73 (1) Subject to section 74, the Lieutenant Governor in Council may make regulations, (a)  prescribing or specifying anything that this Act describes as being prescribed, specified, described, provided for, authorized or required in the regulations made under this Act; (b)  exempting persons or classes of persons from the persons described in clause (d) of the definition of “health care practitioner” in section 2; (c)  specifying persons or classes of persons who shall not be included in the definition of “health information custodian” in subsection 3 (1); (d)  specifying that certain types of information shall or shall not be included in the definition of “personal health information” in subsection 4 (1); (e)  defining, for the purposes of this Act and its regulations, any word or expression used in this Act that has not already been expressly defined in this Act; (f)  making any provision of this Act or its regulations, that applies to some but not all health information custodians, applicable to a prescribed person mentioned in paragraph 8 of the definition of “health information custodian” in subsection 3 (1) or a member of a prescribed class of persons mentioned in that paragraph; (g)  specifying requirements with respect to information practices for the purposes of subsection 10 (1), including conditions that a health information custodian is required to comply with when collecting, using or disclosing personal health information or classes of personal health information, or specifying procedural processes or requirements for setting requirements with respect to information practices for the purposes of that subsection; (h)  specifying requirements, or a process for setting requirements, for the purposes of subsection 10 (3) with which a health information custodian is required to comply when using electronic means to collect, use, modify, disclose, retain or dispose of personal health information, including standards for transactions, data elements for transactions, code sets for data elements and procedures for the transmission and authentication of electronic signatures; (i)  specifying requirements for the purposes of subsection 17 (1), including requiring that a health information custodian and its agent enter into an agreement that complies with the regulations made under clause (k) before the custodian provides personal health information to the agent; (j)  specifying requirements that an agreement entered into under this Act or its regulations must contain; (k)  specifying requirements, restrictions or prohibitions with respect to the collection, use or disclosure of any class of personal health information by any person in addition to the requirements, restrictions or prohibitions set out in this Act; (l)  specifying requirements that an express instruction mentioned in clause 37 (1) (a), 38 (1) (a) or 50 (1) (e) must meet; (l.1)  prescribing circumstances in which a person who compiles or maintains a registry of personal health information referred to in clause 39 (1) (c) may use or disclose personal health information; (m)  permitting notices, statements or any other things, that under this Act are required to be provided in writing, to be provided in electronic or other form instead, subject to the conditions or restrictions that are specified by the regulations made under this Act; (m.0.1)  authorizing the Agency to specify electronic formats for the purposes of subsection 52 (1.1), which may include requirements, conditions, restrictions or exceptions that apply to the authorization; Note: On a day to be named by proclamation of the Lieutenant Governor, subsection 73 (1) of the Act is amended by adding the following clause: (See: 2020, c. 5, Sched. 6, s. 24 (2)) (m.1)  governing the services provided by consumer electronic service providers within the meaning of section 54.1, including their collection, use and disclosure of personal health information, the use of those services by health information custodians as well as by individuals and the rights of those individuals with regard to the services; (n)  prescribing under what circumstances the Canadian Blood Services may collect, use and disclose personal health information, the conditions that apply to the collection, use and disclosure of personal health information by the Canadian Blood Services and disclosures that may be made by a health information custodian to the Canadian Blood Services; (n.1)  requiring health information custodians to provide information to the Commissioner and specifying the type of information to be provided and the time at which and manner in which it is to be provided; (n.2)  prescribing under what circumstances the Agency may collect, use and disclose personal health information, the conditions that apply to the collection, use and disclosure of personal health information by the Agency and disclosures of personal health information that may be made by a health information custodian or other person to the Agency; (n.3)  governing (i)  under what circumstances a person or entity, or group of persons or entities, described in subsection (1.1) may collect, use and disclose personal health information, (ii)  conditions that apply to the collection, use and disclosure of personal health information by a person, entity or group mentioned in subclause (i), (iii)  security requirements, records retention, information practices and rules for access and correction for personal health information held by a person, entity or group mentioned in subclause (i), (iv)  disclosures of personal health information that may be made by a health information custodian or other person to a person, entity or group mentioned in subclause (i), (v)  any requirements with respect to the collection, use and disclosure of personal health information that a person, entity or group must comply with if they used to fall under the description in subsection (1.1) but no longer fall under that description; (n.4)  providing for and governing powers, functions and responsibilities of the Agency for the purposes of this Act and the regulations; (n.5)  respecting requirements with which a health information custodian is required to comply when selecting and using electronic means to collect, use, modify, disclose, retain or dispose of personal health information, including the process for setting, monitoring and enforcing such requirements; (o)  specifying information relating to the administration or enforcement of this Act that is required to be contained in a report made under subsection 58 (1) of the Freedom of Information and Protection of Privacy Act; (o.1)  governing administrative penalties imposed by the Commissioner under clause 61 (1) (h.1) and all matters necessary and incidental to the administration of a system of administrative penalties under this Act; (o.2)  governing the de-identification of personal health information and the collection, use and disclosure of de-identified information by health information custodians and any other persons; (p)  respecting any matter necessary or advisable to carry out effectively the purposes of this Act.  2004, c. 3, Sched. A, s. 73 (1); 2016, c. 6, Sched. 1, s. 1 (28); 2019, c. 15, Sched. 30, s. 8 (1); 2020, c. 5, Sched. 6, s. 24 (1, 3); 2022, c. 11, Sched. 4, s. 2 (1, 2). Application (1.1) Subclause (1) (n.3) (i) applies with respect to the following persons or entities, or groups of persons or entities, that comply with the prescribed conditions, if any: 1.  Persons or entities, or groups of persons or entities, designated under subsection 29 (1) of the Connecting Care Act, 2019 as an Ontario Health Team. 2.  Persons or entities, or groups of persons or entities, that have not yet been designated as an Ontario Health Team under subsection 29 (1) of the Connecting Care Act, 2019 but that have received written authorization from the Minister approving them to, i.  use the title “Ontario Health Team”, and ii.  collect, use and disclose personal health information in accordance with the conditions and other requirements made under clause (1) (n.3). 2022, c. 11, Sched. 4, s. 2 (3). General or specific application (2) A regulation made under this Act may be of general application or specific to any person or persons or class or classes in its application.  2004, c. 3, Sched. A, s. 73 (2). Classes (3) A class described in the regulations made under this Act may be described according to any characteristic or combination of characteristics and may be described to include or exclude any specified member, whether or not with the same characteristics.  2004, c. 3, Sched. A, s. 73 (3). Rolling incorporation by reference (4) If a regulation adopts by reference any code, standard, guideline or similar document, the regulation may require compliance with the code, standard, guideline or document as amended from time to time, whether the amendment was made before or after the regulation was made. 2019, c. 15, Sched. 30, s. 8 (2). Regulations respecting administrative penalties (5) Without limiting the generality of clause (1) (o.1), regulations made under that clause may prescribe specific amounts of administrative penalties or provide that the amounts of administrative penalties be based on the type of the contravention in question, on the contravention history of the person required to pay the administrative penalty or on whether the person is or is not a natural person. 2020, c. 5, Sched. 6, s. 24 (4). Section Amendments with date in force (d/m/y) 2016, c. 6, Sched. 1, s. 1 (28) - 03/06/2016 2019, c. 15, Sched. 30, s. 8 (1, 2) - 31/07/2020 2020, c. 5, Sched. 6, s. 24 (1, 3, 4) - 25/03/2020; 2020, c. 5, Sched. 6, s. 24 (2) - not in force 2022, c. 11, Sched. 4, s. 2 (1-3) - 14/04/2022