Bill 31, Health Information Protection Act, 2004

Smitherman, Hon. George Minister of Health and Long-Term Care

Versions

Bill 31 2004

An Act to enact
and amend various Acts
with respect to the protection
of health information

Her Majesty, by and with the advice and consent of the Legislative Assembly of the Province of Ontario, enacts as follows:

Personal Health Information Protection Act, 2004

1. The Personal Health Information Protection Act, 2004, as set out in Schedule A, is hereby enacted.

Quality of Care Information Protection Act, 2004

2. The Quality of Care Information Protection Act, 2004, as set out in Schedule B, is hereby enacted.

Commencement

3. (1) Subject to subsections (2) and (3), this Act comes into force on the day it receives Royal Assent.

Schedules

(2) The Schedules to this Act come into force as provided in the commencement section at or near the end of each Schedule.

Selective proclamation

(3) A proclamation mentioned in the commencement section in a Schedule to this Act may apply to one or more sections, subsections, clauses or paragraphs of the Schedule or to one or more other subdivisions of any section of the Schedule, and proclamations may be issued at different times under this subsection.

Short title

4. The short title of this Act is the Health Information Protection Act, 2004.

SCHEDULE A
PERSONAL HEALTH INFORMATION PROTECTION ACT, 2004

CONTENTS


PART I INTERPRETATION AND APPLICATION
Purposes, Definitions and Interpretation
1.	Purposes
2.	Definitions
3.	Health information custodian
4.	Personal health information
5.	Substitute decision-maker
6.	Interpretation
Application of Act
7.	Application of Act
8.	Freedom of information legislation
9.	Non-application of Act
PART II PRACTICES TO PROTECT PERSONAL HEALTH INFORMATION
General
10.	Information practices
11.	Accuracy
12.	Security
Records
13.	Handling of records
14.	Place where records kept
Accountability and Openness
15.	Contact person
16.	Written public statement
17.	Agents and information
PART III CONSENT CONCERNING PERSONAL HEALTH INFORMATION
General
18.	Elements of consent
19.	Withdrawal of consent
20.	Assumption of validity
Capacity and Substitute Decision-Making
21. 22. 23. 24. 25. 26. 27. 28.	Capacity to consent Determination of incapacity Persons who may consent Factors to consider for consent Authority of substitute decision-maker Incapable individual: persons who may consent Appointment of representative Transition, representative appointed by Board
PART IV COLLECTION, USE AND DISCLOSURE OF PERSONAL HEALTH INFORMATION
General Limitations and Requirements
29. 30. 31. 32. 33. 34. 35.	Requirement for consent Other information Use and disclosure of personal health information Fundraising Marketing Health cards and health numbers Fees for personal health information
Collection
36.	Indirect collection
Use
37.	Permitted use
Disclosure
38. 39. 40. 41. 42. 43. 44. 45. 46. 47. 48. 49. 50.	Disclosures related to providing health care Disclosures for health or other programs Disclosures related to risks Disclosures for proceedings Disclosure to successor Disclosures related to this or other Acts Disclosure for research Disclosure for planning and management of health system Monitoring health care payments Disclosure for analysis of health system Disclosure with Commissioner's approval Restrictions on recipients Disclosure outside Ontario
PART V ACCESS TO RECORDS OF PERSONAL HEALTH INFORMATION AND CORRECTION
Access
51. 52. 53. 54.	Application of Part Individual's right of access Request for access Response of health information custodian
Correction
55.	Correction
PART VI ADMINISTRATION AND ENFORCEMENT
Complaints, Reviews and Inspections
56. 57. 58. 59. 60. 61. 62. 63. 64. 65.	Complaint to Commissioner Response of Commissioner Commissioner's self-initiated review Conduct of Commissioner's review Inspection powers Powers of Commissioner Appeal of order Enforcement of order Further order of Commissioner Damages for breach of privacy
Commissioner
66. 67. 68. 69.	General powers Delegation Limitations re personal health information Immunity
PART VII GENERAL
70. 71. 72. 73. 74. 75.	Non-retaliation Immunity Offences Regulations Public consultation before making regulations Review of Act
PART VIII COMPLEMENTARY AMENDMENTS
76. 77. 78. 79. 80. 81. 82. 83. 84. 85. 86. 87. 88. 89. 90. 91. 92. 93. 94. 95. 96. 97. 98.	Ambulance Act Charitable Institutions Act Child and Family Services Act Commitment to the Future of Medicare Act, 2004 Drug and Pharmacies Regulation Act Freedom of Information and Protection of Privacy Act Health Cards and Numbers Control Act, 1991 Health Care Accessibility Act Health Care Consent Act, 1996 Health Insurance Act Health Protection and Promotion Act Homes for the Aged and Rest Homes Act Independent Health Facilities Act Long-Term Care Act, 1994 Mental Health Act Municipal Freedom of Information and Protection of Privacy Act Nursing Homes Act Occupational Health and Safety Act Ombudsman Act Ontario Drug Benefit Act Public Hospitals Act Substitute Decisions Act, 1992 Trillium Gift of Life Network Act
PART IX COMMENCEMENT AND SHORT TITLE
99. 100.	Commencement Short title
______________

PART I
INTERPRETATION AND APPLICATION

Purposes, Definitions and Interpretation

Purposes

1. The purposes of this Act are,

(a) to establish rules for the collection, use and disclosure of personal health information about individuals that protect the confidentiality of that information and the privacy of individuals with respect to that information, while facilitating the effective provision of health care;

(b) to provide individuals with a right of access to personal health information about themselves, subject to limited and specific exceptions set out in this Act;

(c) to provide individuals with a right to require the correction or amendment of personal health information about themselves, subject to limited and specific exceptions set out in this Act;

(d) to provide for independent review and resolution of complaints with respect to personal health information; and

(e) to provide effective remedies for contraventions of this Act.

Definitions

2. In this Act,

"agent", in relation to a health information custodian, means a person that, with the authorization of the custodian, acts for or on behalf of the custodian in respect of personal health information for the purposes of the custodian, and not the agent's own purposes, whether or not the agent has the authority to bind the custodian, whether or not the agent is employed by the custodian and whether or not the agent is being remunerated; ("mandataire")

"Assistant Commissioner" means the Assistant Commissioner for Personal Health Information appointed under the Freedom of Information and Protection of Privacy Act; ("commissaire adjoint")

"attorney for personal care" means an attorney under a power of attorney for personal care made in accordance with the Substitute Decisions Act, 1992; ("procureur au soin de la personne")

"attorney for property" means an attorney under a continuing power of attorney for property made in accordance with the Substitute Decisions Act, 1992; ("procureur aux biens")

"Board" means the Consent and Capacity Board constituted under the Health Care Consent Act, 1996; ("Commission")

"capable" means mentally capable, and "capacity" has a corresponding meaning; ("capable", "capacité")

"collect", in relation to personal health information, means to gather, acquire, receive or obtain the information by any means from any source, and "collection" has a corresponding meaning; ("recueillir", "collecte")

"Commissioner" means the Information and Privacy Commissioner appointed under the Freedom of Information and Protection of Privacy Act; ("commissaire")

"disclose", in relation to personal health information in the custody or under the control of a health information custodian or a person, means to make the information available or to release it to another health information custodian or to another person, but does not include to use the information, and "disclosure" has a corresponding meaning; ("divulguer", "divulgation")

"guardian of property" means a guardian of property or a statutory guardian of property under the Substitute Decisions Act, 1992; ("tuteur aux biens")

"guardian of the person" means a guardian of the person appointed under the Substitute Decisions Act, 1992; ("tuteur à la personne")

"health care" means any observation, examination, assessment, care, service or procedure that is done for a health-related purpose and that,

(a) is carried out or provided to diagnose, treat or maintain an individual's physical or mental condition,

(b) is carried out or provided to prevent disease or injury or to promote health, or

and includes,

(d) the compounding, dispensing or selling of a drug, a device, equipment or any other item to an individual, or for the use of an individual, pursuant to a prescription, and

(e) a community service that is described in subsection 2 (3) of the Long-Term Care Act, 1994 and provided by a service provider within the meaning of that Act; ("soins de santé")

"health care practitioner" means,

(a) a person who is a member within the meaning of the Regulated Health Professions Act, 1991 and who provides health care,

(b) a person who is registered as a drugless practitioner under the Drugless Practitioners Act and who provides health care,

(c) a person who is a member of the Ontario College of Social Workers and Social Service Workers and who provides health care, or

(d) any other person whose primary function is to provide health care for payment; ("praticien de la santé")

"health information custodian" has the meaning set out in section 3; ("dépositaire de renseignements sur la santé")

"health number" means the number, the version code or both of them assigned to an insured person within the meaning of the Health Insurance Act by the General Manager within the meaning of that Act; ("numéro de la carte Santé")

"incapable" means mentally incapable, and "incapacity" has a corresponding meaning; ("incapable", "incapacité")

"individual", in relation to personal health information, means the individual, whether living or deceased, with respect to whom the information was or is being collected or created; ("particulier")

"information practices", in relation to a health information custodian, means the policy of the custodian for actions in relation to personal health information, including,

(a) when, how and the purposes for which the custodian routinely collects, uses, modifies, discloses, retains or disposes of personal health information, and

(b) the administrative, technical and physical safeguards and practices that the custodian maintains with respect to the information; ("pratiques relatives aux renseignements")

"Minister" means the Minister of Health and Long-Term Care; ("ministre")

"partner" means either of two persons who have lived together for at least one year and have a close personal relationship that is of primary importance in both persons' lives; ("partenaire")

"person" includes a partnership, association or other entity; ("personne")

"personal health information" has the meaning set out in section 4; ("renseignements personnels sur la santé")

"prescribed" means prescribed by the regulations made under this Act; ("prescrit")

"proceeding" includes a proceeding held in, before or under the rules of a court, a tribunal, a commission, a justice of the peace, a coroner, a committee of a College within the meaning of the Regulated Health Professions Act, 1991, a committee of the Board of Regents continued under the Drugless Practitioners Act, a committee of the Ontario College of Social Workers and Social Service Workers under the Social Work and Social Service Work Act, 1998, an arbitrator or a mediator; ("instance")

"quality of care information" has the same meaning as in the Quality of Care Information Protection Act, 2004; ("renseignements sur la qualité des soins")

"record" means a record of information in any form or in any medium, whether in written, printed, photographic or electronic form or otherwise, but does not include a computer program or other mechanism that can produce a record; ("dossier")

"relative" means either of two persons who are related to each other by blood, marriage or adoption; ("parent")

"research" means a systematic investigation designed to develop or establish principles, facts or generalizable knowledge, or any combination of them, and includes the development, testing and evaluation of research; ("recherche")

"researcher" means a person who conducts research; ("chercheur")

"research ethics board" means a board of persons that is established for the purpose of approving research plans under section 44 and that meets the prescribed requirements; ("commission d'éthique de la recherche")

"spouse" means either of two persons who,

(a) are married to each other, or

(b) live together in a conjugal relationship outside marriage and,

(i) have cohabited for at least one year,

(ii) are together the parents of a child, or

(iii) have together entered into a cohabitation agreement under section 53 of the Family Law Act,

unless they are living separate and apart as a result of a breakdown of their relationship; ("conjoint")

"substitute decision-maker" has the meaning set out in section 5; ("mandataire spécial")

"use", in relation to personal health information in the custody or under the control of a health information custodian or a person, means to handle or deal with the information, subject to subsection 6 (1), but does not include to disclose the information, and "use", as a noun, has a corresponding meaning. ("utiliser", "utilisation")

Health information custodian

3. (1) In this Act,

"health information custodian", subject to subsections (3) to (11), means a person or organization described in one of the following paragraphs who has custody or control of personal health information as a result of or in connection with performing the person's or organization's powers or duties or the work described in the paragraph, if any:

1. A health care practitioner or a person who operates a group practice of health care practitioners.

2. A service provider within the meaning of the Long-Term Care Act, 1994 who provides a community service to which that Act applies.

3. A community care access corporation within the meaning of the Community Care Access Corporations Act, 2001.

4. A person who operates one of the following facilities, programs or services:

i. A hospital within the meaning of the Public Hospitals Act, a private hospital within the meaning of the Private Hospitals Act, a psychiatric facility within the meaning of the Mental Health Act, an institution within the meaning of the Mental Hospitals Act or an independent health facility within the meaning of the Independent Health Facilities Act.

ii. An approved charitable home for the aged within the meaning of the Charitable Institutions Act, a placement co-ordinator described in subsection 9.6 (2) of that Act, a home or joint home within the meaning of the Homes for the Aged and Rest Homes Act, a placement co-ordinator described in subsection 18 (2) of that Act, a nursing home within the meaning of the Nursing Homes Act, a placement co-ordinator described in subsection 20.1 (2) of that Act or a care home within the meaning of the Tenant Protection Act, 1997.

iii. A pharmacy within the meaning of Part VI of the Drug and Pharmacies Regulation Act.

iv. A laboratory or a specimen collection centre as defined in section 5 of the Laboratory and Specimen Collection Centre Licensing Act.

v. An ambulance service within the meaning of the Ambulance Act.

vi. A home for special care within the meaning of the Homes for Special Care Act.

vii. A centre, program or service for community health or mental health whose primary purpose is the provision of health care.

5. An evaluator within the meaning of the Health Care Consent Act, 1996 or an assessor within the meaning of the Substitute Decisions Act, 1992.

6. A medical officer of health or a board of health within the meaning of the Health Protection and Promotion Act.

7. The Minister, together with the Ministry of the Minister if the context so requires.

8. Any other person prescribed as a health information custodian if the person has custody or control of personal health information as a result of or in connection with performing prescribed powers, duties or work or any prescribed class of such persons.

Interpretation, officer in charge

(2) For the purposes of subparagraph 4 i of the definition of "health information custodian" in subsection (1), the officer in charge of an institution within the meaning of the Mental Hospitals Act shall be deemed to be the person who operates the institution.

Exceptions

(3) Except as is prescribed, a person described in any of the following paragraphs is not a health information custodian in respect of personal health information that the person collects, uses or discloses while performing the person's powers or duties or the work described in the paragraph, if any:

1. A person described in paragraph 1, 2 or 5 of the definition of "health information custodian" in subsection (1) who is an agent of a health information custodian.

2. A person who is authorized to act for or on behalf of a person that is not a health information custodian, if the scope of duties of the authorized person does not include the provision of health care.

3. The Minister when acting on behalf of an institution within the meaning of the Freedom of Information and Protection of Privacy Act or the Municipal Freedom of Information and Protection of Privacy Act that is not a health information custodian.

Other exceptions

(4) A health information custodian does not include a person described in one of the following paragraphs who has custody or control of personal health information as a result of or in connection with performing the work described in the paragraph:

1. An aboriginal healer who provides traditional healing services to aboriginal persons or members of an aboriginal community.

2. An aboriginal midwife who provides traditional midwifery services to aboriginal persons or members of an aboriginal community.

3. A person who treats another person solely by prayer or spiritual means in accordance with the tenets of the religion of the person giving the treatment.

Multiple facilities

(5) Subject to subsection (6) or an order of the Minister under subsection (8), a health information custodian that operates more than one facility described in one of the subparagraphs of paragraph 4 of the definition of "health information custodian" in subsection (1) shall be deemed to be a separate custodian with respect to personal health information of which it has custody or control as a result of or in connection with operating each of the facilities that it operates.

Single custodian

(6) Despite subsection (5), the following persons shall be deemed to be a single health information custodian with respect to all the functions described in the applicable paragraph, if any:

1. A person who operates a hospital within the meaning of the Public Hospitals Act and any of the facilities, programs or services described in paragraph 4 of the definition of "health information custodian" in subsection (1).

2. A community care access corporation that provides a community service within the meaning of subsection 2 (3) of the Long Term Care Act, 1994 and acts as a placement co-ordinator as described in subsection 9.6 (2) of the Charitable Institutions Act, subsection 18 (2) of the Homes for the Aged and Rest Homes Act or subsection 20.1 (2) of the Nursing Homes Act.

3. Health information custodians or facilities that are prescribed.

Application to act as one custodian

(7) A health information custodian that operates more than one facility described in one of the subparagraphs of paragraph 4 of the definition of "health information custodian" in subsection (1) or two or more health information custodians may apply to the Minister, in a form approved by the Minister, for an order described in subsection (8).

Minister's order

(8) Upon receiving an application described in subsection (7), the Minister may make an order permitting all or some of the applicants to act as a single health information custodian on behalf of those facilities, powers, duties or work that the Minister specifies, subject to the terms that the Minister considers appropriate and specifies in the order, if the Minister is of the opinion that it is appropriate to make the order in the circumstances, having regard to,

(a) the public interest;

(b) the ability of the applicants to provide individuals with reasonable access to their personal health information;

(d) whether permitting the applicants to act as a single health information custodian is necessary to enable them to effectively provide integrated health care.

Scope of order

(9) In an order made under subsection (8), the Minister may order that any class of health information custodians that the Minister considers to be situated similarly to the applicants is permitted to act as a single health information custodian, subject to the terms that the Minister considers appropriate and specifies in the order, if the Minister is of the opinion that it is appropriate to so order, having regard to,

(a) the public interest;

(b) the ability of the custodians that are subject to the order made under this subsection to provide individuals with reasonable access to their personal health information;

(c) the ability of the custodians that are subject to the order made under this subsection to comply with the requirements of this Act; and

(d) whether permitting the custodians that are subject to the order made under this subsection to act as a single health information custodian is necessary to enable them to effectively provide integrated health care.

No hearing required

(10) The Minister is not required to hold a hearing or to afford to any person an opportunity for a hearing before making an order under subsection (8).

Duration

(11) Subject to subsection (12), a health information custodian does not cease to be a health information custodian with respect to a record of personal health information until complete custody and control of the record, where applicable, passes to another person who is legally authorized to hold the record.

Death of custodian

(12) If a health information custodian dies, the following person shall be deemed to be the health information custodian with respect to records of personal health information held by the deceased custodian until custody and control of the records, where applicable, passes to another person who is legally authorized to hold the records:

1. The estate trustee of the deceased custodian.

2. The person who has assumed responsibility for the administration of the deceased custodian's estate, if the estate does not have an estate trustee.

Personal health information

4. (1) In this Act,

"personal health information", subject to subsections (3) and (4), means identifying information about an individual in oral or recorded form, if the information,

(a) relates to the physical or mental health of the individual, including information that consists of the health history of the individual's family,

(b) relates to the providing of health care to the individual, including the identification of a person as a provider of health care to the individual,

(d) relates to payments or eligibility for health care in respect of the individual,

(e) relates to the donation by the individual of any body part or bodily substance of the individual or is derived from the testing or examination of any such body part or bodily substance,

(f) is the individual's health number, or

(g) identifies an individual's substitute decision-maker.

Identifying information

(2) In this section,

"identifying information" means information that identifies an individual or for which it is reasonably foreseeable in the circumstances that it could be utilized, either alone or with other information, to identify an individual.

Mixed records

(3) Personal health information about an individual includes identifying information about the individual that is not personal health information described in subsection (1) but that is contained in a record that contains personal health information described in that subsection about the individual.

Exception

(4) Personal health information does not include identifying information contained in a record that is in the custody or under the control of a health information custodian if,

(a) the identifying information contained in the record relates primarily to one or more employees or other agents of the custodian; and

(b) the record is maintained primarily for a purpose other than the provision of health care or assistance in providing health care to the employees or other agents.

Substitute decision-maker

5. (1) In this Act,

"substitute decision-maker", in relation to an individual, means, unless the context requires otherwise, a person who is authorized under this Act to consent on behalf of the individual to the collection, use or disclosure of personal health information about the individual.

Decision about treatment

(2) A substitute decision-maker of an individual within the meaning of section 9 of the Health Care Consent Act, 1996 shall be deemed to be a substitute decision-maker of the individual in respect of the collection, use or disclosure of personal health information about the individual if the purpose of the collection, use or disclosure is necessary for, or ancillary to, a decision about a treatment under Part II of that Act.

Admission to a care facility

(3) A substitute decision-maker of an individual within the meaning of section 39 of the Health Care Consent Act, 1996 shall be deemed to be a substitute decision-maker of the individual in respect of the collection, use or disclosure of personal health information about the individual if the purpose of the collection, use or disclosure is necessary for, or ancillary to, a decision about admission to a care facility under Part III of that Act.

Personal assistance services

(4) A substitute decision-maker of an individual within the meaning of section 56 of the Health Care Consent Act, 1996 shall be deemed to be a substitute decision-maker of the individual in respect of the collection, use or disclosure of personal health information about the individual if the purpose of the collection, use or disclosure is necessary for, or ancillary to, a decision about a personal assistance service under Part IV of that Act.

Interpretation

6. (1) For the purposes of this Act, the providing of personal health information between a health information custodian and an agent of the custodian is a use by the custodian, and not a disclosure by the person providing the information or a collection by the person to whom the information is provided.

Provisions based on consent

(2) A provision of this Act that applies to the collection, use or disclosure of personal health information about an individual by a health information custodian with the consent of the individual, whatever the nature of the consent, does not affect the collection, use or disclosure that this Act permits or requires the health information custodian to make of the information without the consent of the individual.

Permissive disclosure

(3) A provision of this Act that permits a health information custodian to disclose personal health information about an individual without the consent of the individual,

(a) does not require the custodian to disclose it unless required to do so by law;

(b) does not relieve the custodian from a legal requirement to disclose the information; and

Application of Act

Application of Act

7. (1) Except if this Act or its regulations specifically provide otherwise, this Act applies to,

(a) the collection of personal health information by a health information custodian on or after the day this section comes into force;

(b) the use or disclosure of personal health information, on or after the day this section comes into force, by,

(i) a health information custodian, even if the custodian collected the information before that day, or

(ii) a person who is not a health information custodian and to whom a health information custodian disclosed the information, even if the person received the information before that day; and

(c) the collection, use or disclosure of a health number by any person on or after the day this section comes into force.

Conflict

(2) In the event of a conflict between a provision of this Act or its regulations and a provision of any other Act or its regulations, this Act and its regulations prevail unless this Act, its regulations or the other Act specifically provide otherwise.

Interpretation

(3) For the purpose of this section, there is no conflict unless it is not possible to comply with both this Act and its regulations and any other Act or its regulations.

Exception

(4) This Act and its regulations do not prevail in the event of a conflict between a provision of this Act or its regulations and a provision of the Quality of Care Information Protection Act, 2004 or its regulations.

Freedom of information legislation

8. (1) Subject to subsection (2), the Freedom of Information and Protection of Privacy Act and the Municipal Freedom of Information and Protection of Privacy Act do not apply to personal health information collected by a health information custodian or in the custody or under the control of a health information custodian unless this Act specifies otherwise.

Exceptions

(2) Sections 11, 12, 15, 16, 17 and 33, subsection 35 (2) and sections 36 and 44 of the Freedom of Information and Protection of Privacy Act and sections 5, 9, 10, 24, 25, 26 and 34 of the Municipal Freedom of Information and Protection of Privacy Act apply in respect of records of personal health information in the custody or under the control of a health information custodian that is an institution within the meaning of either of those Acts, as the case may be, or that is acting as part of such an institution.

Same

(3) A record of personal health information prepared by or in the custody or control of an institution within the meaning of the Freedom of Information and Protection of Privacy Act or the Municipal Freedom of Information and Protection of Privacy Act shall be deemed to be a record to which clause 32 (b) of the Freedom of Information and Protection of Privacy Act or clause 25 (1) (b) of the Municipal Freedom of Information and Protection of Privacy Act applies, as the case may be.

Access

(4) This Act does not limit a person's right of access under section 10 of the Freedom of Information and Protection of Privacy Act or section 4 of the Municipal Freedom of Information and Protection of Privacy Act to a record of personal health information if all the types of information referred to in subsection 4 (1) are reasonably severed from the record.

Transition

(5) This Act does not apply to a collection, use or disclosure of personal health information, a request for access or an appeal made under the Freedom of Information and Protection of Privacy Act or the Municipal Freedom of Information and Protection of Privacy Act before the day this section comes into force, and the applicable Act continues to apply to the collection, use, disclosure, request or appeal.

Non-application of Act

9. (1) This Act does not apply to personal health information about an individual after the earlier of 120 years after a record containing the information was created and 50 years after the death of the individual.

Other rights and Acts

(2) Nothing in this Act shall be construed to interfere with,

(a) anything in connection with a subrogated claim or a potential subrogated claim;

(b) any legal privilege, including solicitor-client privilege;

(d) the power of a court or a tribunal to compel a witness to testify or to compel the production of a document;

(e) the regulatory activities of a College under the Regulated Heath Professions Act, 1991, the College under the Social Work and Social Service Work Act, 1998 or the Board under the Drugless Practitioners Act; or

(f) any provision of any Act of Ontario or Canada or any court order, if the provision or order, as the case may be, prohibits a person from making information public or from publishing information.

PART II
PRACTICES TO PROTECT PERSONAL
HEALTH INFORMATION

General

Information practices

10. (1) A health information custodian that has custody or control of personal health information shall have in place information practices that comply with the requirements of this Act and its regulations.

Duty to follow practices

(2) A health information custodian shall comply with its information practices.

Use of electronic means

(3) A health information custodian that uses electronic means to collect, use, modify, disclose, retain or dispose of personal health information shall comply with the prescribed requirements, if any.

Providers to custodians

(4) A person who provides goods or services for the purpose of enabling a health information custodian to use electronic means to collect, use, modify, disclose, retain or dispose of personal health information shall comply with the prescribed requirements, if any.

Accuracy

11. (1) A health information custodian that uses personal health information about an individual shall take reasonable steps to ensure that the information is as accurate, complete and up-to-date as is necessary for the purposes for which it uses the information.

Same, disclosure

(2) A health information custodian that discloses personal health information about an individual shall,

(a) take reasonable steps to ensure that the information is as accurate, complete and up-to-date as is necessary for the purposes of the disclosure that are known to the custodian at the time of the disclosure; or

(b) clearly set out for the recipient of the disclosure the limitations, if any, on the accuracy, completeness or up-to-date character of the information.

Security

12. (1) A health information custodian shall take steps that are reasonable in the circumstances to ensure that personal health information in the custodian's custody or control is protected against theft, loss and unauthorized use or disclosure and to ensure that the records containing the information are protected against unauthorized copying, modification or disposal.

Notice of loss, etc.

(2) Subject to subsection (3) and subject to the exceptions and additional requirements, if any, that are prescribed, a health information custodian that has custody or control of personal health information about an individual shall notify the individual at the first reasonable opportunity if the information is stolen, lost, or accessed by unauthorized persons.

Exception

(3) If the health information custodian is a researcher who has received the personal health information from another health information custodian under subsection 44 (1), the researcher shall not notify the individual that the information is stolen, lost or accessed by unauthorized persons unless the health information custodian under that subsection first obtains the individual's consent to having the researcher contact the individual and informs the researcher that the individual has given the consent.

Records

Handling of records

13. (1) A health information custodian shall ensure that the records of personal health information that it has in its custody or under its control are retained, transferred and disposed of in a secure manner and in accordance with the prescribed requirements, if any.

Retention of records subject to a request

(2) Despite subsection (1), a health information custodian that has custody or control of personal health information that is the subject of a request for access under section 53 shall retain the information for as long as necessary to allow the individual to exhaust any recourse under this Act that he or she may have with respect to the request.

Place where records kept

14. (1) A health information custodian may keep a record of personal health information about an individual in the individual's home in any reasonable manner to which the individual consents, subject to any restrictions set out in a regulation, by-law or published guideline under the Regulated Health Professions Act, 1991, an Act referred to in Schedule 1 of that Act, the Drugless Practitioners Act or the Social Work and Social Service Work Act, 1998.

Records kept in other places

(2) A health care practitioner may keep a record of personal health information about an individual in a place other than the individual's home and other than a place in the control of the practitioner if,

(a) the record is kept in a reasonable manner;

(b) the individual consents;

(c) the health care practitioner is permitted to keep the record in the place in accordance with a regulation, by-law or published guideline under the Regulated Health Professions Act, 1991, an Act referred to in Schedule 1 to that Act, the Drugless Practitioners Act or the Social Work and Social Service Work Act, 1998, if the health care practitioner is described in any of clauses (a) to (c) of the definition of "health care practitioner" in section 2; and

(d) the prescribed conditions, if any, are satisfied.

Accountability and Openness

Contact person

15. (1) A health information custodian that is a natural person may designate a contact person described in subsection (3).

Same

(2) A health information custodian that is not a natural person shall designate a contact person described in subsection (3).

Functions of contact person

(3) A contact person is an agent of the health information custodian and is authorized on behalf of the custodian to,

(a) facilitate the custodian's compliance with this Act;

(b) ensure that all agents of the custodian are appropriately informed of their duties under this Act;

(d) respond to requests of an individual for access to or correction of a record of personal health information about the individual that is in the custody or under the control of the custodian; and

(e) receive complaints from the public about the custodian's alleged contravention of this Act or its regulations.

If no contact person

(4) A health information custodian that is a natural person and that does not designate a contact person under subsection (1) shall perform on his or her own the functions described in clauses (3) (b), (c), (d) and (e).

Written public statement

16. (1) A health information custodian shall, in a manner that is practical in the circumstances, make available to the public a written statement that,

(a) provides a general description of the custodian's information practices;

(b) describes how to contact,

(i) the contact person described in subsection 15 (3), if the custodian has one, or

(ii) the custodian, if the custodian does not have that contact person;

(c) describes how an individual may obtain access to or request correction of a record of personal health information about the individual that is in the custody or control of the custodian; and

(d) describes how to make a complaint to the custodian and to the Commissioner under this Act.

Notification

(2) If a health information custodian uses or discloses personal health information about an individual, without the individual's consent, in a manner that is outside the scope of the custodian's description of its information practices under clause (1) (a), the custodian shall,

(a) inform the individual of the uses and disclosures at the first reasonable opportunity unless, under section 52, the individual does not have a right of access to a record of the information;

(b) make a note of the uses and disclosures; and

(c) keep the note as part of the records of personal health information about the individual that it has in its custody or under its control or in a form that is linked to those records.

Agents and information

17. (1) A health information custodian is responsible for personal health information in the custody or control of the health information custodian and may permit the custodian's agents to collect, use, disclose, retain or dispose of personal health information on the custodian's behalf only if,

(a) the custodian is permitted or required to collect, use, disclose, retain or dispose of the information, as the case may be;

(b) the collection, use, disclosure, retention or disposition of the information, as the case may be, is in the course of the agent's duties and not contrary to the limits imposed by the custodian, this Act or another law; and

Restriction on agents

(2) Except as permitted or required by law and subject to the exceptions and additional requirements, if any, that are prescribed, an agent of a health information custodian shall not collect, use, disclose, retain or dispose of personal health information on the custodian's behalf unless the custodian permits the agent to do so in accordance with subsection (1).

Responsibility of agent

(3) An agent of a health information custodian shall notify the custodian at the first reasonable opportunity if personal health information handled by the agent on behalf of the custodian is stolen, lost or accessed by unauthorized persons.

PART III
CONSENT CONCERNING
PERSONAL HEALTH INFORMATION

General

Elements of consent

18. (1) If this Act or any other Act requires the consent of an individual for the collection, use or disclosure of personal health information by a health information custodian, the consent,

(a) must be a consent of the individual;

(b) must be knowledgeable;

(d) must not be obtained through deception or coercion.

Implied consent

(2) Subject to subsection (3), a consent to the collection, use or disclosure of personal health information about an individual may be express or implied.

Exception

(3) A consent to the disclosure of personal health information about an individual must be express, and not implied, if,

(a) a health information custodian makes the disclosure to a person that is not a health information custodian; or

(b) a health information custodian makes the disclosure to another health information custodian and the disclosure is not for the purposes of providing health care or assisting in providing health care.

Same

(4) Subsection (3) does not apply to,

(a) a disclosure pursuant to an implied consent described in subsection 20 (4);

(b) a disclosure pursuant to clause 32 (1) (b); or

Knowledgeable consent

(5) A consent to the collection, use or disclosure of personal health information about an individual is knowledgeable if it is reasonable in the circumstances to believe that the individual knows,

(a) the purposes of the collection, use or disclosure, as the case may be; and

(b) that the individual may give or withhold consent.

Notice of purposes

(6) Unless it is not reasonable in the circumstances, it is reasonable to believe that an individual knows the purposes of the collection, use or disclosure of personal health information about the individual by a health information custodian if the custodian posts or makes readily available a notice describing the purposes where it is likely to come to the individual's attention or provides the individual with such a notice.

Transition

(7) A consent that an individual gives, before the day that subsection (1) comes into force, to a collection, use or disclosure of information that is personal health information is a valid consent if it meets the requirements of this Act for consent.

Withdrawal of consent

19. (1) If an individual consents to have a health information custodian collect, use or disclose personal health information about the individual, the individual may withdraw the consent, whether the consent is express or implied, by providing notice to the health information custodian, but the withdrawal of the consent shall not have retroactive effect.

Conditional consent

(2) If an individual places a condition on his or her consent to have a health information custodian collect, use or disclose personal health information about the individual, the condition is not effective to the extent that it purports to prohibit or restrict any recording of personal health information by a health information custodian that is required by law or by established standards of professional practice or institutional practice.

Assumption of validity

20. (1) A health information custodian who has obtained an individual's consent to a collection, use or disclosure of personal health information about the individual or who has received a copy of a document purporting to record the individual's consent to the collection, use or disclosure is entitled to assume that the consent fulfils the requirements of this Act and the individual has not withdrawn it, unless it is not reasonable to assume so.

Implied consent

(2) A health information custodian described in paragraph 1, 2, 3 or 4 of the definition of "health information custodian" in subsection 3 (1), that receives personal health information about an individual from the individual, the individual's substitute decision-maker or another health information custodian for the purpose of providing health care or assisting in the provision of health care to the individual, is entitled to assume that it has the individual's implied consent to collect, use or disclose the information for the purposes of providing health care or assisting in providing health care to the individual, unless the custodian that receives the information is aware that the individual has expressly withheld or withdrawn the consent.

Limited consent

(3) If a health information custodian discloses, with the consent of an individual, personal health information about the individual to a health information custodian described in paragraph 1, 2, 3 or 4 of the definition of "health information custodian" in subsection 3 (1) for the purpose of the provision of health care to the individual and if the disclosing custodian does not have the consent of the individual to disclose all the personal health information about the individual that it considers reasonably necessary for that purpose, the disclosing custodian shall notify the custodian to whom it disclosed the information of that fact.

Implied consent, affiliation

(4) If an individual who is a resident or patient in a facility that is a health information custodian provides to the custodian information about his or her religious or other organizational affiliation, the facility may assume that it has the individual's implied consent to provide his or her name and location in the facility to a representative of the religious or other organization, where the custodian has offered the individual the opportunity to withhold or withdraw the consent and the individual has not done so.

Capacity and Substitute Decision-Making

Capacity to consent

21. (1) An individual is capable of consenting to the collection, use or disclosure of personal health information if the individual is able,

(a) to understand the information that is relevant to deciding whether to consent to the collection, use or disclosure, as the case may be; and

(b) to appreciate the reasonably foreseeable consequences of giving, not giving, withholding or withdrawing the consent.

Different information

(2) An individual may be capable of consenting to the collection, use or disclosure of some parts of personal health information, but incapable of consenting with respect to other parts.

Different times

(3) An individual may be capable of consenting to the collection, use or disclosure of personal health information at one time, but incapable of consenting at another time.

Presumption of capacity

(4) An individual is presumed to be capable of consenting to the collection, use or disclosure of personal health information.

Non-application

(5) A health information custodian may rely on the presumption described in subsection (4) unless the custodian has reasonable grounds to believe that the individual is incapable of consenting to the collection, use or disclosure of personal health information.

Determination of incapacity

22. (1) A health information custodian that determines the incapacity of an individual to consent to the collection, use or disclosure of personal health information under this Act shall do so in accordance with the requirements and restrictions, if any, that are prescribed.

Information about determination

(2) If it is reasonable in the circumstances, a health information custodian shall provide, to an individual determined incapable of consenting to the collection, use or disclosure of his or her personal health information by the custodian, information about the consequences of the determination of incapacity, including the information, if any, that is prescribed.

Review of determination

(3) An individual whom a health information custodian determines is incapable of consenting to the collection, use or disclosure of his or her personal health information by a health information custodian may apply to the Board for a review of the determination unless there is a person who is entitled to act as the substitute decision-maker of the individual under subsection 5 (2), (3) or (4).

Parties

(4) The parties to the application are:

1. The individual applying for the review of the determination.

2. The health information custodian that has custody or control of the personal health information.

3. All other persons whom the Board specifies.

Powers of Board

(5) The Board may confirm the determination of incapacity or may determine that the individual is capable of consenting to the collection, use or disclosure of personal health information.

Restriction on repeated applications

(6) If a determination that an individual is incapable with respect to consenting to the collection, use or disclosure of personal health information is confirmed on the final disposition of an application under this section, the individual shall not make a new application under this section for a determination with respect to the same or a similar issue within six months after the final disposition of the earlier application, unless the Board gives leave in advance.

Grounds for leave

(7) The Board may give leave for the new application to be made if it is satisfied that there has been a material change in circumstances that justifies reconsideration of the individual's capacity.

Procedure

(8) Sections 73 to 81 of the Health Care Consent Act, 1996 apply with necessary modifications to an application under this section.

Persons who may consent

23. (1) If this Act or any other Act refers to a consent required of an individual to a collection, use or disclosure of personal health information about the individual, a person described in one of the following paragraphs may give, withhold or withdraw the consent:

1. If the individual is capable of consenting to the collection, use or disclosure of the information,

i. the individual, or

ii. if the individual is at least 16 years of age, any person who is capable of consenting, whom the individual has authorized in writing to act on his or her behalf and who, if a natural person, is at least 16 years of age.

2. If the individual is a child who is less than 16 years of age, a parent of the child or a children's aid society or other person who is lawfully entitled to give or refuse consent in the place of the parent unless the information relates to,

i. treatment within the meaning of the Health Care Consent Act, 1996, about which the child has made a decision on his or her own in accordance with that Act, or

ii. counselling in which the child has participated on his or her own under the Child and Family Services Act.

3. If the individual is incapable of consenting to the collection, use or disclosure of the information, a person who is authorized under subsection 5 (2), (3) or (4) or section 26 to consent on behalf of the individual.

4. If the individual is deceased, the deceased's estate trustee or the person who has assumed responsibility for the administration of the deceased's estate, if the estate does not have an estate trustee.

5. A person whom an Act of Ontario or Canada authorizes or requires to act on behalf of the individual.

Definition

(2) In subsection (1),

"parent" does not include a parent who has only a right of access to the child.

Conflict if child capable

(3) If the individual is a child who is less than 16 years of age and who is capable of consenting to the collection, use or disclosure of the information and if there is a person who is entitled to act as the substitute decision-maker of the child under paragraph 2 of subsection (1), a decision of the child to give, withhold or withdraw the consent or to provide the information prevails over a conflicting decision of that person.

Factors to consider for consent

24. (1) A person who consents under this Act or any other Act on behalf of or in the place of an individual to a collection, use or disclosure of personal health information by a health information custodian, who withholds or withdraws such a consent or who provides an express instruction under clause 37 (1) (a), 38 (1) (a) or 50 (1) (e) shall take into consideration,

(a) the wishes, values and beliefs that,

(i) if the individual is capable, the person knows the individual holds and believes the individual would want reflected in decisions made concerning the individual's personal health information, or

(ii) if the individual is incapable or deceased, the person knows the individual held when capable or alive and believes the individual would have wanted reflected in decisions made concerning the individual's personal health information;

(b) whether the benefits that the person expects from the collection, use or disclosure of the information outweigh the risk of negative consequences occurring as a result of the collection, use or disclosure;

(c) whether the purpose for which the collection, use or disclosure is sought can be accomplished without the collection, use or disclosure; and

(d) whether the collection, use or disclosure is necessary to satisfy any legal obligation.

Determination of compliance

(2) If a substitute decision-maker, on behalf of an incapable individual, gives, withholds or withdraws a consent to a collection, use or disclosure of personal health information about the individual by a health information custodian or provides an express instruction under clause 37 (1) (a), 38 (1) (a) or 50 (1) (e) and if the custodian is of the opinion that the substitute decision-maker has not complied with subsection (1), the custodian may apply to the Board for a determination as to whether the substitute decision-maker complied with that subsection.

Parties

(3) The parties to the application are:

1. The health information custodian.

2. The incapable individual.

3. The substitute decision-maker.

4. Any other person whom the Board specifies.

Power of Board

(4) In determining whether the substitute decision-maker complied with subsection (1), the Board may substitute its opinion for that of the substitute decision-maker.

Directions

(5) If the Board determines that the substitute decision-maker did not comply with subsection (1), it may give him or her directions and, in doing so, shall take into consideration the matters set out in clauses (1) (a) to (d).

Time for compliance

(6) The Board shall specify the time within which the substitute decision-maker must comply with its directions.

Deemed not authorized

(7) If the substitute decision-maker does not comply with the Board's directions within the time specified by the Board, he or she shall be deemed not to meet the requirements of subsection 26 (2).

Public Guardian and Trustee

(8) If the substitute decision-maker who is given directions is the Public Guardian and Trustee, he or she is required to comply with the directions and subsection (6) does not apply to him or her.

Procedure

(9) Sections 73 to 81 of the Health Care Consent Act, 1996 apply with necessary modifications to an application under this section.

Authority of substitute decision-maker

25. (1) If this Act permits or requires an individual to make a request, give an instruction or take a step and a substitute decision-maker is authorized to consent on behalf of the individual to the collection, use or disclosure of personal health information about the individual, the substitute decision-maker may make the request, give the instruction or take the step on behalf of the individual.

Same

(2) If a substitute decision-maker makes a request, gives an instruction or takes a step under subsection (1) on behalf of an individual, references in this Act to the individual with respect to the request made, the instruction given or the step taken by the substitute decision-maker shall be read as references to the substitute decision-maker, and not to the individual.

Incapable individual: persons who may consent

26. (1) If an individual is determined to be incapable of consenting to the collection, use or disclosure of personal health information by a health information custodian, a person described in one of the following paragraphs may, on the individual's behalf and in the place of the individual, give, withhold or withdraw the consent:

1. The individual's guardian of the person or guardian of property, if the consent relates to the guardian's authority to make a decision on behalf of the individual.

2. The individual's attorney for personal care or attorney for property, if the consent relates to the attorney's authority to make a decision on behalf of the individual.

3. The individual's representative appointed by the Board under section 27, if the representative has authority to give the consent.

4. The individual's spouse or partner.

5. A child or parent of the individual, or a children's aid society or other person who is lawfully entitled to give or refuse consent in the place of the parent. This paragraph does not include a parent who has only a right of access to the individual. If a children's aid society or other person is lawfully entitled to consent in the place of the parent, this paragraph does not include the parent.

6. A parent of the individual with only a right of access to the individual.

7. A brother or sister of the individual.

8. Any other relative of the individual.

Requirements

(2) A person described in subsection (1) may consent only if the person,

(a) is capable of consenting to the collection, use or disclosure of personal health information by a health information custodian;

(b) in the case of an individual, is at least 16 years old or is the parent of the individual to whom the personal health information relates;

(c) is not prohibited by court order or separation agreement from having access to the individual to whom the personal health information relates or from giving or refusing consent on the individual's behalf;

(d) is available; and

(e) is willing to assume the responsibility of making a decision on whether or not to consent.

Meaning of "available"

(3) For the purpose of clause (2) (d), a person is available if it is possible, within a time that is reasonable in the circumstances, to communicate with the person and obtain a consent.

Ranking

(4) A person described in a paragraph of subsection (1) may consent only if no person described in an earlier paragraph meets the requirements of subsection (2).

Same

(5) Despite subsection (4), a person described in a paragraph of subsection (1) who is present or has otherwise been contacted may consent if the person believes that,

(a) no other person described in an earlier paragraph or the same paragraph exists; or

(b) although such other person exists, the other person is not a person described in paragraph 1 or 2 of subsection (1) and would not object to the person who is present or has otherwise been contacted making the decision.

Public Guardian and Trustee

(6) If no person described in subsection (1) meets the requirements of subsection (2), the Public Guardian and Trustee may make the decision to consent.

Conflict between persons in same paragraph

(7) If two or more persons who are described in the same paragraph of subsection (1) and who meet the requirements of subsection (2) disagree about whether to consent, and if their claims rank ahead of all others, the Public Guardian and Trustee may make the decision in their stead.

Transition, representative appointed by individual

(8) Where an individual, to whom personal health information relates, appointed a representative under section 36.1 of the Mental Health Act before the day this section comes into force, the representative shall be deemed to have the same authority as a person mentioned in paragraph 2 of subsection (1).

Limited authority

(9) The authority conferred on the representative by subsection (8) is limited to the purposes for which the representative was appointed.

Revocation

(10) An individual who is capable of consenting with respect to personal health information may revoke the appointment mentioned in subsection (8) in writing.

Ranking

(11) A person who is entitled to be the substitute decision-maker of the individual under this section may act as the substitute decision-maker only in circumstances where there is no person who may act as the substitute decision-maker of the individual under subsection 5 (2), (3) or (4).

Appointment of representative

27. (1) An individual who is 16 years old or older and who is determined to be incapable of consenting to the collection, use or disclosure of personal health information may apply to the Board for appointment of a representative to consent on the individual's behalf to a collection, use or disclosure of the information by a health information custodian.

Application by proposed representative

(2) If an individual is incapable of consenting to the collection, use or disclosure of personal health information, another individual who is 16 years old or older may apply to the Board to be appointed as a representative to consent on behalf of the incapable individual to a collection, use or disclosure of the information.

Exception

(3) Subsections (1) and (2) do not apply if the individual to whom the personal health information relates has a guardian of the person, a guardian of property, an attorney for personal care, or an attorney for property, who has authority to give or refuse consent to the collection, use or disclosure.

Parties

(4) The parties to the application are:

1. The individual to whom the personal health information relates.

2. The proposed representative named in the application.

3. Every person who is described in paragraph 4, 5, 6 or 7 of subsection 26 (1).

4. All other persons whom the Board specifies.

Appointment

(5) In an appointment under this section, the Board may authorize the representative to consent, on behalf of the individual to whom the personal health information relates, to,

(a) a particular collection, use or disclosure at a particular time;

(b) a collection, use or disclosure of the type specified by the Board in circumstances specified by the Board, if the individual is determined to be incapable of consenting to the collection, use or disclosure of personal health information at the time the consent is sought; or

(c) any collection, use or disclosure at any time, if the individual is determined to be incapable of consenting to the collection, use or disclosure of personal health information at the time the consent is sought.

Criteria for appointment

(6) The Board may make an appointment under this section if it is satisfied that the following requirements are met:

1. The individual to whom the personal health information relates does not object to the appointment.

2. The representative consents to the appointment, is at least 16 years old and is capable of consenting to the collection, use or disclosure of personal health information.

3. The appointment is in the best interests of the individual to whom the personal health information relates.

Powers of Board

(7) Unless the individual to whom the personal health information relates objects, the Board may,

(a) appoint as representative a different individual than the one named in the application;

(b) limit the duration of the appointment;

(d) on any person's application, remove, vary or suspend a condition imposed on the appointment or impose an additional condition on the appointment.

Termination

(8) The Board may, on any person's application, terminate an appointment made under this section if,

(a) the individual to whom the personal health information relates or the representative requests the termination;

(b) the representative is no longer capable of consenting to the collection, use or disclosure of personal health information;

(c) the appointment is no longer in the best interests of the individual to whom the personal health information relates; or

(d) the individual to whom the personal health information relates has a guardian of the person, a guardian of property, an attorney for personal care, or an attorney for property, who has authority to give or refuse consent to the types of collections, uses and disclosures for which the appointment was made and in the circumstances to which the appointment applies.

Procedure

(9) Sections 73 to 81 of the Health Care Consent Act, 1996 apply with necessary modifications to an application under this section.

Transition, representative appointed by Board

28. (1) This Act applies to a representative whom the Board appointed under section 36.2 of the Mental Health Act or who was deemed to be appointed under that section before the day this section comes into force for an individual with respect to the individual's personal health information, as if the representative were the individual's representative appointed by the Board under section 27.

Limited authority

(2) The authority conferred on the representative by subsection (1) is limited to the purposes for which the representative was appointed.

PART IV
COLLECTION, USE AND DISCLOSURE OF PERSONAL HEALTH INFORMATION

General Limitations and Requirements

Requirement for consent

29. A health information custodian shall not collect, use or disclose personal health information about an individual unless,

(a) it has the individual's consent under this Act and the collection, use or disclosure, as the case may be, to the best of the custodian's knowledge, is necessary for a lawful purpose; or

(b) the collection, use or disclosure, as the case may be, is permitted or required by this Act.

Other information

30. (1) A health information custodian shall not collect, use or disclose personal health information if other information will serve the purpose of the collection, use or disclosure.

Extent of information

(2) A health information custodian shall not collect, use or disclose more personal health information than is reasonably necessary to meet the purpose of the collection, use or disclosure, as the case may be.

Exception

(3) This section does not apply to personal health information that a health information custodian is required by law to collect, use or disclose.

Use and disclosure of personal health information

31. (1) A health information custodian that collects personal health information in contravention of this Act shall not use it or disclose it unless required by law to do so.

Express instruction to public hospitals, etc.

(2) An express instruction that an individual, before November 1, 2005, gives to a health information custodian that is a public hospital within the meaning of the Public Hospitals Act or a person described in paragraph 1 of subsection 3 (6) with respect to the use or disclosure of personal health information about the individual is not an express instruction for the purpose of clause 37 (1) (a), 38 (1) (a) or 50 (1) (e).

Same

(3) Nothing in subsection (2) prevents the custodian from refraining, in accordance with an express instruction that an individual gives as described in that subsection, to use or disclose the information under clause 37 (1) (a), 38 (1) (a) or 50 (1) (e).

Repeal

(4) Subsections (2) and (3) are repealed on November 1, 2005.

Fundraising

32. (1) Subject to subsection (2), a health information custodian may collect, use or disclose personal health information about an individual for the purpose of fundraising activities only where,

(a) the individual expressly consents; or

(b) the individual consents by way of an implied consent and the information consists only of the individual's name and the prescribed types of contact information.

Requirements and restrictions

(2) The manner in which consent is obtained under subsection (1) and the resulting collection, use or disclosure of personal health information for the purpose of fundraising activities shall comply with the requirements and restrictions that are prescribed, if any.

Marketing

33. A health information custodian shall not collect, use or disclose personal health information about an individual for the purpose of marketing anything or for the purpose of market research unless the individual expressly consents and the custodian collects, uses or discloses the information, as the case may be, subject to the prescribed requirements and restrictions, if any.

Health cards and health numbers

34. (1) In this section,

"health card" means a card provided to an insured person within the meaning of the Health Insurance Act by the General Manager of the Ontario Health Insurance Plan; ("carte Santé")

"provincially funded health resource" means a service, thing, subsidy or other benefit funded, in whole or in part, directly or indirectly by the Government of Ontario, if it is health related or prescribed. ("ressource en matière de santé subventionnée par la province")

Collection or use

(2) Despite subsection 49 (1), a person who is not a health information custodian shall not collect or use another person's health number except,

(a) for purposes related to the provision of provincially funded health resources to that other person;

(b) for the purposes for which a health information custodian has disclosed the number to the person;

(c) if the person is the governing body of health care practitioners who provide provincially funded health resources and is collecting or using health numbers for purposes related to its duties or powers; or

(d) if the person is prescribed and is collecting or using the health number, as the case may be, for purposes related to health administration, health planning, health research or epidemiological studies.

Disclosure

(3) Despite subsection 49 (1) and subject to the exceptions and additional requirements, if any, that are prescribed, a person who is not a health information custodian shall not disclose a health number except as required by law.

Confidentiality of health cards

(4) No person shall require the production of another person's health card, but a person who provides a provincially funded health resource to a person who has a health card may require the production of the health card.

Exceptions

(5) Subsections (2) and (3) do not apply to,

(a) a person who collects, uses or discloses a health number for the purposes of a proceeding;

(b) a prescribed entity mentioned in subsection 45 (1) that collects, uses or discloses the health number in the course of carrying out its functions under section 45; or

(c) a health data institute that the Minister approves under subsection 47 (9) and that collects, uses or discloses the health number in the course of carrying out its functions under sections 47 and 48.

Fees for personal health information

35. (1) A health information custodian shall not charge a person a fee for collecting or using personal health information except as authorized by the regulations made under this Act.

Same, for disclosure

(2) When disclosing personal health information, a health information custodian shall not charge fees to a person that exceed the prescribed amount or the amount of reasonable cost recovery, if no amount is prescribed.

Collection

Indirect collection

36. (1) A health information custodian may collect personal health information about an individual indirectly if,

(a) the individual consents to the collection being made indirectly;

(b) the information to be collected is reasonably necessary for providing health care or assisting in providing health care to the individual and it is not reasonably possible to collect, directly from the individual,

(i) personal health information that can reasonably be relied on as accurate, or

(ii) personal health information in a timely manner;

(c) the custodian is an institution within the meaning of the Freedom of Information and Protection of Privacy Act or the Municipal Freedom of Information and Protection of Privacy Act, or is acting as part of such an institution, and the custodian is collecting the information for a purpose related to,

(i) investigating a breach of an agreement or a contravention or an alleged contravention of the laws of Ontario or Canada,

(ii) the conduct of a proceeding or a possible proceeding, or

(iii) the statutory function of the custodian;

(d) the custodian collects the information from a person who is not a health information custodian for the purpose of carrying out research conducted in accordance with subsection 37 (3) or research that a research ethics board has approved under section 44 or that meets the criteria set out in clauses 44 (10) (a) to (c), except if the person is prohibited by law from disclosing the information to the custodian;

(e) the custodian is a prescribed entity mentioned in subsection 45 (1) and the custodian is collecting personal health information from a person who is not a health information custodian for the purpose of that subsection;

(f) the Commissioner authorizes that the collection be made in a manner other than directly from the individual;

(g) the custodian collects the information from a person who is permitted or required by law or by a treaty, agreement or arrangement made under an Act or an Act of Canada to disclose it to the custodian; or

(h) subject to the requirements and restrictions, if any, that are prescribed, the health information custodian is permitted or required by law or by a treaty, agreement or arrangement made under an Act or an Act of Canada to collect the information indirectly.

Direct collection without consent

(2) A health information custodian may collect personal health information about an individual directly from the individual, even if the individual is incapable of consenting, if the collection is reasonably necessary for the provision of health care and it is not reasonably possible to obtain consent in a timely manner.

Use

Permitted use

37. (1) A health information custodian may use personal health information about an individual,

(a) for the purpose for which the information was collected or created and for all the functions reasonably necessary for carrying out that purpose, but not if the information was collected with the consent of the individual or under clause 36 (1) (b) and the individual expressly instructs otherwise;

(b) for a purpose for which this Act, another Act or an Act of Canada permits or requires a person to disclose it to the custodian;

(c) for planning or delivering programs or services that the custodian provides or that the custodian funds in whole or in part, allocating resources to any of them, evaluating or monitoring any of them or detecting, monitoring or preventing fraud or any unauthorized receipt of services or benefits related to any of them;

(d) for the purpose of risk management, error management or for the purpose of activities to improve or maintain the quality of care or to improve or maintain the quality of any related programs or services of the custodian;

(e) for educating agents to provide health care;

(f) in a manner consistent with Part II, for the purpose of disposing of the information or modifying the information in order to conceal the identity of the individual;

(g) for the purpose of seeking the individual's consent, when the personal health information used by the custodian for this purpose is limited to the individual's name and contact information;

(h) for the purpose of a proceeding or contemplated proceeding in which the custodian or the agent or former agent of the custodian is, or is expected to be, a party or witness, if the information relates to or is a matter in issue in the proceeding or contemplated proceeding;

(i) for the purpose of obtaining payment or processing, monitoring, verifying or reimbursing claims for payment for the provision of health care or related goods and services;

(j) for research conducted by the custodian, subject to subsection (3), unless another clause of this subsection applies; or

(k) subject to the requirements and restrictions, if any, that are prescribed, if permitted or required by law or by a treaty, agreement or arrangement made under an Act or an Act of Canada.

Agents

(2) If subsection (1) authorizes a health information custodian to use personal health information for a purpose, the custodian may provide the information to an agent of the custodian who may use it for that purpose on behalf of the custodian.

Research

(3) Under clause (1) (j), a health information custodian may use personal health information about an individual only if the custodian prepares a research plan and has a research ethics board approve it and for that purpose subsections 44 (2) to (4) and clauses 44 (6) (a) to (f) apply to the use as if it were a disclosure.

Mixed uses

(4) If a research plan mentioned in subsection (3) proposes that a health information custodian that is an institution within the meaning of the Freedom of Information and Protection of Privacy Act or the Municipal Freedom of Information and Protection of Privacy Act or that is acting as part of such an institution use personal health information, together with personal information within the meaning of those two Acts that is not personal health information, those two Acts do not apply to the use and this section applies to the use.

Disclosure

Disclosures related to providing health care

38. (1) A health information custodian may disclose personal health information about an individual,

(a) to a person described in paragraph 1, 2, 3 or 4 of the definition of "health information custodian" in subsection 3 (1), if the disclosure is reasonably necessary for the provision of health care and it is not reasonably possible to obtain the individual's consent in a timely manner, but not if the individual has expressly instructed the custodian not to make the disclosure;

(b) in order for the Minister or another health information custodian to determine or provide funding or payment to the custodian for the provision of health care; or

(c) for the purpose of contacting a relative, friend or potential substitute decision-maker of the individual, if the individual is injured, incapacitated or ill and unable to give consent personally.

Notice of instruction

(2) If a health information custodian discloses personal health information about an individual under clause (1) (a) and if an instruction of the individual made under that clause prevents the custodian from disclosing all the personal health information that the custodian considers reasonably necessary to disclose for the provision of health care or assisting in the provision of health care to the individual, the custodian shall notify the person to whom it makes the disclosure of that fact.

Facility that provides health care

(3) A health information custodian that is a facility that provides health care may disclose to a person the following personal health information relating to an individual who is a patient or a resident in the facility if the custodian offers the individual the option, at the first reasonable opportunity after admission to the facility, to object to such disclosures and if the individual does not do so:

1. The fact that the individual is a patient or resident in the facility.

2. The individual's general health status described as critical, poor, fair, stable or satisfactory, or in similar terms.

3. The location of the individual in the facility.

Deceased individual

(4) A health information custodian may disclose personal health information about an individual who is deceased, or is reasonably suspected to be deceased,

(a) for the purpose of identifying the individual;

(b) for the purpose of informing any person whom it is reasonable to inform in the circumstances of,

(i) the fact that the individual is deceased or reasonably suspected to be deceased, and

(ii) the circumstances of death, where appropriate; or

Disclosures for health or other programs

39. (1) Subject to the requirements and restrictions, if any, that are prescribed, a health information custodian may disclose personal health information about an individual,

(a) for the purpose of determining or verifying the eligibility of the individual to receive health care or related goods, services or benefits provided under an Act of Ontario or Canada and funded in whole or in part by the Government of Ontario or Canada or by a municipality;

(b) to a person conducting an audit or reviewing an application for accreditation or reviewing an accreditation, if the audit or review relates to services provided by the custodian and the person does not remove any records of personal health information from the custodian's premises; or

(c) to a prescribed person who compiles or maintains a registry of personal health information for purposes of facilitating or improving the provision of health care or that relates to the storage or donation of body parts or bodily substances.

Same

(2) A health information custodian may disclose personal health information about an individual,

(a) to the Chief Medical Officer of Health or a medical officer of health within the meaning of the Health Protection and Promotion Act if the disclosure is made for a purpose of that Act; or

(b) to a public health authority that is similar to the persons described in clause (a) and that is established under the laws of Canada, another province or a territory of Canada or other jurisdiction, if the disclosure is made for a purpose that is substantially similar to a purpose of the Health Protection and Promotion Act.

Removal allowed

(3) Despite clause (1) (b), the person described in that clause may remove records of personal health information from the custodian's premises if,

(a) the removal is authorized by or under an Act of Ontario or Canada; or

(b) an agreement between the custodian and the person authorizes the removal and provides that the records will be held in a secure and confidential manner and will be returned when the audit or review is completed.

Authorization to collect

(4) A person who is not a health information custodian is authorized to collect the personal health information that a health information custodian may disclose to the person under clause (1) (c).

Disclosures related to risks

40. (1) A health information custodian may disclose personal health information about an individual if the custodian believes on reasonable grounds that the disclosure is necessary for the purpose of eliminating or reducing a significant risk of serious bodily harm to a person or group of persons.

Disclosures related to care or custody

Same

(3) A health information custodian may disclose personal health information about an individual under subsection (2) to assist an institution or a facility in making a decision concerning,

(a) arrangements for the provision of health care to the individual; or

(b) the placement of the individual into custody, detention, release, conditional release, discharge or conditional discharge under Part IV of the Child and Family Services Act, the Mental Health Act, the Ministry of Correctional Services Act, the Corrections and Conditional Release Act (Canada), Part XX.1 of the Criminal Code (Canada), the Prisons and Reformatories Act (Canada) or the Youth Criminal Justice Act (Canada).

Disclosures for proceedings

41. (1) A health information custodian may disclose personal health information about an individual,

(a) subject to the requirements and restrictions, if any, that are prescribed, for the purpose of a proceeding or contemplated proceeding in which the custodian or the agent or former agent of the custodian is, or is expected to be, a party or witness, if the information relates to or is a matter in issue in the proceeding or contemplated proceeding;

(b) to a proposed litigation guardian or legal representative of the individual for the purpose of having the person appointed as such;

(c) to a litigation guardian or legal representative who is authorized under the Rules of Civil Procedure, or by a court order, to commence, defend or continue a proceeding on behalf of the individual or to represent the individual in a proceeding; or

(d) for the purpose of complying with,

(i) a summons, order or similar requirement issued in a proceeding by a person having jurisdiction to compel the production of information, or

(ii) a procedural rule that relates to the production of information in a proceeding.

Disclosure by agent or former agent

(2) An agent or former agent who receives personal health information under subsection (1) or under subsection 37 (2) for purposes of a proceeding or contemplated proceeding may disclose the information to the agent's or former agent's professional advisor for the purpose of providing advice or representation to the agent or former agent, if the advisor is under a professional duty of confidentiality.

Disclosure to successor

42. (1) A health information custodian may disclose personal health information about an individual to a potential successor of the custodian, for the purpose of allowing the potential successor to assess and evaluate the operations of the custodian, if the potential successor first enters into an agreement with the custodian to keep the information confidential and secure and not to retain any of the information longer than is necessary for the purpose of the assessment or evaluation.

Transfer to successor

(2) A health information custodian may transfer records of personal health information about an individual to the custodian's successor if the custodian makes reasonable efforts to give notice to the individual before transferring the records or, if that is not reasonably possible, as soon as possible after transferring the records.

Transfer to archives

(3) Subject to the agreement of the person who is to receive the transfer, a health information custodian may transfer records of personal health information about an individual to,

(a) the Archives of Ontario; or

(b) in the prescribed circumstances, a prescribed person whose functions include the collection and preservation of records of historical or archival importance, if the disclosure is made for the purpose of that function.

Disclosures related to this or other Acts

43. (1) A health information custodian may disclose personal health information about an individual,

(a) for the purpose of determining, assessing or confirming capacity under the Health Care Consent Act, 1996, the Substitute Decisions Act, 1992 or this Act;

(b) to a College within the meaning of the Regulated Health Professions Act, 1991 for the purpose of the administration or enforcement of the Drug and Pharmacies Regulation Act, the Regulated Health Professions Act, 1991 or an Act named in Schedule 1 to that Act;

(c) to the Board of Regents continued under the Drugless Practitioners Act for the purpose of the administration or enforcement of that Act;

(d) to the Ontario College of Social Workers and Social Service Workers for the purpose of the administration or enforcement of the Social Work and Social Service Work Act, 1998;

(e) to the Public Guardian and Trustee, the Children's Lawyer, a children's aid society, a Residential Placement Advisory Committee established under subsection 34 (2) of the Child and Family Services Act or the Registrar of Adoption Information appointed under subsection 163 (1) of that Act so that they can carry out their statutory functions;

(f) in the circumstances described in clause 42 (c), (g) or (n) of the Freedom of Information and Protection of Privacy Act or clause 32 (c), (g) or (l) of the Municipal Freedom of Information and Protection of Privacy Act, if the custodian is subject to either of those Acts;

(g) subject to the requirements and restrictions, if any, that are prescribed, to a person carrying out an inspection, investigation or similar procedure that is authorized by a warrant or by or under this Act or any other Act of Ontario or an Act of Canada for the purpose of complying with the warrant or for the purpose of facilitating the inspection, investigation or similar procedure;

(h) subject to the requirements and restrictions, if any, that are prescribed, if permitted or required by law or by a treaty, agreement or arrangement made under an Act or an Act of Canada.

Interpretation

(2) For the purposes of clause (1) (h) and subject to the regulations made under this Act, if an Act, an Act of Canada or a regulation made under any of those Acts specifically provides that information is exempt, under stated circumstances, from a confidentiality or secrecy requirement, that provision shall be deemed to permit the disclosure of the information in the stated circumstances.

Disclosure for research

44. (1) A health information custodian may disclose personal health information about an individual to a researcher if the researcher,

(a) submits to the custodian,

(i) an application in writing,

(ii) a research plan that meets the requirements of subsection (2), and

(iii) a copy of the decision of a research ethics board that approves the research plan; and

(b) enters into the agreement required by subsection (5).

Research plan

(2) A research plan must be in writing and must set out,

(a) the affiliation of each person involved in the research;

(b) the nature and objectives of the research and the public or scientific benefit of the research that the researcher anticipates; and

Consideration by board

(3) When deciding whether to approve a research plan that a researcher submits to it, a research ethics board shall consider the matters that it considers relevant, including,

(a) whether the objectives of the research can reasonably be accomplished without using the personal health information that is to be disclosed;

(b) whether, at the time the research is conducted, adequate safeguards will be in place to protect the privacy of the individuals whose personal health information is being disclosed and to preserve the confidentiality of the information;

(c) the public interest in conducting the research and the public interest in protecting the privacy of the individuals whose personal health information is being disclosed; and

(d) whether obtaining the consent of the individuals whose personal health information is being disclosed would be impractical.

Decision of board

(4) After reviewing a research plan that a researcher has submitted to it, the research ethics board shall provide to the researcher a decision in writing, with reasons, setting out whether the board approves the plan, and whether the approval is subject to any conditions, which must be specified in the decision.

Agreement respecting disclosure

(5) Before a health information custodian discloses personal health information to a researcher under subsection (1), the researcher shall enter into an agreement with the custodian in which the researcher agrees to comply with the conditions and restrictions, if any, that the custodian imposes relating to the use, security, disclosure, return or disposal of the information.

Compliance by researcher

(6) A researcher who receives personal health information about an individual from a health information custodian under subsection (1) shall,

(a) comply with the conditions, if any, specified by the research ethics board in respect of the research plan;

(b) use the information only for the purposes set out in the research plan as approved by the research ethics board;

(c) not publish the information in a form that could reasonably enable a person to ascertain the identity of the individual;

(d) despite subsection 49 (1), not disclose the information except as required by law and subject to the exceptions and additional requirements, if any, that are prescribed;

(e) not make contact or attempt to make contact with the individual, directly or indirectly, unless the custodian first obtains the individual's consent to being contacted;

(f) notify the custodian immediately in writing if the researcher becomes aware of any breach of this subsection or the agreement described in subsection (5); and

(g) comply with the agreement described in subsection (5).

Mixed disclosures

(7) If a researcher submits a research plan under subsection (1) that proposes that a health information custodian that is an institution within the meaning of the Freedom of Information and Protection of Privacy Act or the Municipal Freedom of Information and Protection of Privacy Act or that is acting as part of such an institution disclose to the researcher personal health information, together with personal information within the meaning of those two Acts that is not personal health information, those two Acts do not apply to the disclosure and this section applies to the disclosure.

Transition

(8) Despite subsection (7), nothing in this section prevents a health information custodian that is an institution within the meaning of the Freedom of Information and Protection of Privacy Act or the Municipal Freedom of Information and Protection of Privacy Act or that is acting as part of such an institution from disclosing to a researcher personal health information, that is personal information within the meaning of those two Acts, if, before the day this section comes into force, the researcher has entered into an agreement that requires the custodian to comply with clause 21 (1) (e) of the Freedom of Information and Protection of Privacy Act or clause 14 (1) (e) of the Municipal Freedom of Information and Protection of Privacy Act as a condition of disclosing the information.

Disclosure under other Acts

(9) Despite any other Act that permits a health information custodian to disclose personal health information to a researcher for the purpose of conducting research, this section applies to the disclosure as if it were a disclosure for research under this section unless the regulations made under this Act provide otherwise.

Research approved outside Ontario

(10) Subject to subsection (11), a health information custodian may disclose personal health information to a researcher or may use the information to conduct research if,

(a) the research involves the use of personal health information originating wholly or in part outside Ontario;

(b) the research has received the prescribed approval from a body outside Ontario that has the function of approving research; and

Same

(11) Subsections (1) to (4) and clauses (6) (a) and (b) do not apply to a disclosure or use made under subsection (10) and references in the rest of this section to subsection (1) shall be read as references to this subsection with respect to that disclosure or use.

Transition

(12) Despite anything in this section, a health information custodian that lawfully disclosed personal health information to a researcher for the purpose of conducting research in the three-year period before the day this section comes into force may continue to disclose personal health information to the researcher for the purposes of that research for a period of three years after the day this section comes into force.

Same, use

(13) Despite anything in this section, a health information custodian that lawfully used personal health information for the purpose of conducting research in the three-year period before the day this section comes into force may continue to use personal health information for the purposes of that research for a period of three years after the day this section comes into force.

Repeal

(14) Subsections (12) and (13) are repealed on the third anniversary of the day they came into force.

Disclosure for planning and management of health system

45. (1) A health information custodian may disclose to a prescribed entity personal health information for the purpose of analysis or compiling statistical information with respect to the management of, evaluation or monitoring of, the allocation of resources to or planning for all or part of the health system, including the delivery of services, if the entity meets the requirements under subsection (3).

Exception

(2) Subsection (1) does not apply to,

(a) notes of personal health information about an individual that are recorded by a health information custodian and that document the contents of conversations during a private counselling session or a group, joint or family counselling session; or

(b) prescribed information in circumstances that are prescribed.

Approval

(3) A health information custodian may disclose personal health information to a prescribed entity under subsection (1) if,

(a) the entity has in place practices and procedures to protect the privacy of the individuals whose personal health information it receives and to maintain the confidentiality of the information; and

(b) the Commissioner has approved the practices and procedures, if the custodian makes the disclosure on or after the first anniversary of the day this section comes into force.

Review by Commissioner

(4) The Commissioner shall review the practices and procedures of each prescribed entity every three years from the date of its approval and advise the health information custodian whether the entity continues to meet the requirements of subsection (3).

Authorization to collect

(5) An entity that is not a health information custodian is authorized to collect the personal health information that a health information custodian may disclose to the entity under subsection (1).

Use and disclosure

(6) Subject to the exceptions and additional requirements, if any, that are prescribed and despite subsection 49 (1), an entity that receives personal health information under subsection (1) shall not use the information except for the purposes for which it received the information and shall not disclose the information except as required by law.

Monitoring health care payments

46. (1) A health information custodian shall, upon the request of the Minister, disclose to the Minister personal health information about an individual for the purpose of monitoring or verifying claims for payment for health care funded wholly or in part by the Ministry of Health and Long-Term Care or for goods used for health care funded wholly or in part by the Ministry of Health and Long-Term Care.

Disclosure by Minister

(2) The Minister may disclose information collected under subsection (1) to any person for a purpose set out in that subsection if the disclosure is reasonably necessary for that purpose.

Disclosure for analysis of health system

47. (1) In this section,

"de-identify", in relation to the personal health information of an individual, means to remove any information that identifies the individual or for which it is reasonably foreseeable in the circumstances that it could be utilized, either alone or with other information, to identify the individual, and "de-identification" has a corresponding meaning.

Same

(2) Subject to the restrictions, if any, that are prescribed, a health information custodian shall, upon the request of the Minister, disclose personal health information to a health data institute that the Minister approves under subsection (9) for analysis with respect to the management of, evaluation or monitoring of, the allocation of resources to or planning for all or part of the health system, including the delivery of services, if the requirements of this section are met.

Form, manner and time of disclosure

(3) The Minister may specify the form and manner in which and the time at which the health information custodian is required to disclose the personal health information under subsection (2).

Requirements for Minister

(4) Before requesting the disclosure of personal health information under subsection (2), the Minister shall submit a proposal to the Commissioner and, in accordance with this section, allow the Commissioner to review and comment on the proposal.

Contents of proposal

(5) The proposal must identify a health data institute to which the personal health information would be disclosed under this section and must set out the prescribed matters.

Review by Commissioner

(6) Within 30 days after the Commissioner receives the proposal, the Commissioner shall review the proposal and may comment in writing on the proposal.

Consideration by Commissioner

(7) In reviewing the proposal, the Commissioner shall consider the public interest in conducting the analysis and the privacy interest of the individuals to whom the personal health information relates in the circumstances.

Consideration by Minister

(8) The Minister shall consider the comments, if any, made by the Commissioner within the time specified in subsection (6), and may amend the proposal if the Minister considers it appropriate.

Approval of health data institute

(9) The Minister may approve a health data institute for the purposes of a disclosure made under this section if,

(a) the corporate objects of the institute include performing data analysis of personal health information, linking the information with other information and de-identifying the information for the Minister; and

(b) the institute has in place practices and procedures to protect the privacy of the individuals whose personal health information it receives and to maintain the confidentiality of the information and the Commissioner has approved those practices and procedures.

Review by Commissioner

(10) The Commissioner shall review the practices and procedures of each health data institute every three years from the date of its approval and advise the Minister whether the institute continues to meet the requirements of clauses (9) (a) and (b).

Withdrawal of approval

(11) The Minister shall withdraw the approval of a health data institute that ceases to meet the requirements of clauses (9) (a) and (b) or to carry out its objects mentioned in clause (9) (a), unless the Minister requires the institute to take immediate steps to satisfy the Minister that it will meet the requirements or that it will carry out the objects.

Effect of withdrawal of approval

(12) If the Minister withdraws the approval of a health data institute, the institute shall,

(a) make no further use or disclosure of any personal health information that a health information custodian has disclosed to it under subsection (2) or any information derived from that personal health information; and

(b) comply with the written directions of the Minister that the Commissioner has approved in writing with respect to information described in clause (a).

If institute ceases to exist

(13) If a health data institute ceases to exist, the persons holding the personal health information that the institute received under subsection (2) and held when it ceased to exist shall comply with the written directions of the Minister that the Commissioner has approved in writing with respect to the information.

Disclosure by Minister

(14) The Minister may disclose to the health data institute that receives personal health information under subsection (2) other personal health information for the purposes of the analysis and linking that the Minister requires if the disclosure is included in the Minister's proposal, as amended under subsection (8), if applicable.

Duties of health data institute

(15) A health data institute that receives personal health information under subsection (2) or (14) shall,

(a) follow the practices and procedures described in clause (9) (b) that the Commissioner has approved;

(b) perform the analysis and linking with other data that the Minister requires;

(d) provide the results of the analysis and linking, using only de-identified information, to the Minister or to the persons that the Minister approves;

(e) not disclose the information to the Minister or to the persons that the Minister approves except in a de-identified form; and

(f) subject to clauses (d) and (e), not disclose to any persons the information, even in a de-identified form, or any information derived from the information.

Transition

(16) If the Minister has lawfully required the disclosure of personal health information for a purpose described in subsection (2) in the 18 months before this section comes into force, this section does not apply with respect to a disclosure the Minister requires for a substantially similar purpose after this section comes into force until the first anniversary of the coming into force of this section.

Notification

(17) If the Minister requires a disclosure for a substantially similar purpose under subsection (16) after this section comes into force, the Minister shall notify the Commissioner within the later of the time of requiring the disclosure and 90 days after this section comes into force.

No hearing required

(18) The Minister is not required to hold a hearing or to afford to any person an opportunity for a hearing before making a decision under this section.

Disclosure with Commissioner's approval

48. (1) A health data institute to which a health information custodian has disclosed personal health information under section 47, shall, upon the request of the Minister and in accordance with the Commissioner's approval given under this section, disclose the information to the Minister or another person approved by the Minister if the Minister is of the opinion that it is in the public interest to request the disclosure and the requirements of this section have been met.

Non-application of section

(2) The personal health information mentioned in subsection (1) is not,

(b) information that is prescribed.

Commissioner's approval required

(3) The Minister shall not request the disclosure of personal health information under subsection (1) unless the Minister has submitted to the Commissioner a proposal for the disclosure and the Commissioner has approved the proposal.

Contents of proposal

(4) The proposal must include,

(a) a statement as to why the disclosure is reasonably required in the public interest and why the disclosure under section 47 was insufficient to meet the public interest;

(b) the extent of the identifiers that the Minister proposes be part of the information disclosed and a statement as to why the use of those identifiers is reasonably required for the purpose of the disclosure;

(c) a copy of all proposals and comments previously made or received under section 47 in respect of the information, if any; and

(d) all other information that the Commissioner requires.

Terms of approval

(5) If the Commissioner approves the proposal, the Commissioner may specify terms, conditions or limitations for the disclosure.

Restrictions on recipients

49. (1) Except as permitted or required by law and subject to the exceptions and additional requirements, if any, that are prescribed, a person who is not a health information custodian and to whom a health information custodian discloses personal health information, shall not use or disclose the information for any purpose other than,

(a) the purpose for which the custodian was authorized to disclose the information under this Act; or

(b) the purpose of carrying out a statutory or legal duty.

Extent of use or disclosure

(2) Subject to the exceptions and additional requirements, if any, that are prescribed, a person who is not a health information custodian, and to whom a health information custodian discloses personal health information, shall not use or disclose more of the information than is reasonably necessary to meet the purpose of the use or disclosure, as the case may be, unless the use or disclosure is required by law.

Employee or agent information

(3) Except as permitted or required by law and subject to the exceptions and additional requirements, if any, that are prescribed, if a health information custodian discloses information to another health information custodian and the information is identifying information of the type described in subsection 4 (4) in the custody or under the control of the receiving custodian, the receiving custodian shall not,

(a) use or disclose the information for any purpose other than,

(i) the purpose for which the disclosing custodian was authorized to disclose the information under this Act, or

(ii) the purpose of carrying out a statutory or legal duty; or

(b) use or disclose more of the information than is reasonably necessary to meet the purpose of the use or disclosure, as the case may be.

Same

(4) The restrictions set out in clauses (3) (a) and (b) apply to a health information custodian that receives the identifying information described in subsection (3) even if the custodian receives the information before the day that subsection comes into force.

Freedom of information legislation

(5) Except as prescribed, this section does not apply to an institution within the meaning of the Freedom of Information and Protection of Privacy Act or the Municipal Freedom of Information and Protection of Privacy Act that is not a health information custodian.

Disclosure outside Ontario

50. (1) A health information custodian may disclose personal health information about an individual collected in Ontario to a person outside Ontario only if,

(a) the individual consents to the disclosure;

(b) this Act permits the disclosure;

(c) the person receiving the information performs functions comparable to the functions performed by a person to whom this Act would permit the custodian to disclose the information in Ontario under subsection 40 (2) or clause 43 (1) (b), (c), (d) or (e);

(d) the following conditions are met:

(i) the custodian is a prescribed entity mentioned in subsection 45 (1) and is prescribed for the purpose of this clause,

(ii) the disclosure is for the purpose of health planning or health administration,

(iii) the information relates to health care provided in Ontario to a person who is resident of another province or territory of Canada, and

(iv) the disclosure is made to the government of that province or territory;

(e) the disclosure is reasonably necessary for the provision of health care to the individual, but not if the individual has expressly instructed the custodian not to make the disclosure; or

(f) the disclosure is reasonably necessary for the administration of payments in connection with the provision of health care to the individual or for contractual or legal requirements in that connection.

Notice of instruction

(2) If a health information custodian discloses personal health information about an individual under clause (1) (e) and if an instruction of the individual made under that clause prevents the custodian from disclosing all the personal health information that the custodian considers reasonably necessary to disclose for the provision of health care to the individual, the custodian shall notify the person to whom it makes the disclosure of that fact.

PART V
ACCESS TO RECORDS OF PERSONAL HEALTH INFORMATION AND CORRECTION

Access

Application of Part

51. (1) This Part does not apply to a record that contains,

(a) quality of care information;

(b) personal health information collected or created for the purpose of complying with the requirements of a quality assurance program within the meaning of the Health Professions Procedural Code that is Schedule 2 to the Regulated Health Professions Act, 1991;

(d) personal health information of the prescribed type in the custody or under the control of a prescribed class or classes of health information custodians.

Severable record

(2) Despite subsection (1), this Part applies to that part of a record of personal health information that can reasonably be severed from the part of the record that contains the information described in clauses (1) (a) to (d).

Agent of a non-custodian

(3) This Part does not apply to a record in the custody or under the control of a health information custodian acting as an agent of an institution within the meaning of the Freedom of Information and Protection of Privacy Act or the Municipal Freedom of Information and Protection of Privacy Act that is not a health information custodian if the individual has the right to request access to the record under one of those Acts.

Individual's right of access

52. (1) Subject to this Part, an individual has a right of access to a record of personal health information about the individual that is in the custody or under the control of a health information custodian unless,

(a) the record or the information in the record is subject to a legal privilege that restricts disclosure of the record or the information, as the case may be, to the individual;

(b) another Act, an Act of Canada or a court order prohibits disclosure to the individual of the record or the information in the record in the circumstances;

(c) the information in the record was collected or created primarily in anticipation of or use in a proceeding, and the proceeding, together with all appeals or processes resulting from it, have not been concluded;

(d) the following conditions are met:

(i) the information was collected or created in the course of an inspection, investigation or similar procedure authorized by law, or undertaken for the purpose of the detection, monitoring or prevention of a person's receiving or attempting to receive a service or benefit, to which the person is not entitled under an Act or a program operated by the Minister, or a payment for such a service or benefit, and

(ii) the inspection, investigation, or similar procedure, together with all proceedings, appeals or processes resulting from them, have not been concluded;

(e) granting the access could reasonably be expected to,

(i) result in a risk of serious harm to the treatment or recovery of the individual or a risk of serious bodily harm to the individual or another person,

(ii) lead to the identification of a person who was required by law to provide information in the record to the custodian, or

(iii) lead to the identification of a person who provided information in the record to the custodian explicitly or implicitly in confidence if the custodian considers it appropriate in the circumstances that the name of the person be kept confidential; or

(f) the following conditions are met:

(i) the custodian is an institution within the meaning of the Freedom of Information and Protection of Privacy Act or the Municipal Freedom of Information and Protection of Privacy Act or is acting as part of such an institution, and

(ii) the custodian would refuse to grant access to the part of the record,

(A) under clause 49 (a), (c) or (e) of the Freedom of Information and Protection of Privacy Act, if the request were made under that Act and that Act applied to the record, or

(B) under clause 38 (a) or (c) of the Municipal Freedom of Information and Protection of Privacy Act, if the request were made under that Act and that Act applied to the record.

Severable record

(2) Despite subsection (1), an individual has a right of access to that part of a record of personal health information about the individual that can reasonably be severed from the part of the record to which the individual does not have a right of access as a result of clauses (1) (a) to (f).

Same

(3) Despite subsection (1), if a record is not a record dedicated primarily to personal health information about the individual requesting access, the individual has a right of access only to the portion of personal health information about the individual in the record that can reasonably be severed from the record for the purpose of providing access.

Individual's plan of service

(4) Despite subsection (1), a health information custodian shall not refuse to grant the individual access to his or her plan of service within the meaning of the Long-Term Care Act, 1994.

Consultation regarding harm

(5) Before deciding to refuse to grant an individual access to a record of personal health information under subclause (1) (e) (i), a health information custodian may consult with a member of the College of Physicians and Surgeons of Ontario or a member of the College of Psychologists of Ontario.

Informal access

(6) Nothing in this Act prevents a health information custodian from,

(a) granting an individual access to a record of personal health information, to which the individual has a right of access, if the individual makes an oral request for access or does not make any request for access under section 53; or

(b) with respect to a record of personal health information to which an individual has a right of access, communicating with the individual or his or her substitute decision-maker who is authorized to consent on behalf of the individual to the collection, use or disclosure of personal health information about the individual.

Duty of health information custodian

(7) Nothing in this Part relieves a health information custodian from a legal duty to provide, in a manner that is not inconsistent with this Act, personal health information as expeditiously as is necessary for the provision of health care to the individual.

Request for access

53. (1) An individual may exercise a right of access to a record of personal health information by making a written request for access to the health information custodian that has custody or control of the information.

Detail in request

(2) The request must contain sufficient detail to enable the health information custodian to identify and locate the record with reasonable efforts.

Assistance

(3) If the request does not contain sufficient detail to enable the health information custodian to identify and locate the record with reasonable efforts, the custodian shall offer assistance to the person requesting access in reformulating the request to comply with subsection (2).

Response of health information custodian

54. (1) A health information custodian that receives a request from an individual for access to a record of personal health information shall,

(a) make the record available to the individual for examination and, at the request of the individual, provide a copy of the record to the individual and if reasonably practical, an explanation of any term, code or abbreviation used in the record;

(b) give a written notice to the individual stating that, after a reasonable search, the custodian has concluded that the record does not exist or cannot be found, if that is the case;

(c) if the custodian is entitled to refuse the request, in whole or in part, under any provision of this Part other than clause 52 (1) (c), (d) or (e), give a written notice to the individual stating that the custodian is refusing the request, in whole or in part, providing a reason for the refusal and stating that the individual is entitled to make a complaint about the refusal to the Commissioner under Part VI; or

(d) if the custodian is entitled to refuse the request, in whole or in part, under clause 52 (1) (c), (d) or (e), give a written notice to the individual stating that the custodian is refusing to confirm or deny the existence of any record subject to any of those provisions and that the individual is entitled to make a complaint about the refusal to the Commissioner under Part VI.

Time for response

(2) Subject to subsection (3), the health information custodian shall give the response required by clause (1) (a), (b), (c) or (d) as soon as possible in the circumstances but no later than 30 days after receiving the request.

Extension of time for response

(3) Within 30 days after receiving the request for access, the health information custodian may extend the time limit set out in subsection (2) for a further period of time of not more than 30 days if,

(a) meeting the time limit would unreasonably interfere with the operations of the custodian because the information consists of numerous pieces of information or locating the information would necessitate a lengthy search; or

(b) the time required to undertake the consultations necessary to reply to the request within 30 days after receiving it would make it not reasonably practical to reply within that time.

Notice of extension

(4) Upon extending the time limit under subsection (3), the health information custodian shall give the individual written notice of the extension setting out the length of the extension and the reason for the extension.

Expedited access

(5) Despite subsection (2), the health information custodian shall give the response required by clause (1) (a), (b), (c) or (d) within the time period that the individual specifies if,

(a) the individual provides the custodian with evidence satisfactory to the custodian, acting on a reasonable basis, that the individual requires access to the requested record of personal health information on an urgent basis within that time period; and

(b) the custodian is reasonably able to give the required response within that time period.

Frivolous or vexatious requests

(6) A health information custodian that believes on reasonable grounds that a request for access to a record of personal health information is frivolous or vexatious or is made in bad faith may refuse to grant the individual access to the requested record.

Effect of non-compliance

(7) If the health information custodian does not respond to the request within the time limit or before the extension, if any, expires, the custodian shall be deemed to have refused the individual's request for access.

Right to complain

(8) If the health information custodian refuses or is deemed to have refused the request, in whole or in part,

(a) the individual is entitled to make a complaint about the refusal to the Commissioner under Part VI; and

(b) in the complaint, the burden of proof in respect of the refusal lies on the health information custodian.

Identity of individual

(9) A health information custodian shall not make a record of personal health information or a part of it available to an individual under this Part or provide a copy of it to an individual under clause (1) (a) without first taking reasonable steps to be satisfied as to the individual's identity.

Fee for access

(10) A health information custodian that makes a record of personal health information or a part of it available to an individual under this Part or provides a copy of it to an individual under clause (1) (a) may charge the individual a fee for that purpose if the custodian first gives the individual an estimate of the fee.

Amount of fee

(11) The amount of the fee shall not exceed the prescribed amount or the amount of reasonable cost recovery, if no amount is prescribed.

Waiver of fee

(12) A health information custodian mentioned in subsection (10) may waive the payment of all or any part of the fee that an individual is required to pay under that subsection if, in the custodian's opinion, it is fair and equitable to do so.

Correction

Correction

55. (1) If a health information custodian has granted an individual access to a record of his or her personal health information and if the individual believes that the record is inaccurate or incomplete for the purposes for which the custodian has collected or used the information, the individual may request in writing that the custodian correct the record.

Informal request

(2) If the individual makes an oral request that the health information custodian correct the record, nothing in this Part prevents the custodian from making the requested correction.

Reply

(3) As soon as possible in the circumstances but no later than 30 days after receiving a request for a correction under subsection (1), the health information custodian shall, by written notice to the individual, grant or refuse the individual's request or extend the deadline for replying for a period of not more than 30 days if,

(a) replying to the request within 30 days would unreasonably interfere with the activities of the custodian; or

(b) the time required to undertake the consultations necessary to reply to the request within 30 days would make it not reasonably practical to reply within that time.

Extension of time for reply

(4) A health information custodian that extends the time limit under subsection (3) shall,

(a) give the individual written notice of the extension setting out the length of the extension and the reason for the extension; and

(b) grant or refuse the individual's request as soon as possible in the circumstances but no later than the expiry of the time limit as extended.

Deemed refusal

(5) A health information custodian that does not grant a request for a correction under subsection (1) within the time required shall be deemed to have refused the request.

Frivolous or vexatious requests

(6) A health information custodian that believes on reasonable grounds that a request for a correction under subsection (1) is frivolous or vexatious or is made in bad faith may refuse to grant the request and, in that case, shall provide the individual with a notice that sets out the reasons for the refusal and that states that the individual is entitled to make a complaint about the refusal to the Commissioner under Part VI.

Right to complain

(7) The individual is entitled to make a complaint to the Commissioner under Part VI about a refusal made under subsection (6).

Duty to correct

(8) The health information custodian shall grant a request for a correction under subsection (1) if the individual demonstrates, to the satisfaction of the custodian, that the record is incomplete or inaccurate for the purposes for which the custodian uses the information and gives the custodian the information necessary to enable the custodian to correct the record.

Exceptions

(9) Despite subsection (8), a health information custodian is not required to correct a record of personal health information if,

(a) it consists of a record that was not originally created by the custodian and the custodian does not have sufficient knowledge, expertise and authority to correct the record; or

(b) it consists of a professional opinion or observation that a custodian has made in good faith about the individual.

Duties upon correction

(10) Upon granting a request for a correction under subsection (1), the health information custodian shall,

(a) make the requested correction by,

(i) recording the correct information in the record and,

(A) striking out the incorrect information in a manner that does not obliterate the record, or

(B) if that is not possible, labelling the information as incorrect, severing the incorrect information from the record, storing it separately from the record and maintaining a link in the record that enables a person to trace the incorrect information, or

(ii) if it is not possible to record the correct information in the record, ensuring that there is a practical system in place to inform a person who accesses the record that the information in the record is incorrect and to direct the person to the correct information;

(b) give notice to the individual of what it has done under clause (a);

(c) at the request of the individual, give written notice of the requested correction, to the extent reasonably possible, to the persons to whom the custodian has disclosed the information with respect to which the individual requested the correction of the record, except if the correction cannot reasonably be expected to have an effect on the ongoing provision of health care or other benefits to the individual.

Notice of refusal

(11) A notice of refusal under subsection (3) or (4) must give the reasons for the refusal and inform the individual that the individual is entitled to,

(a) prepare a concise statement of disagreement that sets out the correction that the health information custodian has refused to make;

(b) require that the health information custodian attach the statement of disagreement as part of the records that it holds of the individual's personal health information and disclose the statement of disagreement whenever the custodian discloses information to which the statement relates;

(c) require that the health information custodian make all reasonable efforts to disclose the statement of disagreement to any person who would have been notified under clause (10) (c) if the custodian had granted the requested correction; and

(d) make a complaint about the refusal to the Commissioner under Part VI.

Rights of individual

(12) If a health information custodian, under subsection (3) or (4), refuses a request for a correction under subsection (1), in whole or in part, or is deemed to have refused the request, the individual is entitled to take the actions described in any of clauses (11) (a), (b), (c) and (d).

Custodian's duty

(13) If the individual takes an action described in clause (11) (b) or (c), the health information custodian shall comply with the requirements described in the applicable clause.

PART VI
ADMINISTRATION AND ENFORCEMENT

Complaints, Reviews and Inspections

Complaint to Commissioner

56. (1) A person who has reasonable grounds to believe that another person has contravened or is about to contravene a provision of this Act or its regulations may make a complaint to the Commissioner.

Time for complaint

(2) A complaint that a person makes under subsection (1) must be in writing and must be filed within,

(a) one year after the subject-matter of the complaint first came to the attention of the complainant or should reasonably have come to the attention of the complainant, whichever is the shorter; or

(b) whatever longer period of time that the Commissioner permits if the Commissioner is satisfied that it does not result in any prejudice to any person.

Same, refusal of request

(3) A complaint that an individual makes under subsection 54 (8) or 55 (7) or (12) shall be in writing and shall be filed within six months from the time at which the health information custodian refuses or is deemed to have refused the individual's request mentioned in the applicable subsection.

Non-application

(4) The Ombudsman Act does not apply to any matter in respect of which a complaint may be made to the Commissioner under this Act or to the Commissioner or his or her employees or delegates acting under this Act.

Response of Commissioner

57. (1) Upon receiving a complaint made under this Act, the Commissioner may inform the person about whom the complaint is made of the nature of the complaint and,

(a) inquire as to what means, other than the complaint, that the complainant is using or has used to resolve the subject-matter of the complaint;

(b) require the complainant to try to effect a settlement, within the time period that the Commissioner specifies, with the person about which the complaint is made; or

(c) authorize a mediator to review the complaint and to try to effect a settlement, within the time period that the Commissioner specifies, between the complainant and the person about which the complaint is made.

Dealings without prejudice

(2) If the Commissioner takes an action described in clause (1) (b) or (c) but no settlement is effected within the time period specified,

(a) none of the dealings between the parties to the attempted settlement shall prejudice the rights and duties of the parties under this Act;

(b) none of the information disclosed in the course of trying to effect a settlement shall prejudice the rights and duties of the parties under this Act; and

(c) none of the information disclosed in the course of trying to effect a settlement and that is subject to mediation privilege shall be used or disclosed outside the attempted settlement, including in a review of a complaint under this section or in an inspection under section 60, unless all parties expressly consent.

Commissioner's review

(3) If the Commissioner does not take an action described in clause (1) (b) or (c) or if the Commissioner takes an action described in one of those clauses but no settlement is effected within the time period specified, the Commissioner may review the subject-matter of a complaint made under this Act if satisfied that there are reasonable grounds to do so.

No review

(4) The Commissioner may decide not to review the subject-matter of the complaint for whatever reason the Commissioner considers proper, including if satisfied that,

(a) the person about which the complaint is made has responded adequately to the complaint;

(b) the complaint has been or could be more appropriately dealt with, initially or completely, by means of a procedure, other than a complaint under this Act;

(c) the length of time that has elapsed between the date when the subject-matter of the complaint arose and the date the complaint was made is such that a review under this section would likely result in undue prejudice to any person;

(d) the complainant does not have a sufficient personal interest in the subject-matter of the complaint; or

(e) the complaint is frivolous or vexatious or is made in bad faith.

Notice

(5) Upon deciding not to review the subject-matter of a complaint, the Commissioner shall give notice of the decision to the complainant and shall specify in the notice the reason for the decision.

Same

(6) Upon deciding to review the subject-matter of a complaint, the Commissioner shall give notice of the decision to the person about whom the complaint is made.

Commissioner's self-initiated review

58. (1) The Commissioner may, on his or her own initiative, conduct a review of any matter if the Commissioner has reasonable grounds to believe that a person has contravened or is about to contravene a provision of this Act or its regulations and that the subject-matter of the review relates to the contravention.

Notice

(2) Upon deciding to conduct a review under this section, the Commissioner shall give notice of the decision to every person whose activities are being reviewed.

Conduct of Commissioner's review

59. (1) In conducting a review under section 57 or 58, the Commissioner may make the rules of procedure that the Commissioner considers necessary and the Statutory Powers Procedure Act does not apply to the review.

Evidence

(2) In conducting a review under section 57 or 58, the Commissioner may receive and accept any evidence and other information that the Commissioner sees fit, whether on oath or by affidavit or otherwise and whether or not it is or would be admissible in a court of law.

Inspection powers

60. (1) In conducting a review under section 57 or 58, the Commissioner may, without a warrant or court order, enter and inspect any premises in accordance with this section if,

(a) the Commissioner has reasonable grounds to believe that,

(i) the person about whom the complaint was made or the person whose activities are being reviewed is using the premises for a purpose related to the subject-matter of the complaint or the review, as the case may be, and

(ii) the premises contains books, records or other documents relevant to the subject-matter of the complaint or the review, as the case may be;

(b) the Commissioner is conducting the inspection for the purpose of determining whether the person has contravened or is about to contravene a provision of this Act or its regulations; and

Review powers

(2) In conducting a review under section 57 or 58, the Commissioner may,

(a) demand the production of any books, records or other documents relevant to the subject-matter of the review or copies of extracts from the books, records or other documents;

(b) inquire into all information, records, information practices of a health information custodian and other matters that are relevant to the subject-matter of the review;

(d) use any data storage, processing or retrieval device or system belonging to the person being investigated in order to produce a record in readable form of any books, records or other documents relevant to the subject-matter of the review; or

(e) on the premises that the Commissioner has entered, review or copy any books, records or documents that a person produces to the Commissioner, if the Commissioner pays the reasonable cost recovery fee that the health information custodian or person being reviewed may charge.

Entry to dwellings

(3) The Commissioner shall not, without the consent of the occupier, exercise a power to enter a place that is being used as a dwelling, except under the authority of a search warrant issued under subsection (4).

Search warrants

(4) Where a justice of the peace is satisfied by evidence upon oath or affirmation that there is reasonable ground to believe it is necessary to enter a place that is being used as a dwelling to investigate a complaint that is the subject of a review under section 57, he or she may issue a warrant authorizing the entry by a person named in the warrant.

Time and manner for entry

(5) The Commissioner shall exercise the power to enter premises under this section only during reasonable hours for the premises and only in such a manner so as not to interfere with health care that is being provided to any person on the premises at the time of entry.

No obstruction

(6) No person shall obstruct the Commissioner who is exercising powers under this section or provide the Commissioner with false or misleading information.

Written demand

(7) A demand for books, records or documents or copies of extracts from them under subsection (2) must be in writing and must include a statement of the nature of the things that are required to be produced.

Obligation to assist

(8) If the Commissioner makes a demand for any thing under subsection (2), the person having custody of the thing shall produce it to the Commissioner and, at the request of the Commissioner, shall provide whatever assistance is reasonably necessary, including using any data storage, processing or retrieval device or system to produce a record in readable form, if the demand is for a document.

Removal of documents

(9) If a person produces books, records and other documents to the Commissioner, other than those needed for the current health care of any person, the Commissioner may, on issuing a written receipt, remove them and may review or copy any of them if the Commissioner is not able to review and copy them on the premises that the Commissioner has entered.

Return of documents

(10) The Commissioner shall carry out any reviewing or copying of documents with reasonable dispatch, and shall forthwith after the reviewing or copying return the documents to the person who produced them.

Admissibility of copies

(11) A copy certified by the Commissioner as a copy is admissible in evidence to the same extent, and has the same evidentiary value, as the thing copied.

Answers under oath

(12) In conducting a review under section 57 or 58, the Commissioner may, by summons, in the same manner and to the same extent as a superior court of record, require the appearance of any person before the Commissioner and compel them to give oral or written evidence on oath or affirmation.

Inspection of record without consent

(13) Despite subsections (2) and (12), the Commissioner shall not inspect a record of, require evidence of, or inquire into, personal health information without the consent of the individual to whom it relates, unless,

(a) the Commissioner first determines that it is reasonably necessary to do so, subject to any conditions or restrictions that the Commissioner specifies, which shall include a time limitation, in order to carry out the review and that the public interest in carrying out the review justifies dispensing with obtaining the individual's consent in the circumstances; and

(b) the Commissioner provides a statement to the person who has custody or control of the record to be inspected, or the evidence or information to be inquired into, setting out the Commissioner's determination under clause (a) together with brief written reasons and any restrictions and conditions that the Commissioner has specified.

Limitation on delegation

(14) Despite subsection 67 (1), the power to make a determination under clause (13) (a) and to approve the brief written reasons under clause (13) (b) may not be delegated except to the Assistant Commissioner.

Document privileged

(15) A document or thing produced by a person in the course of an inquiry is privileged in the same manner as if the inquiry were a proceeding in a court.

Protection

(16) Except on the trial of a person for perjury in respect of his or her sworn testimony, no statement made or answer given by that or any other person in the course of a review by the Commissioner is admissible in evidence in any court or at any inquiry or in any other proceedings, and no evidence in respect of proceedings before the Commissioner shall be given against any person.

Protection under federal Act

(17) The Commissioner shall inform a person giving a statement or answer in the course of a review by the Commissioner of the person's right to object to answer any question under section 5 of the Canada Evidence Act.

Representations

(18) The Commissioner shall give the person who made the complaint, the person about whom the complaint is made and any other affected person an opportunity to make representations to the Commissioner.

Representative

(19) A person who is given an opportunity to make representations to the Commissioner may be represented by counsel or another person.

Access to representations

(20) The Commissioner may permit a person to be present during the representations that another person makes to the Commissioner or to have access to them unless doing so would reveal,

(a) the substance of a record of personal health information, for which a health information custodian claims to be entitled to refuse a request for access made under section 53; or

(b) personal health information to which an individual is not entitled to request access under section 53.

Proof of appointment

(21) If the Commissioner or Assistant Commissioner has delegated his or her powers under this section to an officer or employee of the Commissioner, the officer or employee who exercises the powers shall, upon request, produce the certificate of delegation signed by the Commissioner or Assistant Commissioner, as the case may be.

Powers of Commissioner

61. (1) After conducting a review under section 57 or 58, the Commissioner may,

(a) if the review relates to a complaint into a request by an individual under subsection 53 (1) for access to a record of personal health information, make an order directing the health information custodian about whom the complaint was made to grant the individual access to the requested record;

(b) if the review relates to a complaint into a request by an individual under subsection 55 (1) for correction of a record of personal health information, make an order directing the health information custodian about whom a complaint was made to make the requested correction;

(c) make an order directing any person whose activities the Commissioner reviewed to perform a duty imposed by this Act or its regulations;

(d) make an order directing any person whose activities the Commissioner reviewed to cease collecting, using or disclosing personal health information if the Commissioner determines that the person is collecting, using or disclosing the information, as the case may be, or is about to do so in contravention of this Act, its regulations or an agreement entered into under this Act;

(e) make an order directing any person whose activities the Commissioner reviewed to dispose of records of personal health information that the Commissioner determines the person collected, used or disclosed in contravention of this Act, its regulations or an agreement entered into under this Act but only if the disposal of the records is not reasonably expected to adversely affect the provision of health care to an individual;

(f) make an order directing any health information custodian whose activities the Commissioner reviewed to change, cease or not commence an information practice specified by the Commissioner, if the Commissioner determines that the information practice contravenes this Act or its regulations;

(g) make an order directing any health information custodian whose activities the Commissioner reviewed to implement an information practice specified by the Commissioner, if the Commissioner determines that the information practice is reasonably necessary in order to achieve compliance with this Act and its regulations;

(h) make an order directing any person who is an agent of a health information custodian, whose activities the Commissioner reviewed and that an order made under any of clauses (a) to (g) directs to take any action or to refrain from taking any action, to take the action or to refrain from taking the action if the Commissioner considers that it is necessary to make the order against the agent to ensure that the custodian will comply with the order made against the custodian; or

(i) make comments and recommendations on the privacy implications of any matter that is the subject of the review.

Terms of order

(2) An order that the Commissioner makes under subsection (1) may contain the terms that the Commissioner considers appropriate.

Copy of order, etc.

(3) Upon making comments, recommendations or an order under subsection (1), the Commissioner shall provide a copy of them, including reasons for any order made, to,

(a) the complainant and the person about whom the complaint was made, if the Commissioner made the comments, recommendations or order after conducting a review under section 57 of a complaint;

(b) the person whose activities the Commissioner reviewed, if the Commissioner made the comments, recommendations or order after conducting a review under section 58;

(d) the body or bodies that are legally entitled to regulate or review the activities of a health information custodian directed in the order or to whom the comments or recommendations relate; and

(e) any other person whom the Commissioner considers appropriate.

No order

(4) If, after conducting a review under section 57 or 58, the Commissioner does not make an order under subsection (1), the Commissioner shall give the complainant, if any, and the person whose activities the Commissioner reviewed a notice that sets out the Commissioner's reasons for not making an order.

Appeal of order

62. (1) A person affected by an order of the Commissioner made under any of clauses 61 (1) (c) to (h) may appeal the order to the Divisional Court on a question of law in accordance with the rules of court by filing a notice of appeal within 30 days after receiving the copy of the order.

Certificate of Commissioner

(2) In an appeal under this section, the Commissioner shall certify to the Divisional Court,

(a) the order and a statement of the Commissioner's reasons for making the order;

(b) the record of all hearings that the Commissioner has held in conducting the review on which the order is based;

(d) all other material that the Commissioner considers is relevant to the appeal.

Confidentiality of information

(3) In an appeal under this section, the court may take precautions to avoid the disclosure by the court or any person of any personal health information about an individual, including, where appropriate, receiving representations without notice, conducting hearings in private or sealing the court files.

Court order

(4) On hearing an appeal under this section, the court may, by order,

(a) direct the Commissioner to make the decisions and to do the acts that the Commissioner is authorized to do under this Act and that the court considers proper; and

(b) if necessary, vary or set aside the Commissioner's order.

Compliance by Commissioner

(5) The Commissioner shall comply with the court's order.

Enforcement of order

63. An order made by the Commissioner under this Act that has become final as a result of there being no further right of appeal may be filed with the Superior Court of Justice and on filing becomes and is enforceable as a judgment or order of the Superior Court of Justice to the same effect.

Further order of Commissioner

64. (1) After conducting a review under section 57 or 58 and making an order under subsection 61 (1), the Commissioner may rescind or vary the order or may make a further order under that subsection if new facts relating to the subject-matter of the review come to the Commissioner's attention or if there is a material change in the circumstances relating to the subject-matter of the review.

Circumstances

(2) The Commissioner may exercise the powers described in subsection (1) even if the order that the Commissioner rescinds or varies has been filed with the Superior Court of Justice under section 63.

Copy of order, etc.

(3) Upon making a further order under subsection (1), the Commissioner shall provide a copy of it to the persons described in clauses 61 (3) (a) to (e) and shall include with the copy a notice setting out,

(a) the Commissioner's reasons for making the order; and

(b) if the order was made under any of clauses 61 (1) (c) to (h), a statement that the persons affected by the order have the right to appeal described in subsection (4).

Appeal

(4) A person affected by an order that the Commissioner rescinds, varies or makes under any of clauses 61 (1) (c) to (h) may appeal the order to the Divisional Court on a question of law in accordance with the rules of court by filing a notice of appeal within 30 days after receiving the copy of the order and subsections 62 (2) to (5) apply to the appeal.

Damages for breach of privacy

65. (1) If the Commissioner has made an order under this Act that has become final as the result of there being no further right of appeal, a person affected by the order may commence a proceeding in the Superior Court of Justice for damages for actual harm that the person has suffered as a result of a contravention of this Act or its regulations.

Same

(2) If a person has been convicted of an offence under this Act and the conviction has become final as a result of there being no further right of appeal, a person affected by the conduct that gave rise to the offence may commence a proceeding in the Superior Court of Justice for damages for actual harm that the person has suffered as a result of the conduct.

Damages for mental anguish

(3) If, in a proceeding described in subsection (1) or (2), the Superior Court of Justice determines that the harm suffered by the plaintiff was caused by a contravention or offence, as the case may be, that the defendants engaged in wilfully or recklessly, the court may include in its award of damages an award, not exceeding $10,000, for mental anguish.

Commissioner

General powers

66. The Commissioner may,

(a) engage in or commission research into matters affecting the carrying out of the purposes of this Act;

(b) conduct public education programs and provide information concerning this Act and the Commissioner's role and activities;

(d) on the request of a health information custodian, offer comments on the custodian's actual or proposed information practices;

(e) assist in investigations and similar procedures conducted by a person who performs similar functions to the Commissioner under the laws of Canada, except that in providing assistance, the Commissioner shall not use or disclose information collected by or for the Commissioner under this Act;

(f) in appropriate circumstances, authorize the collection of personal health information about an individual in a manner other than directly from the individual.

Delegation

67. (1) The Commissioner may in writing delegate any of the Commissioner's powers, duties or functions under this Act, including the power to make orders, to the Assistant Commissioner or to an officer or employee of the Commissioner.

Subdelegation by Assistant Commissioner

(2) The Assistant Commissioner may in writing delegate any of the powers, duties or functions delegated to him or her under subsection (1) to any other officers or employees of the Commissioner, subject to the conditions and restrictions that the Assistant Commissioner specifies in the delegation.

Limitations re personal health information

68. (1) The Commissioner and any person acting under his or her authority may collect, use or retain personal health information in the course of carrying out any functions under this Part solely if no other information will serve the purpose of the collection, use or retention of the personal health information and in no other circumstances.

Extent of information

(2) The Commissioner and any person acting under his or her authority shall not in the course of carrying out any functions under this Part collect, use or retain more personal health information than is reasonably necessary to enable the Commissioner to perform his or her functions relating to the administration of this Act or for a proceeding under it.

Confidentiality

(3) The Commissioner, the Assistant Commissioner and persons acting on behalf of or under the direction of either of them shall not disclose any information that comes to their knowledge in the course of exercising their functions under this Act unless,

(a) the disclosure is required for the purpose of exercising those functions;

(b) the information relates to a health information custodian, the disclosure is made to a body that is legally entitled to regulate or review the activities of the custodian and the Commissioner or the Assistant Commissioner is of the opinion that the disclosure is justified;

(c) the Commissioner obtained the information under subsection 60 (12) and the disclosure is required in a prosecution for an offence under section 131 of the Criminal Code (Canada) in respect of sworn testimony; or

(d) the disclosure is made to the Attorney General, the information relates to the commission of an offence against an Act or an Act of Canada and the Commissioner is of the view that there is evidence of such an offence.

Same

(4) Despite anything in subsection (3), the Commissioner, the Assistant Commissioner and persons acting on behalf of or under the direction of either of them shall not disclose,

(a) any quality of care information that comes to their knowledge in the course of exercising their functions under this Act; or

(b) the identity of a person, other than a complainant under subsection 56 (1), who has provided information to the Commissioner and who has requested the Commissioner to keep the person's identity confidential.

Information in review or proceeding

(5) The Commissioner in a review under section 57 or 58 and a court, tribunal or other person, including the Commissioner, in a proceeding mentioned in section 65 or this section shall take every reasonable precaution, including, when appropriate, receiving representations without notice and conducting hearings that are closed to the public, to avoid the disclosure of any information for which a health information custodian is entitled to refuse a request for access made under section 53.

Not compellable witness

(6) The Commissioner, the Assistant Commissioner and persons acting on behalf of or under the direction of either of them shall not be required to give evidence in a court or in a proceeding of a judicial nature concerning anything coming to their knowledge in the exercise of their functions under this Act that they are prohibited from disclosing under subsection (3) or (4).

Immunity

69. No action or other proceeding for damages may be instituted against the Commissioner, the Assistant Commissioner or any person acting on behalf of or under the direction of either of them for,

(a) anything done, reported or said in good faith and in the exercise or intended exercise of any of their powers or duties under this Act; or

(b) any alleged neglect or default in the exercise in good faith of any of their powers or duties under this Act.

PART VII
GENERAL

Non-retaliation

70. No one shall dismiss, suspend, demote, discipline, harass or otherwise disadvantage a person by reason that,

(a) the person, acting in good faith and on the basis of reasonable belief, has disclosed to the Commissioner that any other person has contravened or is about to contravene a provision of this Act or its regulations;

(b) the person, acting in good faith and on the basis of reasonable belief, has done or stated an intention of doing anything that is required to be done in order to avoid having any person contravene a provision of this Act or its regulations;

(c) the person, acting in good faith and on the basis of reasonable belief, has refused to do or stated an intention of refusing to do anything that is in contravention of a provision of this Act or its regulations; or

(d) any person believes that the person will do anything described in clause (a), (b) or (c).

Immunity

71. (1) No action or other proceeding for damages may be instituted against a health information custodian or any other person for,

(a) anything done, reported or said, both in good faith and reasonably in the circumstances, in the exercise or intended exercise of any of their powers or duties under this Act; or

(b) any alleged neglect or default that was reasonable in the circumstances in the exercise in good faith of any of their powers or duties under this Act.

Crown liability

(2) Despite subsections 5 (2) and (4) of the Proceedings Against the Crown Act, subsection (1) does not relieve the Crown of liability in respect of a tort committed by a person mentioned in subsection (1) to which it would otherwise be subject.

Substitute decision-maker

(3) A person who, on behalf of or in the place of an individual, gives or refuses consent to a collection, use or disclosure of personal health information about the individual, makes a request, gives an instruction or takes a step is not liable for damages for doing so if the person acts reasonably in the circumstances, in good faith and in accordance with this Act and its regulations.

Reliance on assertion

(4) Unless it is not reasonable to do so in the circumstances, a person is entitled to rely on the accuracy of an assertion made by another person, in connection with a collection, use or disclosure of, or access to, the information under this Act, to the effect that the other person,

(a) is a person who is authorized to request access to a record of personal health information under section 53;

(b) is a person who is entitled under section 5 or 23 or subsection 26 (1) to consent to the collection, use or disclosure of personal health information about another individual;

(d) holds the beliefs described in subsection 26 (5).

Offences

72. (1) A person is guilty of an offence if the person,

(a) wilfully collects, uses or discloses personal health information in contravention of this Act or its regulations;

(b) makes a request under this Act, under false pretences, for access to or correction of a record of personal health information;

(c) in connection with the collection, use or disclosure of personal health information or access to a record of personal health information, makes an assertion, knowing that it is untrue, to the effect that the person,

(i) is a person who is entitled to consent to the collection, use or disclosure of personal health information about another individual,

(ii) meets the requirement of clauses 26 (2) (b) and (c),

(iii) holds the beliefs described in subsection 26 (5), or

(iv) is a person entitled to access to a record of personal health information under section 52;

(d) disposes of a record of personal health information in the custody or under the control of the custodian with an intent to evade a request for access to the record that the custodian has received under subsection 53 (1);

(e) wilfully disposes of a record of personal health information in contravention of section 13;

(f) contravenes subsection 34 (2), (3) or (4) or clause 47 (15) (a), (e) or (f);

(g) wilfully obstructs the Commissioner or a person known to be acting under the authority of the Commissioner in the performance of his or her functions under this Act;

(h) wilfully makes a false statement to mislead or attempt to mislead the Commissioner or a person known to be acting under the authority of the Commissioner in the performance of his or her functions under this Act;

(i) wilfully fails to comply with an order made by the Commissioner or a person known to be acting under the authority of the Commissioner under this Act; or

(j) contravenes section 70.

Penalty

(2) A person who is guilty of an offence under subsection (1) is liable, on conviction,

(a) if the person is a natural person, to a fine of not more than $50,000; and

(b) if the person is not a natural person, to a fine of not more than $250,000.

Officers, etc.

(3) If a corporation commits an offence under this Act, every officer, member, employee or other agent of the corporation who authorized the offence, or who had the authority to prevent the offence from being committed but knowingly refrained from doing so, is a party to and guilty of the offence and is liable, on conviction, to the penalty for the offence, whether or not the corporation has been prosecuted or convicted.

No prosecution

(4) No person is liable to prosecution for an offence against this or any other Act by reason of complying with a requirement of the Commissioner under this Act.

Commencing a prosecution

(5) No person other than the Attorney General or a counsel or agent acting on behalf of the Attorney General may commence a prosecution for an offence under subsection (1).

Regulations

73. (1) Subject to section 74, the Lieutenant Governor in Council may make regulations,

(a) prescribing or specifying anything that this Act describes as being prescribed, specified, described, provided for, authorized or required in the regulations made under this Act;

(b) exempting persons or classes of persons from the persons described in clause (d) of the definition of "health care practitioner" in section 2;

(c) specifying persons or classes of persons who shall not be included in the definition of "health information custodian" in subsection 3 (1);

(d) specifying that certain types of information shall or shall not be included in the definition of "personal health information" in subsection 4 (1);

(e) defining, for the purposes of this Act and its regulations, any word or expression used in this Act that has not already been expressly defined in this Act;

(f) making any provision of this Act or its regulations, that applies to some but not all health information custodians, applicable to a prescribed person mentioned in paragraph 8 of the definition of "health information custodian" in subsection 3 (1) or a member of a prescribed class of persons mentioned in that paragraph;

(g) specifying requirements with respect to information practices for the purposes of subsection 10 (1), including conditions that a health information custodian is required to comply with when collecting, using or disclosing personal health information or classes of personal health information, or specifying procedural processes or requirements for setting requirements with respect to information practices for the purposes of that subsection;

(h) specifying requirements, or a process for setting requirements, for the purposes of subsection 10 (3) with which a health information custodian is required to comply when using electronic means to collect, use, modify, disclose, retain or dispose of personal health information, including standards for transactions, data elements for transactions, code sets for data elements and procedures for the transmission and authentication of electronic signatures;

(i) specifying requirements for the purposes of subsection 17 (1), including requiring that a health information custodian and its agent enter into an agreement that complies with the regulations made under clause (k) before the custodian provides personal health information to the agent;

(j) specifying requirements that an agreement entered into under this Act or its regulations must contain;

(k) specifying requirements, restrictions or prohibitions with respect to the collection, use or disclosure of any class of personal health information by any person in addition to the requirements, restrictions or prohibitions set out in this Act;

(l) specifying requirements that an express instruction mentioned in clause 37 (1) (a), 38 (1) (a) or 50 (1) (e) must meet;

(m) permitting notices, statements or any other things, that under this Act are required to be provided in writing, to be provided in electronic or other form instead, subject to the conditions or restrictions that are specified by the regulations made under this Act;

(n) prescribing under what circumstances the Canadian Blood Services may collect, use and disclose personal health information, the conditions that apply to the collection, use and disclosure of personal health information by the Canadian Blood Services and disclosures that may be made by a health information custodian to the Canadian Blood Services;

(o) specifying information relating to the administration or enforcement of this Act that is required to be contained in a report made under subsection 58 (1) of the Freedom of Information and Protection of Privacy Act;

(p) respecting any matter necessary or advisable to carry out effectively the purposes of this Act.

General or specific application

(2) A regulation made under this Act may be of general application or specific to any person or persons or class or classes in its application.

Classes

(3) A class described in the regulations made under this Act may be described according to any characteristic or combination of characteristics and may be described to include or exclude any specified member, whether or not with the same characteristics.

Public consultation before making regulations

74. (1) Subject to subsection (7), the Lieutenant Governor in Council shall not make any regulation under section 73 unless,

(a) the Minister has published a notice of the proposed regulation in The Ontario Gazette and given notice of the proposed regulation by all other means that the Minister considers appropriate for the purpose of providing notice to the persons who may be affected by the proposed regulation;

(b) the notice complies with the requirements of this section;

(c) the time periods specified in the notice, during which members of the public may exercise a right described in clause (2) (b) or (c), have expired; and

(d) the Minister has considered whatever comments and submissions that members of the public have made on the proposed regulation in accordance with clause (2) (b) or (c) and has reported to the Lieutenant Governor in Council on what, if any, changes to the proposed regulation the Minister considers appropriate.

Contents of notice

(2) The notice mentioned in clause (1) (a) shall contain,

(a) a description of the proposed regulation and the text of it;

(b) a statement of the time period during which members of the public may submit written comments on the proposed regulation to the Minister and the manner in which and the address to which the comments must be submitted;

(c) a description of whatever other rights, in addition to the right described in clause (b), that members of the public have to make submissions on the proposed regulation and the manner in which and the time period during which those rights must be exercised;

(d) a statement of where and when members of the public may review written information about the proposed regulation;

(e) all prescribed information; and

(f) all other information that the Minister considers appropriate.

Time period for comments

(3) The time period mentioned in clauses (2) (b) and (c) shall be at least 60 days after the Minister gives the notice mentioned in clause (1) (a) unless the Minister shortens the time period in accordance with subsection (4).

Shorter time period for comments

(4) The Minister may shorten the time period if, in the Minister's opinion,

(a) the urgency of the situation requires it;

(b) the proposed regulation clarifies the intent or operation of this Act or the regulations; or

Discretion to make regulations

(5) Upon receiving the Minister's report mentioned in clause (1) (d), the Lieutenant Governor in Council, without further notice under subsection (1), may make the proposed regulation with the changes that the Lieutenant Governor in Council considers appropriate, whether or not those changes are mentioned in the Minister's report.

No public consultation

(6) The Minister may decide that subsections (1) to (5) should not apply to the power of the Lieutenant Governor in Council to make a regulation under section 73 if, in the Minister's opinion,

(a) the urgency of the situation requires it;

(b) the proposed regulation clarifies the intent or operation of this Act or the regulations; or

Same

(7) If the Minister decides that subsections (1) to (5) should not apply to the power of the Lieutenant Governor in Council to make a regulation under section 73,

(a) those subsections do not apply to the power of the Lieutenant Governor in Council to make the regulation; and

(b) the Minister shall give notice of the decision to the public and to the Commissioner as soon as is reasonably possible after making the decision.

Contents of notice

(8) The notice mentioned in clause (7) (b) shall include a statement of the Minister's reasons for making the decision and all other information that the Minister considers appropriate.

Publication of notice

(9) The Minister shall publish the notice mentioned in clause (7) (b) in The Ontario Gazette and give the notice by all other means that the Minister considers appropriate.

Temporary regulation

(10) If the Minister decides that subsections (1) to (5) should not apply to the power of the Lieutenant Governor in Council to make a regulation under section 73 because the Minister is of the opinion that the urgency of the situation requires it, the regulation shall,

(a) be identified as a temporary regulation in the text of the regulation; and

(b) unless it is revoked before its expiry, expire at a time specified in the regulation, which shall not be after the second anniversary of the day on which the regulation comes into force.

No review

(11) Subject to subsection (12), neither a court, nor the Commissioner shall review any action, decision, failure to take action or failure to make a decision by the Lieutenant Governor in Council or the Minister under this section.

Exception

(12) Any person resident in Ontario may make an application for judicial review under the Judicial Review Procedure Act on the grounds that the Minister has not taken a step required by this section.

Time for application

(13) No person shall make an application under subsection (12) with respect to a regulation later than 21 days after the day on which,

(a) the Minister publishes a notice with respect to the regulation under clause (1) (a) or subsection (9), where applicable; or

(b) the regulation is filed, if it is a regulation described in subsection (10).

Review of Act

75. A committee of the Legislative Assembly shall,

(a) begin a comprehensive review of this Act not later than the third anniversary of the day on which this section comes into force; and

(b) within one year after beginning that review, make recommendations to the Assembly concerning amendments to this Act.

PART VIII
COMPLEMENTARY AMENDMENTS

Ambulance Act

Ambulance Act

76. (1) Subsection 1 (1) of the Ambulance Act, as amended by the Statutes of Ontario, 1996, chapter 32, section 59, 1997, chapter 30, Schedule A, section 2, 1998, chapter 18, Schedule G, section 45, 1998, chapter 34, section 1, 1999, chapter 9, section 1, 1999, chapter 12, Schedule J, section 1 and 2002, chapter 17, Schedule F, Table, is amended by adding the following definitions:

"base hospital" means a hospital designated by the Minister under clause 4 (2) (d); ("hôpital principal")

"base hospital program" means a program operated by a base hospital for the purpose of,

(a) delegating controlled acts to paramedics,

(b) providing medical advice relating to pre-hospital patient care and transportation of patients to ambulance and communication services and to emergency medical attendants, paramedics and other employees of the services,

(c) providing quality assurance information and advice relating to pre-hospital patient care to ambulance services and to emergency medical attendants and paramedics, and

(d) providing the continuing medical education required to maintain the delegation of controlled acts to paramedics; ("programme de l'hôpital principal")

"medical director" means a physician designated by a base hospital as the medical director of a base hospital program; ("directeur médical")

(2) Subsection 18 (3) of the Act is repealed.

(3) The Act is amended by adding the following section:

Disclosure of personal health information

19. (1) In this section,

"operator" means the operator of an ambulance service or communication service, unless the context requires otherwise; ("exploitant")

"personal health information" has the same meaning as in the Personal Health Information Protection Act, 2004. ("renseignements personnels sur la santé")

Disclosure without consent

(2) The persons named in the following paragraphs may disclose to each other personal health information about an individual without the individual's consent where the disclosure is reasonably necessary for purposes relating to the discharge or exercise by the recipient of the information of their duties or powers under this Act or the regulations:

1. The Minister and an operator.

2. The Minister and a medical director.

3. The Minister and one of an upper-tier municipality and a delivery agent.

4. An operator and one of an upper-tier municipality, a local municipality and a delivery agent.

5. An operator and a medical director.

6. A medical director and one of an upper-tier municipality and a delivery agent.

Purposes

(3) The purposes mentioned in subsection (2) are purposes relating to the provision, administration, management, operation, use, inspection, investigation or regulation of ambulance services or to the enforcement of this Act or the regulations.

Charitable Institutions Act

Charitable Institutions Act

77. (1) Subparagraph 6 iv of subsection 3.1 (2) of the Charitable Institutions Act, as enacted by the Statutes of Ontario, 1993, chapter 2, section 2, is repealed and the following substituted:

iv. to have his or her records of personal health information within the meaning of the Personal Health Information Protection Act, 2004 kept confidential in accordance with the law.

(2) The definition of "record" in subsection 10.1 (1) of the Act, as enacted by the Statutes of Ontario, 1993, chapter 2, section 8, is amended by striking out "medical record, drug record" and substituting "record of personal health information within the meaning of the Personal Health Information Protection Act, 2004".

(3) Section 12 of the Act, as amended by the Statutes of Ontario, 1993, chapter 2, section 10, 1994, chapter 26, section 70, 1996, chapter 2, section 61 and 1997, chapter 15, section 3, is amended by adding the following subsections:

Exception

(4) A regulation made under clause (1) (z.6) shall not apply to a record of personal health information within the meaning of the Personal Health Information Protection Act, 2004.

Same

(5) Despite subsection (4), a regulation made under clause (1) (z.6) that relates to the security, retention or disposal of a record of personal health information within the meaning of the Personal Health Information Protection Act, 2004 applies to the extent that the regulation is consistent with that Act and the regulations made under it.

Child and Family
Services Act

Child and Family Services Act

78. (1) Section 54 of the Child and Family Services Act, as amended by the Statutes of Ontario, 1999, chapter 2, section 14, is amended by adding the following subsection:

Conflict

(5.1) Subsections (4) and (5) prevail despite anything in the Personal Health Information Protection Act, 2004.

(2) Section 72 of the Act, as amended by the Statutes of Ontario, 1999, chapter 2, section 22, is amended by adding the following subsection:

Conflict

(9) This section prevails despite anything in the Personal Health Information Protection Act, 2004.

(3) Subsection 74 (1) of the Act, as re-enacted by the Statutes of Ontario, 1999, chapter 2, section 24, is amended by adding the following definition:

"record of personal health information" has the same meaning as in the Mental Health Act. ("dossier de renseignements personnels sur la santé")

(4) Section 74 of the Act, as amended by the Statutes of Ontario, 1999, chapter 2, section 24, is amended by adding the following subsection:

Conflict

(5.1) Subsection (5) prevails despite anything in the Personal Health Information Protection Act, 2004.

(5) Subsection 74 (7) of the Act, as re-enacted by the Statutes of Ontario, 1999, chapter 2, section 24, is amended by striking out the portion before clause (a) and substituting the following:

Matters to be considered by court

(7) Where a motion or an application under subsection (2) concerns a record of personal health information, subsection 35 (6) (attending physician's statement, hearing) of the Mental Health Act applies and the court shall give equal consideration to,

. . . . .

(6) Subsection 74.1 (8) of the Act, as enacted by the Statutes of Ontario, 1999, chapter 2, section 25, is amended by striking out the portion before clause (a) and substituting the following:

Matters to be considered

(8) If a warrant issued under this section concerns a record of personal health information and the warrant is challenged under subsection 35 (6) (attending physician's statement, hearing) of the Mental Health Act, equal consideration shall be given to,

. . . . .

(7) Clause 179 (2) (f) of the Act is repealed and the following substituted:

(f) that is a record of personal health information within the meaning of "record of personal health information" in the Mental Health Act;

(8) Section 183 of the Act is amended by adding the following subsection:

Conflict

(6.1) Subsections (2) to (6) prevail despite anything in the Personal Health Information Protection Act, 2004.

Commitment to the
Future of Medicare Act, 2004

Commitment to the Future of Medicare Act, 2004

79. (1) This section applies only if Bill 8 ( An Act to establish the Ontario Health Quality Council, to enact new legislation concerning health service accessibility and repeal the Health Care Accessibility Act, to provide for accountability in the health service sector, and to amend the Health Insurance Act ) receives Royal Assent.

(2) References in this section to provisions of Bill 8 are references to those provisions as they were numbered in the first reading version of the Bill.

(3) On the later of November 1, 2004 and the day on which subsection 14 (6) of Bill 8 comes into force, subsection 14 (6) of the Commitment to the Future of Medicare Act, 2004 is repealed.

(4) On the later of November 1, 2004 and the day on which subsection 15 (3) of Bill 8 comes into force, subsection 15 (3) of the Act is repealed.

Drug and Pharmacies
Regulation Act

Drug and Pharmacies Regulation Act

80. Section 157 of the Drug and Pharmacies Regulation Act is amended by adding the following subsection:

Conflict

(1.1) Subsection (1) prevails despite anything in the Personal Health Information Protection Act, 2004.

Freedom of Information and
Protection of Privacy Act

Freedom of Information and Protection of Privacy Act

81. (1) Subsection 4 (4) of the Freedom of Information and Protection of Privacy Act is repealed and the following substituted:

Assistant Commissioners

(4) From the officers of the Commissioner's staff, the Commissioner shall appoint one or two Assistant Commissioners and may appoint an Assistant Commissioner for Personal Health Information.

(2) Clause 33 (2) (c) of the Act is repealed and the following substituted:

(c) a reference to the provision of this Act or the Personal Health Information Protection Act, 2004 on which the head relies.

(3) Subsection 34 (2) of the Act is repealed and the following substituted:

Contents of report

(2) A report made under subsection (1) shall specify,

(a) the number of requests under this Act or the Personal Health Information Protection Act, 2004 for access to records made to the institution;

(b) the number of refusals by the head to disclose a record, the provisions of this Act or the Personal Health Information Protection Act, 2004 under which disclosure was refused and the number of occasions on which each provision was invoked;

(c) the number of uses or purposes for which personal information is disclosed where the use or purpose is not included in the statements of uses and purposes set forth under clauses 45 (d) and (e) or the written public statement provided under subsection 16 (1) of the Personal Health Information Protection Act, 2004;

(d) the amount of fees collected by the institution under section 57 or under subsection 54 (10) of the Personal Health Information Protection Act, 2004; and

(e) any other information indicating an effort by the institution to put into practice the purposes of this Act or the Personal Health Information Protection Act, 2004.

(4) Subsection 58 (1) of the Act is repealed and the following substituted:

Annual report of Commissioner

(1) The Commissioner shall make an annual report to the Speaker of the Assembly in accordance with subsections (2) and (3).

(5) Section 58 of the Act is amended by adding the following subsections:

Same, personal health information

(3) If the Commissioner has delegated powers or duties under the Personal Health Information Protection Act, 2004 to the Assistant Commissioner for Personal Health Information, a report made under subsection (1) shall include a report prepared in consultation with the Assistant Commissioner on the exercise of the Commissioner's powers and duties under that Act, including,

(a) information related to the number and nature of complaints received by the Commissioner under section 56 of that Act and the disposition of them;

(b) information related to the number and nature of reviews conducted by the Commissioner under section 58 of that Act and the disposition of them;

(c) information related to the number of times the Commissioner has made a determination under subsection 60 (13) of that Act and general information about the Commissioner's grounds for the determination;

(d) all other information prescribed by the regulations made under that Act; and

(e) all other matters that the Commissioner considers appropriate.

Tabling

(4) The Speaker shall cause the annual report to be laid before the Assembly if it is in session or shall deposit the report with the Clerk of the Assembly if the Assembly is not in session.

(6) Subsection 65 (1) of the Act is amended by adding "or a health information custodian as defined in the Personal Health Information Protection Act, 2004" at the end.

(7) Subsection 65 (2) of the Act is repealed.

Health Cards and Numbers
Control Act, 1991

Health Cards and Numbers Control Act, 1991

82. The Health Cards and Numbers Control Act, 1991, as amended by the Statutes of Ontario, 2002, chapter 18, Schedule I, section 5, is repealed.

Health Care Accessibility Act

Health Care Accessibility Act

83. (1) This section applies only if, by November 1, 2004,

(a) Bill 8 ( An Act to establish the Ontario Health Quality Council, to enact new legislation concerning health service accessibility and repeal the Health Care Accessibility Act, to provide for accountability in the health service sector, and to amend the Health Insurance Act ) has not received Royal Assent; and

(b) section 41 of Bill 8, as numbered in the first reading version of the Bill, has not come into force.

(2) Clause 6.1 (4) (b) of the Health Care Accessibility Act, as enacted by the Statutes of Ontario, 1996, chapter 1, Schedule H, section 37, is amended by adding at the end "or the Personal Health Information Protection Act, 2004".

Health Care
Consent Act, 1996

Health Care Consent Act, 1996

84. (1) Subsection 20 (7) of the Health Care Consent Act, 1996 is amended by striking out "they are of opposite sex and" in the portion before clause (a).

(2) The English version of clause 20 (7) (a) of the Act is amended by striking out "are married" at the beginning and substituting "they are married".

(3) The English version of clause 20 (7) (b) of the Act is amended by striking out "are living" at the beginning and substituting "they are living".

(4) Subsection 20 (8) of the Act is repealed and the following substituted:

Not spouse

(8) Two persons are not spouses for the purpose of this section if they are living separate and apart as a result of a breakdown of their relationship.

(5) Clause (a) of the definition of "partner" in subsection 20 (9) of the Act, as enacted by the Statutes of Ontario, 2002, chapter 18, Schedule A, section 10, is repealed.

(6) The French version of clause (b) of the definition of "partner" in subsection 20 (9) of the Act, as enacted by the Statutes of Ontario, 2002, chapter 18, Schedule A, section 10, is amended by striking out "soit".

(7) Section 22 of the Act is amended by adding the following subsection:

Conflict

(2) Subsection (1) prevails despite anything to the contrary in the Personal Health Information Protection Act, 2004.

(8) Section 43 of the Act is amended by adding the following subsection:

Conflict

(2) Subsection (1) prevails despite anything to the contrary in the Personal Health Information Protection Act, 2004.

(9) Subsection 44 (2) of the Act is repealed and the following substituted:

Collection and disclosure of information

(2) A decision concerning the collection and disclosure of information relating to the incapable person is a decision that is necessary and ancillary to the admission, if the information is required for the purpose of the admission and is not personal health information within the meaning of the Personal Health Information Protection Act, 2004.

(10) Section 60 of the Act is amended by adding the following subsection:

Conflict

(2) Subsection (1) prevails despite anything to the contrary in the Personal Health Information Protection Act, 2004.

(11) Subsection 76 (2) of the Act is repealed and the following substituted:

Health record

(2) The party who is the subject of the treatment, the admission or the personal assistance service, as the case may be, and his or her counsel or agent are entitled to examine and to copy, at their own expense, any medical or other health record prepared in respect of the party, subject to subsections 35 (6) and (7) of the Mental Health Act (withholding record of personal health information), subsections 33 (2), (3) and (4) of the Long-Term Care Act, 1994 (withholding record of personal health information) and subsections 183 (2) to (6) of the Child and Family Services Act (withholding record of mental disorder).

Health Insurance Act

Health Insurance Act

85. (1) Clause 4.1 (4) (b) of the Health Insurance Act, as enacted by the Statutes of Ontario, 1996, chapter 1, Schedule H, section 3, is repealed and the following substituted:

(b) disclosure of the names or other identifying information is otherwise authorized under the Freedom of Information and Protection of Privacy Act or the Personal Health Information Protection Act, 2004.

(2) Section 29 of the Act, as re-enacted by the Statutes of Ontario, 1996, chapter 1, Schedule H, section 22, is amended by adding the following subsection:

Exception

(3) This section does not apply where the Personal Health Information Protection Act, 2004 applies.

Health Protection and
Promotion Act

Health Protection and Promotion Act

86. Subsection 11 (2) of the Health Protection and Promotion Act is repealed and the following substituted:

Report

(2) The medical officer of health shall report the results of the investigation to the complainant, but shall not include in the report personal health information within the meaning of the Personal Health Information Protection Act, 2004 in respect of a person other than the complainant, unless consent to the disclosure is obtained in accordance with that Act.

Conflict

(3) The obligation imposed on the medical officer of health under subsection (2) prevails despite anything to the contrary in the Personal Health Information Protection Act, 2004.

Homes for the Aged and
Rest Homes Act

Homes for the Aged and Rest Homes Act

87. (1) Subparagraph 6 iv of subsection 1.1 (2) of the Homes for the Aged and Rest Homes Act, as enacted by the Statutes of Ontario, 1993, chapter 2, section 14, is repealed and the following substituted:

iv. to have his or her records of personal health information within the meaning of the Personal Health Information Protection Act, 2004 kept confidential in accordance with the law.

(2) The definition of "record" in subsection 21 (1) of the Act, as enacted by the Statutes of Ontario, 1993, chapter 2, section 17, is amended by striking out "medical record, drug record" and substituting "record of personal health information within the meaning of the Personal Health Information Protection Act, 2004".

Independent Health
Facilities Act

Independent Health Facilities Act

88. Clause 37.1 (7) (b) of the Independent Health Facilities Act, as enacted by the Statutes of Ontario, 1996, chapter 1, Schedule F, section 34, is repealed and the following substituted:

Long-Term Care Act, 1994

Long-Term Care Act, 1994

89. (1) The definition of "personal record" in subsection 2 (1) of the Long-Term Care Act, 1994 is repealed.

(2) Subsection 2 (1) of the Act, as amended by the Statutes of Ontario, 1996, chapter 2, section 71, 1998, chapter 18, Schedule G, section 65 and 2002, chapter 17, Schedule F, Table, is amended by adding the following definition:

"personal health information" has the same meaning as in the Personal Health Information Protection Act, 2004; ("renseignements personnels sur la santé")

(3) The definition of "substitute decision-maker" in subsection 2 (1) of the Act, as enacted by the Statutes of Ontario, 1996, chapter 2, section 71, is amended by repealing clause (a) and substituting the following:

(a) any person who is a substitute decision-maker within the meaning of the Personal Health Information Protection Act, 2004, or

(4) Subsection 2 (2) of the Act is repealed.

(5) Clauses 25 (2) (c) and (d) of the Act are repealed and the following substituted:

(c) shall state that a request for access to a record of personal health information may be made by a person entitled to the access under the Personal Health Information Protection Act, 2004, and shall specify the person to whom the request must be made;

(6) Section 32 of the Act, as amended by the Statutes of Ontario, 1996, chapter 2, section 71, is repealed and the following substituted:

Permitted disclosure of personal health information

32. A service provider may disclose a record of personal health information to the Minister if the disclosure is for the purpose of enabling the Minister to exercise a power under section 64.

(7) Subsection 33 (1) of the Act is amended by striking out "personal record" and substituting "record of personal health information".

(8) Subsection 33 (2) of the Act is amended by striking out "personal record or a part of the personal record" and substituting "record of personal health information or a part of the record".

(9) Subsection 33 (3) of the Act is amended by,

(a) striking out "examine the personal record" and substituting "examine the record of personal health information"; and

(b) striking out "disclose the personal record" and substituting "disclose the record".

(10) Subsection 33 (5) of the Act is amended by striking out "personal record" and substituting "record of personal health information".

(11) Section 34 of the Act is repealed and the following substituted:

Disclosure to Appeal Board

34. In a proceeding before the Appeal Board under this Act in respect of a person, a service provider who has the custody or the control of a record of personal health information respecting the person shall disclose it to the Appeal Board at the request of any party to the proceeding.

(12) Subsection 35 (3) of the Act is repealed and the following substituted:

Non-application

(3) This section does not apply to a proceeding before the Appeal Board under this Act.

(13) The Act is amended by adding the following section:

Conflict

35.1 Sections 33, 34 and 35 prevail despite anything to the contrary in the Personal Health Information Protection Act, 2004.

(14) Section 36 of the Act, as amended by the Statutes of Ontario, 1996, chapter 2, section 71, is repealed and the following substituted:

Access to records

36. (1) Despite subsection 89 (14) of Schedule A to the Health Information Protection Act, 2004, this section, as it read immediately before that subsection came into force, continues to apply to a request for access that a person made under this section before that subsection came into force.

Explanation of plan of service

(2) If a person who makes a request to an approved agency for access to his or her plan of service also requests that the approved agency provide an explanation of the plan of service, the approved agency shall provide the explanation when it gives the person access to the plan of service.

(15) Section 37 of the Act is repealed.

(16) The definition of "record" in subsection 62 (1) of the Act is amended by striking out "medical record, drug record" and substituting "record of personal health information".

(17) Subsection 64 (1) of the Act is amended by striking out the portion before paragraph 1 and substituting the following:

Collection of personal information

(1) The Minister may collect, directly or indirectly, personal information for the following purposes:

. . . . .

(18) Section 65 of the Act is repealed.

(19) Clause 66 (1) (b) of the Act is amended by striking out "37".

(20) Paragraph 42 of subsection 68 (1) of the Act is repealed and the following substituted:

42. relating to the security, retention or disposal of a record of personal health information within the meaning of the Personal Health Information Protection Act, 2004, but only to the extent that a regulation made under this paragraph is consistent with that Act and the regulations made under it;

(21) Paragraph 42.1 of subsection 68 (1) of the Act, as enacted by the Statutes of Ontario, 1996, chapter 2, section 71, is repealed.

Mental Health Act

Mental Health Act

90. (1) The definition of "mentally competent" in subsection 1 (1) of the Mental Health Act is repealed.

(2) Subsection 1 (1) of the Act, as amended by the Statutes of Ontario, 1992, chapter 32, section 20, 1996, chapter 2, section 72 and 2000, chapter 9, section 1, is amended by adding the following definitions:

"personal health information" has the same meaning as in the Personal Health Information Protection Act, 2004; ("renseignements personnels sur la santé")

"record of personal health information", in relation to a person, means a record of personal health information that is compiled in a psychiatric facility in respect of the person; ("dossier de renseignements personnels sur la santé")

(3) The definition of "substitute decision-maker" in subsection 1 (1) of the Act, as enacted by the Statutes of Ontario, 1996, chapter 2, section 72, is repealed and the following substituted:

"substitute decision-maker", in relation to a patient, means the person who would be authorized under the Health Care Consent Act, 1996 to give or refuse consent to a treatment on behalf of the patient, if the patient were incapable with respect to the treatment under that Act, unless the context requires otherwise; ("mandataire spécial")

(4) Section 29 of the Act, as amended by the Statutes of Ontario, 2000, chapter 9, section 11, is amended by adding the following subsection:

Transfer of records from one facility to another

(1.1) The officer in charge of the psychiatric facility from which the patient is transferred may transfer the patient's record of personal health information to the officer in charge of the psychiatric facility to which the patient is transferred.

(5) The Act is amended by adding the following section:

Conflict

34.1 Where there is a conflict between the Personal Health Information Protection Act, 2004 and section 35 or 35.1 of this Act or any provision of this Act relating to the issuance or renewal of a community treatment order or the treatment, care or supervision of a person in accordance with a community treatment plan, the provisions of this Act apply.

(6) The following provisions of the Act are repealed:

1. Subsection 35 (1), as amended by the Statutes of Ontario, 1996, chapter 2, section 72.

2. Subsection 35 (2), as amended by the Statutes of Ontario, 1992, chapter 32, section 20.

3. Subsection 35 (3), as amended by the Statutes of Ontario, 1992, chapter 32, section 20, 1996, chapter 2, section 72 and 2000, chapter 9, section 16.

4. Subsection 35 (4).

(7) Section 35 of the Act, as amended by the Statutes of Ontario, 1992, chapter 32, section 20, 1996, chapter 2, section 72 and 2000, chapter 9, section 16, is amended by adding the following subsections:

Personal health information

(1) In this section,

"patient" includes former patient, out-patient, former out-patient and anyone who is or has been detained in a psychiatric facility.

Disclosure, etc., for purpose of detention or order

(2) The officer in charge of a psychiatric facility may collect, use and disclose personal health information about a patient, with or without the patient's consent, for the purposes of,

(a) examining, assessing, observing or detaining the patient in accordance with this Act; or

(b) complying with Part XX.1 (Mental Disorder) of the Criminal Code (Canada) or an order or disposition made pursuant to that Part.

Disclosure to Board

(3) In a proceeding before the Board under this or any other Act in respect of a patient, the officer in charge shall, at the request of any party to the proceeding, disclose to the Board the patient's record of personal health information.

Disclosure of record

(4) The officer in charge may disclose or transmit a person's record of personal health information to or permit the examination of the record by,

(a) a physician who is considering issuing or renewing, or who has issued or renewed, a community treatment order under section 33.1;

(b) a physician appointed under subsection 33.5 (2);

(c) another person named in the person's community treatment plan as being involved in the person's treatment or care and supervision upon the written request of the physician or other named person; or

(d) a prescribed person who is providing advocacy services to patients in the prescribed circumstances.

(8) The following provisions of the Act are amended by striking out "clinical record" wherever it appears and substituting in each case "record of personal health information":

1. Subsection 35 (5).

2. Subsection 35 (6).

3. Subsection 35 (7).

(9) Subsection 35 (8.1) of the Act, as enacted by Statutes of Ontario, 1992, chapter 32, section 20, is repealed.

(10) Subsection 35 (9) of the Act, as re-enacted by the Statutes of Ontario, 1992, chapter 32, section 20 and amended by 1996, chapter 2, section 72, is repealed and the following substituted:

Disclosure in proceeding

(9) No person shall disclose in a proceeding in any court or before any body any information in respect of a patient obtained in the course of assessing or treating the patient, or in the course of assisting in his or her assessment or treatment, or in the course of employment in the psychiatric facility, except,

(a) where the patient is mentally capable within the meaning of the Personal Health Information Protection Act, 2004, with the patient's consent;

(b) where the patient is not mentally capable, with the consent of the patient's substitute decision-maker within the meaning of the Personal Health Information Protection Act, 2004; or

(c) where the court or, in the case of a proceeding not before a court, the Divisional Court determines, after a hearing from which the public is excluded and that is held on notice to the patient or, if the patient is not mentally capable, the patient's substitute decision-maker referred to in clause (b), that the disclosure is essential in the interests of justice.

(11) Subsection 35 (12) of the Act, as enacted by Statutes of Ontario, 1996, chapter 2, section 72, is repealed.

(12) Section 36 of the Act, as amended by the Statutes of Ontario, 1992, chapter 32, section 20, 1996, chapter 2, section 72 and 2000, chapter 9, section 18, is repealed and the following substituted:

Patient access to clinical record

36. Despite subsection 90 (12) of Schedule A to the Health Information Protection Act, 2004, this section, as it read immediately before that subsection came into force, continues to apply to a request for access that a patient made under this section before that subsection came into force.

(13) Section 36.1 of the Act, as enacted by the Statutes of Ontario, 1992, chapter 32, section 20 and amended by 1996, chapter 2, section 72 and 2000, chapter 9, section 19, is repealed.

(14) Section 36.2 of the Act, as enacted by the Statutes of Ontario, 1992, chapter 32, section 20 and amended by 1996, chapter 2, section 72 and 2000, chapter 9, section 20, is repealed.

(15) Section 36.3 of the Act, as enacted by the Statutes of Ontario, 1996, chapter 2, section 72, is repealed.

(16) Subsections 38 (4) and (5) of the Act, as re-enacted by the Statutes of Ontario, 1992, chapter 32, section 20, are repealed.

(17) Subsection 38 (8) of the Act, as enacted by the Statutes of Ontario, 1992, chapter 32, section 20, is amended by striking out "(5)".

(18) Subsection 53 (1) of the Act is amended by striking out "clinical record" and substituting "record of personal health information".

(19) Subsection 54 (3) of the Act, as re-enacted by the Statutes of Ontario, 1992, chapter 32, section 20, is amended by striking out "clinical record" and substituting "record of personal health information".

(20) Subclause 81 (1) (b) (v) of the Act is repealed and the following substituted:

(v) prescribing the forms, records, books, returns and reports to be made and kept in that respect and the period for which the psychiatric facility involved shall retain each, and providing for returns, reports and information to be furnished to the Ministry;

(21) Section 81 of the Act, as amended by the Statutes of Ontario, 1996, chapter 2, section 72, 1997, chapter 15, section 11 and 2000, chapter 9, section 30, is amended by adding the following clauses:

(h.2) requiring that a physician who determines that a patient is incapable of consenting to the collection, use or disclosure of personal health information promptly,

(i) give the patient a written notice that sets out the advice that the regulation specifies with respect to the patient's rights, and

(ii) notify a rights adviser;

(h.3) requiring the rights adviser mentioned in clause (h.2) to give the patient the explanations that the regulation specifies and governing the content of the explanations;

(22) Clause 81 (1) (i) of the Act, as enacted by the Statutes of Ontario, 1996, chapter 2, section 72, is amended by adding at the end "or the regulations".

(23) Clause 81 (1) (j) of the Act, as enacted by the Statutes of Ontario, 1996, chapter 2, section 72, is amended by striking out "who are incapable, within the meaning of the Health Care Consent Act, 1996, with respect to treatment of a mental disorder" in the portion before subclause (i) and substituting "who are either incapable, within the meaning of the Health Care Consent Act, 1996, with respect to treatment of a mental disorder or are incapable, within the meaning of the Personal Health Information Protection Act, 2004, with respect to personal health information".

(24) Clause 81 (1) (k.2) of the Act, as enacted by the Statutes of Ontario, 1996, chapter 2, section 72, is repealed.

(25) Clause 81 (1) (k.3) of the Act, as re-enacted by the Statutes of Ontario, 2000, chapter 9, section 30, is amended by striking out "clinical record under clause 35 (3) (d.1), (e.3), (e.4) or (e.5)" at the end and substituting "record of personal health information under subsection 35 (4)".

(26) Subsection 81 (1) of the Act, as amended by the Statutes of Ontario, 1996, chapter 2, section 72, 1997, chapter 15, section 11 and 2000, chapter 9, section 30, is amended by adding the following clause:

(k.4) prescribing a person and circumstances for the purpose of clause 35 (4) (d);

Municipal Freedom of Information and Protection of Privacy Act

Municipal Freedom of Information and Protection of Privacy Act

91. Subsection 26 (2) of the Municipal Freedom of Information and Protection of Privacy Act is repealed and the following substituted:

Contents of report

(2) A report made under subsection (1) shall specify,

(a) the number of requests under this Act or the Personal Health Information Protection Act, 2004 for access to records made to the institution;

(c) the number of uses or purposes for which personal information is disclosed if the use or purpose is not included in the statements of uses and purposes set forth under clauses 34 (1) (d) and (e) or the written public statement provided under subsection 16 (1) of the Personal Health Information Protection Act, 2004;

(d) the amount of fees collected by the institution under section 45 or under subsection 54 (10) of the Personal Health Information Protection Act, 2004; and

(e) any other information indicating an effort by the institution to put into practice the purposes of this Act or the Personal Health Information Protection Act, 2004.

Nursing Homes Act

Nursing Homes Act

92. (1) Subparagraph 6 iv of subsection 2 (2) of the Nursing Homes Act is repealed and the following substituted:

iv. to have his or her records of personal health information within the meaning of the Personal Health Information Protection Act, 2004 kept confidential in accordance with the law.

(2) The definition of "record" in subsection 24 (1) of the Act, as re-enacted by the Statutes of Ontario, 1993, chapter 2, section 38, is amended by striking out "medical record, drug record" and substituting "record of personal health information within the meaning of the Personal Health Information Protection Act, 2004".

(3) Section 38 of the Act, as amended by the Statutes of Ontario, 1993, chapter 2, section 43, 1994, chapter 26, section 75, 1996, chapter 2, section 74 and 1997, chapter 15, section 13, is amended by adding the following subsections:

Exception

(4) A regulation made under paragraph 18 of subsection (1) shall not apply to a record of personal health information within the meaning of the Personal Health Information Protection Act, 2004.

Same

(5) Despite subsection (4), a regulation made under paragraph 18 of subsection (1) that relates to the security, retention or disposal of a record of personal health information within the meaning of the Personal Health Information Protection Act, 2004 applies to the extent that the regulation is consistent with that Act and the regulations made under it.

Occupational Health and Safety Act

Occupational Health and Safety Act

93. Section 63 of the Occupational Health and Safety Act, as amended by the Statutes of Ontario, 1992, chapter 14, section 2, is amended by adding the following subsection:

Conflict

(6) This section prevails despite anything to the contrary in the Personal Health Information Protection Act, 2004.

Ombudsman Act

Ombudsman Act

94. Section 19 of the Ombudsman Act is amended by adding the following subsection:

Providing personal information despite privacy Acts

(3.1) A person who is subject to the Freedom of Information and Protection of Privacy Act or the Personal Health Information Protection Act, 2004 is not prevented by any provisions in those Acts from providing personal information to the Ombudsman, when the Ombudsman requires the person to provide the information under subsection (1) or (2).

Ontario Drug Benefit Act

Ontario Drug Benefit Act

95. (1) Subsection 5 (5) of the Ontario Drug Benefit Act is repealed.

(2) Clause 13 (7) (b) of the Act, as enacted by the Statutes of Ontario, 1996, chapter 1, Schedule G, section 12, is repealed and the following substituted:

Public Hospitals Act

Public Hospitals Act

96. (1) Section 1 of the Public Hospitals Act, as amended by the Statutes of Ontario, 1996, chapter 1, Schedule F, section 3, 1998, chapter 18, Schedule G, section 70 and 2002, chapter 17, Schedule F, Table, is amended by adding the following definition:

"personal health information" has the same meaning as in the Personal Health Information Protection Act, 2004; ("renseignements personnels sur la santé")

(2) Subsection 14 (1) of the Act is amended by striking out "medical record" and substituting "record of personal health information".

(3) Subsection 14 (2) of the Act, as enacted by the Statutes of Ontario, 1996, chapter 1, Schedule F, section 12, is amended by striking out "medical records" and substituting "records of personal health information".

(4) Subclause 32 (1) (t) (iv) of the Act, as enacted by the Statutes of Ontario, 1996, chapter 1, Schedule F, section 14, is amended by striking out "medical records" and substituting "records of personal health information".

(5) Clause 32 (1) (u) of the Act, as enacted by the Statutes of Ontario, 1996, chapter 1, Schedule F, section 14, is amended by striking out "medical records" and substituting "records of personal health information".

Substitute Decisions Act, 1992

Substitute Decisions Act, 1992

97. (1) Subsection 83 (9) of the Substitute Decisions Act, 1992 is repealed.

(2) Clause 90 (1) (e.4) of the Act, as enacted by the Statutes of Ontario, 1996, chapter 2, section 60, is amended by striking out "subject to the Mental Health Act and the Long-Term Care Act, 1994 but" in the portion before subclause (i).

Trillium Gift of Life Network Act

Trillium Gift of Life Network Act

98. (1) The definition of "personal information" in section 1 of the Trillium Gift of Life Network Act, as enacted by the Statutes of Ontario, 2000, chapter 39, section 2, is repealed and the following substituted:

"personal information" includes personal information as defined in the Freedom of Information and Protection of Privacy Act and personal health information as defined in the Personal Health Information Protection Act, 2004; ("renseignements personnels")

(2) Section 5 of the Act, as amended by the Statutes of Ontario, 1999, chapter 6, section 29, is amended by adding the following subsection:

Consent is full authority, personal information

(4.1) The authority to give consent under this section includes the authority to consent to the collection, use or disclosure of personal information that is necessary for, or ancillary to, a decision about the gift.

(3) Subsection 8.16 (6) of the Act, as enacted by the Statutes of Ontario, 2000, chapter 39, section 5, is amended by adding at the end "or the Personal Health Information Protection Act, 2004".

(4) Subsection 8.18 (13) of the Act, as enacted by the Statutes of Ontario, 2000, chapter 39, section 6, is amended by adding at the end "or the Personal Health Information Protection Act, 2004".

PART IX
COMMENCEMENT AND SHORT TITLE

Commencement

99. (1) Subject to subsection (2), this Schedule comes into force on the day the Health Information Protection Act, 2004 receives Royal Assent.

Same

(2) Sections 1 to 72 and 75 to 98 come into force on November 1, 2004.

Short title

100. The short title of the Act set out in this Schedule is the Personal Health Information Protection Act, 2004.

SCHEDULE B
QUALITY OF CARE INFORMATION
PROTECTION ACT, 2004


CONTENTS
1. 2. 3. 4. 5. 6. 7. 8. 9. 10. 11 12. 13.	Definitions Conflict Disclosure to quality of care committee Quality of care information Non-disclosure in proceeding Non-retaliation Offence Immunity Regulations Public consultation before making regulations Regulated Health Professions Act, 1991 Commencement Short title
______________

Definitions

1. In this Act,

"disclose" means, with respect to quality of care information, to provide or make the information available to a person who is not a member of the quality of care committee with which the information is associated, and "disclosure" has a corresponding meaning; ("divulguer", "divulgation")

"health care" means any observation, examination, assessment, care, service or procedure that is done for a health-related purpose and that,

(a) is carried out or provided to diagnose, treat or maintain an individual's physical or mental condition,

(b) is carried out or provided to prevent disease or injury or to promote health, or

and includes,

(d) the compounding, dispensing or selling of a drug, a device, equipment or any other item to an individual, or for the use of an individual, pursuant to a prescription, and

(e) a prescribed type of service; ("soins de santé")

"health facility" means a hospital within the meaning of the Public Hospitals Act, a private hospital within the meaning of the Private Hospitals Act, a psychiatric facility within the meaning of the Mental Health Act, an institution within the meaning of the Mental Hospitals Act or an independent health facility within the meaning of the Independent Health Facilities Act; ("établissement de santé")

"information" includes personal health information as defined in the Personal Health Information Protection Act, 2004; ("renseignements")

"Minister" means the Minister of Health and Long-Term Care; ("ministre")

"proceeding" includes a proceeding that is within the jurisdiction of the Legislature and that is held in, before or under the rules of a court, a tribunal, a commission, a justice of the peace, a coroner, a committee of a College within the meaning of the Regulated Health Professions Act, 1991, a committee of the Board of Regents continued under the Drugless Practitioners Act, a committee of the Ontario College of Social Workers and Social Service Workers under the Social Work and Social Service Work Act, 1998, an arbitrator or a mediator, but does not include any activities carried on by a quality of care committee; ("instance")

"quality of care committee" means a body of one or more individuals,

(a) that is established, appointed or approved,

(i) by a health facility,

(ii) by an entity that is prescribed by the regulations and that provides health care, or

(iii) by an entity that is prescribed by the regulations and that carries on activities for the purpose of improving or maintaining the quality of care provided by a health facility, a health care provider or a class of health facility or health care provider,

(b) that meets the prescribed criteria, if any, and

(c) whose functions are to carry on activities for the purpose of studying, assessing or evaluating the provision of health care with a view to improving or maintaining the quality of the health care or the level of skill, knowledge and competence of the persons who provide the health care; ("comité de la qualité des soins")

"quality of care information" means information that,

(a) is collected by or prepared for a quality of care committee for the sole or primary purpose of assisting the committee in carrying out its functions, or

(b) relates solely or primarily to any activity that a quality of care committee carries on as part of its functions,

but does not include,

(d) information contained in a record that is required by law to be created or to be maintained,

(e) facts contained in a record of an incident involving the provision of health care to an individual, except if the facts involving the incident are also fully recorded in a record mentioned in clause (c) relating to the individual, or

(f) information that a regulation specifies is not quality of care information and that a quality of care committee receives after the day on which that regulation is made; ("renseignements sur la qualité des soins")

"regulations" mean the regulations made under this Act; ("règlements")

"use", with respect to quality of care information, does not include to disclose the information and "use", as a noun, does not include disclosure of the information; ("utiliser", "utilisation")

"witness" means a person, whether or not a party to a proceeding, who, in the course of the proceeding,

(a) is examined or cross-examined for discovery, either orally or in writing,

(b) makes an affidavit, or

(c) is competent or compellable to be examined or cross-examined or to produce a document, whether under oath or not. ("témoin")

Conflict

2. In the event of a conflict between a provision of this Act or its regulations and a provision of any other Act or its regulations, this Act and its regulations prevail unless this Act or its regulations specifically provide otherwise.

Disclosure to quality of care committee

3. Despite this Act and the Personal Health Information Protection Act, 2004, a person may disclose any information to a quality of care committee for the purposes of the committee.

Quality of care information

4. (1) Despite the Personal Health Information Protection Act, 2004, no person shall disclose quality of care information except as permitted by this Act.

Definition

(2) In subsections (3) and (4),

"management", with respect to a health facility or entity, includes members of the senior management staff, the board of directors, governors or trustees and members of the commission or other governing body or authority of the facility or entity.

Exception, quality of care committee

(3) Despite subsection (1) and the Personal Health Information Protection Act, 2004, a quality of care committee may disclose quality of care information to,

(a) the management of the health facility or entity mentioned in subclause (a) (ii) of the definition of "quality of care committee" in section 1 that established, appointed or approved the committee if the committee considers it appropriate to do so for the purpose of improving or maintaining the quality of health care provided in or by the facility or entity; or

(b) the management of a health facility or health care provider, where an entity mentioned in subclause (a) (iii) of the definition of "quality of care committee" in section 1 carries on activities for the purpose of improving or maintaining the quality of health care provided by the facility, the provider or a class including the facility or the provider, if the committee considers it appropriate to do so for the purpose of improving or maintaining the quality of health care provided in or by the facility, provider or class.

Exception, any person

(4) Despite subsection (1) and the Personal Health Information Protection Act, 2004, a person may disclose quality of care information if the disclosure is necessary for the purposes of eliminating or reducing a significant risk of serious bodily harm to a person or group of persons.

Use of information

(5) A person to whom information is disclosed under subsection (3) or (4) shall not use the information except for the purposes for which the information was disclosed to the person.

Further disclosure of information

(6) A member of the management of a health facility or entity described in subsection (3) to whom quality of care information is disclosed under that subsection may disclose the information to an agent or employee of the facility or entity if the disclosure is necessary for the purposes of improving or maintaining the quality of health care provided in or by the facility or entity.

Same

(7) A person to whom information is disclosed under subsection (3), (4) or (6) shall not disclose the information except if subsection (4) or (6) permits the disclosure.

Non-disclosure in proceeding

5. (1) No person shall ask a witness and no court or other body holding a proceeding shall permit or require a witness in the proceeding to disclose quality of care information.

Non-admissibility of evidence

(2) Quality of care information is not admissible in evidence in a proceeding.

Non-retaliation

6. No one shall dismiss, suspend, demote, discipline, harass or otherwise disadvantage a person by reason that the person has disclosed information to a quality of care committee under section 4.

Offence

7. (1) Every person who contravenes section 4 or 6 is guilty of an offence.

Penalty

(2) A person who is guilty of an offence under subsection (1) is liable, on conviction,

(a) to a fine of not more than $50,000, if the person is an individual; or

(b) to a fine of not more than $250,000, if the person is not an individual.

Officers, etc.

Immunity

8. (1) No action or other proceeding may be instituted against a person who in good faith discloses information to a quality of care committee at the request of the committee or for the purposes of assisting the committee in carrying out its functions.

Same, committee member

(2) No action or other proceeding, including a prosecution for an offence under section 7, may be instituted in respect of,

(a) a member of a committee who, in good faith, discloses quality of care information for a purpose described in subsection 4 (3); or

(b) a person who, in good faith, discloses information for a purpose described in subsection 4 (4), if the disclosure is reasonable in the circumstances.

Same, failure to disclose

(3) No action or other proceeding may be instituted against a member of a committee in respect of the failure of the committee to make a disclosure described in subsection 4 (3) or (4).

Regulations

9. (1) Subject to section 10, the Lieutenant Governor in Council may make regulations,

(a) defining any term used in this Act that is not defined in this Act;

(b) specifying information for the purpose of clause (f) of the definition of "quality of care information" in section 1;

(c) specifying a provision of another Act or its regulations that prevails over this Act or its regulations for the purpose of section 2;

(d) prescribing information for the purpose of clause 10 (2) (e).

Minister's regulations

(2) The Minister may make regulations prescribing anything that the definition of "health care" or "quality of care committee" in section 1 mentions as being prescribed.

Public consultation before making regulations

10. (1) Subject to subsection (7), the Lieutenant Governor in Council shall not make any regulation under section 9 unless,

(b) the notice complies with the requirements of this section;

(c) the time periods specified in the notice, during which members of the public may exercise a right described in clause (2) (b) or (c), have expired; and

Contents of notice

(2) The notice mentioned in clause (1) (a) shall contain,

(a) a description of the proposed regulation and the text of it;

(d) a statement of where and when members of the public may review written information about the proposed regulation;

(e) all prescribed information; and

(f) all other information that the Minister considers appropriate.

Time period for comments

Shorter time period for comments

(4) The Minister may shorten the time period if, in the Minister's opinion,

(a) the urgency of the situation requires it;

(b) the proposed regulation clarifies the intent or operation of this Act or the regulations; or

Discretion to make regulations

No public consultation

(6) The Minister may decide that subsections (1) to (5) should not apply to the power of the Lieutenant Governor in Council to make a regulation under section 9 if, in the Minister's opinion,

(a) the urgency of the situation requires it;

(b) the proposed regulation clarifies the intent or operation of this Act or the regulations; or

Same

(7) If the Minister decides that subsections (1) to (5) should not apply to the power of the Lieutenant Governor in Council to make a regulation under section 9,

(a) those subsections do not apply to the power of the Lieutenant Governor in Council to make the regulation; and

(b) the Minister shall give notice of the decision to the public as soon as is reasonably possible after making the decision.

Contents of notice

(8) The notice mentioned in clause (7) (b) shall include a statement of the Minister's reasons for making the decision and all other information that the Minister considers appropriate.

Publication of notice

(9) The Minister shall publish the notice mentioned in clause (7) (b) in The Ontario Gazette and give the notice by all other means that the Minister considers appropriate.

Temporary regulation

(10) If the Minister decides that subsections (1) to (5) should not apply to the power of the Lieutenant Governor in Council to make a regulation under section 9 because the Minister is of the opinion that the urgency of the situation requires it, the regulation shall,

(a) be identified as a temporary regulation in the text of the regulation; and

(b) unless it is revoked before its expiry, expire at a time specified in the regulation, which shall not be after the second anniversary of the day on which the regulation comes into force.

No review

(11) Subject to subsection (12), a court shall not review any action, decision, failure to take action or failure to make a decision by the Lieutenant Governor in Council or the Minister under this section.

Exception

Time for application

(13) No person shall make an application under subsection (12) with respect to a regulation later than 21 days after the day on which,

(a) the Minister publishes a notice with respect to the regulation under clause (1) (a) or subsection (9), where applicable; or

(b) the regulation is filed, if it is a regulation described in subsection (10).

Regulated Health Professions Act, 1991

11. (1) Subsection 83 (5) of Schedule 2 to the Regulated Health Professions Act, 1991, as enacted by the Statutes of Ontario, 1998, chapter 18, Schedule G, section 19, is repealed.

(2) Schedule 2 to the Act is amended by adding the following section:

Quality assurance and other information

83.1 (1) In this section,

"disclose" means, with respect to quality assurance information, to provide or make the information available to a person who is not,

(a) a member of the Quality Assurance Committee,

(b) an assessor appointed by the Committee, a person engaged on its behalf such as a mentor or a person conducting an assessment program on its behalf, or

and "disclosure" has a corresponding meaning; ("divulguer", "divulgation")

"proceeding" includes a proceeding that is within the jurisdiction of the Legislature and that is held in, before or under the rules of a court, a tribunal, a commission, a justice of the peace, a coroner, a committee of a College under the Regulated Health Professions Act, 1991, a committee of the Board under the Drugless Practitioners Act, a committee of the College under the Social Work and Social Service Work Act, 1998, an arbitrator or a mediator, but does not include any activities carried on by the Quality Assurance Committee; ("instance")

"quality assurance information" means information that,

(a) is collected by or prepared for the Quality Assurance Committee for the sole or primary purpose of assisting the Committee in carrying out its functions,

(b) relates solely or primarily to any activity that the Quality Assurance Committee carries on as part of its functions,

(c) is prepared by a member or on behalf of a member solely or primarily for the purpose of complying with the requirements of the prescribed quality assurance program, or

(d) is provided to the Quality Assurance Committee under subsection (3),

but does not include,

(e) the name of a member and allegations that the member may have committed an act of professional misconduct, or may be incompetent or incapacitated,

(f) information that was referred to the Quality Assurance Committee from another committee of the College or the Board, or

(g) information that a regulation made under this Code specifies is not quality assurance information and that the Quality Assurance Committee receives after the day on which that regulation is made; ("renseignements sur l'assurance de la qualité")

"witness" means a person, whether or not a party to a proceeding, who, in the course of the proceeding,

(a) is examined or cross-examined for discovery, either orally or in writing,

(b) makes an affidavit, or

(c) is competent or compellable to be examined or cross-examined or to produce a document, whether under oath or not. ("témoin")

Conflict

(2) In the event of a conflict between this section and a provision under any other Act, this section prevails unless it specifically provides otherwise.

Disclosure to Quality Assurance Committee

(3) Despite the Personal Health Information Protection Act, 2004, a person may disclose any information to the Quality Assurance Committee for the purposes of the committee.

Quality assurance information

(4) Despite the Personal Health Information Protection Act, 2004, no person shall disclose quality assurance information except as permitted by the Regulated Health Professions Act, 1991, including this Code or an Act named in Schedule 1 to that Act or regulations or by-laws made under the Regulated Health Professions Act, 1991 or under an Act named in Schedule 1 to that Act.

Non-disclosure in proceeding

(5) No person shall ask a witness and no court or other body conducting a proceeding shall permit or require a witness in the proceeding to disclose quality assurance information except as permitted or required by the provisions relating to the quality assurance program.

Non-admissibility of evidence

(6) Quality assurance information is not admissible in evidence in a proceeding.

Non-retaliation

(7) No one shall dismiss, suspend, demote, discipline, harass or otherwise disadvantage a person by reason that the person has disclosed information to the Quality Assurance Committee under subsection (3), but a person may be disciplined for disclosing false information to the Committee.

Immunity

(8) No action or other proceeding may be instituted against a person who in good faith discloses information to a Quality Assurance Committee at the request of the Committee or for the purposes of assisting the Committee in carrying out its functions.

(3) Subsection 95 (1) of Schedule 2 to the Act, as re-enacted by the Statutes of Ontario, 1998, chapter 18, Schedule G, section 23, is amended by adding the following clause:

(r.1) specifying information for the purposes of clause (g) of the definition of "quality assurance information" in subsection 83.1 (1);

Commencement

12. (1) Subject to subsection (2), this Schedule comes into force on the day the Health Information Protection Act, 2004 receives Royal Assent.

Same

(2) Sections 1 to 8 and subsections 11 (1) and (2) come into force on November 1, 2004.

Short title

13. The short title of the Act set out in this Schedule is the Quality of Care Information Protection Act, 2004.

EXPLANATORY NOTE

This Explanatory Note was written as a reader's aid to Bill 31 and does not form part of the law. Bill 31 has been enacted as Chapter 3 of the Statutes of Ontario, 2004.

The Bill enacts two new Acts with respect to the protection of health information and makes complementary amendments to other Acts.

SCHEDULE A
PERSONAL HEALTH INFORMATION PROTECTION ACT, 2004

The Schedule enacts the Personal Health Information Protection Act, 2004 which establishes rules concerning the collection, use and disclosure of personal health information by health information custodians and other persons.

Part I sets out the purposes of the Act and provides definitions and rules concerning the application of the Act.

Personal health information is defined as certain information about an individual, whether living or deceased and whether in oral or recorded form. It is information that can identify an individual and that relates to matters such as the individual's physical or mental health, the providing of health care to the individual, payments or eligibility for health care in respect of the individual, the donation by the individual of a body part or bodily substance and the individual's health number.

Health information custodians are defined as listed persons or organizations such as a health care practitioner or a person who operates a group practice of health care practitioners, the operator of a hospital, nursing home, pharmacy or ambulance service or the Minister of Health and Long-Term Care, who have custody or control of personal health information as a result of the work that they do or in connection with the powers or duties they perform. The regulations made under the Act may specify other custodians.

The Act sets out specific circumstances where it does not apply. For example, it does not apply to recorded information about an individual if the record was created more than 120 years ago or if 50 years or more have passed since the death of the individual.

Subject to few exceptions, if there is a conflict between a confidentiality provision in the Act and one in another Act, the Act prevails unless the Act or the other Act specifically provides otherwise. There is no conflict unless it is not possible to comply with both the Act and its regulations and any other Act or its regulations.

Part II sets out duties of health information custodians with respect to personal health information. A health information custodian is responsible for the personal health information in the custody of the custodian and may permit the custodian's agents to collect, use, disclose, retain or dispose of personal health information on the custodian's behalf if certain requirements are met. In addition, the agent may handle personal health information as permitted or required by law or in the prescribed circumstances. A custodian must have in place information practices with respect to its collection, use and disclosure of personal health information and the administrative, technical and physical safeguards that it maintains with respect to the information. It must also take reasonable steps to ensure that records that it makes of personal health information are accurate and that the information is protected against theft, loss and unauthorized use or disclosure. A custodian must notify an individual if information about the individual is stolen, lost, or accessed by unauthorized persons. The regulations made under the Act can provide for the handling of records of personal health information.

A health information custodian must make available to the public a statement that describes its information practices, how to contact its contact person, how an individual can obtain access to or request correction of a record of personal health information about the individual and how to make a complaint to the custodian and the Commissioner under the Act. A custodian must notify individuals of its uses and disclosures of personal health information that fall outside the scope of the custodian's description of its information practices.

Part III sets out rules concerning consent to the collection, use or disclosure of personal health information. Consent must either be given by the individual or be implied, except that some consents cannot be implied. An example is the consent to the disclosure of personal health information by a health information custodian to a person who is not a health information custodian, other than disclosure of an individual's name and location to a representative of a religious or other organization where the individual provided the information about his or her religious or other affiliation to the health information custodian. An individual may withdraw a consent that the individual has given, but the withdrawal does not have retroactive effect. If an individual gives conditional consent to the collection, use or disclosure of personal health information, the condition is not effective if it restricts the recording of personal health information by a health information custodian that is required by law or by established professional or institutional practice.

An individual is capable of consenting to the collection, use or disclosure of personal health information if the individual is able to understand the information that is relevant to deciding whether to consent to the collection, use or disclosure, as the case may be, and to appreciate the reasonably foreseeable consequences of giving, not giving or withholding the consent. A person whom an individual has authorized to act on his or her behalf may give consent for the individual. If an individual is incapable of giving consent, a substitute decision-maker may give consent. The list of substitute decision-makers for an incapable individual is ranked according to priority.

Part IV. No health information custodian is permitted to collect, use or disclose personal health information about an individual without the individual's consent unless it is permitted or required by the Act. A health information custodian must not collect, use or disclose personal health information if other information can serve the purpose and may collect, use or disclose only as much personal health information as is reasonably necessary for the purpose. A health information custodian may only collect, use or disclose personal health information about an individual for fundraising activities if the individual has expressly or implicitly consented and the prescribed requirements and restrictions are met. The Part contains restrictions on the collection, use or disclosure by any person of another person's health number.

The Part sets out circumstances in which a health information custodian may collect, use or disclose personal health information about an individual without the individual's consent. The list of circumstances for disclosure includes disclosure for the purpose of providing health care to an individual if it is not reasonably possible to obtain the individual's consent in a timely manner, but not if the individual has instructed the custodian not to disclose the information. The list also includes disclosure to a medical officer of health for public health protection purposes, disclosure if another Act permits or requires it, disclosure for the purposes of research to be performed in accordance with a research plan approved by a research ethics board, disclosure to a prescribed entity for the purpose of analysis with respect to the management of the health care system, if the Information and Privacy Commissioner has approved the entity's privacy practices in the case of a disclosure occurring on or after November 1, 2005 and disclosure to the Minister of Health and Long-Term Care for monitoring payments for health care funded in whole or in part by the Ministry. The Minister may direct a health information custodian to disclose personal health information to a health data institute for the purposes of analysis with respect to the management or evaluation of all or part of the health system.

Part V provides that an individual is entitled to access to a record of personal health information about the individual that is kept by a health information custodian, except in certain cases such as where the information relates solely to monitoring the quality of health care provided in a health facility. The Part sets out procedures for granting and refusing access and for requesting corrections to personal health information. An individual who disagrees with a decision of the custodian is entitled to make a complaint to the Information and Privacy Commissioner.

Part VI deals with administration and enforcement. A person who has reasonable grounds to believe that another person has contravened or is about to contravene a provision of the Act or its regulations may make a complaint to the Information and Privacy Commissioner. Upon receiving a complaint, the Commissioner may take a number of steps, such as requiring the complainant to try to effect a settlement, arranging for mediation or conducting a review. The Commissioner may also conduct a review related to an actual or an imminent contravention of the Act or its regulations, whether or not a person has made a complaint. If the Commissioner conducts a review, the Part sets out the powers of the Commissioner to enter and inspect a premises without a warrant or with a warrant. In connection with a review, the Commissioner may also, where necessary, require that evidence be given under oath, demand the production of documents or inquire into information and information practices of a health information custodian.

After conducting a review, the Commissioner may make a range of orders, including orders directing any person whose activities the Commissioner has reviewed to perform a duty imposed by the Act, directing a health information custodian to grant an individual access to a requested record and directing a health information custodian to implement an information practice that the Commissioner specifies. A person affected by an order that deals with complaints and reviews under Part VI, other than complaints pertaining to the access to records or correction of records, may appeal the order to the Divisional Court on a question of law. If the Commissioner has made an order as a result of a contravention of the Act, a person affected by the contravention may bring an action for damages.

Part VII deals with general matters. A person who complains to the Information and Privacy Commissioner about a contravention of the Act is protected from retaliation. The Part protects persons from liability for their acts and omissions made in good faith and reasonably in the circumstances in the exercise of their powers or duties under the Act. The Part provides offences for contravening certain provisions of the Act but permits that only the Attorney General or his or her agent may commence a prosecution. The Lieutenant Governor in Council has powers to make regulations as long as it complies with a process of public consultation set out in the Part before making regulations.

Part VIII amends other Acts including the following:

1. The Schedule amends the Ambulance Act to allow specified persons to disclose to each other personal health information about an individual without the individual's consent if the disclosure is reasonably necessary for purposes relating to the discharge or exercise of their duties or powers. The specified persons include the Minister of Health and Long-Term Care, municipalities, delivery agents, operators of an ambulance or communication service and medical directors of base hospital programs.

2. The Information and Privacy Commissioner under the Freedom of Information and Protection of Privacy Act may appoint an Assistant Commissioner for Personal Health Information from the officers of the Commissioner's staff.

3. The Schedule repeals several provisions of the Long-Term Care Act, 1994 and the Mental Health Act that deal with access to and correction of records of personal health information.

4. The Schedule amends the Mental Health Act to allow the officer in charge of a psychiatric facility to collect, use and disclose personal health information about a patient, with or without the patient's consent, for the purposes of examining, assessing, observing or detaining the patient in accordance with the Act or complying with an order or disposition made pursuant to the Part on mental disorders in the Criminal Code (Canada).

SCHEDULE B
QUALITY OF CARE INFORMATION
PROTECTION ACT, 2004

The Schedule enacts the Quality of Care Information Protection Act, 2004. The Act protects from disclosure information that is provided to the quality of care committee of a health facility or a health care entity or oversight body that is prescribed in the regulations. Quality of care information includes information collected by or prepared for a quality of care committee solely or primarily for quality of care purposes. It does not include information, such as facts contained in a record that a health facility maintains for the purpose of providing health care and facts relating to incidents, unless the facts are also contained in records that are not protected under the Act.

It is an offence under the Act to disclose quality of care information in contravention of the Act.

The Act also amends Schedule 2 to the Regulated Health Professions Act, 1991 to provide comparable protection in respect of quality assurance information collected by a College's Quality Assurance Committee.

[38] Bill 31 As Amended by Standing Committee (PDF)

Bill 31 2004

An Act to enact
and amend various Acts
with respect to the protection
of health information

Her Majesty, by and with the advice and consent of the Legislative Assembly of the Province of Ontario, enacts as follows:

Personal Health Information Protection Act, 2004

1. The Personal Health Information Protection Act, 2004, as set out in Schedule A, is hereby enacted.

Quality of Care Information Protection Act, 2004

2. The Quality of Care Information Protection Act, 2004, as set out in Schedule B, is hereby enacted.

Commencement

3. (1) Subject to subsections (2) and (3), this Act comes into force on the day it receives Royal Assent.

Schedules

(2) The Schedules to this Act come into force as provided in the commencement section at or near the end of each Schedule.

Selective proclamation

Short title

4. The short title of this Act is the Health Information Protection Act, 2004.

SCHEDULE A
PERSONAL HEALTH INFORMATION PROTECTION ACT, 2004

CONTENTS


PART I INTERPRETATION AND APPLICATION
Purposes, Definitions and Interpretation
1.	Purposes
2.	Definitions
3.	Health information custodian
4.	Personal health information
5.	Substitute decision-maker
6.	Interpretation
Application of Act
7.	Application of Act
8.	Freedom of information legislation
9.	Non-application of Act
PART II PRACTICES TO PROTECT PERSONAL HEALTH INFORMATION
General
10.	Information practices
11.	Accuracy
12.	Security
Records
13.	Handling of records
14.	Place where records kept
Accountability and Openness
15.	Contact person
16.	Written public statement
17.	Agents and information
PART III CONSENT CONCERNING PERSONAL HEALTH INFORMATION
General
18.	Elements of consent
19.	Withdrawal of consent
20.	Assumption of validity
Capacity and Substitute Decision-Making
21. 22. 23. 23.1 24. 25. 26. 27.	Capacity to consent Determination of incapacity Persons who may consent Factors to consider for consent Authority of substitute decision-maker Incapable individual: persons who may consent Appointment of representative Transition, representative appointed by Board
PART IV COLLECTION, USE AND DISCLOSURE OF PERSONAL HEALTH INFORMATION
General Limitations and Requirements
28. 29. 30. 31. 32. 33. 34.	Requirement for consent Other information Use and disclosure of personal health information Fundraising Marketing Health cards and health numbers Fees for personal health information
Collection
35.	Indirect collection
Use
36.	Permitted use
Disclosure
37. 38. 39. 40. 41. 42. 43. 43.1 44. 45. 46. 47. 48.	Disclosures related to providing health care Disclosures for health or other programs Disclosures related to risks Disclosures for proceedings Disclosure to successor Disclosures related to this or other Acts Disclosure for research Disclosure for planning and management of health system Monitoring health care payments Disclosure for analysis of health system Disclosure with Commissioner's approval Restrictions on recipients Disclosure outside Ontario
PART V ACCESS TO RECORDS OF PERSONAL HEALTH INFORMATION AND CORRECTION
Access
49. 50. 51. 52.	Application of Part Individual's right of access Request for access Response of health information custodian
Correction
53.	Correction
PART VI ADMINISTRATION AND ENFORCEMENT
Complaints, Reviews and Inspections
54. 55. 56. 56.1 57. 60. 60.1	Complaint to Commissioner Response of Commissioner Commissioner's self-initiated review Conduct of Commissioner's review Inspection powers Powers of Commissioner Appeal of order
61. 62. 63.	Enforcement of order Further order of Commissioner Damages for breach of privacy
Commissioner
64. 65. 66. 67.	General powers Delegation Limitations re personal health information Immunity
PART VII GENERAL
68. 69. 70. 71. 72. 73.	Non-retaliation Immunity Offences Regulations Public consultation before making regulations Review of Act
PART VIII COMPLEMENTARY AMENDMENTS
Ambulance Act
74.	Ambulance Act
Charitable Institutions Act
75.	Charitable Institutions Act
Child and Family Services Act
76.	Child and Family Services Act
Commitment to the Future of Medicare Act, 2004
77.	Commitment to the Future of Medicare Act, 2004
Drug and Pharmacies Regulation Act
78.	Drug and Pharmacies Regulation Act
Freedom of Information and Protection of Privacy Act
79.	Freedom of Information and Protection of Privacy Act
Health Cards and Numbers Control Act, 1991
80.	Health Cards and Numbers Control Act, 1991
Health Care Accessibility Act
81.	Health Care Accessibility Act
Health Care Consent Act, 1996
82.	Health Care Consent Act, 1996
Health Insurance Act
83.	Health Insurance Act
Health Protection and Promotion Act
84.	Health Protection and Promotion Act
Homes for the Aged and Rest Homes Act
85.	Homes for the Aged and Rest Homes Act
Independent Health Facilities Act
86.	Independent Health Facilities Act
Long-Term Care Act, 1994
87.	Long-Term Care Act, 1994
Mental Health Act
88.	Mental Health Act
Municipal Freedom of Information and Protection of Privacy Act
88.1	Municipal Freedom of Information and Protection of Privacy Act
Nursing Homes Act
89.	Nursing Homes Act
Occupational Health and Safety Act
90.	Occupational Health and Safety Act
Ombudsman Act
90.1	Ombudsman Act
Ontario Drug Benefit Act
91.	Ontario Drug Benefit Act
Public Hospitals Act
92.	Public Hospitals Act
Substitute Decisions Act, 1992
93.	Substitute Decisions Act, 1992
Trillium Gift of Life Network Act
94.	Trillium Gift of Life Network Act
PART IX COMMENCEMENT AND SHORT TITLE
95. 96.	Commencement Short title
______________