jswizzle3737/ontario_laws_and_regs huggingface dataset:
Prescribed entities, s. 293 of the Act
  1. The following entities are prescribed for the purposes of section 293 of the Act: 1. The Canadian Institute for Health Information. 2. The Institute for Clinical Evaluative Sciences.
Prescribed restrictions, s. 293 (2) of the Act
  2. The following requirements and restrictions apply to the disclosure of personal information by a service provider to a person or entity under subsection 293 (2) of the Act: 1. A service provider may only disclose the personal information if, i. the person or entity to which the information will be disclosed identifies as a First Nations, Inuit or Métis person or entity, ii. the information relates to First Nations, Inuit or Métis individuals, iii. the service provider and the person or entity to which the information will be disclosed have entered into an agreement with respect to the use, security, disclosure, return or disposal of the information, iv. the agreement referred to in subparagraph iii, A. requires the person or entity to whom the information is disclosed to notify the service provider who disclosed it of any loss or theft of the personal information or of any unauthorized use or disclosure of the information, and B. sets out how the person or entity will notify the service provider, v. the service provider has received written acknowledgement from each of the bands or First Nations, Inuit or Métis communities whose member’s personal information will be disclosed, indicating that the band or community approves of the fact that the person or entity will receive the personal information, and vi. the service provider has received written acknowledgement from each of the bands or First Nations, Inuit or Métis communities with which an individual whose personal information will be disclosed identifies, indicating that the band or community approves of the fact that the person or entity will receive the personal information.
Prescribed excluded information, s. 293 (1), (2) and (3) of the Act
  3. The following information and corresponding circumstances are prescribed for the purposes of subsection 293 (4) of the Act: 1. Recorded information that documents the content of conversations that took place during a counselling session.
Restrictions on use of personal information by Minister and service provider
 5. The Minister shall not use personal information for the purposes described in paragraph 6 of subsection 283 (1) of the Act and a service provider shall not use personal information collected for the purposes of providing a service for the purpose set out in clause 291 (1) (j) of the Act unless the following requirements are met: 1. The Minister or service provider, as the case may be, prepares a research plan that meets the requirements of subsection 4 (2) with the exception of those requirements set out in, i. paragraphs 12 and 14 of that subsection, in the case of the Minister, or ii paragraph 12 of that subsection, in the case of a service provider. 2. The Minister or service provider, as the case may be, submits the research plan to a research ethics board that meets the criteria set out in paragraph 1 of subsection 4 (1). 3. The Minister or service provider, as the case may be, has received written confirmation from each member of the research ethics board that the member’s personal interest in the use of the personal information or the performance of the research does not conflict or appear to conflict with the member’s ability to objectively review the research plan. 4. The research ethics board has approved the plan.
Applications under ss. 302, 304 and 305 of the Act
 7. (1) The Consent and Capacity Board continued under the Health Care Consent Act, 1996 is prescribed as the body for the purposes of sections 302, 304 and 305 of the Act.  (2) For the purposes of subsections 302 (10), 304 (4), and 305 (10) of the Act, in conducting an application under section 302, 304 or 305 of the Act, respectively, the Consent and Capacity Board shall comply with sections 73 to 79 of the Health Care Consent Act, 1996.
Additional requirements, s. 308 (2) of the Act
 8. The following additional requirements are prescribed for the purposes of subsection 308 (2) of the Act: 1. The service provider shall notify the individual in plain, easy-to-understand language, and the notification shall include a general description of how the personal information was lost, stolen or used or disclosed without authority. 2. The service provider shall inform the individual of any steps the service provider has taken to, i. prevent a similar theft or loss or unauthorized use or disclosure of personal information from recurring, and ii. mitigate possible adverse effects on the individual that may be caused by the theft or loss or unauthorized use or disclosure. 3. The service provider shall provide the individual with the contact information of an employee of the service provider who can provide the individual with additional information about the theft or loss or unauthorized use or disclosure.
Prescribed circumstances, s. 308 (3) of the Act
  9. Each of the following circumstances is prescribed for the purposes of subsection 308 (3) of the Act: 1.   The service provider has reasonable grounds to believe that the personal information was used or disclosed without authority by a person who knew or ought to have known that the person was using or disclosing the information without authority. 2.   The service provider has reasonable grounds to believe that the personal information was stolen. 3.   The service provider has reasonable grounds to believe that the personal information that was stolen or lost or used or disclosed without authority was or will be further used or disclosed without authority. 4.   The loss or unauthorized use or disclosure of the personal information is part of a pattern of similar losses or unauthorized uses or disclosures of personal information in the custody or control of the service provider. 5. The service provider has reasonable grounds to believe that personal information that the service provider disclosed, to a prescribed entity or a person or entity that is not a prescribed entity under subsection 293 (1), (2) or (3) of the Act, has been stolen or lost or used or disclosed without authority by the prescribed entity or the person or entity that is not a prescribed entity. 6. An employee of the service provider is terminated, suspended or disciplined as the result of the theft, loss or unauthorized use or disclosure of personal information by the employee. 7. An employee of the service provider resigns and the service provider has reasonable grounds to believe that the resignation is related to an investigation or other action by the service provider with respect to the theft, loss or unauthorized use or disclosure of personal information by the employee. 8. The service provider determines that the loss or unauthorized use or disclosure of the personal information is significant after considering all relevant circumstances, including, i. the sensitivity of the personal information that was lost or used or disclosed without authority, ii. the volume of the personal information that was lost or used or disclosed without authority, iii. the number of persons whose personal information was lost or used or disclosed without authority, and iv. whether one or more service providers were involved in the loss or unauthorized use or disclosure of the personal information.