293 (1) A service provider may disclose personal information collected by the service provider under the authority of this Act to a prescribed entity for the purposes of analysis or compiling statistical information with respect to the management of, evaluation or monitoring of services, the allocation of resources to or planning for those services, including their delivery, if the prescribed entity meets the requirements under subsection (5). Disclosure to other person or entity (2) A service provider may, subject to the prescribed requirements and restrictions, disclose personal information collected by the service provider under the authority of this Act to a person or entity that is not a prescribed entity for the purposes described in subsection (1) and a person or entity to whom a service provider discloses personal information under this subsection shall comply with any prescribed requirements and restrictions with respect to the use, security, disclosure, return or disposal of the information. Minister may require disclosure (3) The Minister may require a service provider to disclose information, including personal information, to a prescribed entity, if the prescribed entity meets the requirements under subsection (5), or to a person or entity that is not a prescribed entity, for the purposes described in subsection (1) and a person or entity, including a prescribed entity, to whom a service provider discloses information under this subsection shall comply with any prescribed requirements and restrictions with respect to the use, security, disclosure, return or disposal of the information. Exception (4) Subsections (1), (2) and (3) do not apply to prescribed information in prescribed circumstances. Requirements for prescribed entity (5) A service provider may disclose personal information to a prescribed entity under subsection (1) or (3) if, (a) the prescribed entity has in place practices and procedures to protect the privacy of the individuals whose personal information it receives and to maintain the confidentiality of the information; and (b) the Commissioner has approved the practices and procedures. Exception (6) Despite clause (5) (b), a service provider may disclose personal information to a prescribed entity under subsection (1) or (3) before the first anniversary of the day this section comes into force even if the Commissioner has not approved its practices and procedures. Review of practices and procedures by Commissioner (7) The Commissioner shall review the practices and procedures of each prescribed entity every three years after they were first approved and advise the service provider whether the prescribed entity continues to meet the requirements of subsection (5). Prescribed entity or other person or entity may collect personal information (8) A prescribed entity or a person or entity that is not a prescribed entity is authorized to collect the personal information that a service provider may disclose to it under subsection (1), (2) or (3). Use and disclosure of personal information by prescribed entity, other person or entity (9) Subject to the exceptions and additional requirements, if any, that are prescribed, a prescribed entity or a person or entity that is not a prescribed entity that receives personal information under subsection (1), (2) or (3) shall not use the information except for the purposes for which it received the information and shall not disclose the information except as required by law. Deemed compliance (10) For the purpose of clause 42 (1) (e) of the
Freedom of Information and Protection of Privacy Act, clause 32 (e) of the Municipal Freedom of Information and Protection of Privacy Act or clause 43 (1) (h) of the Personal Health Information Protection Act, 2004, a disclosure of personal information by an institution or a health information custodian, within the meaning of those Acts, under this section is deemed to be for the purposes of complying with this Act. Records of mental disorders