55.3 The prescribed organization shall comply with the following requirements in developing and maintaining the electronic health record: 1.  It shall take reasonable steps to limit the personal health information it receives to that which is reasonably necessary for developing and maintaining the electronic health record. 2.  It shall not permit its employees or any other person acting on its behalf to view, handle or otherwise deal with the personal health information received from health information custodians, unless the employee or person acting on behalf of the prescribed organization agrees to comply with the restrictions that apply to the prescribed organization. 3.  It shall make available to the public and to each health information custodian that provides personal health information to it, i.  a plain language description of the electronic health record, including a general description of the administrative, technical and physical safeguards in place to, A.  protect against theft, loss and unauthorized collection, use or disclosure of the personal health information that is accessible by means of the electronic health record, B.  protect the personal health information that is accessible by means of the electronic health record against unauthorized copying, modification or disposal, and C.  protect the integrity, security and confidentiality of the personal health information that is accessible by means of the electronic health record, and ii.  any directives, guidelines and policies of the prescribed organization that apply to the personal health information that is accessible by means of the electronic health record, to the extent that these do not reveal a trade secret or confidential scientific, technical, commercial or labour relations information. 4.  It shall, i.  keep an electronic record of all instances where all or part of the personal health information that is accessible by means of the electronic health record is viewed, handled or otherwise dealt with, and ensure that the record identifies the individual to whom the information relates, the type of information that is viewed, handled or otherwise dealt with, all persons who have viewed, handled or otherwise dealt with the information, and the date, time and location of the viewing, handling, or dealing with, and ii.  in the event that a health information custodian has requested that the prescribed organization transmit to the custodian personal health information that is accessible by means of the electronic health record, keep an electronic record of all instances where personal health information is transmitted to the custodian by means of the electronic health record, and ensure that the record identifies the individual to whom the information relates, the type of information that is transmitted, the custodian requesting the information, the date and time that the information was transmitted, and the location to which the information was transmitted. 5.  It shall keep an electronic record of all instances where a consent directive is made, withdrawn or modified, and shall ensure that the record identifies the individual who made, withdrew or modified the consent directive, the instructions that the individual provided regarding the consent directive, the health information custodian, agent or other person to whom the directive is made, withdrawn or modified, and the date and time that the consent directive was made, withdrawn or modified. 6.  It shall keep an electronic record of all instances where all or part of the personal health information that is accessible by means of the electronic health record is disclosed under section 55.7 and shall ensure that the record identifies the health information custodian that disclosed the information, the health information custodian that collected the information, any agent of the health information custodian who collected the information, the individual to whom the information relates, the type of information that was disclosed, the date and time of the disclosure and the purpose of the disclosure. 7.  It shall audit and monitor the electronic records that it is required to keep under paragraphs 4, 5 and 6. 8.  It shall, upon the request of the Commissioner provide to the Commissioner, for the purposes of Part VI, the electronic records kept under paragraphs 4, 5 and 6. 9.  It shall, upon request of a health information custodian that requires the records to audit and monitor its compliance with this Act, provide to the custodian or an agent acting on the custodian’s behalf, the records kept under paragraphs 4, 5 and 6. 10.  It shall perform, for each system that retrieves, processes or integrates personal health information that is accessible by means of the electronic health record, an assessment with respect to, i.  threats, vulnerabilities and risks to the security and integrity of the personal health information, and ii.  how each of those systems may affect the privacy of the individuals to whom the information relates. 11.  It shall notify, at the first reasonable opportunity, each health information custodian that provided personal health information to the prescribed organization if the personal health information that the health information custodian provided is stolen or lost or if it is collected, used or disclosed without authority. 12.  It shall, i.  make available to each health information custodian that provided personal health information to the prescribed organization a written copy of the results of the assessments carried out under paragraph 10 that relates to the personal health information the custodian provided, and ii.  make available to the public a summary of the results of the assessments carried out under paragraph 10. 13.  It shall ensure that any third party it retains to assist in providing services for the purpose of developing or maintaining the electronic health record agrees to comply with the restrictions and conditions that are necessary to enable the prescribed organization to comply with all these requirements. 14.  On and after the first anniversary of the day this section comes into force, it shall have in place and comply with practices and procedures, i.  that are for the purpose of protecting the privacy of the individuals whose personal health information it receives and for maintaining the confidentiality of the information, and ii.  that are approved by the Commissioner. 15.  It shall notify the Commissioner, in writing, immediately after becoming aware that personal health information that is accessible by means of the electronic health record, i.  has been viewed, handled or otherwise dealt with by the prescribed organization or a third party retained by the prescribed organization, other than in accordance with this Act or its regulations, or ii.  has been made available or released by the prescribed organization or a third party retained by the prescribed organization, other than in accordance with this Act or its regulations. 16.  It shall submit to the Commissioner, at least annually, a report in the form and manner specified by the Commissioner, and based on or containing any information, other than personal health information, that is kept in the electronic record required under paragraph 6 that the Commissioner may specify, respecting every instance in which personal health information was disclosed under section 55.7 since the time of the last report. 17.  It shall comply with the practices and procedures prescribed in the regulations when managing consent directives. 18.  It shall have in place and comply with practices and procedures that have been approved by the Minister for responding to or facilitating a response to a request made by an individual under Part V in respect of the individual’s record of personal health information that is accessible by means of the electronic health record. 19.  It shall comply with such other requirements as may be prescribed in the regulations. 2016, c. 6, Sched. 1, s. 1 (13). Section Amendments with date in force (d/m/y) 2016, c. 6, Sched. 1, s. 1 (13) - 01/10/2020