jswizzle3737/ontario_laws_and_regs huggingface dataset:
1 The purposes of this Act are, (a)  to establish rules for the collection, use and disclosure of personal health information about individuals that protect the confidentiality of that information and the privacy of individuals with respect to that information, while facilitating the effective provision of health care; (b)  to provide individuals with a right of access to personal health information about themselves, subject to limited and specific exceptions set out in this Act; (c)  to provide individuals with a right to require the correction or amendment of personal health information about themselves, subject to limited and specific exceptions set out in this Act; (d)  to provide for independent review and resolution of complaints with respect to personal health information; and (e)  to provide effective remedies for contraventions of this Act.  2004, c. 3, Sched. A, s. 1.
4 (1) In this Act, “personal health information”, subject to subsections (3) and (4), means identifying information about an individual in oral or recorded form, if the information, (a)  relates to the physical or mental health of the individual, including information that consists of the health history of the individual’s family, (b)  relates to the providing of health care to the individual, including the identification of a person as a provider of health care to the individual, (c)  Repealed: 2020, c. 13, Sched. 3, s. 8 (7). (c.1)  is a plan that sets out the home and community care services for the individual to be provided by a health service provider or Ontario Health Team pursuant to funding under section 21 of the Connecting Care Act, 2019, (d)  relates to payments or eligibility for health care, or eligibility for coverage for health care, in respect of the individual, (e)  relates to the donation by the individual of any body part or bodily substance of the individual or is derived from the testing or examination of any such body part or bodily substance, (f)  is the individual’s health number, or (g)  identifies an individual’s substitute decision-maker.  2004, c. 3, Sched. A, s. 4 (1); 2007, c. 8, s. 224 (6); 2007, c. 10, Sched. H, s. 2; 2020, c. 13, Sched. 3, s. 8 (7, 8). Identifying information (2) In this section, “identifying information” means information that identifies an individual or for which it is reasonably foreseeable in the circumstances that it could be utilized, either alone or with other information, to identify an individual.  2004, c. 3, Sched. A, s. 4 (2). Mixed records (3) Personal health information includes identifying information that is not personal health information described in subsection (1) but that is contained in a record that contains personal health information described in that subsection.  2009, c. 33, Sched. 18, s. 25 (3). Exception (4) Personal health information does not include identifying information contained in a record that is in the custody or under the control of a health information custodian if, (a)  the identifying information contained in the record relates primarily to one or more employees or other agents of the custodian; and (b)  the record is maintained primarily for a purpose other than the provision of health care or assistance in providing health care to the employees or other agents.  2004, c. 3, Sched. A, s. 4 (4). Section Amendments with date in force (d/m/y) 2007, c. 8, s. 224 (6) - 01/07/2010; 2007, c. 10, Sched. H, s. 2 - 04/06/2007 2009, c. 33, Sched. 18, s. 25 (3) - 15/12/2009 2020, c. 13, Sched. 3, s. 8 (7, 8) - 01/05/2022
5 (1) In this Act, “substitute decision-maker”, in relation to an individual, means, unless the context requires otherwise, a person who is authorized under this Act to consent on behalf of the individual to the collection, use or disclosure of personal health information about the individual.  2004, c. 3, Sched. A, s. 5 (1). Decision about treatment (2) A substitute decision-maker of an individual within the meaning of section 9 of the Health Care Consent Act, 1996 shall be deemed to be a substitute decision-maker of the individual in respect of the collection, use or disclosure of personal health information about the individual if the purpose of the collection, use or disclosure is necessary for, or ancillary to, a decision about a treatment under Part II of that Act.  2004, c. 3, Sched. A, s. 5 (2). Admission to a care facility (3) A substitute decision-maker of an individual within the meaning of section 39 of the Health Care Consent Act, 1996 shall be deemed to be a substitute decision-maker of the individual in respect of the collection, use or disclosure of personal health information about the individual if the purpose of the collection, use or disclosure is necessary for, or ancillary to, a decision about admission to a care facility under Part III of that Act.  2004, c. 3, Sched. A, s. 5 (3). Note: On a day to be named by proclamation of the Lieutenant Governor, section 5 of the Act is amended by adding the following subsection: (See: 2017, c. 25, Sched. 5, s. 69) Confining in a care facility (3.1) A substitute decision-maker of an individual within the meaning of section 54.4 of the Health Care Consent Act, 1996 shall be deemed to be a substitute decision-maker of the individual in respect of the collection, use or disclosure of personal health information about the individual if the purpose of the collection, use or disclosure is necessary for, or ancillary to, a decision about confining in a care facility under Part III.1 of that Act. 2017, c. 25, Sched. 5, s. 69. Personal assistance services (4) A substitute decision-maker of an individual within the meaning of section 56 of the Health Care Consent Act, 1996 shall be deemed to be a substitute decision-maker of the individual in respect of the collection, use or disclosure of personal health information about the individual if the purpose of the collection, use or disclosure is necessary for, or ancillary to, a decision about a personal assistance service under Part IV of that Act.  2004, c. 3, Sched. A, s. 5 (4). Section Amendments with date in force (d/m/y) 2017, c. 25, Sched. 5, s. 69 - not in force
6 (1) For the purposes of this Act, the providing of personal health information between a health information custodian and an agent of the custodian is a use by the custodian, and not a disclosure by the person providing the information or a collection by the person to whom the information is provided.  2004, c. 3, Sched. A, s. 6 (1). Provisions based on consent (2) A provision of this Act that applies to the collection, use or disclosure of personal health information about an individual by a health information custodian with the consent of the individual, whatever the nature of the consent, does not affect the collection, use or disclosure that this Act permits or requires the health information custodian to make of the information without the consent of the individual.  2004, c. 3, Sched. A, s. 6 (2). Permissive disclosure (3) A provision of this Act that permits a health information custodian to disclose personal health information about an individual without the consent of the individual, (a)  does not require the custodian to disclose it unless required to do so by law; (b)  does not relieve the custodian from a legal requirement to disclose the information; and (c)  does not prevent the custodian from obtaining the individual’s consent for the disclosure.  2004, c. 3, Sched. A, s. 6 (3). Application of Act
7 (1) Except if this Act or its regulations specifically provide otherwise, this Act applies to, (a)  the collection of personal health information by a health information custodian on or after the day this section comes into force; (b)  the use or disclosure of personal health information, on or after the day this section comes into force, by, (i)  a health information custodian, even if the custodian collected the information before that day, or (ii)  a person who is not a health information custodian and to whom a health information custodian disclosed the information, even if the person received the information before that day; and (c)  the collection, use or disclosure of a health number by any person on or after the day this section comes into force.  2004, c. 3, Sched. A, s. 7 (1). Conflict (2) In the event of a conflict between a provision of this Act or its regulations and a provision of any other Act or its regulations, this Act and its regulations prevail unless this Act, its regulations or the other Act specifically provide otherwise.  2004, c. 3, Sched. A, s. 7 (2). Interpretation (3) For the purpose of this section, there is no conflict unless it is not possible to comply with both this Act and its regulations and any other Act or its regulations.  2004, c. 3, Sched. A, s. 7 (3). Exception (4) This Act and its regulations do not prevail in the event of a conflict between a provision of this Act or its regulations and a provision of the Quality of Care Information Protection Act, 2004 or its regulations.  2004, c. 3, Sched. A, s. 7 (4). Crown bound (5) For greater certainty, this Act binds the Crown, including all ministries, agencies and employees of the Crown.  2007, c. 10, Sched. H, s. 3. Section Amendments with date in force (d/m/y) 2007, c. 10, Sched. H, s. 3 - 04/06/2007
8 (1) Subject to subsection (2), the Freedom of Information and Protection of Privacy Act and the Municipal Freedom of Information and Protection of Privacy Act do not apply to personal health information in the custody or under the control of a health information custodian unless this Act specifies otherwise.  2007, c. 10, Sched. H, s. 4. Exceptions (2) Sections 11, 12, 15, 16, 17, 33 and 34, subsection 35 (2) and sections 36 and 44 of the Freedom of Information and Protection of Privacy Act and sections 5, 9, 10, 25, 26 and 34 of the Municipal Freedom of Information and Protection of Privacy Act apply in respect of records of personal health information in the custody or under the control of a health information custodian that is an institution within the meaning of either of those Acts, as the case may be, or that is acting as part of such an institution.  2007, c. 10, Sched. H, s. 4. Same (3) A record of personal health information prepared by or in the custody or control of an institution within the meaning of the Freedom of Information and Protection of Privacy Act
or the Municipal Freedom of Information and Protection of Privacy Act shall be deemed to be a record to which clause 32 (b) of the
Freedom of Information and Protection of Privacy Act
or clause 25 (1) (b) of the Municipal Freedom of Information and Protection of Privacy Act applies, as the case may be.  2004, c. 3, Sched. A, s. 8 (3). Access (4) This Act does not limit a person’s right of access under section 10 of the Freedom of Information and Protection of Privacy Act or section 4 of the Municipal Freedom of Information and Protection of Privacy Act to a record of personal health information if all the types of information referred to in subsection 4 (1) are reasonably severed from the record.  2004, c. 3, Sched. A, s. 8 (4). Transition (5) This Act does not apply to a collection, use or disclosure of personal health information, a request for access or an appeal made under the Freedom of Information and Protection of Privacy Act or the Municipal Freedom of Information and Protection of Privacy Act before the day this section comes into force, and the applicable Act continues to apply to the collection, use, disclosure, request or appeal.  2004, c. 3, Sched. A, s. 8 (5). Section Amendments with date in force (d/m/y) 2007, c. 10, Sched. H, s. 4 - 04/06/2007
9 (1) This Act does not apply to personal health information about an individual after the earlier of 120 years after a record containing the information was created and 50 years after the death of the individual.  2004, c. 3, Sched. A, s. 9 (1). Other rights and Acts (2) Nothing in this Act shall be construed to interfere with, (a)  anything in connection with a subrogated claim or a potential subrogated claim; (b)  any legal privilege, including solicitor-client privilege; (c)  the law of evidence or information otherwise available by law to a party or a witness in a proceeding; (d)  the power of a court or a tribunal to compel a witness to testify or to compel the production of a document; (e)  the regulatory activities of a College under the Regulated Health Professions Act, 1991, the College under the Social Work and Social Service Work Act, 1998
or the Board under the Drugless Practitioners Act; or Note: On a day to be named by proclamation of the Lieutenant Governor, clause 9 (2) (e) of the Act is repealed and the following substituted: (See: 2021, c. 27, Sched. 2, s. 68 (2)) (e)  the regulatory activities of a College under the Regulated Heath Professions Act, 1991, the College under the Social Work and Social Service Work Act, 1998, the Board under the Drugless Practitioners Act or the Health and Supportive Care Providers Oversight Authority under the Health and Supportive Care Providers Oversight Authority Act, 2021; or (f)  any provision of any Act of Ontario or Canada or any court order, if the provision or order, as the case may be, prohibits a person from making information public or from publishing information.  2004, c. 3, Sched. A, s. 9 (2). Section Amendments with date in force (d/m/y) 2021, c. 27, Sched. 2, s. 68 (2) - not in force PART II   PRACTICES TO PROTECT PERSONAL HEALTH INFORMATION General
10 (1) A health information custodian that has custody or control of personal health information shall have in place information practices that comply with the requirements of this Act and its regulations.  2004, c. 3, Sched. A, s. 10 (1). Duty to follow practices (2) A health information custodian shall comply with its information practices.  2004, c. 3, Sched. A, s. 10 (2). Use of electronic means (3) A health information custodian that uses electronic means to collect, use, modify, disclose, retain or dispose of personal health information shall comply with the prescribed requirements, if any.  2004, c. 3, Sched. A, s. 10 (3). Providers to custodians (4) A person who provides goods or services for the purpose of enabling a health information custodian to use electronic means to collect, use, modify, disclose, retain or dispose of personal health information shall comply with the prescribed requirements, if any.  2004, c. 3, Sched. A, s. 10 (4). Note: On a day to be named by proclamation of the Lieutenant Governor, the Act is amended by adding the following section: (See: 2020, c. 5, Sched. 6, s. 3) Electronic audit log 10.1 (1) Subject to any prescribed exceptions, a health information custodian that uses electronic means to collect, use, disclose, modify, retain or dispose of personal health information shall, (a)  maintain, or require the maintenance of, an electronic audit log described in subsection (4); (b)  audit and monitor the electronic audit log as often as is required by the regulations; and (c)  comply with any requirements that may be prescribed. 2020, c. 5, Sched. 6, s. 3. Access by Commissioner (2) A health information custodian referred to in subsection (1) shall provide a copy of the electronic audit log to the Commissioner, upon request. 2020, c. 5, Sched. 6, s. 3. Same (3) Despite subsection 60 (13), the Commissioner may be provided with a copy of the electronic audit log even if it contains personal health information. 2020, c. 5, Sched. 6, s. 3. Content of log (4) The electronic audit log must include, for every instance in which a record or part of a record of personal health information that is accessible by electronic means is viewed, handled, modified or otherwise dealt with, (a)  the type of information that was viewed, handled, modified or otherwise dealt with; (b)  the date and time on which the information was viewed, handled, modified or otherwise dealt with; (c)  the identity of all persons who viewed, handled, modified or otherwise dealt with the personal health information; (d)  the identity of the individual to whom the personal health information relates; and (e)  any other information that may be prescribed. 2020, c. 5, Sched. 6, s. 3. Section Amendments with date in force (d/m/y) 2020, c. 5, Sched. 6, s. 3 - not in force
11 (1) A health information custodian that uses personal health information about an individual shall take reasonable steps to ensure that the information is as accurate, complete and up-to-date as is necessary for the purposes for which it uses the information.  2004, c. 3, Sched. A, s. 11 (1). Same, disclosure (2) A health information custodian that discloses personal health information about an individual shall, (a)  take reasonable steps to ensure that the information is as accurate, complete and up-to-date as is necessary for the purposes of the disclosure that are known to the custodian at the time of the disclosure; or (b)  clearly set out for the recipient of the disclosure the limitations, if any, on the accuracy, completeness or up-to-date character of the information.  2004, c. 3, Sched. A, s. 11 (2).
11.1 A health information custodian shall take steps that are reasonable in the circumstances to ensure that personal health information is not collected without authority. 2016, c. 6, Sched. 1, s. 1 (3). Section Amendments with date in force (d/m/y) 2016, c. 6, Sched. 1, s. 1 (3) - 01/06/2016
11.2 (1) Subject to subsection (2) and to any other exceptions that may be prescribed, no person shall use or attempt to use information that has been de-identified to identify an individual, either alone or with other information, unless this Act or another Act permits the information to be used to identify the individual. 2019, c. 15, Sched. 30, s. 3. Exceptions (2) The limitation in subsection (1) does not prevent any of the following from using information that they de-identified, either alone or with other information, to identify an individual: 1.  A health information custodian. 2.  A prescribed entity mentioned in subsection 45 (1). 3.  A prescribed person who compiles or maintains a registry of personal health information. 4.  Any other prescribed person. 2019, c. 15, Sched. 30, s. 3. Section Amendments with date in force (d/m/y) 2019, c. 15, Sched. 30, s. 3 - 31/07/2020
12 (1) A health information custodian shall take steps that are reasonable in the circumstances to ensure that personal health information in the custodian’s custody or control is protected against theft, loss and unauthorized use or disclosure and to ensure that the records containing the information are protected against unauthorized copying, modification or disposal.  2004, c. 3, Sched. A, s. 12 (1). Notice of theft, loss, etc. to individual (2) Subject to subsection (4) and to the exceptions and additional requirements, if any, that are prescribed, if personal health information about an individual that is in the custody or control of a health information custodian is stolen or lost or if it is used or disclosed without authority, the health information custodian shall, (a)  notify the individual at the first reasonable opportunity of the theft or loss or of the unauthorized use or disclosure; and (b)  include in the notice a statement that the individual is entitled to make a complaint to the Commissioner under Part VI. 2016, c. 6, Sched. 1, s. 1 (4). Notice to Commissioner (3) If the circumstances surrounding a theft, loss or unauthorized use or disclosure referred to in subsection (2) meet the prescribed requirements, the health information custodian shall notify the Commissioner of the theft or loss or of the unauthorized use or disclosure. 2016, c. 6, Sched. 1, s. 1 (4). Exception (4) If the health information custodian is a researcher who has received the personal health information from another health information custodian under subsection 44 (1), the researcher shall not notify the individual if the information is stolen or lost or if it is used or disclosed without authority, unless the health information custodian that disclosed the personal health information under subsection 44 (1), (a)  first obtains the individual’s consent to having the researcher contact the individual; and (b)  informs the researcher that the individual has given the consent. 2016, c. 6, Sched. 1, s. 1 (4). Section Amendments with date in force (d/m/y) 2016, c. 6, Sched. 1, s. 1 (4) - 03/06/2016 Records
13 (1) A health information custodian shall ensure that the records of personal health information that it has in its custody or under its control are retained, transferred and disposed of in a secure manner and in accordance with the prescribed requirements, if any.  2004, c. 3, Sched. A, s. 13 (1). Retention of records subject to a request (2) Despite subsection (1), a health information custodian that has custody or control of personal health information that is the subject of a request for access under section 53 shall retain the information for as long as necessary to allow the individual to exhaust any recourse under this Act that he or she may have with respect to the request.  2004, c. 3, Sched. A, s. 13 (2).
14 (1) A health information custodian may keep a record of personal health information about an individual in the individual’s home in any reasonable manner to which the individual consents, subject to any restrictions set out in a regulation, by-law or published guideline under the Regulated Health Professions Act, 1991, an Act referred to in Schedule 1 of that Act, the Drugless Practitioners Act or the Social Work and Social Service Work Act, 1998.  2004, c. 3, Sched. A, s. 14 (1). Records kept in other places (2) A health care practitioner may keep a record of personal health information about an individual in a place other than the individual’s home and other than a place in the control of the practitioner if, (a)  the record is kept in a reasonable manner; (b)  the individual consents; (c)  the health care practitioner is permitted to keep the record in the place in accordance with a regulation, by-law or published guideline under the Regulated Health Professions Act, 1991, an Act referred to in Schedule 1 to that Act, the Drugless Practitioners Act or the Social Work and Social Service Work Act, 1998, if the health care practitioner is described in any of clauses (a) to (c) of the definition of “health care practitioner” in section 2; and (d)  the prescribed conditions, if any, are satisfied.  2004, c. 3, Sched. A, s. 14 (2). Accountability and Openness
15 (1) A health information custodian that is a natural person may designate a contact person described in subsection (3).  2004, c. 3, Sched. A, s. 15 (1). Same (2) A health information custodian that is not a natural person shall designate a contact person described in subsection (3).  2004, c. 3, Sched. A, s. 15 (2). Functions of contact person (3) A contact person is an agent of the health information custodian and is authorized on behalf of the custodian to, (a)  facilitate the custodian’s compliance with this Act; (b)  ensure that all agents of the custodian are appropriately informed of their duties under this Act; (c)  respond to inquiries from the public about the custodian’s information practices; (d)  respond to requests of an individual for access to or correction of a record of personal health information about the individual that is in the custody or under the control of the custodian; and (e)  receive complaints from the public about the custodian’s alleged contravention of this Act or its regulations.  2004, c. 3, Sched. A, s. 15 (3). If no contact person (4) A health information custodian that is a natural person and that does not designate a contact person under subsection (1) shall perform on his or her own the functions described in clauses (3) (b), (c), (d) and (e).  2004, c. 3, Sched. A, s. 15 (4).
16 (1) A health information custodian shall, in a manner that is practical in the circumstances, make available to the public a written statement that, (a)  provides a general description of the custodian’s information practices; (b)  describes how to contact, (i)  the contact person described in subsection 15 (3), if the custodian has one, or (ii)  the custodian, if the custodian does not have that contact person; (c)  describes how an individual may obtain access to or request correction of a record of personal health information about the individual that is in the custody or control of the custodian; and (d)  describes how to make a complaint to the custodian and to the Commissioner under this Act.  2004, c. 3, Sched. A, s. 16 (1). Notification (2) If a health information custodian uses or discloses personal health information about an individual, without the individual’s consent, in a manner that is outside the scope of the custodian’s description of its information practices under clause (1) (a), the custodian shall, (a)  inform the individual of the uses and disclosures at the first reasonable opportunity unless, under section 52, the individual does not have a right of access to a record of the information; (b)  make a note of the uses and disclosures; and (c)  keep the note as part of the records of personal health information about the individual that it has in its custody or under its control or in a form that is linked to those records.  2004, c. 3, Sched. A, s. 16 (2).
17 (1) A health information custodian is responsible for personal health information in the custody or control of the health information custodian and may permit the custodian’s agents to collect, use, disclose, retain or dispose of personal health information on the custodian’s behalf only if, (a)  the custodian is permitted or required to collect, use, disclose, retain or dispose of the information, as the case may be; (b)  the collection, use, disclosure, retention or disposal of the information, as the case may be, is necessary in the course of the agent’s duties and is not contrary to this Act or another law; and (c)  the prescribed requirements, if any, are met.  2004, c. 3, Sched. A, s. 17 (1); 2016, c. 6, Sched. 1, s. 1 (5). Same (1.1) A permission granted to an agent under subsection (1) may be subject to such conditions or restrictions as the health information custodian may impose. 2016, c. 6, Sched. 1, s. 1 (6). Restriction, collection, use, etc. by agents (2) Subject to any exception that may be prescribed, an agent of a health information custodian may collect, use, disclose, retain or dispose of personal health information only if, (a)  the collection, use, disclosure, retention or disposal of the information, as the case may be, (i)  is permitted by the custodian in accordance with subsection (1), (ii)  is necessary for the purpose of carrying out his or her duties as agent of the custodian, (iii)  is not contrary to this Act or another law, and (iv)  complies with any conditions or restrictions that the custodian has imposed under subsection (1.1); and (b)  the prescribed requirements, if any, are met. 2016, c. 6, Sched. 1, s. 1 (7). Responsibilities of health information custodian (3) A health information custodian shall, (a)  take steps that are reasonable in the circumstances to ensure that no agent of the custodian collects, uses, discloses, retains or disposes of personal health information unless it is in accordance with subsection (2); and (b)  remain responsible for any personal health information that is collected, used, disclosed, retained or disposed of by the custodian’s agents, regardless of whether or not the collection, use, disclosure, retention or disposal was carried out in accordance with subsection (2). 2016, c. 6, Sched. 1, s. 1 (7). Responsibilities of the agent (4) An agent of a health information custodian shall, (a)  comply with the conditions or restrictions imposed by the health information custodian on the agent’s collection, use, disclosure, retention or disposal of personal health information under subsection (1.1); and (b)  notify the custodian at the first reasonable opportunity if personal health information that the agent collected, used, disclosed, retained or disposed of on behalf of the custodian is stolen or lost or if it is used or disclosed without authority. 2016, c. 6, Sched. 1, s. 1 (7). Section Amendments with date in force (d/m/y) 2016, c. 6, Sched. 1, s. 1 (5-7) - 03/06/2016 Notice to governing College
18 (1) If this Act or any other Act requires the consent of an individual for the collection, use or disclosure of personal health information by a health information custodian, the consent, (a)  must be a consent of the individual; (b)  must be knowledgeable; (c)  must relate to the information; and (d)  must not be obtained through deception or coercion.  2004, c. 3, Sched. A, s. 18 (1). Implied consent (2) Subject to subsection (3), a consent to the collection, use or disclosure of personal health information about an individual may be express or implied.  2004, c. 3, Sched. A, s. 18 (2). Exception (3) A consent to the disclosure of personal health information about an individual must be express, and not implied, if, (a)  a health information custodian makes the disclosure to a person that is not a health information custodian; or (b)  a health information custodian makes the disclosure to another health information custodian and the disclosure is not for the purposes of providing health care or assisting in providing health care.  2004, c. 3, Sched. A, s. 18 (3). Same (4) Subsection (3) does not apply to, (a)  a disclosure pursuant to an implied consent described in subsection 20 (4); (b)  a disclosure pursuant to clause 32 (1) (b); or (c)  a prescribed type of disclosure that does not include information about an individual’s state of health.  2004, c. 3, Sched. A, s. 18 (4). Knowledgeable consent (5) A consent to the collection, use or disclosure of personal health information about an individual is knowledgeable if it is reasonable in the circumstances to believe that the individual knows, (a)  the purposes of the collection, use or disclosure, as the case may be; and (b)  that the individual may give or withhold consent.  2004, c. 3, Sched. A, s. 18 (5). Notice of purposes (6) Unless it is not reasonable in the circumstances, it is reasonable to believe that an individual knows the purposes of the collection, use or disclosure of personal health information about the individual by a health information custodian if the custodian posts or makes readily available a notice describing the purposes where it is likely to come to the individual’s attention or provides the individual with such a notice.  2004, c. 3, Sched. A, s. 18 (6). Transition (7) A consent that an individual gives, before the day that subsection (1) comes into force, to a collection, use or disclosure of information that is personal health information is a valid consent if it meets the requirements of this Act for consent.  2004, c. 3, Sched. A, s. 18 (7).
19 (1) If an individual consents to have a health information custodian collect, use or disclose personal health information about the individual, the individual may withdraw the consent, whether the consent is express or implied, by providing notice to the health information custodian, but the withdrawal of the consent shall not have retroactive effect.  2004, c. 3, Sched. A, s. 19 (1). Conditional consent (2) If an individual places a condition on his or her consent to have a health information custodian collect, use or disclose personal health information about the individual, the condition is not effective to the extent that it purports to prohibit or restrict any recording of personal health information by a health information custodian that is required by law or by established standards of professional practice or institutional practice.  2004, c. 3, Sched. A, s. 19 (2).
20 (1) A health information custodian who has obtained an individual’s consent to a collection, use or disclosure of personal health information about the individual or who has received a copy of a document purporting to record the individual’s consent to the collection, use or disclosure is entitled to assume that the consent fulfils the requirements of this Act and the individual has not withdrawn it, unless it is not reasonable to assume so.  2004, c. 3, Sched. A, s. 20 (1). Implied consent (2) A health information custodian described in paragraph 1, 3 or 4 of the definition of “health information custodian” in subsection 3 (1), that receives personal health information about an individual from the individual, the individual’s substitute decision-maker or another health information custodian for the purpose of providing health care or assisting in the provision of health care to the individual, is entitled to assume that it has the individual’s implied consent to collect, use or disclose the information for the purposes of providing health care or assisting in providing health care to the individual, unless the custodian that receives the information is aware that the individual has expressly withheld or withdrawn the consent.  2004, c. 3, Sched. A, s. 20 (2); 2016, c. 30, s. 43 (3); 2020, c. 13, Sched. 3, s. 8 (9, 10). Limited consent (3) If a health information custodian discloses, with the consent of an individual, personal health information about the individual to a health information custodian described in paragraph 1, 3 or 4 of the definition of “health information custodian” in subsection 3 (1) for the purpose of the provision of health care to the individual and if the disclosing custodian does not have the consent of the individual to disclose all the personal health information about the individual that it considers reasonably necessary for that purpose, the disclosing custodian shall notify the custodian to whom it disclosed the information of that fact.  2004, c. 3, Sched. A, s. 20 (3); 2016, c. 30, s. 43 (3); 2020, c. 13, Sched. 3, s. 8 (11, 12). Implied consent, affiliation (4) If an individual who is a resident or patient in a facility that is a health information custodian provides to the custodian information about his or her religious or other organizational affiliation, the facility may assume that it has the individual’s implied consent to provide his or her name and location in the facility to a representative of the religious or other organization, where the custodian has offered the individual the opportunity to withhold or withdraw the consent and the individual has not done so.  2004, c. 3, Sched. A, s. 20 (4). Section Amendments with date in force (d/m/y) 2016, c. 30, s. 43 (3)
- 01/11/2017 2020, c. 13, Sched. 3, s. 8 (9-12) - 01/05/2022 Capacity and Substitute Decision-Making
21 (1) An individual is capable of consenting to the collection, use or disclosure of personal health information if the individual is able, (a)  to understand the information that is relevant to deciding whether to consent to the collection, use or disclosure, as the case may be; and (b)  to appreciate the reasonably foreseeable consequences of giving, not giving, withholding or withdrawing the consent.  2004, c. 3, Sched. A, s. 21 (1). Different information (2) An individual may be capable of consenting to the collection, use or disclosure of some parts of personal health information, but incapable of consenting with respect to other parts.  2004, c. 3, Sched. A, s. 21 (2). Different times (3) An individual may be capable of consenting to the collection, use or disclosure of personal health information at one time, but incapable of consenting at another time.  2004, c. 3, Sched. A, s. 21 (3). Presumption of capacity (4) An individual is presumed to be capable of consenting to the collection, use or disclosure of personal health information.  2004, c. 3, Sched. A, s. 21 (4). Non-application (5) A health information custodian may rely on the presumption described in subsection (4) unless the custodian has reasonable grounds to believe that the individual is incapable of consenting to the collection, use or disclosure of personal health information.  2004, c. 3, Sched. A, s. 21 (5).
22 (1) A health information custodian that determines the incapacity of an individual to consent to the collection, use or disclosure of personal health information under this Act shall do so in accordance with the requirements and restrictions, if any, that are prescribed.  2004, c. 3, Sched. A, s. 22 (1). Information about determination (2) If it is reasonable in the circumstances, a health information custodian shall provide, to an individual determined incapable of consenting to the collection, use or disclosure of his or her personal health information by the custodian, information about the consequences of the determination of incapacity, including the information, if any, that is prescribed.  2004, c. 3, Sched. A, s. 22 (2). Review of determination (3) An individual whom a health information custodian determines is incapable of consenting to the collection, use or disclosure of his or her personal health information by a health information custodian may apply to the Board for a review of the determination unless there is a person who is entitled to act as the substitute decision-maker of the individual under subsection 5 (2), (3) or (4).  2004, c. 3, Sched. A, s. 22 (3). Note: On a day to be named by proclamation of the Lieutenant Governor, subsection 22 (3) of the Act is amended by striking out “(3) or (4)” at the end and substituting “(3), (3.1) or (4)”. (See: 2017, c. 25, Sched. 5, s. 70) Parties (4) The parties to the application are: 1.  The individual applying for the review of the determination. 2.  The health information custodian that has custody or control of the personal health information. 3.  All other persons whom the Board specifies.  2004, c. 3, Sched. A, s. 22 (4). Powers of Board (5) The Board may confirm the determination of incapacity or may determine that the individual is capable of consenting to the collection, use or disclosure of personal health information.  2004, c. 3, Sched. A, s. 22 (5). Restriction on repeated applications (6) If a determination that an individual is incapable with respect to consenting to the collection, use or disclosure of personal health information is confirmed on the final disposition of an application under this section, the individual shall not make a new application under this section for a determination with respect to the same or a similar issue within six months after the final disposition of the earlier application, unless the Board gives leave in advance.  2004, c. 3, Sched. A, s. 22 (6). Grounds for leave (7) The Board may give leave for the new application to be made if it is satisfied that there has been a material change in circumstances that justifies reconsideration of the individual’s capacity.  2004, c. 3, Sched. A, s. 22 (7). Procedure (8) Sections 73 to 81 of the Health Care Consent Act, 1996 apply with necessary modifications to an application under this section.  2004, c. 3, Sched. A, s. 22 (8). Section Amendments with date in force (d/m/y) 2017, c. 25, Sched. 5, s. 70 - not in force
23 (1) If this Act or any other Act refers to a consent required of an individual to a collection, use or disclosure by a health information custodian of personal health information about the individual, a person described in one of the following paragraphs may give, withhold or withdraw the consent: 1.  If the individual is capable of consenting to the collection, use or disclosure of the information, i.  the individual, or ii.  if the individual is at least 16 years of age, any person who is capable of consenting, whom the individual has authorized in writing to act on his or her behalf and who, if a natural person, is at least 16 years of age. 2.  If the individual is a child who is less than 16 years of age, a parent of the child or a children’s aid society or other person who is lawfully entitled to give or refuse consent in the place of the parent unless the information relates to, i.  treatment within the meaning of the Health Care Consent Act, 1996, about which the child has made a decision on his or her own in accordance with that Act, or ii.  counselling in which the child has participated on his or her own under the Child, Youth and Family Services Act, 2017. 3.  If the individual is incapable of consenting to the collection, use or disclosure of the information, a person who is authorized under subsection 5 (2), (3) or (4) or section 26 to consent on behalf of the individual. Note: On a day to be named by proclamation of the Lieutenant Governor, paragraph 3 of subsection 23 (1) of the Act is amended by striking out “(3) or (4)” and substituting “(3), (3.1) or (4)”. (See: 2017, c. 25, Sched. 5, s. 71) 4.  If the individual is deceased, the deceased’s estate trustee or the person who has assumed responsibility for the administration of the deceased’s estate, if the estate does not have an estate trustee. 5.  A person whom an Act of Ontario or Canada authorizes or requires to act on behalf of the individual.  2004, c. 3, Sched. A, s. 23 (1); 2007, c. 10, Sched. H, s. 5; 2017, c. 14, Sched. 4, s. 28 (1); 2021, c. 4, Sched. 11, s. 27 (2). Definition (2) In subsection (1), “parent” does not include a parent who has only a right of access to the child.  2004, c. 3, Sched. A, s. 23 (2); 2021, c. 4, Sched. 11, s. 27 (3, 4). Conflict if child capable (3) If the individual is a child who is less than 16 years of age and who is capable of consenting to the collection, use or disclosure of the information and if there is a person who is entitled to act as the substitute decision-maker of the child under paragraph 2 of subsection (1), a decision of the child to give, withhold or withdraw the consent or to provide the information prevails over a conflicting decision of that person.  2004, c. 3, Sched. A, s. 23 (3). Section Amendments with date in force (d/m/y) 2007, c. 10, Sched. H, s. 5 - 04/06/2007 2017, c. 14, Sched. 4, s. 28 (1) - 30/04/2018; 2017, c. 25, Sched. 5, s. 71 - not in force 2021, c. 4, Sched. 11, s. 27 (2-4) - 19/04/2021
25 (1) If this Act permits or requires an individual to make a request, give an instruction or take a step and a substitute decision-maker is authorized to consent on behalf of the individual to the collection, use or disclosure of personal health information about the individual, the substitute decision-maker may make the request, give the instruction or take the step on behalf of the individual.  2004, c. 3, Sched. A, s. 25 (1). Same (2) If a substitute decision-maker makes a request, gives an instruction or takes a step under subsection (1) on behalf of an individual, references in this Act to the individual with respect to the request made, the instruction given or the step taken by the substitute decision-maker shall be read as references to the substitute decision-maker, and not to the individual.  2004, c. 3, Sched. A, s. 25 (2).
28 (1) This Act applies to a representative whom the Board appointed under section 36.2 of the Mental Health Act or who was deemed to be appointed under that section before the day this section comes into force for an individual with respect to the individual’s personal health information, as if the representative were the individual’s representative appointed by the Board under section 27.  2004, c. 3, Sched. A, s. 28 (1). Limited authority (2) The authority conferred on the representative by subsection (1) is limited to the purposes for which the representative was appointed.  2004, c. 3, Sched. A, s. 28 (2). PART IV   COLLECTION, USE AND DISCLOSURE OF PERSONAL HEALTH INFORMATION General Limitations and Requirements
29 A health information custodian shall not collect, use or disclose personal health information about an individual unless, (a)  it has the individual’s consent under this Act and the collection, use or disclosure, as the case may be, to the best of the custodian’s knowledge, is necessary for a lawful purpose; or (b)  the collection, use or disclosure, as the case may be, is permitted or required by this Act.  2004, c. 3, Sched. A, s. 29.
30 (1) A health information custodian shall not collect, use or disclose personal health information if other information will serve the purpose of the collection, use or disclosure.  2004, c. 3, Sched. A, s. 30 (1). Extent of information (2) A health information custodian shall not collect, use or disclose more personal health information than is reasonably necessary to meet the purpose of the collection, use or disclosure, as the case may be.  2004, c. 3, Sched. A, s. 30 (2). Exception (3) This section does not apply to personal health information that a health information custodian is required by law to collect, use or disclose.  2004, c. 3, Sched. A, s. 30 (3).
31 (1) A health information custodian that collects personal health information in contravention of this Act shall not use it or disclose it unless required by law to do so.  2004, c. 3, Sched. A, s. 31 (1). (2) Repealed:  2004, c. 3, Sched. A, s. 31 (4). (3) Repealed:  2004, c. 3, Sched. A, s. 31 (4). (4) Spent:  2004, c. 3, Sched. A, s. 31 (4). Section Amendments with date in force (d/m/y) 2004, c. 3, Sched. A, s. 31 (4) - 01/11/2005
32 (1) Subject to subsection (2), a health information custodian may collect, use or disclose personal health information about an individual for the purpose of fundraising activities only where, (a)  the individual expressly consents; or (b)  the individual consents by way of an implied consent and the information consists only of the individual’s name and the prescribed types of contact information.  2004, c. 3, Sched. A, s. 32 (1); 2007, c. 10, Sched. H, s. 9. Requirements and restrictions (2) The manner in which consent is obtained under subsection (1) and the resulting collection, use or disclosure of personal health information for the purpose of fundraising activities shall comply with the requirements and restrictions that are prescribed, if any.  2004, c. 3, Sched. A, s. 32 (2). Section Amendments with date in force (d/m/y) 2007, c. 10, Sched. H, s. 9 - 04/06/2007
33 A health information custodian shall not collect, use or disclose personal health information about an individual for the purpose of marketing anything or for the purpose of market research unless the individual expressly consents and the custodian collects, uses or discloses the information, as the case may be, subject to the prescribed requirements and restrictions, if any.  2004, c. 3, Sched. A, s. 33.
35 (1) A health information custodian shall not charge a person a fee for collecting or using personal health information except as authorized by the regulations made under this Act.  2004, c. 3, Sched. A, s. 35 (1). Same, for disclosure (2) When disclosing personal health information, a health information custodian shall not charge fees to a person that exceed the prescribed amount or the amount of reasonable cost recovery, if no amount is prescribed.  2004, c. 3, Sched. A, s. 35 (2). Collection