A A A

Second Session, Thirty-Ninth Legislature

This version is based on the printed bill that was distributed in the Legislature after First Reading.   It is not the official version.   If accuracy is critical, you can obtain a copy of the printed bill from Statutory Publications or view the online bilingual version (PDF).

Bill 32

THE PERSONAL HEALTH INFORMATION AMENDMENT ACT


Explanatory Note

THE PERSONAL HEALTH INFORMATION

AMENDMENT ACT

(Assented to                                         )

HER MAJESTY, by and with the advice and consent of the Legislative Assembly of Manitoba, enacts as follows:

C.C.S.M. c. P33.5 amended

1

The Personal Health Information Act is amended by this Act.

2

The English version of the second paragraph of the preamble is amended by replacing "to correct" with "to request the correction of".

3

Subsection 1(1) is amended by adding the following definitions:

"adjudicator" means the Information and Privacy Adjudicator appointed under The Freedom of Information and Protection of Privacy Act; (« arbitre »)

"demographic information" means an individual's name, address, telephone number and e-mail address; (« renseignements signalétiques »)

4(1)

Clauses 2(c) and (d) are replaced with the following:

(c) to establish rules governing the collection, use, disclosure, retention and destruction of personal health information in a manner that recognizes

(i) the right of individuals to privacy of their personal health information, and

(ii) the need for health professionals to collect, use and disclose personal health information in order to provide health care to individuals;

4(2)

Clauses 2(e) and (f) are renumbered as clauses 2(d) and (e).

5

Section 3 is replaced with the following:

Application of this Act

3

This Act does not apply to statistical health information, or to health information that does not, either by itself or when combined with other information available to the holder, allow an individual to be readily identified.

6(1)

Subsection 6(1) is replaced with the following:

Trustee to respond promptly

6(1)

A trustee shall respond to a request as promptly as required in the circumstances but no later than

(a)  72 hours after receiving it, if the information is about health care the trustee is currently providing; and

(b)  30 days after receiving it in any other case, unless the request is transferred to another trustee under section 8.

6(2)

Subsection 6(3) is amended by striking out "30-day period" and substituting "time frame required under subsection (1)".

7

The following is added after section 9:

Notice of right to access information

9.1

In accordance with the regulations, a trustee must take reasonable steps to inform individuals

(a) of their right to examine and receive a copy of their personal health information that the trustee maintains; and

(b) about how they can exercise that right.

8

Subsection 14(2) is amended by striking out "or" at the end of clause (d) and by adding the following as clause (d.1):

(d.1) the information is collected for the purpose of

(i) compiling an accurate family or genetic health history of the individual, or

(ii) determining or verifying the individual's eligibility to participate in a program of or receive a benefit or service from the trustee or from the government, and is collected in the course of processing an application made by or on behalf of the individual; or

9

Subsection 17(4) is repealed.

10

The following is added after Division 2 of Part 3:

DIVISION 2.1

CONSENT RE PERSONAL HEALTH INFORMATION

Elements of consent

19.1(1)

When this Act requires an individual's consent for the use or disclosure of personal health information, the consent must

(a) relate to the purpose for which the information is used or disclosed;

(b) be knowledgeable;

(c) be voluntary; and

(d) not be obtained through misrepresentation.

Knowledgeable consent

19.1(2)

Consent is knowledgeable if the individual who gives it has been provided with the information that a reasonable person in the same circumstances would need in order to make a decision about the use or disclosure of the information.

Express or implied consent

19.1(3)

Consent may be express or implied.

Exception

19.1(4)

Consent must be express, and not implied, if

(a) a trustee makes a disclosure to a person that is not a trustee; or

(b) a trustee makes a disclosure to another trustee, but the disclosure is not for the purpose of providing health care or assisting in providing health care.

When exceptions apply

19.1(5)

Subsection (4) does not apply to a disclosure made under section 23.1 (disclosure to religious organization) or section 23.2 (disclosure for charitable fundraising).

Express consent need not be written

19.1(6)

An express consent need not be in writing.

Express consent can be relied on

19.1(7)

A trustee (other than the trustee who obtained the consent) may act in accordance with an express written consent or a record of an express consent having been given without verifying that the consent meets the requirements of subsection (1), unless he or she has reason to believe that the requirements have not been met.

Consent with conditions

19.1(8)

An individual may give consent subject to conditions.  But a condition that has the effect of restricting or prohibiting a trustee from recording personal health information is not effective if the recording is required by law or by established standards of professional or institutional practice.

Consent may be withdrawn

19.2

An individual who has given consent, whether express or implied, to the use or disclosure of personal health information may withdraw it by notifying the trustee.  A withdrawal does not have retroactive effect.

11

Subsection 20(3) is amended by striking out "and disclosure".

12

The following is added after clause 21(c):

(c.1) the information is demographic information about an individual, or is his or her PHIN, and is used to

(i) confirm eligibility for health care or payment for health care, or

(ii) verify the accuracy of the demographic information or PHIN;

(c.2) the information is demographic information about an individual and is used to collect a debt the individual owes to the trustee, or to the government if the trustee is a department;

13(1)

Subsection 22(2) is amended

(a) in clause (a), by striking out "is providing" and substituting "is or will be providing";

(b) by replacing clause (f) with the following:

(f) in accordance with subsection 22(2.2) (disclosure to another government), section 23 (disclosure to patient's family), section 23.1 (disclosure to religious organization), section 23.2 (disclosure for fundraising), section 24 or 24.1 (disclosure for health research) or section 25 (disclosure to an information manager);

(c) by adding the following after clause (g):

(g.1) to another trustee who requires the information to evaluate or monitor the quality of services the other trustee provides;

(g.2) for the purpose of determining or verifying the individual's eligibility for a program, service or benefit, if the information disclosed is limited to the individual's demographic information;

(g.3) to another trustee for the purpose of de-identifying the personal health information;

(d) by replacing clause (h) with the following:

(h) to a computerized health information network established by a body specified in subsection (2.1), in which personal health information is recorded for the purpose of

(i) providing health care,

(ii) facilitating the evaluation or monitoring of a program that relates to the provision of health care or payment for health care, or

(iii) facilitating research and planning that relates to the provision of health care or payment for health care;

(e) by adding the following after clause (i):

(i.1) for the purpose of collecting a debt owed by the individual to the trustee, or to the government if the trustee is a department, if the information disclosed is limited to demographic information;

(f) by replacing clause (k) with the following:

(k) required in anticipation of or for use in a civil or quasi-judicial proceeding to which the trustee is a party, or to which the government is a party if the trustee is a department;

(k.1) required in anticipation of or for use in the prosecution of an offence;

(g) by adding the following after clause (l):

(l.1) required by police to assist in locating an individual reported as being a missing person, if the information disclosed is limited to demographic information;

13(2)

The following is added after subsection 22(2):

Computerized health information network

22(2.1)

For the purpose of clause (2)(h), a computerized health information network may be established by

(a) the government or a government agency;

(b) the Government of Canada or of another province or territory or an agency of such a government;

(c) an organization representing one or more governments; or

(d) a trustee that is a public body specified in the regulations.

Disclosure by minister to another government

22(2.2)

The minister or his or her designate may disclose an individual's personal health information to the government of another jurisdiction in Canada, or an agency of such a government, without the individual's consent, if

(a)  the individual the information is about normally resides in the other jurisdiction;

(b) the information is about health care he or she received in Manitoba; and

(c) the government of the other jurisdiction requires the information for the purpose of monitoring or evaluating the extra-jurisdictional provision of health care to its residents.

13(3)

Subsection 22(3) is amended by adding ", (2.1) or (2.2)" after ''subsection (2)".

14(1)

Subsection 23(1) is amended in the part before clause (a) by adding "or is receiving health care services from a trustee at home," after "health care facility,".

14(2)

The following is added after subsection 23(1):

Timely disclosure to family

23(1.1)

When an immediate family member, or someone else with whom the patient or resident is known to have a close personal relationship, asks a trustee to disclose information under subsection (1), the trustee must disclose the information as soon as reasonably possible but no later than 72 hours after the request is made, as long as the requirements of that subsection are met.

15

The following is added after section 23:

Disclosure to religious organization

23.1(1)

In the case of an individual who is a patient in a hospital or is a resident of a personal care home, the hospital or personal care home may disclose

(a) the individual's name and general health status; and

(b) the individual's location, unless disclosing the location would reveal specific information about the individual's health;

to a representative of a religious organization.

Conditions

23.1(2)

A disclosure may be made under subsection (1) only if

(a) the trustee has notified the individual in writing that the trustee might disclose personal health information about the individual to a representative of a religious organization, or has posted a notice to that effect where it is likely to come to the individual's attention;

(b) the notice is in a form that the individual can reasonably be expected to understand; and

(c) the individual has been given a reasonable opportunity to object to the disclosure and has not done so.

Disclosure for fundraising

23.2

A trustee that is a hospital or personal care home may disclose the name and mailing address of an individual who has been a patient of the hospital, or who is or has been a resident of the personal care home, to a fundraising charitable foundation affiliated with the hospital or personal care home, if

(a) the trustee has notified the individual in writing that the trustee might disclose personal health information about the individual to a charitable foundation, or has posted a notice to that effect where it is likely to come to the individual's attention;

(b) the notice is in a form that the individual can reasonably be expected to understand;

(c) the individual has been given a reasonable opportunity to object to the disclosure and has not done so; and

(d) the trustee and the charitable foundation comply with any additional requirements specified in the regulations.

16(1)

Subsection 24(1) is replaced with the following:

Disclosure for health research

24(1)

A trustee may disclose personal health information to a person conducting health research if the research has been approved under this section.

16(2)

Clause 24(3)(d) is replaced with the following:

(d) the research proposal contains

(i) reasonable safeguards to protect the confidentiality and security of the personal health information, and

(ii) procedures to destroy or remove, at the earliest opportunity consistent with the purposes of the research, any information that, either by itself or when combined with other information available to the holder, allows individuals to be readily identified.

17

The following is added after section 24:

Disclosure to health research organization

24.1(1)

A trustee may disclose personal health information to a health research organization for a purpose mentioned in subsection (2) only if the organization is prescribed in the regulations and meets the requirements of this section.

Purposes

24.1(2)

A trustee may disclose personal health information to a prescribed organization under this section for any of the following purposes:

(a) analyzing the health status of the population;

(b) identifying and describing patterns of illness;

(c) describing and analyzing how health services are used;

(d) analyzing the availability and adequacy of human resources required to provide health services;

(e) measuring health system performance;

(f) health system planning.

Protecting individual privacy

24.1(3)

A prescribed health research organization must

(a) use personal health information disclosed to it under this section for the purpose for which it was disclosed and no other;

(b) have in place policies and procedures that protect the privacy of the individuals whose information is disclosed to it and that ensure the security and integrity of the information; and

(c) as soon as reasonably possible having regard to the use of the information, remove any information that, either by itself or when combined with other information available to the organization, allows the identity of the individuals to be readily ascertained.

Agreement required

24.1(4)

Before disclosing personal health information to a prescribed health research organization, the trustee must enter into an agreement with the organization that includes any requirements specified in the regulations.

Duties of health research organization

24.1(5)

A prescribed health research organization must

(a) comply with the terms of the agreement entered into under subsection (4); and

(b) if the organization is not a trustee, comply with the same requirements concerning the protection, retention and destruction of personal health information that the trustee is required to comply with under this Act.

18

Subsection 32(1) is amended by striking out "or" at the end of clause (b) and replacing clause (c) with the following:

(c) in a review conducted by the adjudicator under this Act when the Ombudsman is a party; or

(d) in an application for judicial review of an adjudicator's order under this Act.

19

Subsection 34(4) is amended by striking out "in the course of a prosecution or an appeal referred to in subsection 32(1)" and substituting "for a purpose mentioned in clauses 32(1)(a) to (d)".

20

Section 38 is amended by adding the following definition:

"complaint" includes a complaint initiated by the Ombudsman under subsection 39(4); (« plainte »)

21

Clause 41(1)(b) is amended by striking out "or vexatious" and substituting ", vexatious or an abuse of process".

22(1)

Subsection 48(5) is amended by striking out everything after "inform the complainant" and substituting the following:

(a)  as to whether the Ombudsman intends to ask the adjudicator to review the decision under section 48.1; and

(b) that, if the Ombudsman does not ask for a review, the complainant may appeal the decision to the court under section 49 and of the time limit for an appeal.

22(2)

The following is added after subsection 48(6):

Recommendations published

48(7)

The Ombudsman must make recommendations made under this section available to the public, and may do so by publishing them on a website on the Internet.

23

The following is added after section 48:

REQUEST FOR ADJUDICATOR'S REVIEW

Request for review

48.1(1)

The Ombudsman may ask the adjudicator to review a matter described in subsection (2) if he or she has given a report to the trustee under section 48 and

(a) the trustee's response indicates that it refuses to take action to implement any of the Ombudsman's recommendations;

(b) the trustee's response indicates that it accepts the Ombudsman's recommendations, but the trustee does not take action to implement them within the required time; or

(c) the trustee fails to respond as required by subsection 48(4).

Nature of request

48.1(2)

The Ombudsman may ask the adjudicator to review

(a) any decision, act or failure to act by the trustee relating to an individual's request to examine or receive a copy of his or her personal health information, or for correction of such information; or

(b) a matter relating to privacy, if the Ombudsman considers that an individual's personal health information has been collected, used or disclosed contrary to this Act.

Deadline

48.1(3)

The Ombudsman's request for review must be made

(a) within 15 days after the Ombudsman receives the trustee's response to the Ombudsman's report under subsection 48(4); or

(b) if the trustee does not respond, within 15 days after the deadline for a response has expired.

Notifying others of a request

48.2

As soon as practicable after receiving a request from the Ombudsman, the adjudicator must notify the complainant, the trustee concerned and any other person who, in the adjudicator's opinion, is affected by it.

CONDUCT OF REVIEW BY ADJUDICATOR

Review by adjudicator

48.3

On receiving a request from the Ombudsman, the adjudicator must conduct a review of the matter and decide all questions of fact and law arising in the course of the review.

Procedures for a review

48.4(1)

The adjudicator may make rules of procedure for conducting a review under section 48.3.

Evidence

48.4(2)

The adjudicator may receive and accept any evidence and other information that he or she considers appropriate, whether on oath or by affidavit or otherwise, and whether or not it is admissible in a court of law.

Review in private

48.4(3)

A review may be conducted in private.

Powers and protections of adjudicator

48.4(4)

For the purpose of conducting a review, the adjudicator has the same powers and protections as the Ombudsman has under section 29 (Evidence Act powers and production of records).

Right to make representations

48.5(1)

The complainant, the trustee concerned and any person given notice under section 48.2

(a) must be given an opportunity to make representations to the adjudicator during a review under section 48.3; and

(b) are entitled to be represented by counsel or an agent.

Procedure

48.5(2)

The adjudicator may decide

(a) whether representations are to be made orally or in writing; and

(b) whether a person is entitled to be present during representations made to the adjudicator by another person, or is entitled to have access to those representations or to comment on them.

Ombudsman as party

48.5(3)

The Ombudsman has a right to be a party in any review conducted by the adjudicator if the Ombudsman considers that the review raises an issue of public interest.

Review to be completed within 90 days

48.6(1)

A review under section 48.3 must be completed within 90 days after the adjudicator receives the request from the Ombudsman, unless the adjudicator extends the period.

Extension

48.6(2)

If the 90-day period is extended, the adjudicator must notify the complainant, the trustee concerned, the Ombudsman and any other person given notice under section 48.2, and he or she must also inform them of the date by which the review is expected to be completed.

Burden of proof if access denied

48.7

In a review of a decision to refuse to permit an applicant to examine or receive a copy of personal health information, it is up to the trustee to prove that the refusal is justified.

ADJUDICATOR'S ORDER

Adjudicator's order

48.8(1)

Upon completing a review under section 48.3, the adjudicator must dispose of the issues by making an order under this section.

Order re access

48.8(2)

If the review concerns a complaint about access, the adjudicator may, by order,

(a) require the trustee to permit the applicant to examine or copy all of part of the personal health information, if the adjudicator determines that the trustee was not justified under section 11 in refusing to permit the applicant to do so;

(b) confirm the trustee's decision, if the adjudicator determines that the trustee was justified under section 11 in refusing to permit the applicant to examine or copy the information;

(c) confirm or reduce a fee, or order a refund of a fee, in the appropriate circumstances;

(d) confirm a decision not to correct personal health information, or specify how personal information is to be corrected.

Order re privacy

48.8(3)

If the review concerns a complaint about privacy, the adjudicator may, by order,

(a) require the trustee to cease or modify a specified practice of collecting, using, disclosing, retaining or destroying personal health information contrary to this Act;

(b) require the trustee to destroy personal health information collected in contravention of this Act.

Order may contain terms or conditions

48.8(4)

The adjudicator may specify terms or conditions in an order made under this section.

Order given to parties

48.8(5)

The adjudicator must give a copy of an order made under this section to each of the following:

(a) the complainant;

(b) the trustee concerned;

(c) the Ombudsman;

(d) any other person given notice under section 48.2.

Orders published

48.8(6)

The adjudicator must make orders made under this section available to the public, and may do so by publishing them on a website on the Internet.

Duty to comply with orders

48.9(1)

Unless an application for judicial review is made under subsection (2), the trustee concerned must comply with an adjudicator's order

(a) within 30 days after being given a copy; or

(b) within any longer period specified in the order.

Judicial review

48.9(2)

An application for judicial review of an adjudicator's order must be made within 25 days after the person making the application is given a copy of the order, unless the court extends the period.

Order stayed if application made for judicial review

48.9(3)

If an application for judicial review is made under subsection (2), the adjudicator's order is stayed until the court deals with the application.

GENERAL PROVISIONS RE THE ADJUDICATOR

Adjudicator to take precautions against disclosing

48.10

The adjudicator shall take every reasonable precaution, including receiving representations ex parte, conducting hearings in private and examining records in private, to avoid disclosure to the complainant of personal health information the trustee is justified in refusing to disclose under section 11.

Statements made to adjudicator not admissible in evidence

48.11(1)

A statement made or an answer given by a person during a review by the adjudicator is inadmissible as evidence in court or in any other proceeding, except

(a) in a prosecution for perjury in respect of sworn testimony;

(b) in a prosecution for an offence under this Act; or

(c) in an application for judicial review or an appeal from a decision with respect to that application.

Evidence of proceeding before adjudicator

48.11(2)

Subsection (1) applies also in respect of evidence of the existence of proceedings conducted before the adjudicator.

Information provided under qualified privilege

48.12

Anything said, any information supplied, and any record produced by a person during a review by the adjudicator under this Act is privileged in the same manner as if it were said, supplied or produced in a proceeding in a court.

Protection from liability

48.13

No proceedings lie against the adjudicator or deputy adjudicator, or against any person acting for or under the direction of either of them, for anything done, reported or said in good faith in the exercise or performance or the intended exercise or performance of a duty or power under this Act.

Annual report

48.14(1)

The adjudicator must make an annual report to the Speaker of the Assembly about the exercise of the adjudicator's responsibilities under this Act.

Tabling report in Assembly

48.14(2)

The Speaker must table a copy of the report in the Assembly within 15 days after receiving it if the Assembly is sitting or, if it is not, within 15 days after the next sitting begins.

24

Subsections 49(2) and (3) are replaced with the following:

Restrictions on appeal

49(2)

An appeal may be made under this section only if

(a) the individual has made a complaint about access to the Ombudsman and the Ombudsman has provided a report under section 47; and

(b) the deadline set out in subsection 48.1(3) for the Ombudsman to request the adjudicator to review the matter has expired, and the Ombudsman did not request a review.

Appeal within 30 days

49(3)

An appeal is to be made by filing an application with the court within 30 days after the deadline set out in subsection 48.1(3) expires, or within any longer period that the court may allow in special circumstances.

25

Subsections 50(1) and (3) are repealed and subsection 50(2) is renumbered as section 50.

26

Section 60 is amended by renumbering it as subsection 60(1) and adding the following as subsections 60(2) and (3):

If person unavailable

60(2)

If the trustee reasonably believes that no person listed in subsection (1) exists or is available, the adult person listed first in the following clauses who is readily available and willing to act may exercise the rights of an individual who lacks the capacity to do so:

(a) the individual's spouse, or common-law partner, with whom the individual is cohabiting;

(b) a son or daughter;

(c) a parent, if the individual is an adult;

(d) a brother or sister;

(e) a person with whom the individual is known to have a close personal relationship;

(f) a grandparent;

(g) a grandchild;

(h) an aunt or uncle;

(i) a nephew or niece.

Ranking

60(3)

The older or oldest of two or more relatives described in any clause of subsection (2) is to be preferred to another of those relatives.

27

Subsections 63(2), (3) and (4) are amended by striking out "or information manager" wherever it occurs and substituting ", information manager or health research organization".

28

Subsections 65(1) and (2) are amended by adding "or adjudicator" after "Ombudsman" wherever it occurs.

29

Subsection 66(1) is amended

(a) by replacing subclause (d)(i) with the following:

(i) their rights to information under this Act, and

(b) in clause (i), by striking out "clause 22(2)(h)" and substituting "22(2.1)(d)";

(c) by adding the following after clause (i):

(i.1) specifying additional requirements for the purpose of section 23.2 (charitable fundraising);

(d) in clause (j), by adding ", 24.1(4)" after "24(4)"; and

(e) by adding the following after clause (j):

(j.1) prescribing health research organizations for the purpose of section 24.1;

30

Section 67 is replaced with the following:

Review of Act in five years

67(1)

The minister must undertake a comprehensive review of the operation of this Act, which involves public representations, within five years after an adjudicator is first appointed under section 58.1 of The Freedom of Information and Protection of Privacy Act.

Tabling of report

67(2)

The minister must submit a report on the review to the Legislative Assembly within one year after the review is undertaken, or within such further time as the Assembly may allow.

Coming into force

31

This Act comes into force on a day to be fixed by proclamation.

Explanatory Note

This Bill amends The Personal Health Information Act.  The following are the key changes.

Consent

The current Act requires that people give their consent before their personal health information can be used or disclosed, except in specified circumstances.  This Bill sets out criteria for a valid consent, and permits consent to be either express or implied.

Information about current care

When a family member asks a hospital or personal care home for information about care currently being provided to a relative, the facility must respond to the request within 72 hours.  Similarly, individuals who want information about care that is currently being provided to them are entitled to a response within 72 hours.

Demographic information

A new category of personal health information is created – referred to as "demographic information" – which does not reveal a person's health status.  The Bill allows such information to be disclosed without consent if the police need the information to help find a missing person, if a health care provider needs to confirm someone's eligibility for health care coverage, and in other specified circumstances.

Additional disclosures

The Bill broadens the ability to disclose personal health information, without consent, in the following circumstances:

  • Hospitals and personal care homes may disclose limited information to clergy who wish to provide spiritual care to patients and residents of those facilities, unless the patient or resident objects.
  • To assist with fundraising, hospitals and personal care homes may disclose limited information to charitable foundations with which they are associated, unless the patient or resident objects.
  • Trustees of information may disclose it on a limited basis to health research organizations for the purpose of ongoing population health and health system analysis.
  • Trustees of information may disclose it to another trustee who requires it to monitor and evaluate the quality of that other trustee's services.

Substitute decision makers

The list of persons who can exercise the rights of another person under the Act is expanded to include family members and trusted friends.  This will ensure that there is always someone capable of consenting to the use and disclosure of personal health information and someone who can request access health records on another's behalf.

Information and Privacy Adjudicator

The new Information and Privacy Adjudicator appointed under The Freedom of Information and Protection of Privacy Act will have a similar role under The Personal Health Information Act.  That adjudicator has the power, at the request of the Ombudsman, to issue an order against any trustee who has not acted on the Ombudsman's recommendations.