jswizzle3737/ontario_laws_and_regs huggingface dataset:
36 (1) A health information custodian may collect personal health information about an individual indirectly if, (a)  the individual consents to the collection being made indirectly; (b)  the information to be collected is reasonably necessary for providing health care or assisting in providing health care to the individual and it is not reasonably possible to collect, directly from the individual, (i)  personal health information that can reasonably be relied on as accurate and complete, or (ii)  personal health information in a timely manner; (c)  the custodian is an institution within the meaning of the Freedom of Information and Protection of Privacy Act
or the Municipal Freedom of Information and Protection of Privacy Act, or is acting as part of such an institution, and the custodian is collecting the information for a purpose related to, (i)  investigating a breach of an agreement or a contravention or an alleged contravention of the laws of Ontario or Canada, (ii)  the conduct of a proceeding or a possible proceeding, or (iii)  the statutory function of the custodian; (d)  the custodian collects the information from a person who is not a health information custodian for the purpose of carrying out research conducted in accordance with subsection 37 (3) or research that a research ethics board has approved under section 44 or that meets the criteria set out in clauses 44 (10) (a) to (c), except if the person is prohibited by law from disclosing the information to the custodian; (e)  the custodian is a prescribed entity mentioned in subsection 45 (1) and the custodian is collecting personal health information from a person who is not a health information custodian for the purpose of that subsection; (f)  the Commissioner authorizes that the collection be made in a manner other than directly from the individual; (g)  the custodian collects the information from a person who is permitted or required by law or by a treaty, agreement or arrangement made under an Act or an Act of Canada to disclose it to the custodian; or (h)  subject to the requirements and restrictions, if any, that are prescribed, the health information custodian is permitted or required by law or by a treaty, agreement or arrangement made under an Act or an Act of Canada to collect the information indirectly.  2004, c. 3, Sched. A, s. 36 (1); 2007, c. 10, Sched. H, s. 11. Direct collection without consent (2) A health information custodian may collect personal health information about an individual directly from the individual, even if the individual is incapable of consenting, if the collection is reasonably necessary for the provision of health care and it is not reasonably possible to obtain consent in a timely manner.  2004, c. 3, Sched. A, s. 36 (2). Section Amendments with date in force (d/m/y) 2007, c. 10, Sched. H, s. 11 - 04/06/2007 Use
40 (1) A health information custodian may disclose personal health information about an individual if the custodian believes on reasonable grounds that the disclosure is necessary for the purpose of eliminating or reducing a significant  risk of serious bodily harm to a person or group of persons.  2004, c. 3, Sched. A, s. 40 (1). Disclosures related to care or custody (2) A health information custodian may disclose personal health information about an individual to the head of a penal or other custodial institution in which the individual is being lawfully detained or to the officer in charge of a psychiatric facility within the meaning of the Mental Health Act in which the individual is being lawfully detained for the purposes described in subsection (3).  2004, c. 3, Sched. A, s. 40 (2). Same (3) A health information custodian may disclose personal health information about an individual under subsection (2) to assist an institution or a facility in making a decision concerning, (a)  arrangements for the provision of health care to the individual; or (b)  the placement of the individual into custody, detention, release, conditional release, discharge or conditional discharge under Part VI of the Child, Youth and Family Services Act, 2017, the Mental Health Act, the Ministry of Correctional Services Act, the Corrections and Conditional Release Act (Canada), Part XX.1 of the Criminal Code (Canada), the Prisons and Reformatories Act
(Canada) or the Youth Criminal Justice Act
(Canada).  2004, c. 3, Sched. A, s. 40 (3); 2017, c. 14, Sched. 4, s. 28 (2). Note: On a day to be named by proclamation of the Lieutenant Governor, clause 40 (3) (b) of the Act is amended by striking out “the Mental Health Act, the Ministry of Correctional Services Act” and substituting “the
Correctional Services and Reintegration Act, 2018, the Mental Health Act”. (See: 2018, c. 6, Sched. 3, s. 11) Section Amendments with date in force (d/m/y) 2017, c. 14, Sched. 4, s. 28 (2) - 30/04/2018 2018, c. 6, Sched. 3, s. 11 - not in force
41 (1) A health information custodian may disclose personal health information about an individual, (a)  subject to the requirements and restrictions, if any, that are prescribed, for the purpose of a proceeding or contemplated proceeding in which the custodian or the agent or former agent of the custodian is, or is expected to be, a party or witness, if the information relates to or is a matter in issue in the proceeding or contemplated proceeding; (b)  to a proposed litigation guardian or legal representative of the individual for the purpose of having the person appointed as such; (c)  to a litigation guardian or legal representative who is authorized under the Rules of Civil Procedure, or by a court order, to commence, defend or continue a proceeding on behalf of the individual or to represent the individual in a proceeding; or (d)  for the purpose of complying with, (i)  a summons, order or similar requirement issued in a proceeding by a person having jurisdiction to compel the production of information, or (ii)  a procedural rule that relates to the production of information in a proceeding.  2004, c. 3, Sched. A, s. 41 (1). Disclosure by agent or former agent (2) An agent or former agent who receives personal health information under subsection (1) or under subsection 37 (2) for purposes of a proceeding or contemplated proceeding may disclose the information to the agent’s or former agent’s professional advisor for the purpose of providing advice or representation to the agent or former agent, if the advisor is under a professional duty of confidentiality.  2004, c. 3, Sched. A, s. 41 (2).
42 (1) A health information custodian may disclose personal health information about an individual to a potential successor of the custodian, for the purpose of allowing the potential successor to assess and evaluate the operations of the custodian, if the potential successor first enters into an agreement with the custodian to keep the information confidential and secure and not to retain any of the information longer than is necessary for the purpose of the assessment or evaluation.  2004, c. 3, Sched. A, s. 42 (1). Transfer to successor (2) A health information custodian may transfer records of personal health information about an individual to the custodian’s successor if the custodian makes reasonable efforts to give notice to the individual before transferring the records or, if that is not reasonably possible, as soon as possible after transferring the records.  2004, c. 3, Sched. A, s. 42 (2). Transfer to archives (3) Subject to the agreement of the person who is to receive the transfer, a health information custodian may transfer records of personal health information about an individual to, (a)  the Archives of Ontario; or (b)  in the prescribed circumstances, a prescribed person whose functions include the collection and preservation of records of historical or archival importance, if the disclosure is made for the purpose of that function.  2004, c. 3, Sched. A, s. 42 (3).
45 (1) A health information custodian may disclose to a prescribed entity personal health information for the purpose of analysis or compiling statistical information with respect to the management of, evaluation or monitoring of, the allocation of resources to or planning for all or part of the health system, including the delivery of services, if the entity meets the requirements under subsection (3).  2004, c. 3, Sched. A, s. 45 (1). Exception (2) Subsection (1) does not apply to, (a)  notes of personal health information about an individual that are recorded by a health information custodian and that document the contents of conversations during a private counselling session or a group, joint or family counselling session; or (b)  prescribed information in circumstances that are prescribed.  2004, c. 3, Sched. A, s. 45 (2). Approval (3) A health information custodian may disclose personal health information to a prescribed entity under subsection (1) if, (a)  the entity has in place practices and procedures to protect the privacy of the individuals whose personal health information it receives and to maintain the confidentiality of the information; and (b)  the Commissioner has approved the practices and procedures, if the custodian makes the disclosure on or after the first anniversary of the day this section comes into force.  2004, c. 3, Sched. A, s. 45 (3). Review by Commissioner (4) The Commissioner shall review the practices and procedures of each prescribed entity every three years from the date of its approval and advise the health information custodian whether the entity continues to meet the requirements of subsection (3).  2004, c. 3, Sched. A, s. 45 (4). Authorization to collect (5) An entity that is not a health information custodian is authorized to collect the personal health information that a health information custodian may disclose to the entity under subsection (1).  2004, c. 3, Sched. A, s. 45 (5). Use and disclosure (6) Subject to the exceptions and additional requirements, if any, that are prescribed and despite subsection 49 (1), an entity that receives personal health information under subsection (1) shall not use the information except for the purposes for which it received the information and shall not disclose the information except as required by law.  2004, c. 3, Sched. A, s. 45 (6). Additional uses, extra-ministerial data integration unit (7) Despite subsection (6), if an entity that receives personal health information under subsection (1) is an extra-ministerial data integration unit within the meaning of Part III.1 of the
Freedom of Information and Protection of Privacy Act, or if such an extra-ministerial data integration unit is located within the entity, the entity may also use the personal health information for a purpose set out in section 49.2 of that Act if the entity complies with Part III.1 of that Act as if it were initially collecting the personal health information. 2020, c. 5, Sched. 6, s. 7. Section Amendments with date in force (d/m/y) 2020, c. 5, Sched. 6, s. 7 - 25/03/2020
46 (1) If requested by the Minister or the minister of a prescribed ministry, a health information custodian shall disclose personal health information to the minister who made the request for the purpose of determining, providing, monitoring or verifying payment or funding for health care funded wholly or in part by the Ministry, the prescribed ministry, a local health integration network or the Agency or for goods used for health care funded wholly or in part by one or more of them. 2020, c. 5, Sched. 6, s. 8 (1). Note: On a day to be named by proclamation of the Lieutenant Governor, subsection 46 (1) of the Act is amended by striking out “a local health integration network”. (See: 2020, c. 5, Sched. 6, s. 8 (2)) Disclosure by minister (2) The Minister or a minister of a prescribed ministry may disclose information collected under subsection (1) to any person for a purpose set out in that subsection if the disclosure is reasonably necessary for that purpose. 2020, c. 5, Sched. 6, s. 8 (1). Other information (3) The Minister or minister of a prescribed ministry, as the case may be, who makes a request under subsection (1) shall not collect, use or disclose personal health information if other information will serve the purpose of the collection, use or disclosure. 2020, c. 5, Sched. 6, s. 8 (1). Extent of information (4) The Minister or minister of a prescribed ministry, as the case may be, who makes a request under subsection (1) shall not collect, use or disclose more personal health information than is reasonably necessary to meet the purpose of the collection, use or disclosure, as the case may be. 2020, c. 5, Sched. 6, s. 8 (1). Section Amendments with date in force (d/m/y) 2006, c. 4, s. 51 (4) - 28/03/2006 2019, c. 5, Sched. 3, s. 17 (7) - 06/06/2019; 2019, c. 5, Sched. 3, s. 17 (8) - no effect - see 2020, c. 5, Sched. 6, s. 25 - 25/03/2020 2020, c. 5, Sched. 6, s. 8 (1) - 25/03/2020; 2020, c. 5, Sched. 6, s. 8 (2) - not in force
48 (1) A health data institute to which a health information custodian has disclosed personal health information under section 47, shall, upon the request of the Minister and in accordance with the Commissioner’s approval given under this section, disclose the information to the Minister or another person approved by the Minister if the Minister is of the opinion that it is in the public interest to request the disclosure and the requirements of this section have been met.  2004, c. 3, Sched. A, s. 48 (1). Non-application of section (2) The personal health information mentioned in subsection (1) is not, (a)  notes of personal health information about an individual that are recorded by a health information custodian and that document the contents of conversations during a private counselling session or a group, joint or family counselling session; or (b)  information that is prescribed.  2004, c. 3, Sched. A, s. 48 (2). Commissioner’s approval required (3) The Minister shall not request the disclosure of personal health information under subsection (1) unless the Minister has submitted to the Commissioner a proposal for the disclosure and the Commissioner has approved the proposal.  2004, c. 3, Sched. A, s. 48 (3). Contents of proposal (4) The proposal must include, (a)  a statement as to why the disclosure is reasonably required in the public interest and why the disclosure under section 47 was insufficient to meet the public interest; (b)  the extent of the identifiers that the Minister proposes be part of the information disclosed and a statement as to why the use of those identifiers is reasonably required for the purpose of the disclosure; (c)  a copy of all proposals and comments previously made or received under section 47 in respect of the information, if any; and (d)  all other information that the Commissioner requires.  2004, c. 3, Sched. A, s. 48 (4). Terms of approval (5) If the Commissioner approves the proposal, the Commissioner may specify terms, conditions or limitations for the disclosure.  2004, c. 3, Sched. A, s. 48 (5).
49 (1) Except as permitted or required by law and subject to the exceptions and additional requirements, if any, that are prescribed, a person who is not a health information custodian and to whom a health information custodian discloses personal health information, shall not use or disclose the information for any purpose other than, (a)  the purpose for which the custodian was authorized to disclose the information under this Act; or (b)  the purpose of carrying out a statutory or legal duty.  2004, c. 3, Sched. A, s. 49 (1). Extent of use or disclosure (2) Subject to the exceptions and additional requirements, if any, that are prescribed, a person who is not a health information custodian, and to whom a health information custodian discloses personal health information, shall not use or disclose more of the information than is reasonably necessary to meet the purpose of the use or disclosure, as the case may be, unless the use or disclosure is required by law.  2004, c. 3, Sched. A, s. 49 (2). Employee or agent information (3) Except as permitted or required by law and subject to the exceptions and additional requirements, if any, that are prescribed, if a health information custodian discloses information to another health information custodian and the information is identifying information of the type described in subsection 4 (4) in the custody or under the control of the receiving custodian, the receiving custodian shall not, (a)  use or disclose the information for any purpose other than, (i)  the purpose for which the disclosing custodian was authorized to disclose the information under this Act, or (ii)  the purpose of carrying out a statutory or legal duty; or (b)  use or disclose more of the information than is reasonably necessary to meet the purpose of the use or disclosure, as the case may be.  2004, c. 3, Sched. A, s. 49 (3). Same (4) The restrictions set out in clauses (3) (a) and (b) apply to a health information custodian that receives the identifying information described in subsection (3) even if the custodian receives the information before the day that subsection comes into force.  2004, c. 3, Sched. A, s. 49 (4). Freedom of information legislation (5) Except as prescribed, subsections (1) to (4) do not apply to an institution within the meaning of the Freedom of Information and Protection of Privacy Act or the Municipal Freedom of Information and Protection of Privacy Act
that is not a health information custodian or to a person employed by or acting for such an institution when the person is acting in that capacity.  2007, c. 10, Sched. H, s. 17. Same (6) Where this Act permits or requires a health information custodian to disclose personal health information to an institution within the meaning of the Freedom of Information and Protection of Privacy Act or the Municipal Freedom of Information and Protection of Privacy Act that is not a health information custodian, the institution may collect the information from the custodian.  2007, c. 10, Sched. H, s. 17. Section Amendments with date in force (d/m/y) 2007, c. 10, Sched. H, s. 17 - 04/06/2007
50 (1) A health information custodian may disclose personal health information about an individual collected in Ontario to a person outside Ontario only if, (a)  the individual consents to the disclosure; (b)  this Act permits the disclosure; (c)  the person receiving the information performs functions comparable to the functions performed by a person to whom this Act would permit the custodian to disclose the information in Ontario under subsection 40 (2) or clause 43 (1) (b), (c), (d) or (e); (d)  the following conditions are met: (i)  the custodian is a prescribed entity mentioned in subsection 45 (1) and is prescribed for the purpose of this clause, (ii)  the disclosure is for the purpose of health planning or health administration, (iii)  the information relates to health care provided in Ontario to a person who is resident of another province or territory of Canada, and (iv)  the disclosure is made to the government of that province or territory; (e)  the disclosure is reasonably necessary for the provision of health care to the individual, but not if the individual has expressly instructed the custodian not to make the disclosure; or (f)  the disclosure is reasonably necessary for the administration of payments in connection with the provision of health care to the individual or for contractual or legal requirements in that connection.  2004, c. 3, Sched. A, s. 50 (1). Notice of instruction (2) If a health information custodian discloses personal health information about an individual under clause (1) (e) and if an instruction of the individual made under that clause prevents the custodian from disclosing all the personal health information that the custodian considers reasonably necessary to disclose for the provision of health care to the individual, the custodian shall notify the person to whom it makes the disclosure of that fact.  2004, c. 3, Sched. A, s. 50 (2). PART V   ACCESS TO Records of PERSONAL HEALTH INFORMATION AND CORRECTION Access
53 (1) An individual may exercise a right of access to a record of personal health information by making a written request for access to the health information custodian that has custody or control of the information.  2004, c. 3, Sched. A, s. 53 (1). Detail in request (2) The request must contain sufficient detail to enable the health information custodian to identify and locate the record with reasonable efforts.  2004, c. 3, Sched. A, s. 53 (2). Assistance (3) If the request does not contain sufficient detail to enable the health information custodian to identify and locate the record with reasonable efforts, the custodian shall offer assistance to the person requesting access in reformulating the request to comply with subsection (2).  2004, c. 3, Sched. A, s. 53 (3).
55.1 (1) In this Part, “advisory committee” means the advisory committee established by the Minister under section 55.11; (“comité consultatif”) “consent directive” means a directive under section 55.6 and includes a directive to modify or withdraw a directive that has already been made; (“directive en matière de consentement”) “electronic health record” means the electronic systems that are developed and maintained by the prescribed organization for the purpose of enabling health information custodians to collect, use and disclose personal health information by means of the systems in accordance with this Part and the regulations made under this Part; (“dossier de santé électronique”) “identifying information” has the same meaning as in subsection 4 (2). (“renseignements identificatoires”) 2016, c. 6, Sched. 1, s. 1 (11); 2019, c. 15, Sched. 30, s. 5. What constitutes collection, use, disclosure re: electronic health record (2) Despite anything in section 2, for the purposes of this Part, a health information custodian is considered to be collecting, using or disclosing personal health information in the following circumstances: 1.  When a health information custodian views, handles or otherwise deals with all or part of an individual’s personal health information by means of the electronic health record and that information was provided to the prescribed organization by another health information custodian, i.  the health information custodian is considered to be collecting the personal health information if it is viewing, handling or otherwise dealing with the information for the first time, and ii.  the health information custodian is considered to be using the personal health information each time it subsequently views, handles or otherwise deals with the information. 2.  Whenever a health information custodian views, handles or otherwise deals with all or part of an individual’s personal health information by means of the electronic health record and that information was provided to the prescribed organization by the custodian, the custodian is considered to be using the personal health information. 3.  A health information custodian who provides personal health information to the prescribed organization is considered to be disclosing the information only when another health information custodian collects the information by means of the electronic health record. 2016, c. 6, Sched. 1, s. 1 (11). Same, where information provided to prescribed organization (3) Despite anything in section 2, when a health information custodian provides personal health information to the prescribed organization, (a)  the custodian is considered not to be disclosing the information to the prescribed organization; and (b)  the prescribed organization is considered not to be collecting the information from the custodian. 2016, c. 6, Sched. 1, s. 1 (11). Section Amendments with date in force (d/m/y) 2016, c. 6, Sched. 1, s. 1 (11) - 01/10/2020 2019, c. 15, Sched. 30, s. 5 - 01/10/2020
55.2 (1) The prescribed organization has the power and the duty to develop and maintain the electronic health record in accordance with this Part and the regulations made under this Part. 2016, c. 6, Sched. 1, s. 1 (12). Functions of prescribed organization (2) The prescribed organization shall perform the following functions: 1.  Manage and integrate personal health information it receives from health information custodians. 2.  Ensure the proper functioning of the electronic health record by servicing the electronic systems that support the electronic health record. 3.  Ensure the accuracy and quality of the personal health information that is accessible by means of the electronic health record by conducting data quality assurance activities on the personal health information it receives from health information custodians. 4.  Conduct analyses of the personal health information that is accessible by means of the electronic health record in order to provide alerts and reminders to health information custodians for their use in the provision of health care to individuals. 2016, c. 6, Sched. 1, s. 1 (12). Other powers and duties (3) In addition to carrying out the powers, duties and functions described in this Part and in Part V, the prescribed organization shall carry out any prescribed powers, duties or functions. 2016, c. 6, Sched. 1, s. 1 (12). Section Amendments with date in force (d/m/y) 2016, c. 6, Sched. 1, s. 1 (12) - 01/10/2020
55.4 (1) The Minister may make directives to the prescribed organization with respect to the carrying out of its powers, duties and functions under this Part, and the prescribed organization shall comply with the directives of the Minister. 2016, c. 6, Sched. 1, s. 1 (14). Consultation (2) Before making a directive under subsection (1), the Minister shall, (a)  submit a draft of the directive to the Commissioner and the advisory committee for the purpose of reviewing and making recommendations on the draft directive; and (b)  consider the recommendations, if any, made by the Commissioner and the advisory committee and amend the directive if the Minister considers it appropriate to do so. 2016, c. 6, Sched. 1, s. 1 (14). Timing (3) The Minister shall allow the Commissioner and the advisory committee a period of at least 30 days for the purposes of review and recommendation under subsection (2), unless the Minister believes that there are urgent circumstances involving a significant risk to privacy or the confidentiality of personal health information, in which case the Minister may abridge the review period for both the Commissioner and the advisory committee to not less than five business days. 2016, c. 6, Sched. 1, s. 1 (14). Section Amendments with date in force (d/m/y) 2016, c. 6, Sched. 1, s. 1 (14) - 01/10/2020 Collection, use, disclosure by custodians
55.6 (1) Subject to the limitations prescribed in the regulations, if any, an individual may at any time make a directive that withholds or withdraws, in whole or in part, the individual’s consent to the collection, use and disclosure of his or her personal health information by means of the electronic health record by a health information custodian for the purposes of providing or assisting in the provision of health care to the individual. 2016, c. 6, Sched. 1, s. 1 (16). Compliance (2) Where the prescribed organization receives a directive made under subsection (1), it shall, in accordance with the requirements prescribed in the regulations, if any, implement the directive. 2016, c. 6, Sched. 1, s. 1 (16). Withdrawal or modifications (3) Subject to the limitations prescribed in the regulations, if any, an individual who has made a directive under subsection (1) may withdraw or modify the directive. 2016, c. 6, Sched. 1, s. 1 (16). How to make directive (4) An individual may make a directive under subsection (1) or withdraw or modify a directive under subsection (3) by submitting the directive to the prescribed organization. 2016, c. 6, Sched. 1, s. 1 (16). Must contain sufficient detail (5) The directive must contain sufficient detail to enable the prescribed organization to implement the directive. 2016, c. 6, Sched. 1, s. 1 (16). Assistance (6) If the directive does not contain sufficient detail to enable the prescribed organization to implement the directive with reasonable efforts, the prescribed organization shall offer assistance to the person in reformulating the directive to comply with subsection (5). 2016, c. 6, Sched. 1, s. 1 (16). Information re directives (7) If a health information custodian seeks to collect personal health information that is subject to a consent directive, the prescribed organization shall notify the custodian that an individual has made a directive under subsection (1) and shall ensure that no personal health information that is subject to the directive is provided. 2016, c. 6, Sched. 1, s. 1 (16). Section Amendments with date in force (d/m/y) 2016, c. 6, Sched. 1, s. 1 (16) - 01/10/2020
55.8 Despite the contents of a consent directive, personal health information may be utilized by a system that is maintained by the prescribed organization and that retrieves, processes or integrates personal health information that is accessible by means of the electronic health record to provide alerts to health information custodians about potentially harmful medication interactions, as long as the alerts do not reveal personal health information that is subject to the consent directive. 2016, c. 6, Sched. 1, s. 1 (18). Section Amendments with date in force (d/m/y) 2016, c. 6, Sched. 1, s. 1 (18) - 01/10/2020
55.9 (1) Despite section 55.5, members of a ministry data integration unit located within the Ministry may collect personal health information by means of the electronic health record for the purposes set out in section 49.2 of the Freedom of Information and Protection of Privacy Act in accordance with the requirements set out in Part III.1 (Data Integration) of that Act. 2020, c. 5, Sched. 6, s. 11. No other uses and disclosures permitted (2) Despite any other provision in this Act or the regulations, members of a ministry data integration unit shall not use or disclose the personal health information collected under subsection (1) except as authorized by this section or by Part III.1 of the Freedom of Information and Protection of Privacy Act. 2020, c. 5, Sched. 6, s. 11. Direction to prescribed organization (3) A member of a ministry data integration unit located within the Ministry may issue a direction requiring the prescribed organization to provide members of the ministry data integration unit with the information that the members are authorized to collect under subsection (1), and the prescribed organization must comply with the direction. 2020, c. 5, Sched. 6, s. 11. Terms and conditions (4) A direction made under subsection (3) may specify the form, manner and timeframe in which the information that is the subject of the direction is to be provided to the ministry data integration unit. 2020, c. 5, Sched. 6, s. 11. Disclosure (5) If members of a ministry data integration unit collect personal health information by means of the electronic health record under subsection (1), the disclosure of the personal health information to the members of the ministry data integration unit by the health information custodian who provided it to the prescribed organization is permitted under this Act. 2020, c. 5, Sched. 6, s. 11. Definitions (6) In this section, “member” and “ministry data integration unit” have the same meanings as in Part III.1 of the Freedom of Information and Protection of Privacy Act. 2020, c. 5, Sched. 6, s. 11. Section Amendments with date in force (d/m/y) 2016, c. 6, Sched. 1, s. 1 (19) - 01/10/2020 2020, c. 5, Sched. 6, s. 11 - 01/10/2020 Provision of personal health information to, and collection by, coroners and medical officers of health
55.9.1 (1) Where the prescribed requirements, if any, are met, the prescribed organization may provide personal health information that is accessible by means of the electronic health record to a coroner in relation to an investigation conducted under the Coroners Act. 2020, c. 5, Sched. 6, s. 12. Collection by medical officer of health (2) The Chief Medical Officer of Health or a medical officer of health within the meaning of the Health Protection and Promotion Act may collect personal health information by means of the electronic health record for purposes related to their duties under that Act or the Immunization of School Pupils Act. 2020, c. 5, Sched. 6, s. 12. Disclosure (3) Personal health information may be provided or collected in accordance with subsection (1) or (2) despite any provision of sections 55.5, 55.6 and 55.7. 2020, c. 5, Sched. 6, s. 12. Section Amendments with date in force (d/m/y) 2020, c. 5, Sched. 6, s. 12 - 01/10/2020
55.10 (1) Despite any other provision in this Act or the regulations, the Minister may direct the disclosure of personal health information that is accessible by means of the electronic health record to a person, as if the Minister had custody or control of the information, if, (a)  a person has requested that the Minister disclose the personal health information in accordance with clause 39 (1) (c), subsection 39 (2), section 44 or 45 of this Act; (b)  the personal health information requested by the person was provided to the prescribed organization under this Part by more than one health information custodian; (c)  the Minister has, (i)  submitted the request to the advisory committee, (ii)  provided the advisory committee with 30 days to review the request and make recommendations to the Minister, and (iii)  considered the recommendations, if any, made by the advisory committee; and (d)  the Minister has determined that the disclosure of the personal health information would be in accordance with clause 39 (1) (c), subsection 39 (2) or section 44 or 45. 2016, c. 6, Sched. 1, s. 1 (20). Shorter time period (2) The Minister may shorten the time period in subclause (1) (c) (ii) if, (a)  in the Minister’s opinion, the urgency of the situation requires it; and (b)  the request is for the disclosure of personal health information in accordance with subsection 39 (2). 2016, c. 6, Sched. 1, s. 1 (20). Must comply (3) The prescribed organization must comply with a direction under this section. 2016, c. 6, Sched. 1, s. 1 (20). Terms and conditions (4) A direction under this section may specify the form, manner and timeframe in which the information that is the subject of the direction is to be disclosed. 2016, c. 6, Sched. 1, s. 1 (20). Disclosure only if necessary (5) The Minister shall not direct the disclosure of personal health information under this section if other information will serve the purpose of the disclosure. 2016, c. 6, Sched. 1, s. 1 (20). Only necessary disclosure (6) The Minister shall not direct the disclosure of more personal health information than is reasonably necessary to meet the purpose of the disclosure. 2016, c. 6, Sched. 1, s. 1 (20). Section Amendments with date in force (d/m/y) 2016, c. 6, Sched. 1, s. 1 (20) - 01/10/2020
55.11 (1) The Minister shall establish an advisory committee for the purpose of making recommendations to the Minister concerning, (a)  practices and procedures that the prescribed organization must have in place to protect the privacy of the individuals whose personal health information it receives and to maintain the confidentiality of the information; (b)  practices and procedures that the prescribed organization must have in place for responding or facilitating a response to a request made by an individual under Part V for a record of personal health information relating to the individual that is accessible by means of the electronic health record; (c)  the administrative, technical and physical safeguards the prescribed organization should have in place to protect the privacy of the individuals whose personal health information it receives and to maintain the confidentiality of the information; (d)  the role of the prescribed organization in assisting a health information custodian to fulfil its obligations to give notice to individuals under subsections 12 (2) and 55.5 (7) in the event that personal health information that is accessible by means of the electronic health record is stolen or lost or is collected, used or disclosed without authority; (e)  the provision of notice in the event that personal health information that is accessible by means of the electronic health record is stolen or lost or is collected, used or disclosed without authority; (f)  anything that is referred to in this Part or in the regulations as capable of being the subject of a recommendation of the advisory committee; and (g)  any other matter referred to the advisory committee by the Minister. 2016, c. 6, Sched. 1, s. 1 (21). Terms of reference (2) Subject to the other provisions of this Part, the Minister shall determine the terms of reference of the advisory committee, including terms of reference with respect to conflicts of interest, the membership of the committee and the organization and governance of the committee. 2016, c. 6, Sched. 1, s. 1 (21). Appointments (3) The Minister shall appoint the members of the advisory committee in accordance with the requirements, if any, prescribed in the regulations. 2016, c. 6, Sched. 1, s. 1 (21). Support by Ministry (4) The Ministry, (a)  shall provide administrative support for the advisory committee; (b)  shall have custody and control of the records of the advisory committee for the purposes of the Freedom of Information and Protection of Privacy Act; and (c)  is responsible for compliance with the Archives and Recordkeeping Act, 2006, in connection with records created by or supplied to the advisory committee. 2016, c. 6, Sched. 1, s. 1 (21). Section Amendments with date in force (d/m/y) 2016, c. 6, Sched. 1, s. 1 (21) - 01/10/2020
55.12 (1) The Commissioner shall review the practices and procedures of the prescribed organization referred to in paragraph 14 of section 55.3 every three years after they are first approved or reviewed, as the case may be, to determine if the practices and procedures continue to meet the requirements of subparagraph 14 i of section 55.3 and, after the review, the Commissioner may renew the approval. 2020, c. 5, Sched. 6, s. 13. Notice by Commissioner (2) The Commissioner shall advise health information custodians of the results of a review conducted under subsection (1). 2016, c. 6, Sched. 1, s. 1 (22). Section Amendments with date in force (d/m/y) 2016, c. 6, Sched. 1, s. 1 (22) - 01/10/2020 2020, c. 5, Sched. 6, s. 13 - 01/10/2020
55.13 A health information custodian who, acting in good faith, provides personal health information to the prescribed organization by means of the electronic health record is not liable for damages resulting from, (a)  any unauthorized viewing or handling of the provided information, or any unauthorized dealing with the provided information, by the prescribed organization, its employees or any other person acting on its behalf; or (b)  any unauthorized collection of the provided information by another health information custodian. 2016, c. 6, Sched. 1, s. 1 (23). Section Amendments with date in force (d/m/y) 2016, c. 6, Sched. 1, s. 1 (23) - 01/10/2020
55.14 (1) The Lieutenant Governor in Council may make regulations for carrying out the purposes and provisions of this Part. 2016, c. 6, Sched. 1, s. 1 (24). Same (2) Without limiting the generality of subsection (1), the Lieutenant Governor in Council may make regulations, (a)  prescribing an organization as the prescribed organization for the purposes of this Part and respecting the purposes for which the organization is prescribed, subject to subsection (3); (b)  prescribing additional powers, duties and functions of the prescribed organization; (c)  prescribing additional requirements with which the prescribed organization must comply in developing or maintaining the electronic health record; (d)  specifying data elements collected, used or disclosed by a health information custodian under subsection 55.5 (2) that may not be made subject to a consent directive provided by an individual under subsection 55.6 (1); (e)  governing the notices that are required under section 55.7 and requiring notices under other circumstances and governing such notices; (f)  prescribing the level of specificity at which personal health information may be made subject to a consent directive, including whose collection, use and disclosure of the information may be restricted; (g)  Repealed: 2020, c. 5, Sched. 6, s. 14. (h)  requiring classes of health information custodians or specific health information custodians to provide personal health information to the prescribed organization under this Part and specifying what personal health information they are required to provide; (i)  respecting the provision of services related to the electronic health record by the prescribed organization directly to individuals; (j)  providing for anything that under this Part may or must be provided for or prescribed by the regulations. 2016, c. 6, Sched. 1, s. 1 (24); 2020, c. 5, Sched. 6, s. 14. Same, two or more organizations prescribed (3) A regulation made under clause (2) (a) may prescribe more than one organization to act as the prescribed organization for the purposes of this Part and may provide for the respective powers, duties and functions of each organization under this Part. 2016, c. 6, Sched. 1, s. 1 (24). Review (4) The Minister shall review every regulation made under the authority of clause (2) (f) at least once in every three-year period. 2016, c. 6, Sched. 1, s. 1 (24). Public consultation (5) Section 74 applies, with necessary modification, to the making of a regulation under this section. 2016, c. 6, Sched. 1, s. 1 (24). Section Amendments with date in force (d/m/y) 2016, c. 6, Sched. 1, s. 1 (24) - 03/06/2016 2020, c. 5, Sched. 6, s. 14 - 25/03/2020 PART VI   ADMINISTRATION AND ENFORCEMENT Complaints, Reviews and Inspections
56 (1) A person who has reasonable grounds to believe that another person has contravened or is about to contravene a provision of this Act or its regulations may make a complaint to the Commissioner.  2004, c. 3, Sched. A, s. 56 (1). Time for complaint (2) A complaint that a person makes under subsection (1) must be in writing and must be filed within, (a)  one year after the subject-matter of the complaint first came to the attention of the complainant or should reasonably have come to the attention of the complainant, whichever is the shorter; or (b)  whatever longer period of time that the Commissioner permits if the Commissioner is satisfied that it does not result in any prejudice to any person.  2004, c. 3, Sched. A, s. 56 (2); 2009, c. 33, Sched. 18, s. 25 (6). Same, refusal of request (3) A complaint that an individual makes under subsection 54 (8) or 55 (7) or (12) shall be in writing and shall be filed within six months from the time at which the health information custodian refuses or is deemed to have refused the individual’s request mentioned in the applicable subsection.  2004, c. 3, Sched. A, s. 56 (3). Non-application (4) The Ombudsman Act
does not apply to any matter in respect of which a complaint may be made to the Commissioner under this Act or to the Commissioner or his or her employees or delegates acting under this Act.  2004, c. 3, Sched. A, s. 56 (4). Section Amendments with date in force (d/m/y) 2009, c. 33, Sched. 18, s. 25 (6) - 15/12/2009
58 (1) The Commissioner may, on his or her own initiative, conduct a review of any matter if the Commissioner has reasonable grounds to believe that a person has contravened or is about to contravene a provision of this Act or its regulations and that the subject-matter of the review relates to the contravention.  2004, c. 3, Sched. A, s. 58 (1). Notice (2) Upon deciding to conduct a review under this section, the Commissioner shall give notice of the decision to every person whose activities are being reviewed.  2004, c. 3, Sched. A, s. 58 (2).
59 (1) In conducting a review under section 57 or 58, the Commissioner may make the rules of procedure that the Commissioner considers necessary and the Statutory Powers Procedure Act does not apply to the review.  2004, c. 3, Sched. A, s. 59 (1). Evidence (2) In conducting a review under section 57 or 58, the Commissioner may receive and accept any evidence and other information that the Commissioner sees fit, whether on oath or by affidavit or otherwise and whether or not it is or would be admissible in a court of law.  2004, c. 3, Sched. A, s. 59 (2).
61.1 (1) An order requiring a person to pay an administrative penalty may be issued under clause 61 (1) (h.1) for the purposes of, (a)  encouraging compliance with this Act and its regulations; or (b)  preventing a person from deriving, directly or indirectly, any economic benefit as a result of a contravention of this Act or its regulations. 2020, c. 5, Sched. 6, s. 17. Amount of administrative penalty (2) The amount of an administrative penalty for a contravention shall, (a)  reflect the purposes referred to in subsection (1); and (b)  be determined by the Commissioner in accordance with the regulations made under this Act. 2020, c. 5, Sched. 6, s. 17. Two-year limitation (3) An order requiring a person to pay an administrative penalty shall not be issued under this section more than two years after the day the most recent contravention on which the order is based first came to the knowledge of the Commissioner. 2020, c. 5, Sched. 6, s. 17. Content of order of administrative penalty (4) An order requiring a person to pay an administrative penalty shall, (a)  contain or be accompanied by a description of the contravention; and (b)  set out the amount of the penalty to be paid and specify the time and manner of the payment. 2020, c. 5, Sched. 6, s. 17. Payment to Minister of Finance (5) A person who is required to pay an administrative penalty shall pay the penalty to the Minister of Finance. 2020, c. 5, Sched. 6, s. 17. Section Amendments with date in force (d/m/y) 2020, c. 5, Sched. 6, s. 17 - 25/03/2020
62 (1) A person affected by an order of the Commissioner made under any of clauses 61 (1) (c) to (h.1) may appeal the order to the Divisional Court on a question of law in accordance with the rules of court by filing a notice of appeal within 30 days after receiving the copy of the order.  2004, c. 3, Sched. A, s. 62 (1); 2020, c. 5, Sched. 6, s. 18. Certificate of Commissioner (2) In an appeal under this section, the Commissioner shall certify to the Divisional Court, (a)  the order and a statement of the Commissioner’s reasons for making the order; (b)  the record of all hearings that the Commissioner has held in conducting the review on which the order is based; (c)  all written representations that the Commissioner received before making the order; and (d)  all other material that the Commissioner considers is relevant to the appeal.  2004, c. 3, Sched. A, s. 62 (2). Confidentiality of information (3) In an appeal under this section, the court may take precautions to avoid the disclosure by the court or any person of any personal health information about an individual, including, where appropriate, receiving representations without notice, conducting hearings in private or sealing the court files.  2004, c. 3, Sched. A, s. 62 (3). Court order (4) On hearing an appeal under this section, the court may, by order, (a)  direct the Commissioner to make the decisions and to do the acts that the Commissioner is authorized to do under this Act and that the court considers proper; and (b)  if necessary, vary or set aside the Commissioner’s order.  2004, c. 3, Sched. A, s. 62 (4). Compliance by Commissioner (5) The Commissioner shall comply with the court’s order.  2004, c. 3, Sched. A, s. 62 (5). Section Amendments with date in force (d/m/y) 2020, c. 5, Sched. 6, s. 18 - 25/03/2020