Persons who provide to custodians
 6. (1) Except as otherwise required by law, the following are prescribed as requirements for the purposes of subsection 10 (4) of the Act with respect to a person who supplies services for the purpose of enabling a health information custodian to use electronic means to collect, use, modify, disclose, retain or dispose of personal health information, and who is not an agent of the custodian: 1. The person shall not use any personal health information to which it has access in the course of providing the services for the health information custodian except as necessary in the course of providing the services. 2. The person shall not disclose any personal health information to which it has access in the course of providing the services for the health information custodian. 3. The person shall not permit its employees or any person acting on its behalf to be able to have access to the information unless the employee or person acting on its behalf agrees to comply with the restrictions that apply to the person who is subject to this subsection.  O. Reg. 329/04, s. 6 (1). (2) In subsection (3), “health information network provider” or “provider” means a person who provides services to two or more health information custodians where the services are provided primarily to custodians to enable the custodians to use electronic means to disclose personal health information to one another, whether or not the person is an agent of any of the custodians.  O. Reg. 329/04, s. 6 (2). (3) The following are prescribed as requirements with respect to a health information network provider in the course of providing services to enable a health information custodian to use electronic means to collect, use, disclose, retain or dispose of personal health information: 1. The provider shall notify every applicable health information custodian at the first reasonable opportunity if, i. the provider accessed, used, disclosed or disposed of personal health information other than in accordance with paragraphs 1 and 2 of subsection (1), or ii. an unauthorized person accessed the personal health information. 2. The provider shall provide to each applicable health information custodian a plain language description of the services that the provider provides to the custodians, that is appropriate for sharing with the individuals to whom the personal health information relates, including a general description of the safeguards in place to protect against unauthorized use and disclosure, and to protect the integrity of the information. 3. The provider shall make available to the public, i. the description referred to in paragraph 2, ii. any directives, guidelines and policies of the provider that apply to the services that the provider provides to the health information custodians to the extent that these do not reveal a trade secret or confidential scientific, technical, commercial or labour relations information, and iii. a general description of the safeguards implemented by the person in relation to the security and confidentiality of the information. 4. The provider shall to the extent reasonably practical, and in a manner that is reasonably practical, keep and make available to each applicable health information custodian, on the request of the custodian, an electronic record of, i. all accesses to all or part of the personal health information associated with the custodian being held in equipment controlled by the provider, which record shall identify the person who accessed the information and the date and time of the access, and ii. all transfers of all or part of the information associated with the custodian by means of equipment controlled by the provider, which record shall identify the person who transferred the information and the person or address to whom it was sent, and the date and time it was sent. 5. The provider shall perform, and provide to each applicable health information custodian a written copy of the results of, an assessment of the services provided to the health information custodians, with respect to, i. threats, vulnerabilities and risks to the security and integrity of the personal health information, and ii. how the services may affect the privacy of the individuals who are the subject of the information. 6. The provider shall ensure that any third party it retains to assist in providing services to a health information custodian agrees to comply with the restrictions and conditions that are necessary to enable the provider to comply with this section. 7. The provider shall enter into a written agreement with each health information custodian concerning the services provided to the custodian that, i. describes the services that the provider is required to provide for the custodian, ii. describes the administrative, technical and physical safeguards relating to the confidentiality and security of the information, and iii. requires the provider to comply with the Act and the regulations.  O. Reg. 329/04, s. 6 (3). (4) A health information custodian who uses goods or services supplied by a person referred to in subsection 10 (4) of the Act, other than a person who is an agent of the custodian, for the purpose of using electronic means to collect, use, modify, disclose, retain or dispose of personal health information shall not be considered in so doing to make the information available or to release it to that person for the purposes of the definition of “disclose” in section 2 of the Act if, (a) the person complies with subsections (1) and (3), to the extent that either is applicable, in supplying services; and (b) in the case of a person supplying goods to the health information custodian, the custodian does not, in returning the goods to the person, enable the person to access the personal health information except where subsection (1) applies and is complied with.  O. Reg. 329/04, s. 6 (4). 6.1 Revoked: O. Reg. 62/20, s. 1.