Source: http://docplayer.net/1226105-Legislative-council-bills-committee-electronic-health-record-sharing-system-bill.html
Timestamp: 2017-04-29 06:02:42
Document Index: 74778782

Matched Legal Cases: ['art 4', 'art 5', 'art 5', 'art 1', 'art 1', 'art 9', 'art 9', 'art 9']

LEGISLATIVE COUNCIL Bills Committee Electronic Health Record Sharing System Bill - PDF
Download "LEGISLATIVE COUNCIL Bills Committee Electronic Health Record Sharing System Bill"
1 LEGISLATIVE COUNCIL Bills Committee Electronic Health Record Sharing System Bill The Privacy Commissioner for Personal Data ( PCPD ) reiterates his support for the enactment of a specific legislation to regulate the operation of the Electronic Health Record Sharing System and to provide adequate protection to the health data concerned. 2. The attached table sets out the major concerns of the PCPD regarding the Electronic Health Record Sharing System Bill ( Bill ) submitted by the Food and Health Bureau to the Legislative Council on 17 April 2014 and the PCPD s comments on the Administration s responses in LC Paper No.CB(2)1775/13-14(02). Office of the Privacy Commissioner for Personal Data 14 July2 Summary of PCPD s Comments and Responses Glossary DPP - data protection principle in Schedule 1 of the PDPO ehr" - electronic health record ehrc - Commissioner for Electronic Health Record HCP - healthcare provider HCR - healthcare recipient PDPO - Personal Data (Privacy) Ordinance (Cap 486) ehrss - Electronic Health Record Sharing System Clause no. of the Bill The Administration s responses to PCPD s concerns Summary of PCPD s comments to the Administration s responses Overall ehr-specific legislation s compatibility with the PDPO The Administration agreed with the PCPD that the privacy protection offered to HCRs personal data should be no less than that provided under the PDPO. As explained below, there are areas where the PCPD has doubts on whether adequate protection is provided under the Bill. 23 Clauses 12 to 16 and Clauses 25 to 28 Sharable scope of data The sharable scope of data was drawn up after seeking advice from healthcare professionals, patients groups and IT experts. Patient surveys confirmed it was acceptable to the public and not excessive. In any event, patients will be informed about the sharable scope before they decide whether to join the ehrss. Need- to-know principle The need-to-know principle has been adopted in the design of the ehrss and reflected in the legislative provisions and operation / workflows in the following ways: Restrictions on use of data are defined in the Bill An HCR has the choice over granting access only to those HCPs The PCPD has no problem with how the scope of data for sharing is delineated for the purpose of provision of healthcare. He is concerned with whether the data will be compartmentalized to enable individual healthcare professionals to gain access to different data compartments on a need-to-know basis. Clauses 25 to 28 of the Bill which deal with the permitted use of data and information contained in an ehr are not directly relevant for controlling access to such data and information. Clauses 12 to 16 of the Bill provide for an HCR to give sharing consent to individual HCPs (hospitals, clinics etc.), not to individual units or personnel of the HCP. In other words, all healthcare professionals of an HCP may gain access to the same set of sharable data relating to the HCR, regardless of their medical disciplines and the nature of healthcare they are providing individually to the HCR. Although a notification (SMS) will be issued by an HCP to an HCR after making access to his ehr, it is doubtful whether the notification will pinpoint the individual healthcare professional who has gained access. As illustration, the PCPD speculates there are varied clinical needs for the different professionals in each of the following three healthcare groups: 34 that have a need to know his health data in the ehrss. Only registered healthcare professionals will be granted access to health data in ehr, while administrative staff concerned in an HCP will only be given access to the HCR s index data. All accesses will be logged and traceable. Access of an HCR s ehr will trigger the issue of a notification (such as SMS) to the relevant HCR. Doctor/nurse/physiotherapist/laboratory technician Dentist/ophthalmologist Nurse attending emergency care/nurse changing a dressing If affirmative, the justification for them to access the same set of sharing health data would be doubtful. The PCPD is no expert in such assessment but would expect the Administration to confirm that a professional assessment will indeed be done so that access to the data in ehr will be made by individual healthcare professionals on a truly "need-to-know basis. To recognise the importance of the cardinal principle that data access will only be made on a need-to-know basis, the requirement should be expressly spelt out in the Bill. Overall Safe deposit box The Administration recognises the need of some patients to provide enhanced access control to some of their health data due to its high sensitivity but considers that this should be balanced against the completeness and integrity of The PCPD strongly supports the safe deposit box concept as it respects the HCR s right of self-determination of his health data and protects him from discrimination which otherwise could result from inadequate access control of particularly sensitive health data such as psychiatric diseases / mental conditions or hereditary diseases. 45 the ehr to ensure the quality of healthcare delivery. Given these opposing needs and the divergent views gathered during the public consultation in December 2011 to February 2012 and the meeting with the deputations on 26 May 2014, the Administration considers it necessary to conduct an in-depth study before deciding whether to implement a safe deposit box. The Administration has conducted preliminary desktop researches on overseas experiences (Australia, United Kingdom, Canada and France). None of the overseas experiences is particularly successful to date. As revealed in a study report published by the World Health Organization The requirement for absolute completeness and integrity of the ehr is unrealistic. After all, HCR s participation in the ehrss is entirely voluntary and the HCP has to attend to his needs and exercise judgment based on the health data it can gather, even if there is no pre-existing ehr because the HCP has not joined the ehrss. ehr should in any case be used by the HCP as a source of very useful clinical information, not as a substitute for obtaining information from the HCR directly during consultation. The overriding right of the HCP to open the safe deposit box in emergency situations can be provided for by incorporating suitable exemption clauses in line with section 59(1) of the PDPO 1. To address the HCP s concern about liability, it is important that the downside of using the safe deposit box facility (that is, the lack of full disclosure of health data might affect the quality of the healthcare provided to the HCR) is explained to the HCR. Having made a decision in a well-informed manner, the HCR should assume the responsibility for its consequences. It was recognized in the WHO report that globally greater patient control of ehr is emerging and it is important that Hong Kong 1 Under section 59(1) of the PDPO, personal data relating to the physical or mental health of the data subject is exempt from the provisions of DPP3 (governing the use of personal data) in any case in which the application of those provisions to the data would be likely to cause serious harm to the physical or mental health of the data subject or any other individual. 56 (WHO) in 2012, most countries did not implement options for patients to conceal information in their ehr. Countries are generally concerned that incomplete health records would affect the quality of care and impose liability on management. The approved budget for implementing the 5-year Stage One ehr Programme does not include a safe deposit box. learns from the experiences of countries which have adopted legislation giving patients control over the sharing of their ehr 2. It is relevant to note that following a government review of the Personally Controlled Electronic Health Record ( PCEHR ) in Australia (in December 2013), it was recommended that the PCEHR should be renamed as My Health Record ( MyHR ) retaining all of the patient controls that exist in the current PCEHR (including the right to withhold certain record from being viewed). The review noted that no medical records are complete and that there are some people who legitimately do not want to share everything. Hence the PCEHR should be considered as a source of supplementary information and clinicians should be confident that they will be meeting the appropriate professional standard if they make decisions, in good faith, based on information in the MyHR even if they turn out to be incorrect or incomplete 3. The PCPD considers that there has been enough discussion on the subject in the past years and the time is ripe for drawing a conclusion on whether there should be a safe deposit box of some form. He feels that there is no strong opposition from the 2 See page 61 Report of the World Health Organisation on Legal Framework for ehealth (2012) (available at the link 3 See page 31 Review of the Personally Controlled Electronic Health Record 67 stakeholders to protecting the patients right under the ehrss. Hence further studies and consultation are meaningful only if they are focused on how (instead of whether) to implement the concept. Hong Kong can take a lead in this development instead of waiting indefinitely for the emergence of a best model from other parts of the world. The PCPD recommends the Administration to (a) incorporate provisions in the Bill to allow for the operation of the safe deposit box and (b) commit to a timetable for working out the details of this facility. Clauses 17(5)(g) and 20 Registration as an HCP The Administration is prepared to remove Clause 17(5)(g) which allows the registration as an HCP by a specified entity that, in the opinion of the ehrc, directly or indirectly provides healthcare to any HCR. Clause 20 of the Bill allows the ehrc to register a Government bureau or department as a HCP for the ehrss if The PCPD s concern is how the ehrc will exercise his discretion under the loosely defined situations (under Clauses 17(5)(g) and 20) which would in effect widen the sharing of HCR s ehr. If the Administration is prepared to remove Clause 17(5)(g), the PCPD sees no point in retaining it. As regards Clause 20, to avoid unnecessarily widening the discretion of the ehrc, the PCPD suggests that the Administration s policy objectives can be equally met by deleting Clause 20, expanding the definition of specified entity under 78 the ehrc is satisfied that the operation of the bureau or department involves providing healthcare. The Administration quoted as examples of such registrants the Immigration Department or Correctional Services Department as they would also provide healthcare to detainees and may find access to the ehrss useful. Clause 17(6) to include Government bureau or department, and requiring these bureau or department to apply for registration under Clause 17(5)(f). Part 4 and Clause 38 Disallowing a person authorized in writing by the data subject to make a data access request ( DAR ) or data correction request ( DCR ) on his behalf The proposal is meant to impose stricter control than the PDPO over access of ehr to address concerns regarding possible abuse by dishonest employers or insurers. The Administration is open to views as to whether Clause 38 should be retained Data access and correction are crucial rights for the protection of an individual s personal data. Clause 38 in effect nullifies section 17A of the PDPO which provides for an HCR to authorize a person in writing to make a DAR or DCR. It therefore reduces the HCR s autonomy in handling his personal data. This is particularly problematic where the HCR falls sick and requires assistance from others in pursuing the requests. 89 or not. While Clause 38 of the Bill applies to the HCRs health data under the ehrss only, the HCRs are still entitled under the PDPO to exercise the rights of data access and correction through their authorized persons in relation to their health data maintained separately with the HCPs. The inconsistent treatment of health data under the Bill and the PDPO will be confusing. The Administration has not provided statistics to support that authorisation is subject to abuse by dishonest employers or insurers. The PCPD objects to the proposal. Part 5 and Clause 41 Offence - Unauthorized access by non-computer means To criminalize the act of unauthorized access not followed by any malicious act could be disproportionate as unauthorized access to personal data under the PDPO is not an offence. The PDPO governs all personal data regardless of data sensitivity. During the public consultation for the review of the PDPO in 2010, there was general support for the proposal to introduce tighter control over sensitive personal data. The proposal was not taken forward by the Administration as it failed to identify a consensus on the coverage of sensitive personal data. However, there should be little argument that health data is sensitive and should therefore, according to the majority views expressed in the 910 2010 public consultation, be afforded a higher level of protection. Unauthorized access to personal data without subsequent malicious act may not be as innocent as it seems to be. For instance, a person who accesses ehr data without authorisation and collects the personal data may not have an immediate plan in mind as regards how to take advantage of the data. He may simply reserve it for some undefined future use. There was a case concerning the conviction of a staff of the Inland Revenue Department for misconduct in public office in copying the personal data of tax payers without the authority of the Commissioner of Inland Revenue. The convicted staff had never used any of the copied data but claimed that the data might be of use to him in future. If the Administration thinks that criminal sanction is too harsh, it may wish to consider other penalties. For example, section 59(1) of the PCEHR Act imposes a civil penalty on a person who collects from the PCEHR system health information without authorisation and that person knows or is reckless as to that fact. 1011 Offence - Creating an offence against misuse of ehr data Difficult to define misuse as it could cover a wide range of scenarios Not appropriate to create an offence to cover generally all misuses of ehr data Misuse of personal data under DPP3 of PDPO is not an offence The PCPD repeats his comments above that patients health data is sensitive and should be afforded greater protection than that provided under the PDPO. No offence is proposed under the Bill for misuse of the ehr for purposes unrelated to the healthcare of the HCRs except that it is an offence under clause 46 of the Bill to use the ehr data for direct marketing purpose. This is an omission which needs to be addressed. Section 64 of the PDPO 4 provides that it is an offence to disclose personal data obtained without the data user s consent but certain conditions must be fulfilled. The applicability of this section is further limited in small HCPs such as a one-doctor clinic where the wrongdoer is the data user and therefore the issue of consent will not arise. Any use which is different from that permitted under the Bill will be misuse. The PCPD disagrees with the Administration s view that an offence on misuse of ehr in general should not be imposed just because there are different extent and scenarios of 4 Under section 64 of the PDPO, it is an offence for a person to disclose any personal data of a data subject obtained from a data user without the latter s consent and with an intent to (i) obtain gain for himself or another person, or (ii) cause loss to the data subject. It is also an offence if the unauthorized disclosure, irrespective of its intent, causes psychological harm to the data subject. The maximum penalty for these new offences is a fine of $1,000,000 and imprisonment for 5 years. 1112 misuse. There are examples in existing ordinances for criminalising a general misuse of personal data for purposes other than that for which the data is collected. For example, use of voters personal data contained in an election register for purposes other than election is an offence 5. Clause 57(2) Limitation of Liability: Inspection of local Electronic Medical Record (emr) systems of HCPs The Administration considers that it is not reasonably practicable for the ehrc to inspect or commit to inspect local emr systems of HCPs to ascertain (1) whether the Electronic Health Record Sharing System Ordinance (the Ordinance) is complied with; and (2) whether any sharable data provided to the ehrss is accurate. The reasons are: The PCPD objects to this proposed limitation which in effect belittles and discredits the ehrc s statutory functions to regulate and supervise the sharing and use of ehr (clause 48(1)(b)) among the HCPs and to supervise their compliance with the Ordinance (clause 48(1)(c)). It calls in question how the ehrc could exercise his supervisory and oversight role effectively. For example, the ehrc has to make decisions to suspend or cancel registration of HCPs. Relieved of any obligation to conduct inspection of the HCPs local emr systems, it is conceivable that such decisions will only be made as a response to crises such as serious data 5 See section 22(3) of the Electoral Affairs Commission (Registration of Electors) (Legislative Council Geographical Constituencies) (District Council Constituencies) Regulation (Cap.541A) and section 42(3) of the Electoral Affairs Commission (Registration) (Electors for Legislative Council Functional Constituencies) (Voters for Election Committee Subsectors) (Members of Election Committee) Regulation (Cap.541B) 1213 Local emr systems are systems used by individual HCP. They are not part of the ehrss and thus fall outside the ambit of the ehrc. Local emr systems may contain sensitive information not relevant to ehr sharing; inspection will be highly intrusive and deter HCPs from joining the ehrss. The ehrc has no expertise and historical knowledge to check the content accuracy of the data in the local emr systems, as they are largely professional assessment of healthcare professionals. The HCPs are subject to the regulation of the PCPD under the PDPO. It is the obligation of the HCPs as data users to ensure security of their local emr systems and the accuracy of the data. The Administration benchmarks the ehrss with the inter-bank clearing system which accepts transactions from breaches on the part of the HCPs, when ideally it should be made as a preventative measure before things get out of control. The PCPD notes that the Administration is obsessive about the integrity of the ehr in the ehrss when considering the safe deposit box. This is in sharp contrast to exonerating the ehrc from inspecting the local emr systems and ensuring the security and content accuracy of the data it uploads to the ehrss. Indeed such assurance is the obligation of ehrc as a data user under DPP4 and DPP2(1) respectively of the PDPO. However, with the proposed limitation, any direction from the PCPD for the ehrc to conduct inspection of the local emr systems is impossible. This effectively reduces the PCPD s enforcement power that may be invoked against the ehrc to ensure the latter s compliance with the PDPO. The Administration s worry over unmeritorious litigations may have been overstated, taking into account that the standard of compliance with DPP2(1) and DPP(4) is simply to take all reasonably practicable steps. The PCPD further notes the Administration s comments that the ehrc may not be professionally equipped to conduct the inspection and inspecting information not relevant to ehr is highly intrusive. These are logistical problems which can be resolved. For example, the inspection could be designed to focus 1314 various banks but does not inspect the banks local systems. Similar clauses that protect the Administration from unmeritorious litigations are found in a number of ordinances concerning land, buildings and infrastructure. on the relevant data of local emr systems. In any event, the ehrc should be meeting his obligations if he takes all reasonably practicable steps in good faith. It is not entirely appropriate to compare the ehrss with the inter-bank clearing system. A closer analogy is the Hospital Authority which manages public hospitals in Hong Kong. It sets up policies and guidelines for adoption by public hospitals in the protection of patients personal data, and ensures compliance through inspections and other audit work. Another relevant benchmark is TransUnion, a credit reference agency that collects consumers credit data from credit providers and maintains a centralized database for the provision of consumer credit data to credit providers to facilitate their assessment of applications for loans and other credit facilities. This is subject to regulation under DPP2(1) (governing data accuracy) and the Code of Practice on Consumer Credit Data published by the PCPD 6. The credit reference agency is not exonerated of its obligations as a data user under DPP2(1) in any way. Lastly, under the PCEHR Act 2012, the system operator of 6 See link to the Code of Practice on Consumer Credit Data published in the PCPD s website: 1415 PCEHR in Australia, which performs similar functions as the ehrc, is not offered any exclusion from inspection 7. All examples given by the Administration for limiting liability are not exemptions from the liability or responsibility for personal data protection. The PCPD will not shirk his responsibility to monitor compliance with the PDPO by individual HCPs. But inevitably, in the interest of fairness in deploying his limited resources among all data users in Hong Kong, he is unable to focus on HCPs. The ehrc no doubt is much better positioned and resourced to exercise oversight over the HCPs. Abdication of this responsibility on the part of the ehrc is counter-productive to promote compliance with the PDPO and the Ordinance by the HCPs. 7 Reference can be made to sections 11 to 12 and Part 5 of the Personally Controlled Electronic Health Records Act 2012 (http://www.comlaw.gov.au/details/c2012a00063). 15 Similar documents
LC Paper No. CB(2)1775/13-14(02) Bills Committee on Electronic Health Record Sharing System Bill The Administration s Response to the follow-up issues arising from the discussion at the meeting on 26 May More information LEGISLATIVE COUNCIL BRIEF
File reference: FH CR 1/1/3781/10 LEGISLATIVE COUNCIL BRIEF ELECTRONIC HEALTH RECORD SHARING SYSTEM BILL A INTRODUCTION At the meeting of the Executive Council on 8 April 2014, the Council ADVISED and More information Electronic Health Record Sharing System
Electronic Health Record Sharing System Voluntary and free registration Secure system Privacy protected Reduce errors and repeated tests More comprehensive and lifelong health records Instant access to More information Electronic Health Record Sharing System Bill. Contents. Part 1. Preliminary. 1. Short title and commencement... C1203. 2. Interpretation...
C1193 Electronic Health Record Sharing System Bill Contents Clause Page Part 1 Preliminary 1. Short title and commencement... C1203 2. Interpretation... C1203 3. Substitute decision maker... C1213 4. Ordinance More information Bills Committee on Electronic Health Record Sharing System Bill
LC Paper No. CB(2)2308/13-14(02)(Revised) Bills Committee on Electronic Health Record Sharing System Bill The Administration s Response to the issues arising from the discussion at the meeting on 29 July More information LC Paper No. CB(2)1515/13-14(01)
LC Paper No. CB(2)1515/13-14(01) Annex I Comments on the legal and drafting issues on Electronic Health Record Sharing System Bill Clause 1 (Short title and commencement) 1. Please advise the expected More information Electronic Health Record Sharing System (ehrss) Healthcare Provider Registration Form
Electronic Health Record Sharing System (ehrss) Healthcare Provider Registration Form Please refer to the Registration Guide at the back of this form, Guide for Healthcare Provider Registration, Conditions More information Appendix 11 - Swiss Data Protection Act
GLEIF- LOU Restricted Appendix 11 - Swiss Data Protection Act GLEIF Revision Version: 1.0 2015-09-23 Master Copy page 2 of 11 Applicable Provisions of the Swiss Data Protection Act (DPA) including the More information Bills Committee on Electronic Health Record Sharing System Bill
LC Paper No. CB(2)1552/14-15(01) Bills Committee on Electronic Health Record Sharing System Bill The Administration s Response to the draft Committee Stage Amendments proposed by Dr Hon Leung Ka-lau This More information Bills Committee on Electronic Health Record Sharing System Bill
LC Paper No. CB(2)1580/13-14(07) Bills Committee on Electronic Health Record Sharing System Bill The Administration s Response to the Issues Raised by Members at the Meeting on 19 May 2014 This paper sets More information Personal Data (Privacy) Ordinance and Electronic Health Record Sharing System (Points to Note for Healthcare Providers and Healthcare Professionals)
Personal Data (Privacy) Ordinance and Electronic Health Record Sharing System (Points to Note for Healthcare Providers and Healthcare Professionals) The Electronic Health Record Sharing System Ordinance More information 235.1. Federal Act on Data Protection (FADP) Aim, Scope and Definitions
English is not an official language of the Swiss Confederation. This translation is provided for information purposes only and has no legal force. Federal Act on Data Protection (FADP) 235.1 of 19 June More information Exercising Your Right of Consent to and Opt-out from Direct Marketing Activities under the Personal Data (Privacy) Ordinance 1
Exercising Your Right of Consent to and Opt-out from Direct Marketing Activities under the Personal Data (Privacy) Ordinance 1 It is common for members of the public to receive unsolicited telephone calls, More information Code of Practice for Using Electronic Health Record for Healthcare
Code of Practice for Using Electronic Health Record for Healthcare [Document Reference No. G80] [V1.1] Effective Date: 26 Jan 2016 Electronic Health Record Office Reproduction of any parts of this publication More information HIPAA PRIVACY AND SECURITY AWARENESS
HIPAA PRIVACY AND SECURITY AWARENESS Introduction The Health Insurance Portability and Accountability Act (known as HIPAA) was enacted by Congress in 1996. HIPAA serves three main purposes: To protect More information Bills Committee on Electronic Health Record Sharing System Bill
LC Paper No. CB(2)1501/14-15(01) Bills Committee on Electronic Health Record Sharing System Bill The Administration s Response to the issues arising from the discussion at the meeting on 12 May 2015 This More information Cloud Computing. Introduction
Cloud Computing Introduction This information leaflet aims to advise organisations which are considering engaging cloud computing on the factors they should consider. It explains the relationship between More information Paper No. CB(2)662/00-01(02)
Paper No. CB(2)662/00-01(02) Drug Dependent Persons Treatment and Rehabilitation Centres (Licensing) Bill Protection of information of inmates in drug treatment centre in overseas laws At the Bills Committee More information Personal Data Act (1998:204);
Personal Data Act (1998:204); issued 29 April 1998. Be it enacted as follows. General provisions Purpose of this Act Section 1 The purpose of this Act is to protect people against the violation of their More information Easy Participation for Healthcare Professionals
Easy Participation for Healthcare Professionals Electronic Health Record Sharing System Welcome to Join www.ehealth.gov.hk 3467 6230 What is an Electronic Health Record (ehr)? An electronic health record More information COMMENTARY. Hong Kong Strengthens Its Personal Data. on Direct Marketing JONES DAY
May 2013 JONES DAY COMMENTARY Hong Kong Strengthens Its Personal Data Privacy Laws and Imposes Criminal Penalties on Direct Marketing In 2012 Hong Kong introduced the Personal Data (Privacy) (Amendment) More information Legislative Council Panel on Health Services. Progress of the Electronic Health Record Programme and Extension of Two Supernumerary Directorate Posts
For Discussion on 18 March 2013 LC Paper No. CB(2)758/12-13(07) Legislative Council Panel on Health Services Progress of the Electronic Health Record Programme and Extension of Two Supernumerary Directorate More information Overview of. Health Professions Act Nurses (Registered) and Nurse Practitioners Regulation CRNBC Bylaws
Overview of Health Professions Act Nurses (Registered) and Nurse Practitioners Regulation CRNBC Bylaws College of Registered Nurses of British Columbia 2855 Arbutus Street Vancouver, BC Canada V6J 3Y8 More information Submission in Response to the Personally Controlled Electronic Health Record System: Legislation Issues Paper
Submission in Response to the Personally Controlled Electronic Health Record System: Legislation Issues Paper August 2011 About National Seniors Australia With a quarter of a million individual members More information Personally Controlled Electronic Health Record System: Legislation Issues Paper
Personally Controlled Electronic Health Record System: Legislation Issues Paper Introduction The AMA has reviewed the Personally Controlled Electronic Health Record System: Legislation Issues Paper. The More information Public Advisory Statement. The Personally-Controlled Electronic Health Record. Frequently Asked Questions by Consumers
http://www.privacy.org.au Secretary@privacy.org.au http://www.privacy.org.au/about/contacts.html Background Public Advisory Statement The Personally-Controlled Electronic Health Record Frequently Asked More information Directors' duties and liabilities under Cayman Islands law
Directors' duties liabilities under Cayman Isls law NOVEMBER 2014 For more briefings visit mourantozannes.com This briefing is only intended to give a summary general overview of the subject matter. It More information Legislative Council Panel on Administration of Justice and Legal Services. Follow-up to meeting on 24 May 2010
LC Paper No. CB(2)2076/09-10(01) For Information Legislative Council Panel on Administration of Justice and Legal Services Follow-up to meeting on 24 May 2010 Five-yearly Review of the Criteria for Assessing More information COMPUTER MISUSE AND CYBERSECURITY ACT (CHAPTER 50A)
COMPUTER MISUSE AND CYBERSECURITY ACT (CHAPTER 50A) (Original Enactment: Act 19 of 1993) REVISED EDITION 2007 (31st July 2007) An Act to make provision for securing computer material against unauthorised More information HIPAA BUSINESS ASSOCIATE AGREEMENT
HIPAA BUSINESS ASSOCIATE AGREEMENT This HIPAA Business Associate Agreement ("BA AGREEMENT") supplements and is made a part of any and all agreements entered into by and between The Regents of the University More information Response of the Northern Ireland Human Rights Commission on the Health and Social Care (Control of Data Processing) NIA Bill 52/11-16
Response of the Northern Ireland Human Rights Commission on the Health and Social Care (Control of Data Processing) NIA Bill 52/11-16 Summary The Northern Ireland Human Rights Commission (the Commission): More information Trust and transparency. Small Business, Enterprise and Employment Bill: Trust and transparency
Small Business, Enterprise and Employment Bill: 1 Government proposals to increase transparency of ownership and control of UK businesses came a step closer on 25 June 2014 with the publication of the More information A GUIDE TO THE OCCUPATIONAL RETIREMENT SCHEMES ORDINANCE
A GUIDE TO THE OCCUPATIONAL RETIREMENT SCHEMES ORDINANCE Issued by THE REGISTRAR OF OCCUPATIONAL RETIREMENT SCHEMES Level 16, International Commerce Centre, 1 Austin Road West, Kowloon, Hong Kong. ORS/C/5 More information Corporate Policy. Data Protection for Data of Customers & Partners.
Corporate Policy. Data Protection for Data of Customers & Partners. 02 Preamble Ladies and gentlemen, Dear employees, The electronic processing of virtually all sales procedures, globalization and growing More information GUIDANCE NOTE ON OUTSOURCING
GN 14 GUIDANCE NOTE ON OUTSOURCING Office of the Commissioner of Insurance Contents Page I. Introduction.. 1 II. Application...... 1 III. Interpretation.... 2 IV. Legal and Regulatory Obligations... 3 More information (a) the kind of data and the harm that could result if any of those things should occur;
Cloud Computing This information leaflet aims to advise organisations on the factors they should take into account in considering engaging cloud computing. It explains the relevance of the Personal Data More information CORPORATE GOVERNANCE AND KEY COMPANY LAW ISSUES IN CHALLENGING ECONOMIC TIMES
CORPORATE GOVERNANCE AND KEY COMPANY LAW ISSUES IN CHALLENGING ECONOMIC TIMES INTRODUCTION Directors stand in a fiduciary relationship to the company and there are general fiduciary duties imposed upon More information OBJECTS AND REASONS. (a) the regulation of the collection, keeping, processing, use or dissemination of personal data;
OBJECTS AND REASONS This Bill would provide for (a) the regulation of the collection, keeping, processing, use or dissemination of personal data; (b) the protection of the privacy of individuals in relation More information Guidelines on endorsement as a nurse practitioner
Guidelines on endorsement as a nurse practitioner 7160 Introduction The National Registration and Accreditation Scheme (the National Scheme) for health professionals in Australia commenced on 1 July 2010 More information NATIONAL PARTNERSHIP AGREEMENT ON E-HEALTH
NATIONAL PARTNERSHIP AGREEMENT ON E-HEALTH Council of Australian Governments An agreement between the Commonwealth of Australia and the States and Territories, being: The State of New South Wales The State More information QUEENSLAND COUNTRY HEALTH FUND. privacy policy. Queensland Country Health Fund Ltd ABN 18 085 048 237. better health cover shouldn t hurt
QUEENSLAND COUNTRY HEALTH FUND privacy policy Queensland Country Health Fund Ltd ABN 18 085 048 237 better health cover shouldn t hurt 1 2 contents 1. Introduction 4 2. National Privacy Principles 5 3. More information Register of People with Significant Control. Guidance for Companies, Societates Europaeae and Limited Liability Partnerships
Register of People with Significant Control Guidance for Companies, Societates Europaeae and Limited Liability Partnerships Version: 4 Published: 11 April 2016 Overview This guidance explains what you More information EXPLANATORY STATEMENT. Issued by Authority of the Minister for Health. My Health Records Act My Health Records (Assisted Registration) Rule 2015
EXPLANATORY STATEMENT Issued by Authority of the Minister for Health My Health Records Act 2012 My Health Records (Assisted Registration) Rule 2015 The My Health Records Act 2012 (the Act) enables the More information Quick guide to the employment practices code
Data protection Quick guide to the employment practices code Ideal for the small business Contents 3 Contents Section 1 About this guidance 4 Section 2 What is the Data Protection Act? 5 Section 3 Recruitment More information 立 法 會 Legislative Council
立 法 會 Legislative Council Ref : CB1/PL/FA LC Paper No. CB(1)1401/12-13(03) Panel on Financial Affairs Meeting on 5 July 2013 Background brief on proposed establishment of an independent Insurance Authority More information Insurance Prudential Rules. ICR Intermediary Conduct. Non-Bank Financial Institutions Regulatory Authority
Insurance Prudential Rules Intermediary Conduct Non-Bank Financial Institutions Regulatory Authority January 2014 Contents 1. Introduction... 3 1.1. Insurance Prudential Rules... 3 1.2. Purpose... 3 2. More information Consultation Document on Review of the Personal Data (Privacy) Ordinance
Consultation Document on Review of the Personal Data (Privacy) Ordinance August 2009 Contents Page Foreword Executive Summary i iii Chapter One : Introduction 1 Chapter Two : An Overview of the Personal More information PRIVACY POLICY. This document is our privacy policy and it tells you how we collect and manage your personal information.
PRIVACY POLICY Introduction iproximity Pty Ltd (we, our, us) recognise the importance of protecting the privacy and the rights of individuals in relation to their personal information this includes existing More information CHAPTER 124B COMPUTER MISUSE
1 L.R.O. 2005 Computer Misuse CAP. 124B CHAPTER 124B COMPUTER MISUSE ARRANGEMENT OF SECTIONS SECTION PART I PRELIMINARY 1. Short title. 2. Application. 3. Interpretation. PART II PROHIBITED CONDUCT 4. More information HIPAA MANUAL. Most health plans and health care providers that are covered by the new Rule must comply with the new requirements by April 14, 2003.
HIPAA MANUAL What is HIPAA? Health Insurance Portability and Accountability Act. The Health Insurance Portability and Accountability Act (HIPAA) provides rights and protections for participants and beneficiaries More information Mandatory data breach notification in the ehealth record system
Mandatory data breach notification in the ehealth record system Draft September 2012 A guide to mandatory data breach notification under the personally controlled electronic health record system Contents More information Managing General Agents (MGAs) Guideline
Managing General Agents (MGAs) Guideline JUNE 2013 DRAFT FOR COMMENT BC AUTHORIZED LIFE INSURERS www.fic.gov.bc.ca PURPOSE This draft guideline outlines best practices that the Financial Institutions Commission More information Communication between the Auditor and the Insurance Authority
PN 620.2 Revised February 2013 Practice Note 620.2 Communication between the Auditor and the Insurance Authority PRACTICE NOTE 620.2 COMMUNICATION BETWEEN THE AUDITOR AND THE INSURANCE AUTHORITY (Issued More information Credit Union Board of Directors Introduction, Resolution and Code for the Protection of Personal Information
Credit Union Board of Directors Introduction, Resolution and Code for the Protection of Personal Information INTRODUCTION Privacy legislation establishes legal privacy rights for individuals and sets enforceable More information http://www.pcpd.org.hk/english/publications/files/gn_insurance_e.pdf
Briefing Data privacy regulation: Spotlight on Hong Kong insurers Summary Two recent regulatory initiatives will place the Hong Kong insurance industry s use and handling of personal data under greater More information COLLECTIVE INVESTMENT LAW DIFC LAW No. 2 of 2010
---------------------------------------------------------------------------------------------- COLLECTIVE INVESTMENT LAW DIFC LAW No. 2 of 2010 ---------------------------------------------------------------------------------------------- More information Financial Advisers (Amendment) Bill
Financial Advisers (Amendment) Bill Bill No. 15/2015. Read the first time on 11 May 2015. A BILL intituled An Act to amend the Financial Advisers Act (Chapter 110 of the 2007 Revised Edition). Be it enacted More information John Leggott College. Data Protection Policy. Introduction
John Leggott College Data Protection Policy Introduction The College needs to keep certain information about its employees, students and other users to allow it to monitor performance, achievements, and More information Guidance on political campaigning
I ICO guidance Guidance on political campaigning 3 Guidance on political campaigning Data Protection Act Privacy and Electronic Communications Regulations Contents Introduction... 3 A. Why comply?... 5 More information Education programme standards for the registered nurse scope of practice Approved by the Council: June 2005
Education programme standards for the registered nurse scope of practice Approved by the Council: June 2005 1 Introduction The Nursing Council of New Zealand ( the Council ) governs the practice of nurses, More information Consultation Document Disclosure of Teachers Registration Information
Consultation Document Disclosure of Teachers Registration Information Purpose 1.1 This paper aims to collect the public s views on whether it is appropriate for the Education Bureau (EDB) to disclose teachers More information Protection. Code of Practice. of Personal Data RPC001147_EN_WB_L_1
Protection of Personal Data RPC001147_EN_WB_L_1 Table of Contents Data Protection Rules Foreword From the Data Protection Commissioner Introduction From the Chairman Data Protection Responsibility of Employees More information What You Need to Know About the New HIPAA Breach Notification Rule 1
What You Need to Know About the New HIPAA Breach Notification Rule 1 New regulations effective September 23, 2009 require all physicians who are covered by HIPAA to notify patients if there are breaches More information Supervisory Policy Manual
This module should be read in conjunction with the Introduction and with the Glossary, which contains an explanation of abbreviations and other terms used in this Manual. If reading on-line, click on blue More information Information Paper for the Legislative Council Panel on Financial Affairs. Protection of Consumer Credit Data
LC Paper No. CB(1)691/03-04(01) Information Paper for the Legislative Council Panel on Financial Affairs Protection of Consumer Credit Data Purpose Pursuant to the request by the Panel vide the Clerk to More information CODE OF PRACTICE 9. HMRC investigations where we suspect tax fraud
CODE OF PRACTICE 9 HMRC investigations where we suspect tax fraud The HMRC Investigation of Fraud Statement (i) The Commissioners of HMRC reserve complete discretion to pursue a Criminal investigation More information Regulation on Credit Reporting Industry
Translated from Chinese Order of the State Council (No. 631) The Regulation on the Credit Reporting Industry, as adopted at the 228th session of the executive meeting of the State Council on December 26, More information STATUTORY INSTRUMENTS. S.I. No. 623 of 2006 EUROPEAN COMMUNITIES (EUROPEAN PUBLIC LIMITED-LIABILITY COMPANY) (EMPLOYEE INVOLVEMENT) REGULATIONS 2006
STATUTORY INSTRUMENTS. S.I. No. 623 of 2006 EUROPEAN COMMUNITIES (EUROPEAN PUBLIC LIMITED-LIABILITY COMPANY) (EMPLOYEE INVOLVEMENT) REGULATIONS 2006 (Prn. A6/2135) 2 [623] S.I. No. 623 of 2006 EUROPEAN More information BVI Financial Services Commission. Registry of Corporate Affairs. User Guides on the BVI Business Companies Act. User Guide No. 4
BVI Financial Services Commission Registry of Corporate Affairs User Guides on the BVI Business Companies Act User Guide No. 4 Directors and Their Responsibilities This is one of a series of User Guides More information REQUIREMENTS OF NEW ZEALAND COMPANY (LIMITED LIABILITY COMPANY)
ABACONDA MANAGEMENT GROUP REQUIREMENTS OF NEW ZEALAND COMPANY (LIMITED LIABILITY COMPANY) COMPANIES ACT 1993 SUMMARY WITH REFERENCES 2011 Table of Contents Shares of New Zealand Company... 2 Shareholders More information Questions and answers for custodians about the Personal Health Information Privacy and Access Act (PHIPAA)
Questions and answers for custodians about the Personal Health Information Privacy and Access Act (PHIPAA) This document provides answers to some frequently asked questions about the The Personal Health More information QUESTIONS AND ANSWERS HEALTHCARE IDENTIFIERS BILL 2010
About Healthcare Identifiers QUESTIONS AND ANSWERS HEALTHCARE IDENTIFIERS BILL 2010 Q1. What is the Healthcare Identifiers Service? The Healthcare Identifiers (HI) Service will implement and maintain a More information Support USers To Access INformation and Services (Grant Agreement No 297206)
Support USers To Access INformation and Services (Grant Agreement No 297206) Deliverable D5.4 Recommendations on security and privacy issues version 3 Version 1.0 Work Package: WP5 Version & Date: v1.0 More information DATA PROTECTION LAWS OF THE WORLD. India
DATA PROTECTION LAWS OF THE WORLD India Date of Download: 6 February 2016 INDIA Last modified 27 January 2016 LAW IN INDIA There is no specific legislation on privacy and data protection in India. However, More information LEGISLATION COMMITTEE OF THE CROATIAN PARLIAMENT
LEGISLATION COMMITTEE OF THE CROATIAN PARLIAMENT 2300 Pursuant to its authority from Article 59 of the Rules of Procedure of the Croatian Parliament, the Legislation Committee determined the revised text More information NEVADA DEPARTMENT OF JUSTICE Office of the Attorney General A GUIDE TO NON-PROFITS. Catherine Cortez Masto, Attorney General
NEVADA DEPARTMENT OF JUSTICE Office of the Attorney General A GUIDE TO NON-PROFITS Catherine Cortez Masto, Attorney General INTRODUCTION Directors of Nevada nonprofit corporations are responsible for management More information FINAL NOTICE. The Bank of New York Mellon London Branch ( BNYMLB ) The Bank of New York Mellon International Limited ( BNYMIL )
FINAL NOTICE To: The Bank of New York Mellon London Branch ( BNYMLB ) The Bank of New York Mellon International Limited ( BNYMIL ) Reference Numbers: 122467 183100 Address: 1 Canada Square London E14 5AL More information Witness Protection Act 1995 No 87
New South Wales Witness Protection Act 1995 No 87 Status information Currency of version Current version for 5 October 2012 to date (generated 10 October 2012 at 19:15). Legislation on the NSW legislation More information Act CLXV of 2013. on Complaints and Public Interest Disclosures. 1. Complaint and public interest disclosure
Act CLXV of 2013 on Complaints and Public Interest Disclosures The National Assembly, committed to increasing public confidence in the functioning of public bodies, recognising the importance of complaints More information Chapter 91. Regulation 68 Patient Rights under Health Insurance Coverage in Louisiana
D. A copy of the certification form shall be maintained by the insurer and by the producing agent or broker in the policyholder's record for a period of five years from the date of issuance of the insurance More information Tax Agent Services Act 2009
Tax Agent Services Act 2009 No. 13, 2009 An Act to establish the Tax Practitioners Board and to provide for the registration of tax agents and BAS agents, and for related purposes Note: An electronic version More information Supplementary Policy on Data Breach Notification Legislation
http://www.privacy.org.au Secretary@privacy.org.au http://www.privacy.org.au/about/contacts.html 4 May 2013 Supplementary Policy on Data Breach Notification Legislation Introduction It has been reported More information SHARE TRADING POLICY
SHARE TRADING POLICY 1. PURPOSE AND SCOPE 1.1 Terramin Australia Limited (Terramin) is a public company, listed on the Australian Securities Exchange (ASX). Terramin is committed to upholding high standards More information Data Protection Act 1998 The Data Protection Policy for the Borough Council of King's Lynn & West Norfolk
Data Protection Act 1998 The for the Borough Council of King's Lynn & West Norfolk 1 Contents Introduction 3 1. Statement of Intent 4 2. Fair Obtaining I Processing 5 3. Data Uses and Processes 6 4. Data More information JB Hi-Fi Limited Securities Trading Policy
JB Hi-Fi Limited Securities Trading Policy 1. Introduction and scope of this Policy Purpose and objectives 1.1 This document sets out the securities trading policy (Policy) of JB Hi-Fi Limited (JB Hi- More information Data Protection Policy
Data Protection Policy CONTENTS Introduction...2 1. Statement of Intent...2 2. Fair Processing or Privacy Statement...3 3. Data Uses and Processes...4 4. Data Quality and Integrity...4 5. Technical and More information ADVISORY GUIDELINES FOR THE HEALTHCARE SECTOR 11 SEPTEMBER 2014
ADVISORY GUIDELINES FOR THE HEALTHCARE SECTOR 11 SEPTEMBER 2014 1 PART I... 4 1 Introduction... 4 PART II: APPLICATION OF THE DATA PROTECTION PROVISIONS TO SCENARIOS FACED IN THE HEALTHCARE SECTOR... 5 More information Protection. Code of Practice. of Personal Data RPC001147_EN_D_19
Protection of Personal Data RPC001147_EN_D_19 Table of Contents Data Protection Rules Foreword From the Data Protection Commissioner Introduction From the Chairman Data Protection Rules Responsibility More information Quorum Privacy Policy
Quorum Privacy Policy Quorum Analytics Inc. ( Quorum") has created this website (the "Website" or the "Site") to provide an online analytical tool that Subscribers can use to generate Derived Analytics More information Part 9 Accounts and Audit
Part 9 Accounts and Audit INTRODUCTION Part 9 (Accounts and Audit) of the new Companies Ordinance (Cap. 622) ( new CO ) contains the accounting and auditing requirements, namely provisions in relation More information Responsibilities of Custodians and Health Information Act Administration Checklist
Responsibilities of Custodians and Administration Checklist APPENDIX 3 Responsibilities of Custodians in Administering the Each custodian under the Act must establish internal processes and procedures More information HIPAA Refresher. HIPAA Health Insurance Portability & Accountability Act
HIPAA Health Insurance Portability & Accountability Act This presentation and materials provided are for informational purposes only. Please seek legal advisor assistance when dealing with privacy and More information REGULATORY CHANGES DEMAND AN ENTERPRISE-WIDE APPROACH TO DISCLOSURE MANAGEMENT OF PHI
REGULATORY CHANGES DEMAND AN ENTERPRISE-WIDE APPROACH TO DISCLOSURE MANAGEMENT OF PHI Healthcare Organizations Can Adopt Enterprise-Wide Disclosure Management Systems To Standardize Disclosure Processes, More information Data protection policy
Data protection policy Introduction The College is required to keep certain information about employees, students and other users to allow it to monitor performance, achievements, health and safety, recruitment More information Share trading policy. Mortgage Choice Limited ABN 57 009 161 979 ME_89157250_10 (W2003)
Share trading policy Mortgage Choice Limited ABN 57 009 161 979 2 Share trading policy 1. Introduction 1.1 The shares of Mortgage Choice Limited ABN 57 009 161 979 (the Company) are quoted on the Australian More information AS APPROVED BY CONVOCATION, MARCH 25, 2004. (new/amended rules and commentary for rule 2.02)
AS APPROVED BY CONVOCATION, MARCH 25, 2004 (new/amended rules and commentary for rule 2.02) When Client an Organization (1.1) Notwithstanding that the instructions may be received from an officer, employee, More information PLEASE NOTE. For more information concerning the history of this Act, please see the Table of Public Acts.
PLEASE NOTE This document, prepared by the Legislative Counsel Office, is an office consolidation of this Act, current to May 30, 2012. It is intended for information and reference purposes only. This More information KINGDOM OF SAUDI ARABIA. Capital Market Authority CREDIT RATING AGENCIES REGULATIONS
KINGDOM OF SAUDI ARABIA Capital Market Authority CREDIT RATING AGENCIES REGULATIONS English Translation of the Official Arabic Text Issued by the Board of the Capital Market Authority Pursuant to its Resolution More information New South Wales. 1 Name of Act 2 Commencement 3 Definitions 4 Who is a witness?