This is an unofficial version.
|Search this Act
S.M. 2008, c. 41
Bill 32, 2nd Session, 39th Legislature
The Personal Health Information Amendment Act (2)
(Assented to October 9, 2008)
HER MAJESTY, by and with the advice and consent of the Legislative Assembly of Manitoba, enacts as follows:
Subsection 1(1) is amended by adding the following definitions:
"adjudicator" means the Information and Privacy Adjudicator appointed under The Freedom of Information and Protection of Privacy Act; (« arbitre »)
Clauses 2(c) and (d) are replaced with the following:
(c) to establish rules governing the collection, use, disclosure, retention and destruction of personal health information in a manner that recognizes
(i) the right of individuals to privacy of their personal health information, and
Section 3 is replaced with the following:
This Act does not apply to statistical health information, or to health information that does not, either by itself or when combined with other information available to the holder, allow an individual to be readily identified.
Subsection 6(1) is replaced with the following:
A trustee shall respond to a request as promptly as required in the circumstances but not later than
(a) 24 hours after receiving it, if the trustee is a hospital and the information is about health care currently being provided to an in-patient;
(b) 72 hours after receiving it, if the information is about health care the trustee is currently providing to a person who is not a hospital in-patient; and
(c) 30 days after receiving it in any other case, unless the request is transferred to another trustee under section 8.
In the circumstance mentioned in clause (1)(a) (hospital patient), the trustee is required only to make the information available for examination and need not, despite section 7, provide a copy or an explanation.
The following is added after section 9:
In accordance with the regulations, a trustee must take reasonable steps to inform individuals
(a) of their right to examine and receive a copy of their personal health information that the trustee maintains; and
Subsection 14(2) is amended by striking out "or" at the end of clause (d) and by adding the following as clause (d.1):
(d.1) the information is collected for the purpose of
(i) compiling an accurate family or genetic health history of the individual, or
(ii) determining or verifying the individual's eligibility to participate in a program of or receive a benefit or service from the trustee or from the government, and is collected in the course of processing an application made by or on behalf of the individual; or
The following is added after Division 2 of Part 3:
CONSENT RE PERSONAL HEALTH INFORMATION
When this Act requires an individual's consent for the use or disclosure of personal health information, the consent must
(a) relate to the purpose for which the information is used or disclosed;
(b) be knowledgeable;
(c) be voluntary; and
(d) not be obtained through misrepresentation.
Consent is knowledgeable if the individual who gives it has been provided with the information that a reasonable person in the same circumstances would need in order to make a decision about the use or disclosure of the information.
Consent may be express or implied.
Consent must be express, and not implied, if
(a) a trustee makes a disclosure to a person that is not a trustee; or
(b) a trustee makes a disclosure to another trustee, but the disclosure is not for the purpose of providing health care or assisting in providing health care.
An express consent need not be in writing.
A trustee (other than the trustee who obtained the consent) may act in accordance with an express written consent or a record of an express consent having been given without verifying that the consent meets the requirements of subsection (1), unless he or she has reason to believe that the requirements have not been met.
An individual may give consent subject to conditions. But a condition that has the effect of restricting or prohibiting a trustee from recording personal health information is not effective if the recording is required by law or by established standards of professional or institutional practice.
An individual who has given consent, whether express or implied, to the use or disclosure of personal health information may withdraw it by notifying the trustee. A withdrawal does not have retroactive effect.
The following is added after clause 21(c):
(c.1) the information is demographic information about an individual, or is his or her PHIN, and is used to
(i) confirm eligibility for health care or payment for health care, or
(ii) verify the accuracy of the demographic information or PHIN;
Subsection 22(2) is amended
(a) in clause (a), by striking out "is providing" and substituting "is or will be providing";
(b) by replacing clause (f) with the following:
(f) in accordance with subsection 22(2.2) (disclosure to another government), section 23 (disclosure to patient's family), section 23.1 (disclosure to religious organization), section 23.2 (disclosure for fundraising), section 24 or 24.1 (disclosure for health research) or section 25 (disclosure to an information manager);
(c) by adding the following after clause (g):
(g.1) to another trustee who requires the information to evaluate or monitor the quality of services the other trustee provides;
(g.2) for the purpose of determining or verifying the individual's eligibility for a program, service or benefit, if the information disclosed is limited to the individual's demographic information;
(g.3) to another trustee for the purpose of de-identifying the personal health information;
(d) by replacing clause (h) with the following:
(h) to a computerized health information network established by a body specified in subsection (2.1), in which personal health information is recorded for the purpose of
(i) providing health care,
(ii) facilitating the evaluation or monitoring of a program that relates to the provision of health care or payment for health care, or
(iii) facilitating research and planning that relates to the provision of health care or payment for health care;
(e) by adding the following after clause (i):
(i.1) for the purpose of collecting a debt owed by the individual to the trustee, or to the government if the trustee is a department, if the information disclosed is limited to demographic information;
(f) by replacing clause (k) with the following:
(k) required in anticipation of or for use in a civil or quasi-judicial proceeding to which the trustee is a party, or to which the government is a party if the trustee is a department;
(k.1) required in anticipation of or for use in the prosecution of an offence;
(g) by adding the following after clause (l):
The following is added after subsection 22(2):
For the purpose of clause (2)(h), a computerized health information network may be established by
(a) the government or a government agency;
(b) the Government of Canada or of another province or territory or an agency of such a government;
(c) an organization representing one or more governments; or
(d) a trustee that is a public body specified in the regulations.
The minister or his or her designate may disclose an individual's personal health information to the government of another jurisdiction in Canada, or an agency of such a government, without the individual's consent, if
(a) the individual the information is about normally resides in the other jurisdiction;
(b) the information is about health care he or she received in Manitoba; and
The following is added after subsection 23(1):
When an immediate family member, or someone else with whom the patient or resident is known to have a close personal relationship, asks a trustee to disclose information under subsection (1), the trustee must disclose the information as soon as reasonably possible but not later than
(a) 24 hours after the request is made, if the trustee is a hospital and the information is about health care currently being provided to an in-patient; or
(b) 72 hours after the request is made, in any other case;
The following is added after section 23:
In the case of an individual who is a patient in a hospital or is a resident of a personal care home, the hospital or personal care home may disclose
(a) the individual's name and general health status; and
(b) the individual's location, unless disclosing the location would reveal specific information about the individual's health;
to a representative of a religious organization.
A disclosure may be made under subsection (1) only if
(a) the trustee has notified the individual in writing that the trustee might disclose personal health information about the individual to a representative of a religious organization, or has posted a notice to that effect where it is likely to come to the individual's attention;
(b) the notice is in a form that the individual can reasonably be expected to understand; and
(c) the individual has been given a reasonable opportunity to object to the disclosure and has not done so.
If a trustee is
(a) a hospital or personal care home; or
(b) a health care facility or health services agency designated in the regulations for the purpose of this section;
it may disclose to a charitable fundraising foundation with which it is affiliated the name and mailing address of an individual who has been a patient of the hospital, who is or has been a resident of the personal care home, or who is receiving or has received services from the facility or agency.
The trustee may make a disclosure under subsection (1) only if
(a) the trustee has notified the individual in writing that the trustee might disclose personal health information about the individual to a charitable fundraising foundation, or has posted a notice to that effect where it is likely to come to the individual's attention;
(b) the notice is in a form that the individual can reasonably be expected to understand;
(c) the individual has been given a reasonable opportunity to object to the disclosure and has not done so; and
Subsection 24(1) is replaced with the following:
Clause 24(3)(d) is replaced with the following:
(d) the research proposal contains
(i) reasonable safeguards to protect the confidentiality and security of the personal health information, and
(ii) procedures to destroy or remove, at the earliest opportunity consistent with the purposes of the research, any information that, either by itself or when combined with other information available to the holder, allows individuals to be readily identified.
The following is added after section 24:
A trustee may disclose personal health information to a health research organization for a purpose mentioned in subsection (2) only if the organization is prescribed in the regulations and meets the requirements of this section.
A trustee may disclose personal health information to a prescribed organization under this section for any of the following purposes:
(a) analyzing the health status of the population;
(b) identifying and describing patterns of illness;
(c) describing and analyzing how health services are used;
(d) analyzing the availability and adequacy of human resources required to provide health services;
(e) measuring health system performance;
(f) health system planning.
A prescribed health research organization must
(a) use personal health information disclosed to it under this section for the purpose for which it was disclosed and no other;
(b) have in place policies and procedures that protect the privacy of the individuals whose information is disclosed to it and that ensure the security and integrity of the information; and
(c) as soon as reasonably possible having regard to the use of the information, remove any information that, either by itself or when combined with other information available to the organization, allows the identity of the individuals to be readily ascertained.
Before disclosing personal health information to a prescribed health research organization, the trustee must enter into an agreement with the organization that includes any requirements specified in the regulations.
A prescribed health research organization must
(a) comply with the terms of the agreement entered into under subsection (4); and
(b) if the organization is not a trustee, comply with the same requirements concerning the protection, retention and destruction of personal health information that the trustee is required to comply with under this Act.
Subsection 32(1) is amended by striking out "or" at the end of clause (b) and replacing clause (c) with the following:
(c) in a review conducted by the adjudicator under this Act when the Ombudsman is a party; or
Section 38 is amended by adding the following definition:
Subsection 48(5) is amended by striking out everything after "inform the complainant" and substituting the following:
(a) as to whether the Ombudsman intends to ask the adjudicator to review the decision under section 48.1; and
The following is added after subsection 48(6):
The following is added after section 48:
REQUEST FOR ADJUDICATOR'S REVIEW
The Ombudsman may ask the adjudicator to review a matter described in subsection (2) if he or she has given a report to the trustee under section 48 and
(a) the trustee's response indicates that it refuses to take action to implement any of the Ombudsman's recommendations;
(b) the trustee's response indicates that it accepts the Ombudsman's recommendations, but the trustee does not take action to implement them within the required time; or
(c) the trustee fails to respond as required by subsection 48(4).
The Ombudsman may ask the adjudicator to review
(a) any decision, act or failure to act by the trustee relating to an individual's request to examine or receive a copy of his or her personal health information, or for correction of such information; or
(b) a matter relating to privacy, if the Ombudsman considers that an individual's personal health information has been collected, used or disclosed contrary to this Act.
The Ombudsman's request for review must be made
(a) within 15 days after the Ombudsman receives the trustee's response to the Ombudsman's report under subsection 48(4); or
(b) if the trustee does not respond, within 15 days after the deadline for a response has expired.
As soon as practicable after receiving a request from the Ombudsman, the adjudicator must notify the complainant, the trustee concerned and any other person who, in the adjudicator's opinion, is affected by it.
CONDUCT OF REVIEW BY ADJUDICATOR
On receiving a request from the Ombudsman, the adjudicator must conduct a review of the matter and decide all questions of fact and law arising in the course of the review.
The adjudicator may make rules of procedure for conducting a review under section 48.3.
The adjudicator may receive and accept any evidence and other information that he or she considers appropriate, whether on oath or by affidavit or otherwise, and whether or not it is admissible in a court of law.
A review may be conducted in private.
For the purpose of conducting a review, the adjudicator has the same powers and protections as the Ombudsman has under section 29 (Evidence Act powers and production of records).
The complainant, the trustee concerned and any person given notice under section 48.2
(a) must be given an opportunity to make representations to the adjudicator during a review under section 48.3; and
(b) are entitled to be represented by counsel or an agent.
The adjudicator may decide
(a) whether representations are to be made orally or in writing; and
(b) whether a person is entitled to be present during representations made to the adjudicator by another person, or is entitled to have access to those representations or to comment on them.
The Ombudsman has a right to be a party in any review conducted by the adjudicator if the Ombudsman considers that the review raises an issue of public interest.
A review under section 48.3 must be completed within 90 days after the adjudicator receives the request from the Ombudsman, unless the adjudicator extends the period.
If the 90-day period is extended, the adjudicator must notify the complainant, the trustee concerned, the Ombudsman and any other person given notice under section 48.2, and he or she must also inform them of the date by which the review is expected to be completed.
In a review of a decision to refuse to permit an applicant to examine or receive a copy of personal health information, it is up to the trustee to prove that the refusal is justified.
Upon completing a review under section 48.3, the adjudicator must dispose of the issues by making an order under this section.
If the review concerns a complaint about access, the adjudicator may, by order,
(a) require the trustee to permit the applicant to examine or copy all of part of the personal health information, if the adjudicator determines that the trustee was not justified under section 11 in refusing to permit the applicant to do so;
(b) confirm the trustee's decision, if the adjudicator determines that the trustee was justified under section 11 in refusing to permit the applicant to examine or copy the information;
(c) confirm or reduce a fee, or order a refund of a fee, in the appropriate circumstances;
(d) confirm a decision not to correct personal health information, or specify how personal information is to be corrected.
If the review concerns a complaint about privacy, the adjudicator may, by order,
(a) require the trustee to cease or modify a specified practice of collecting, using, disclosing, retaining or destroying personal health information contrary to this Act;
(b) require the trustee to destroy personal health information collected in contravention of this Act.
The adjudicator may specify terms or conditions in an order made under this section.
The adjudicator must give a copy of an order made under this section to each of the following:
(a) the complainant;
(b) the trustee concerned;
(c) the Ombudsman;
(d) any other person given notice under section 48.2.
The adjudicator must make orders made under this section available to the public, and may do so by publishing them on a website on the Internet.
Unless an application for judicial review is made under subsection (2), the trustee concerned must comply with an adjudicator's order
(a) within 30 days after being given a copy; or
(b) within any longer period specified in the order.
An application for judicial review of an adjudicator's order must be made within 25 days after the person making the application is given a copy of the order, unless the court extends the period.
If an application for judicial review is made under subsection (2), the adjudicator's order is stayed until the court deals with the application.
GENERAL PROVISIONS RE THE ADJUDICATOR
The adjudicator shall take every reasonable precaution, including receiving representations ex parte, conducting hearings in private and examining records in private, to avoid disclosure to the complainant of personal health information the trustee is justified in refusing to disclose under section 11.
A statement made or an answer given by a person during a review by the adjudicator is inadmissible as evidence in court or in any other proceeding, except
(a) in a prosecution for perjury in respect of sworn testimony;
(b) in a prosecution for an offence under this Act; or
(c) in an application for judicial review or an appeal from a decision with respect to that application.
Subsection (1) applies also in respect of evidence of the existence of proceedings conducted before the adjudicator.
Anything said, any information supplied, and any record produced by a person during a review by the adjudicator under this Act is privileged in the same manner as if it were said, supplied or produced in a proceeding in a court.
No proceedings lie against the adjudicator or deputy adjudicator, or against any person acting for or under the direction of either of them, for anything done, reported or said in good faith in the exercise or performance or the intended exercise or performance of a duty or power under this Act.
The adjudicator must make an annual report to the Speaker of the Assembly about the exercise of the adjudicator's responsibilities under this Act.
Subsections 49(2) and (3) are replaced with the following:
An appeal may be made under this section only if
(a) the individual has made a complaint about access to the Ombudsman and the Ombudsman has provided a report under section 47; and
(b) the deadline set out in subsection 48.1(3) for the Ombudsman to request the adjudicator to review the matter has expired, and the Ombudsman did not request a review.
An appeal is to be made by filing an application with the court within 30 days after the deadline set out in subsection 48.1(3) expires, or within any longer period that the court may allow in special circumstances.
Section 60 is amended by renumbering it as subsection 60(1) and adding the following as subsections 60(2) and (3):
If the trustee reasonably believes that no person listed in subsection (1) exists or is available, the adult person listed first in the following clauses who is readily available and willing to act may exercise the rights of an individual who lacks the capacity to do so:
(a) the individual's spouse, or common-law partner, with whom the individual is cohabiting;
(b) a son or daughter;
(c) a parent, if the individual is an adult;
(d) a brother or sister;
(e) a person with whom the individual is known to have a close personal relationship;
(f) a grandparent;
(g) a grandchild;
(h) an aunt or uncle;
(i) a nephew or niece.
Subsection 66(1) is amended
(a) by replacing subclause (d)(i) with the following:
(i) their rights to information under this Act, and
(b) in clause (i), by striking out "clause 22(2)(h)" and substituting "22(2.1)(d)";
(c) by adding the following after clause (i):
(i.1) for the purpose of section 23.2 (charitable fundraising),
(i) designating health care facilities and health services agencies, and
(ii) specifying additional requirements under clause (2)(d);
(d) in clause (j), by adding ", 24.1(4)" after "24(4)"; and
(e) by adding the following after clause (j):
Section 67 is replaced with the following:
The minister must undertake a comprehensive review of the operation of this Act, which involves public representations, within five years after an adjudicator is first appointed under section 58.1 of The Freedom of Information and Protection of Privacy Act.
The minister must submit a report on the review to the Legislative Assembly within one year after the review is undertaken, or within such further time as the Assembly may allow.
This Act comes into force on a day to be fixed by proclamation.