health Information Privacy Act, 2000.
Transition, health record
(6) Despite its re-enactment by subsection (5), subsection 76 (2) of the Act, as it read immediately before the coming into force of subsection (5), continues to apply to,
(a)a clinical record, if subsections 35 (6), (7) and (8) of the Mental Health Act, as they read immediately before the coming into force of subsection 89 (5) of this Act, continue to apply to the clinical record under subsection 89 (18) of this Act;
(b)a personal record, if subsections 33 (2), (3), (4) and (5) of the Long-Term Care Act, 1994, as they read immediately before the coming into force of subsection 88 (7) of this Act, continue to apply to the personal record under subsections 88 (14) and (15) of this Act;
(c)a record of a mental disorder, if section 183 of the Child and Family Services Act, as it read immediately before the coming into force of subsection 79 (6) of this Act, continues to apply to the record under subsection 79 (7) of this Act.
Health Insurance Act
85. Section 29 of the Health Insurance Act, as re-enacted by the Statutes of Ontario, 1996, chapter 1, Schedule H, section 22, is amended by adding the following subsection:
Exception
(3) This section does not apply where the Personal Health Information Privacy Act, 2000 applies.
Health Protection and
Promotion Act
86. (1) Subsection 11 (2) of the Health Protection and Promotion Act is repealed and the following substituted:
Report
(2) The medical officer of health shall report the results of the investigation to the complainant, but shall not include in the report personal health information within the meaning of the Personal Health Information Privacy Act, 2000 in respect of a person other than the complainant, unless consent to the disclosure is obtained in accordance with that Act.
Obligation prevails
(3) The obligation imposed on the medical officer of health under subsection (2) applies despite anything to the contrary in the Personal Health Information Privacy Act, 2000.
(2) Section 86.2 of the Act, as enacted by the Statutes of Ontario, 1997, chapter 30, Schedule D, section 11, is amended by adding the following subsection:
Subs. (3) prevails
(4) Subsection (3) applies despite anything to the contrary in the Personal Health Information Privacy Act, 2000.
Homes for the Aged
and Rest Homes Act
87. (1) Section 18.1 of the Homes for the Aged and Rest Homes Act, as enacted by the Statutes of Ontario, 1993, chapter 2, section 15, is repealed.
(2) The definition of "record" in subsection 21 (1) of the Act, as re-enacted by the Statutes of Ontario, 1993, chapter 2, section 17, is amended by striking out "medical record, drug record" and substituting "record of personal health information within the meaning of the Personal Health Information Privacy Act, 2000".
Long-Term Care Act, 1994
88. (1) The definition of "personal record" in subsection 2 (1) of the Long-Term Care Act, 1994 is repealed.
(2) Subsection 2 (1) of the Act, as amended by the Statutes of Ontario, 1996, chapter 2, section 71 and 1998, chapter 18, Schedule G, section 65, is further amended by adding the following definition: "
personal health information" has the same meaning as in the Personal Health Information Privacy Act, 2000. ("renseignements personnels sur la sant")
(3) The definition of "substitute decision-maker" in subsection 2 (1) of the Act, as enacted by the Statutes of Ontario, 1996, chapter 2, section 71, is repealed.
(4) Subsection 2 (2) of the Act is repealed.
(5) Clauses 25 (2) (c) and (d) of the Act are repealed and the following substituted:
(c)shall state that a request for access to a person's record of personal health information may be made by a person entitled to such access under the Personal Health Information Privacy Act, 2000, and shall specify the person to whom the request must be made.
(6) Section 32 of the Act, as amended by the Statutes of Ontario, 1996, chapter 2, section 71, is repealed.
(7) Section 33 of the Act is repealed.
(8) Section 34 of the Act is repealed and the following substituted:
Disclosure to Appeal Board
34. In a proceeding before the Appeal Board under this Act in respect of a person, a service provider who has the custody or the control of a record of personal health information respecting the person shall disclose it to the Appeal Board at the request of any party to the proceeding.
(9) Sections 35 and 36 of the Act, as amended by the Statutes of Ontario, 1996, chapter 2, section 71, are repealed and the following substituted:
Explanation of plan of service
35. If a person who makes a request to an approved agency for access to his or her plan of service also requests that the approved agency provide an explanation of the plan of service, the approved agency shall provide the explanation when it gives the person access to the plan of service.
(10) Section 37 of the Act is repealed.
(11) The definition of "record" in subsection 62 (1) of the Act is amended by striking out "medical record, drug record" and substituting "record of personal health information".
(12) Paragraph 42 of subsection 68 (1) of the Act is repealed.
(13) Paragraph 42.1 of subsection 68 (1) of the Act, as enacted by the Statutes of Ontario, 1996, chapter 2, section 71, is repealed.
Transition, disclosure pursuant
to summons
(14) Despite its repeal by subsection (1), the definition of "personal record" in subsection 2 (1) of the Act, as it read immediately before the coming into force of subsection (1), continues to apply for the purposes of the continued application of subsections 33 (2), (3), (4) and (5) of the Act under this subsection.
Same
(15) Despite their repeal by subsection (7), subsections 33 (2), (3), (4) and (5) of the Act, as they read immediately before the coming into force of subsection (7), continue to apply to a personal record if, before the coming into force of subsection (7), a service provider made the statement described in subsection 33 (2) of the Act with respect to the personal record.
Mental Health Act
89. (1) The definition of "mentally competent" in subsection 1 (1) of the Mental Health Act is repealed.
(2) Subsection 1 (1) of the Act, as amended by the Statutes of Ontario, 1992, chapter 32, section 20, 1996, chapter 2, section 72 and 2000, chapter 9, section 1, is further amended by adding the following definition: "
record of personal health information", in relation to a person, means a record of personal health information within the meaning of the Personal Health Information Privacy Act, 2000 that is compiled in a psychiatric facility in respect of the person. ("dossier de renseignements personnels sur la sant")
(3) The definition of "substitute decision-maker" in subsection 1 (1) of the Act, as enacted by the Statutes of Ontario, 1996, chapter 2, section 72, is repealed.
(4) Section 29 of the Act, as amended by the Statutes of Ontario, 2000, chapter 9, section 11, is further amended by adding the following subsection:
Transfer of records from one facility to another
(1.1) The officer in charge of the psychiatric facility from which the patient is transferred may transfer the patient's record of personal health information to the officer in charge of the psychiatric facility to which the patient is transferred.
(5) Section 35 of the Act, as amended by the Statutes of Ontario, 1992, chapter 32, section 20, 1996, chapter 2, section 72 and 2000, chapter 9, section 16, is repealed and the following substituted:
Definition of "patient"
35. (1) In this section, "
patient" includes former patient, out-patient, former out-patient and anyone who is or has been detained in a psychiatric facility.
Disclosure to Board
(2) In a proceeding before the Board under this or any other Act in respect of a patient, the officer in charge shall, at the request of any party to the proceeding, disclose to the Board the patient's record of personal health information.
Other disclosure
(3) The officer in charge may disclose or transmit a person's record of personal health information to or permit the examination of the record by,
(a)a physician who is considering issuing or renewing, or who has issued or renewed, a community treatment order under section 33.1;
(b)a physician appointed under subsection 33.5 (2); or
(c)another person named in the person's community treatment plan as being involved in the person's treatment or care and supervision upon the written request of the physician or other named person.
(6) Section 36 of the Act, as amended by the Statutes of Ontario, 1992, chapter 32, section 20, 1996, chapter 2, section 72 and 2000, chapter 9, section 18, is repealed.
(7) Section 36.1 of the Act, as enacted by the Statutes of Ontario, 1992, chapter 32, section 20 and amended by 1996, chapter 2, section 72 and 2000, chapter 9, section 19, is repealed.
(8) Section 36.2 of the Act, as enacted by the Statutes of Ontario, 1992, chapter 32, section 20 and amended by 1996, chapter 2, section 72 and 2000, chapter 9, section 20, is repealed.
(9) Section 36.3 of the Act, as enacted by the Statutes of Ontario, 1996, chapter 2, section 72, is repealed.
(10) Subsections 38 (4) and (5) of the Act, as re-enacted by the Statutes of Ontario, 1992, chapter 32, section 20, are repealed.
(11) Subsection 38 (8) of the Act, as re-enacted by the Statutes of Ontario, 1992, chapter 32, section 20, is amended by striking out "(5)".
(12) Subsection 53 (1) of the Act is amended by striking out "clinical record" and substituting "record of personal health information".
(13) Subsection 54 (3) of the Act, as re-enacted by the Statutes of Ontario, 1992, chapter 32, section 20, is amended by striking out "clinical record" and substituting "record of personal health information".
(14) Subclause 81 (1) (b) (v) of the Act is repealed and the following substituted:
(v)prescribing the forms, records, books, returns and reports to be made and kept in connection therewith and the period for which each must be retained by the psychiatric facility, and providing for returns, reports and information to be furnished to the Ministry.
(15) Clause 81 (1) (j) of the Act, as enacted by the Statutes of Ontario, 1996, chapter 2, section 72, is amended by striking out "who are incapable, within the meaning of the Health Care Consent Act, 1996, with respect to treatment of a mental disorder" and substituting "who are either incapable, within the meaning of the Health Care Consent Act, 1996, with respect to treatment of a mental disorder or are incapable, within the meaning of the Personal Health Information Privacy Act, 2000, with respect to personal health information".
(16) Clause 81 (1) (k.2) of the Act, as enacted by the Statutes of Ontario, 1996, chapter 2, section 72, is repealed.
(17) Clause 81 (1) (k.3) of the Act, as re-enacted by the Statutes of Ontario, 2000, chapter 9, section 30, is amended by striking out "clause 35 (3) (d.1), (e.3), (e.4) or (e.5)" and substituting "subsection 35 (3)".
Transition, disclosure pursuant
to summons
(18) Despite their repeal by subsection (5),
(a)subsections 35 (6), (7) and (8) of the Act, as they read immediately before the coming into force of subsection (5), continue to apply to a clinical record if, before the coming into force of subsection (5), the attending physician made the statement described in subsection 35 (6) of the Act with respect to the clinical record; and
(b)the definitions of "clinical record" and "patient" in subsection 35 (1) of the Act, as they read immediately before the coming into force of subsection (5), continue to apply for the purposes of the continued application of subsections 35 (6), (7) and (8) of the Act under this subsection.
Nursing Homes Act
90. (1) Section 20.2 of the Nursing Homes Act, as enacted by the Statutes of Ontario, 1993, chapter 2, section 33, is repealed.
(2) Subsection 24 (1) of the Act, as re-enacted by the Statutes of Ontario, 1993, chapter 2, section 38, is amended by striking out "medical record, drug record" and substituting "record of personal health information within the meaning of the Personal Health Information Privacy Act, 2000".
(3) Section 38 of the Act, as amended by the Statutes of Ontario, 1993, chapter 2, section 43, 1994, chapter 26, section 75, 1996, chapter 2, section 74 and 1997, chapter 15, section 13, is further amended by adding the following subsection:
Exception
(4) A regulation made under clause (1) 18 shall not apply to a record of personal health information within the meaning of the Personal Health Information Privacy Act, 2000.
Ontario Drug Benefit Act
91. Subsection 5 (5) of the Ontario Drug Benefit Act is repealed.
Public Hospitals Act
92. (1) Section 1 of the Public Hospitals Act, as amended by the Statutes of Ontario, 1996, chapter 1, Schedule F, section 3 and 1998, chapter 18, Schedule G, section 70, is further amended by adding the following definition: "
personal health information" has the same meaning as in the Personal Health Information Privacy Act, 2000". ("renseignements personnels sur la sant")
(2) Subsection 14 (1) of the Act is amended by striking out "medical record" and substituting "record of personal health information".
(3) Subsection 14 (2) of the Act, as enacted by the Statutes of Ontario, 1996, chapter 1, Schedule F, section 12, is amended by striking out "medical records" and substituting "records of personal health information".
(4) Subclause 32 (1) (t) (iv) of the Act, as enacted by the Statutes of Ontario, 1996, chapter 1, Schedule F, section 14, is amended by striking out "medical records" and substituting "records of personal health information".
(5) Clause 32 (1) (u) of the Act, as enacted by the Statutes of Ontario, 1996, chapter 1, Schedule F, section 14, is amended by striking out "medical records" and substituting "records of personal health information".
Substitute Decisions Act, 1992
93. (1) Subsection 83 (9) of the Substitute Decisions Act, 1992 is repealed.
(2) Clause 90 (1) (e.4) of the Act, as enacted by the Statutes of Ontario, 1996, chapter 2, section 60, is amended by striking out "subject to the Mental Health Act and the Long-Term Care Act, 1994 but despite any other Act or the regulations under any other Act".
PART XIV
COMMENCEMENT AND SHORT TITLE
Commencement
94. This Act comes into force on a day to be named by proclamation of the Lieutenant Governor.
Short title
95. The short title of this Act is the Personal Health Information Privacy Act, 2000.
EXPLANATORY NOTE
The Bill provides rules for the collecting, using, retaining, disclosing and disposing of personal health information in the custody or under the control of health information custodians.
Part I. Health information custodians are defined as listed individuals or organizations who have custody or control of personal health information as a result of the work that they do or in connection with the powers or duties they perform. The regulations made under the Bill may specify other custodians.
Personal health information is defined as certain information about an individual, whether living or deceased and whether or not the information is recorded. The information is information that can identify an individual and that relates to matters such as the individual's physical or mental health or well-being, the providing of health care to the individual, payments or eligibility for health care in respect of the individual, the donation by the individual of a body part or bodily substance, the individual's health number or registration information.
Part II. The Bill sets out specific circumstances where it does not apply. For example, it does not apply to recorded information that is more than 150 years old, anonymous or statistical information that does not permit an individual to be identified, information relating to labour relations affecting the individual or the employment of the individual, the child abuse register or the adoption disclosure register.
Subject to few exceptions, if there is a conflict between a confidentiality provision in the Bill and one in another Act, the Bill prevails unless the Bill or the other Act specifically provides otherwise.
Part III. No health information custodian is permitted to collect, use or disclose personal health information if other information can serve the purpose. The collection, use or disclosure must be limited to registration information if registration information will serve the purpose. A health information custodian may collect, use or disclose only as much personal health information as is reasonably necessary for the purpose. To the extent reasonably possible, a health information custodian who collects, uses or discloses personal health information shall do so in a manner that conceals the identity of the individual.
A health information custodian is required to comply with all standards set out in the regulations made under the Bill and all requirements concerning the electronic transfer of personal health information set out in the regulations. Specific requirements concerning computer matching may apply if a health information custodian is also an institution under the Freedom of Information and Protection of Privacy Act or the Municipal Freedom of Information and Protection of Privacy Act.
Employees and other people who work on behalf of a health information custodian, including an agent, a solicitor, a student, or a volunteer, are deemed to act on behalf of the custodian. An information manager is defined as a person who, on behalf of a health information custodian, processes, stores or disposes of records that contain personal health information or provides information management or information technology services to the custodian with respect to those records. Before providing personal health information to an information manager, a health information custodian is required to enter into an agreement with the manager that sets out the duties of the manager and certain safeguards and notification requirements.
Part IV. A health information custodian is required to establish and maintain administrative, technical and physical safeguards and practices to protect the integrity, accuracy, confidentiality and security of personal health information in the custody or under the control of the custodian. The custodian is also required to have in place a written policy regarding the retention and disposal of records of personal health information.
Health information custodians are required to have in place a contact person among their staff to help themselves comply with the Bill, to respond to inquiries about their information practices and to receive complaints from the public. Custodians are also required to prepare a written statement of their information practices and to make this statement available to the public.
Part V. Where the Bill or any other Act requires the consent of an individual for the collection, use or disclosure of personal health information, it must be an informed consent. In order to give an informed consent, the individual giving the consent must have information that a reasonable person would require in the circumstances to make a decision about the collection, use or disclosure of personal health information.
Part VI. A health information custodian is not permitted to collect personal health information unless the collection is expressly authorized by statute or necessary for a lawful purpose related to a function or activity of the custodian. A custodian that collects personal health information relating to an individual is required to collect it directly from the individual except where the Bill allows methods of indirect collection. The custodian is required to inform the individual of the purpose for collecting the information unless it is reasonable to infer the purpose in the circumstances.
A health information custodian is required to maintain the confidentiality of personal health information in the custody or under the control of the custodian and is permitted to use or disclose it only as permitted or required under the Bill and in accordance with the custodian's lawful purposes. Regulations may prescribe the circumstances in which a custodian must give an individual information about the anticipated uses and disclosures of personal health information relating to the individual. Regulations may also prescribe the circumstances in which a custodian must document any unanticipated uses and disclosures of personal health information.
A person who receives personal health information from a custodian is not permitted to use or disclose the information except in accordance with the Bill.
A health information custodian may use personal health information only for certain purposes, including the purpose for which the information was collected or created, a directly related purpose, a purpose to which the individual consents, a purpose for which the information may be disclosed or is required to be disclosed to a custodian under the Bill, planning or delivering programs or services of a custodian and detecting, monitoring or preventing fraud.
A health information custodian may disclose personal health information relating to an individual only if the individual consents or in circumstances such as the following:
1.Disclosure to a custodian who is a health care practitioner or a facility or organization that provides health care for the purpose of providing or assisting in providing health care to the individual. (Clause 29 (1) (a))
2.Disclosure for the purpose of determining or verifying eligibility of an individual to receive health care or other health-related benefits. (Clause 29 (1) (b))
3.Disclosure for the purpose of managing the custodian's programs or services. (Subsection 30 (2))
4.Disclosure to the Minister to assist the Minister in managing the health system, verifying the accuracy of information held by the Ministry or administering or enforcing an Act administered by the Minister. (Subsection 30 (4) and section 31)
5.Disclosure to a researcher for the purpose of a research project or program if certain conditions are met, including the requirement that the researcher obtain the prior approval of a research ethics review body and enter into an agreement with the custodian to protect the confidentiality and security of the information. (Section 32)
6.Disclosure to eliminate or reduce a significant risk to an individual's safety. (Clause 33 (a))
7.Disclosure under certain circumstances in a proceeding. However, health care practitioners and facilities or organizations that provide health care are not permitted to disclose personal health information about their patients or clients in proceedings unless the individual consents, the court or other body holding the proceeding determines that the disclosure is essential in the interests of justice or certain other circumstances apply. (Section 34)
8.Disclosure for the purpose of an inspection or investigation authorized under an Act of Ontario or Canada or by a warrant. (Clauses 36 (1) (g) and (h))
9.Disclosure in connection with the Remedies for Organized Crime and Other Unlawful Activities Act, 2000, if the Bill that creates that Act receives Royal Assent. (Clause 36 (1) (h.1))
10.Disclosures permitted or required under an Act of Ontario or Canada. (Clause 36 (1) (i))
Part VII. No witness in a proceeding may testify about or give out quality of care information which is defined as information collected or prepared exclusively for a committee in a hospital or another facility, organization or person prescribed by the regulations made under the Bill for such purposes as quality assurance, peer review or ethics review. Quality of care information does not include originals or copies of records about health care or related services provided in the hospital or by the facility, organization or person that were not prepared exclusively for the committee.
Part VIII. With few exceptions, an individual has a right to see his or her record of personal health information. The Bill sets out the process for obtaining access to one's record pursuant to a written request by the individual or, in certain circumstances, a substitute decision-maker.
In certain circumstances, a health information custodian may refuse to give an individual access to a record of his or her personal health information, for example, if the access could reasonably be expected to result in harm to the treatment or recovery of the individual, injury to the mental condition of another individual or bodily harm to another individual or if the access could reasonably be expected to constitute an unjustified invasion of another individual's personal privacy.
If a health information custodian refuses an access request in whole or in part, the individual is entitled to make a complaint to the Information and Privacy Commissioner.
An individual who believes there has been an error or omission in a record of personal health information relating to the individual may request in writing that the health information custodian amend the record. The custodian is required either to amend the record as requested by the individual or to attach a statement of disagreement to the record stating that the custodian has not made the amendment requested.
Part IX. The Bill sets out a list of persons who are authorized to consent or refuse consent on behalf of an individual to a collection, use or disclosure of personal health information relating to the individual. The individual may be living or deceased and may be capable or incapable with respect to personal health information. The list of substitute decision-makers for an incapable individual is ranked according to priority.
A person who is determined to be incapable with respect to personal health information may apply to the Consent and Capacity Board for a review of the determination. The Board may also appoint a representative to make decisions about personal health information on behalf of an incapable person. The application can be made either by the incapable person or the person wishing to become the representative.
Part X. The Bill confers powers and duties on the Information and Privacy Commissioner, and authorizes the Commissioner to delegate any of his or her powers, duties or functions under the Bill to the Assistant Commissioner of Personal Health Information appointed under the Freedom of Information and Protection of Privacy Act.
Part XI. Any person may make a complaint to the Commissioner about any matter under the Bill or the regulations made under the Bill or about the information practices of a health information custodian, but not about what constitutes quality of care information. The Commissioner may require a complainant to attempt to resolve the complaint directly with the custodian or may authorize a mediator to review the complaint and try to effect a settlement.
In addition, if the Commissioner receives information with respect to any matter for which a person would be entitled to make a complaint, the Commissioner may treat the information as a complaint if he or she has reasonable grounds to believe that a person has contravened any provision of this Act or the regulations.
The Commissioner may review a complaint in accordance with the procedure prescribed by the regulations. After a review, the Commissioner may make comments and recommendations on the privacy protection implications of the review. If the Commissioner determines that a health information custodian has collected personal health information in contravention of the Bill, the regulations or an agreement made under the Bill, the Commissioner may order the custodian to cease the collection or to dispose of the records of personal health information involved.
If the complaint relates to a request for access to a record of personal health information or for an amendment of the record, the Commissioner may conduct an inquiry and may make orders to require compliance with the Bill. Failing to comply with an order of the Commissioner constitutes an offence under the Bill.
The Bill also sets out other offences and penalties for offences.
Part XII. The Bill provides protection from liability to health information custodians and persons employed by or in the service of custodians if they act in good faith and reasonably in the circumstances. The Bill also provides protection from liability to substitute decision-makers who act on behalf of individuals if they act reasonably in the circumstances, in good faith and in accordance with the Bill.
The Lieutenant Governor in Council may make regulations under the Bill to govern matters such as fees for collecting, using or disclosing personal health information, providing access to a record of personal health information or providing a copy of a record; the retention and disposal of records of personal health information; administrative, technical and physical safeguards for managing personal health information; and standards for the electronic transfer of records of personal health information.
Part XIII. The Bill makes complementary amendments to other Acts whose provisions are incorporated into the Bill or are no longer needed as a result of the Bill. For example, the provisions of the Mental Health Act that deal with clinical records and of the Long-Term Care Act, 1994 that deal with personal records are repealed. The Health Cards Numbers and Control Act, 1991 is repealed since the health number constitutes personal health information. The prohibition in that Act against requiring the production of another person's health card is continued in the Bill.