Health Information Act

(1) In this Act,

"access request" means a request under subsection 96(1) by an individual for access to a record containing personal health information about him or her; (demande d’accès)

"Act" means an Act of the Northwest Territories except where used in the context of an Act of Canada; (loi)

"agent", except in paragraphs 25(1)(g) and 115(b) and (c), subsection 151(6) and section 193, means a person or organization listed in subsection 9(2) that is authorized by subsection 9(1) to act as an agent; (mandataire)

"collect", in relation to information, means to acquire, gather, obtain or receive information; (recueillir)

"contact person" means a contact person designated under subsection 12(1), or the health information custodian, if he or she is a natural person and acts as his or her own contact person; (personne-ressource)

"correction request" means a request under subsection 119(1) by an individual for correction of a record containing personal health information about him or her; (demande de correction)

"Department" means the Department of Health and Social Services; (ministère)

"disclose", in relation to information, means to release information or make information available in any manner, including verbally or visually, to a person or organization; (divulguer)

"electronic" includes created, recorded, transmitted or stored in digital form or in other intangible form by electronic, magnetic, optical or other similar means; (électronique) "electronic signature" means electronic information

"extra-territorial research ethics committee" means a body, recognized by or established pursuant to the legislation of a jurisdiction other than the Northwest Territories, that

"health information custodian" means

"health service"

"health service provider" means

"individual" means a natural person, whether living or deceased, unless the context indicates otherwise; (individu)

"Information and Privacy Commissioner", "IPC", means the Information and Privacy Commissioner referred to in section 168; (commissaire à l’information et à la protection de la vie privée)

"information manager" means a person or organization that provides one or more of the following services for a health information custodian:

"law enforcement" includes

"organization" includes a government, department, agency, board, committee and panel; (organisation)

"personal health information" means the following information in any form that identifies an individual, or in respect of which it is reasonably foreseeable in the circumstances that the information could be used, either alone or with other information, to identify an individual:

"privacy impact assessment", in respect of an information system or communication technology, means an assessment describing how the privacy of individuals whose personal health information would be collected, used or disclosed would be affected by the system or technology; (évaluation des répercussions sur la vie privée) "public custodian" means

"record"

"regulation" means a regulation of the Northwest Territories except where used in the context of a regulation of Canada; (règlement)

"research"

"research ethics committee" means a research ethics committee designated by the Minister under section 68 or a research ethics committee established by the regulations; (Comité d’éthique de la recherche)

"researcher" means a person or organization, including a health information custodian, that collects or uses, or wishes to collect or to use, personal health information for research purposes; (chercheur)

"substitute decision maker" means a person referred to in paragraphs 25(1)(c) to (i) who acts on behalf of an individual; (subrogé)

"use", in relation to information, means to handle, deal with or apply information for a purpose, including to reproduce or transform it, but does not mean to collect or disclose information. (utiliser)

(2) For the purposes of this Act, a reference to assisting in the provision of a health service includes administrative services such as

(3) Where a provision of this Act relates to the exercise of a right or power conferred on an individual whose personal health information is at issue, including the exercise of any authority of an individual in respect of the collection, use or disclosure of personal health information, a reference to the individual means the person entitled under section 25 to exercise the right or power, except where the context indicates that the particular reference does not apply in respect of a substitute decision maker.

(4) Nothing in this Act shall be construed so as to prevent a health information custodian from collecting, using or disclosing non-identifying information. SNWT 2015,c.14,s.27.

(1) This Act applies to all records containing personal health information that are in the custody or under the control of a health information custodian, except the following:

(2) This Act

(1) If a provision of this Act is inconsistent with or in conflict with a provision of another Act, the provision of this Act prevails unless the other Act expressly provides that it, or a provision of it, prevails notwithstanding this Act.

(2) This Act applies notwithstanding section 4 of the Access to Information and Protection of Privacy Act.

(3) This Act does not limit a person’s right of access under section 5 of the Access to Information and Protection of Privacy Act to a record containing personal health information to which this Act applies if the information to which this Act applies can reasonably be severed from the record.

(4) Subsection (1) does not apply so as to limit the application of the Electronic Transactions Act.

(1) This section only applies to a request made to a public custodian.

(2) If an access request includes a request for access to a record containing information to which the Access to Information and Protection of Privacy Act applies, the part of the request that relates to that information is deemed to be a request under section 6 of the Access to Information and Protection of Privacy Act and that Act applies in respect of that part of the request as if it had been made under section 6 of that Act.

(3) If a correction request includes a request to correct information in a record to which the Access to Information and Protection of Privacy Act applies, the part of the request that relates to that information is deemed to be a request under section 45 of the Access to Information and Protection of Privacy Act and that Act applies in respect of that part of the request as if it had been made under section 45 of that Act.

(1) A health information custodian shall establish or adopt standards, policies and procedures to implement the requirements of this Act and the regulations, including the requirements under sections 85 to 88.

(2) A health information custodian shall, at the request of the Department, give the Department a copy of the standards, policies and procedures established or adopted under subsection (1).

(3) A health information custodian shall comply with standards, policies and procedures established or adopted under subsection (1).

(1) A person or organization listed in subsection (2) may act as an agent for or on behalf of a health information custodian in respect of the powers, duties and functions of the custodian under this Act relating to the collection, use, disclosure, management, retention or disposition of personal health information, if

(2) Each of the following persons and organizations may act as an agent for or on behalf of a health information custodian if authorized by subsection (1) to do so:

(3) A person or organization listed in paragraphs (2)(a) to (d) shall not

(1) An agent shall comply with this Act and the regulations in the collection, use and disclosure of personal health information and in the exercise of other powers of a health information custodian and the performance of other duties and functions of a health information custodian.

(2) A health information custodian shall take reasonable measures to ensure that its agents comply with this Act and the regulations.

(1) An agent shall comply with standards, policies and procedures established or adopted by a health information custodian under subsection 8(1).

(2) A health information custodian shall take reasonable measures to ensure that its agents comply with standards, policies and procedures established or adopted under subsection 8(1).

(1) A health information custodian shall designate one or more contact persons to

(2) For greater certainty, a person may be designated under subsection (1) as a contact person in respect of one or more duties under that subsection and at least one person must be designated as a contact person in respect of each duty.

(3) Notwithstanding subsection (1), a health information custodian who is a natural person may act as his or her own contact person for the purposes of paragraphs (1)(a) to (g).

(1) In this section,

"information management agreement" means an agreement in writing in respect of the protection of personal health information and privacy of individuals the information is about; (accord de gestion de l’information)

"private custodian" means a health information custodian other than a public custodian. (dépositaire privé)

(2) Subject to subsection (3) and any exceptions set out in the regulations, before using the services of an information manager, a health information custodian shall enter into an information management agreement with the information manager.

(3) Subsection (2) does not apply if

(4) An information management agreement must contain terms under which the information manager agrees to comply with

(5) A health information custodian that has entered into an information management agreement under subsection (2) may disclose personal health information to the information manager in accordance with the agreement.

(6) If the Department enters into an information management agreement with an information manager on behalf of a health information custodian, as referred to in subparagraphs (3)(b)(iv) and (c)(ii), that custodian may disclose personal health information to the information manager in accordance with the agreement.

(7) For greater certainty, a health information custodian may have more than one information manager and may, subject to the exceptions set out in this Act or the regulations, disclose personal health information to each information manager without the consent of the individuals the information is about.

(8) An information manager to which personal health information is disclosed shall not

CONSENT AND SUBSTITUTE DECISION

(1) Where this Act requires an individual’s consent for the collection, use or disclosure of personal health information about him or her, the consent

(2) A health information custodian may assume, unless it is unreasonable in the circumstances to make the assumption, that an individual knows the purposes of the collection, use or disclosure of personal health information, if the health information custodian informs the individual about the purposes and,

(3) Subsection (2) is subject to any exceptions set out in the regulations.

(1) Subject to this Act, a consent to the collection, use or disclosure of personal health information about an individual may be express or implied.

(2) For greater certainty, unless the contrary is indicated, a reference in this Act to consent, including a reference to consent in the context of an individual who must consent or who has provided consent, means express or implied consent.

(1) Subject to subsections (3) and (4), a health information custodian that collects personal health information from the individual the information is about for the purpose of providing or assisting in the provision of a health service to the individual, may assume that the individual has provided implied consent to the custodian’s

(2) Subject to subsections (3), (5) and (6), a health information custodian that collects personal health information about an individual from a health service provider, for the purpose of providing or assisting in the provision of a health service to the individual, may assume that

(3) Paragraph (1)(b) and subsection (2) do not apply if the health information custodian that collects the information is aware that the individual has expressly withheld or withdrawn consent.

(4) Paragraph (1)(b) does not apply if the health information custodian that collects the information is aware that the individual has provided an express instruction that the information may not be disclosed.

(5) Subparagraph (2)(a)(i) does not apply if the health information custodian that collects the information is aware that the individual has provided an express instruction limiting the further collection or use of that information.

(6) Subparagraph (2)(a)(ii) does not apply if the health information custodian that collects the information is aware that the individual has provided an express instruction limiting the further disclosure of that information.

(1) Subject to subsection (2), if a health information custodian collects personal health information about an individual from another custodian for a use referred to in section 35, or a public custodian collects personal health information from a health information custodian for a use referred to in section 37, the custodian that collects the information may assume that the individual has provided implied consent to that custodian’s

(2) Subsection (1) does not apply if the health information custodian that collects the information is aware that

(1) Subject to subsection (2), express consent to the collection, use or disclosure of personal health information under this Act must be provided in writing.

(2) Express consent may be provided in verbal form if the health information custodian that seeks the express consent has reasonable grounds to believe that it is not practical for consent to be provided in writing.

(3) Express consent in writing must

(4) Express consent in writing may set out conditions or instructions in respect of future collection, use or disclosure of the personal health information to which the consent relates.

(5) An individual providing express consent in verbal form must clearly indicate to the health information custodian obtaining the express consent that the individual

(6) A health information custodian that obtains express consent in verbal form shall, as soon as reasonably possible after obtaining it, make a record in writing that

(7) A health information custodian that makes a record referred to in subsection (6) shall, in the record,

(1) In this section and section 23, "condition" includes an express instruction provided at the time consent is provided or after consent is provided.

(2) A condition placed by an individual on his or her consent to the collection, use or disclosure of personal health information about the individual

(3) If an individual places a condition on his or her consent to the collection, use or disclosure of personal health information about the individual, a health information custodian that collects the information shall

(1) An individual who has provided express or implied consent to the collection, use or disclosure of personal health information about him or her, may withdraw consent by giving notice to the health information custodian.

(2) A withdrawal of consent may be a full or partial withdrawal.

(3) A withdrawal of consent to the collection, use or disclosure of personal health information

(4) On receiving notice that an individual has withdrawn consent to the collection, use or disclosure of personal health information about him or her, a health information custodian that collected the information shall

(5) Paragraph (4)(d) applies only in respect of a disclosure of personal health information made within one year before the withdrawal of consent.

(1) Any right or power conferred on an individual by this Act, including any authority of an individual in respect of the collection, use or disclosure of personal health information about him or her, may be exercised,

(2) A health information custodian may assume that paragraph (1)(b) applies in respect of the exercise of a right or power conferred by this Act on an individual who has not attained 19 years of age, if the custodian has reasonable grounds to believe that the individual

(3) A health information custodian may assume that paragraph (1)(c) applies in respect of the exercise of a right or power conferred by this Act on an individual who has not attained 19 years of age, if the custodian has a reasonable doubt as to whether the individual

(4) A notice required to be given to an individual under this Act may be given to a substitute decision maker.

(1) Subject to subsection (3) and the regulations, a health information custodian shall not collect, use or disclose personal health information if non-identifying health information would be adequate for the intended purposes of the collection, use or disclosure.

(2) Subject to subsection (3), a health information custodian shall not collect, use or disclose more personal health information than is reasonably necessary to meet the purpose of the collection, use or disclosure.

(3) This section does not apply in respect of personal health information that a health information custodian is required by law to collect, use or disclose.

Collection of Personal Health Information

(1) A person other than an individual who is assigned a personal health number or a health information custodian, shall not collect or use the individual’s personal health number unless the collection or use is required

(2) A person other than a health information custodian that requests an individual to provide a personal health number shall inform that individual of the person’s legal authority to do so.

(1) Subject to the regulations, a health information custodian may strip, encode or otherwise transform personal health information to create or produce non-identifying information.

(2) Subject to the regulations, a health information custodian may, for a purpose for which personal health information may be used or disclosed under this Act,

(1) In this section, "recipient" means a person to whom personal health information is disclosed who is not

(2) Except as permitted or required by law, and subject to the regulations, a recipient shall not use or disclose personal health information disclosed to him or her by a health information custodian for any purpose other than

(3) Except as permitted or required by law, and subject to the regulations, a recipient shall not use or disclose more of the information referred to in subsection (2) than is reasonably necessary to meet the purpose of the use or disclosure.

(1) Subject to subsection (3), a health information custodian may, for a purpose referred to in section 35, disclose personal health information to another custodian.

(2) Subject to subsection (3), a public custodian may, for a purpose referred to in section 37, disclose personal health information to another public custodian.

(3) Subsections (1) and (2) do not apply if the disclosure of personal health information is contrary to an express instruction by the individual.

(1) Subject to subsection (3), a health information custodian may disclose personal health information about an individual to a health service provider for the purpose of providing or assisting in the provision of a health service to that individual.

(2) Subject to subsection (3), a health information custodian may disclose personal health information about an individual if the disclosure

(3) Subsections (1) and (2) do not apply if the disclosure of personal health information is contrary to an express instruction by the individual.

(1) Subject to subsection (2), if an individual is injured, ill or incapacitated and unable to provide consent to the disclosure of personal health information about him or her, a health information custodian may disclose limited personal health information about the individual for the purpose of contacting a person in a close personal relationship with the individual or a potential substitute decision maker.

(2) Subsection (1) does not apply if the disclosure of personal health information is contrary to an express instruction by the individual.

(1) In this section, "relative" means either of two persons who

(2) A health information custodian may disclose personal health information about an individual who is deceased or presumed to be deceased

(1) Subject to subsection (2), a health information custodian may disclose personal health information about an individual to a potential successor to all or part of the operation of the custodian, for the purpose of allowing the potential successor to assess and evaluate the operation of the custodian or the applicable part.

(2) Information may only be disclosed under subsection (1) if the potential successor first enters into an agreement with the health information custodian to keep the information confidential and secure and not to retain the information any longer than is necessary for the purpose of the assessment or evaluation.

(1) A health information custodian may disclose personal health information about an individual to its successor, if

(2) A health information custodian that transfers records containing personal health information about individuals to a successor shall, before the transfer or as soon as possible after the transfer, take reasonable steps to give notice to each individual about the transfer, including information that identifies the successor.

(1) A health information custodian may disclose personal health information about an individual if the custodian has reasonable grounds to believe that the disclosure is required to prevent or reduce

(2) A health information custodian may disclose personal health information about an individual to a medical or mental health expert

(1) Subject to subsection (2) and the regulations, a public custodian may disclose personal health information about an individual to a prescribed person or organization for the purpose of compiling and analyzing statistical information that

(2) Personal health information may only be disclosed under subsection (1) in accordance with an information sharing agreement.

(3) An information sharing agreement referred to in subsection (2) may authorize a prescribed person or organization to which personal health information is disclosed under paragraph (1)(b), to disclose the statistical information that the person or organization has compiled and analyzed to a government or organization, referred to in paragraph 60(a) or (b),

(1) A researcher may apply to a research ethics committee for approval of a research proposal.

(2) An application made under subsection (1) must include

(1) When deciding under paragraph 69(a) whether to approve a research proposal, a research ethics committee shall assess the following factors:

(2) In determining whether express consent to the collection, use or disclosure of personal health information must be obtained from the individuals whose personal health information would be collected, used or disclosed, the research ethics committee may take into account whether the requirement for express consent would be unreasonable, impractical or not feasible.

(1) A research ethics committee shall give notice to a researcher of

(2) The notice referred to in subsection (1) must include

(1) Subject to sections 79 and 80, a health information custodian may disclose personal health information to a researcher in accordance with section 77 or 78.

(2) For greater certainty, a health information custodian is not required to disclose personal health information to a researcher whose research proposal has been approved by a research ethics committee under paragraph 69(a), or by an extra-territorial research ethics committee.

(1) A health information custodian may not disclose personal health information to a researcher under section 77 or 78 unless the custodian and researcher enter into an agreement in which the researcher agrees to comply with

(2) Subject to subsection (3) and the regulations, an agreement referred to in subsection (1) may require a researcher to pay to a health information custodian fees and disbursements for the costs of providing disclosure, such as costs in respect of

(3) Subject to the regulations, fees and disbursements referred to in subsection (2) must not exceed the costs of providing the service.

(1) After an agreement has been entered with a researcher under section 80, a health information custodian may contact individuals to seek their express consent to disclose personal health information about them to the researcher.

(2) A researcher who has collected personal health information about an individual from a health information custodian may only contact the individual to request further details if the custodian first obtains express consent from the individual for the researcher to contact the individual for that purpose.

(1) Subject to subsections (2) and (3), a health information custodian that discloses personal health information about an individual without his or her express consent, shall make a record of

(2) Subsection (1) does not apply to the disclosure of personal health information under section 43, 44 or 48.

(3) Subsection (1) does not apply where a health

from an electronic record stored in an electronic health information system, if the system automatically keeps an electronic log

Protection of Personal Health Information

(1) A health information custodian shall take reasonable measures to maintain administrative, technical and physical safeguards for the protection of personal health information, including for protection

(2) A health information custodian shall implement controls that limit the persons who may use personal health information maintained by the custodian to those authorized to do so.

(1) A health information custodian shall take reasonable measures to protect the security and confidentiality of records that contain personal health information, including measures to ensure that the records

(2) The measures under subsection (1) must include measures to address risks to confidentiality and privacy associated with electronic health records that are based on nationally or territorially recognized information technology security standards and processes that are appropriate for the high level of sensitivity of personal health information.

(3) A health information custodian shall take reasonable measures to maintain records in an orderly manner and to maintain an organized system of record-keeping, to ensure ease of access to the records when personal health information is required.

(4) A health information custodian shall comply with requirements set out in the regulations in respect of the retention, transfer, and destruction or other disposal of records containing personal health information.

(1) In this section, "prescribed custodian" means a health information custodian prescribed as a custodian to which this section applies.

(2) A public custodian and a prescribed custodian shall prepare a privacy impact assessment in respect of a proposed new, or a proposed change to an information system or communication technology relating to the collection, use or disclosure of personal health information.

(3) A health information custodian to which this section applies shall give a copy of the privacy impact assessment to the Information and Privacy Commissioner.

PART 5 ACCESS TO AND CORRECTION OF PERSONAL HEALTH INFORMATION

(1) Nothing in this Act prevents a health information custodian from disclosing personal health information about an individual to him or her

(2) Nothing in this Act relieves a health information custodian from a duty to disclose, in a manner that is not inconsistent with this Act, personal health information as expeditiously as is necessary for the provision of a health service to the individual.

(1) Subject to subsections (2) and (3), an applicant has a right of access to any record containing personal health information about the applicant in the custody or under the control of a health information custodian.

(2) The right of access to a record does not extend to information excepted from disclosure under sections 110 to 118, but where that information can reasonably be severed from a record, the applicant has a right of access to the remainder of the record.

(3) An applicant does not have a right of access to a record requested in an access request if the Information and Privacy Commissioner, under subsection 131(1), has authorized the health information custodian to disregard the access request.

(1) The right of access to a record is subject to the payment of applicable fees and disbursements set in accordance with the regulations.

(2) Subject to the regulations, fees and disbursements referred to in subsection (1) must not exceed the costs of processing the access request.

(3) A public custodian may waive payment of all or part of fees and disbursements referred to in subsection (1) if the custodian has reasonable grounds to believe that the applicant cannot afford the payment or, for any other reason, it is fair to waive payment.

(4) A health information custodian other than a public custodian may waive payment of all or part of fees and disbursements referred to in subsection (1).

(1) An individual who wishes to obtain access to a record containing personal health information about him or her may make a request to the health information custodian that the individual believes has custody or control of the record.

(2) A health information custodian that receives a verbal access request may require an applicant to submit the request in writing.

(3) The access request must include enough detail to enable the health information custodian to identify the record.

(4) In an access request, the applicant may ask for a copy of the record or to examine the record.

(1) Subject to this Part, if an applicant asks under subsection 96(4) for a copy of a record, the health information custodian shall

(2) Subject to this Part, if an applicant asks under subsection 96(4) to examine a record, the health information custodian shall

(1) Subject to subsections (2) and (3), not later than 30 days after receiving an access request, a health information custodian shall give an applicant a response in writing that includes

(2) Subsection (1) does not apply to an access request

(3) The 30 day time limit in subsection (1) does not apply if subsection 104(4), 105(1), 105(2) or 106(3) or section 107 applies to the time limit for responding to an applicant under subsection (1).

(1) Subject to subsection 95(1), if a health information custodian informs an applicant under paragraph 101(1)(b) that a copy of a record or part of a record will be given, but does not give a copy of it with the response referred to in subsection 101(1), the custodian shall give a copy of the record to the applicant as soon as reasonably possible and not later than 30 days after giving the response.

(2) Subject to subsection 95(1), if a health information custodian informs an applicant under paragraph 101(1)(b) that access will be provided through examination of a record, the health information custodian shall provide access as soon as reasonably possible and not later than 30 days after giving the response under subsection 101(1).

(1) A health information custodian that requires further information from an applicant to identify a record shall, as soon as reasonably possible, and not later than 10 days after receiving an access request, make a request in writing to the applicant for the further information.

(2) If fees or disbursements will be payable to a health information custodian from an applicant in respect of an access request, the custodian shall, as soon as reasonably possible, and not later than 20 days after receiving the access request or 20 days after receiving further information under subsection (1), whichever occurs later,

(3) A health information custodian shall give an applicant an invoice for fees or disbursements within the time limit set by the regulations if, in accordance with the regulations, payment of any fees or disbursements by an applicant is required before an access request is processed.

(4) If subsection (1), (2) or (3) applies, a health information custodian shall respond to the applicant as required under subsection 101(1) not later than the latest of

(5) A health information custodian may deem an access request to be abandoned by an applicant if the applicant

(6) A health information custodian shall inform the applicant in writing about subsection (5)

(7) Deemed abandonment of an access request does not prevent an applicant from making a further access request in respect of the same record.

(1) If under subsection 129(1) a health information custodian requests the Information and Privacy Commissioner to authorize the custodian to disregard an access request,

(2) If the Information and Privacy Commissioner denies a request by a health information custodian under subsection 129(1) to authorize the custodian to disregard an access request, the custodian shall respond to the applicant as required under subsection 101(1)

(1) A health information custodian may extend the time limit for responding to an access request for a reasonable period not exceeding 30 days after the expiration of the applicable time limit under subsection 101(1), 104(4) or 105(2) for responding to the access request, if

(2) A health information custodian that extends the time limit shall give notice to the applicant, without delay,

(3) Subject to section 107, a health information custodian that extends the time limit under subsection (1) shall respond to the applicant as required under subsection 101(1) before the expiration of the extension.

(1) If under subsection 132(1) a health information custodian requests the Information and Privacy Commissioner to authorize a further extension of the time limit for responding to an access request, the time limits under subsections 101(1) and 104(4) for the custodian to respond to an applicant are suspended from the day the custodian makes the request to the day the custodian receives the decision from the IPC.

(2) If the Information and Privacy Commissioner denies a request by a health information custodian under subsection 132(1) to authorize an extension of the time limit for responding to an access request, the custodian shall respond to the applicant as required under subsection 101(1) not later than 30 days after receiving the decision from the IPC.

(3) If under subsection 133(2) the Information and Privacy Commissioner authorizes an extension of the time limit for responding to an access request, the health information custodian shall respond to the applicant as required under subsection 101(1) before the expiration of the extension.

(1) A health information custodian may transfer an access request or part of an access request to another custodian, if the access request or part relates to a record

(2) A health information custodian that transfers an access request shall, without delay, give notice to the applicant

(3) A health information custodian to which an access request is transferred shall, without delay after receiving the access request, give the applicant the title, business address, email address and business telephone number of a contact person who can respond to inquiries about the transfer.

(1) Subject to subsections (2) and (3), a health information custodian shall refuse to disclose information to an applicant if the disclosure would reveal personal health information about another individual who has not consented to the disclosure, or if the disclosure would otherwise be an unreasonable invasion of the privacy of another individual.

(2) The prohibition in subsection (1) does not apply in respect of personal health information about another individual in a record about the applicant that was originally provided by the applicant.

(3) Subsection (1) does not apply so as to limit the disclosure of personal health information about an individual to an applicant who is a substitute decision maker for the individual.

(1) In this section, "quality assurance activity", "quality assurance committee" and "quality assurance record" have the definitions assigned to them by section 13 of the Evidence Act.

(2) Subject to subsection (3), a health information custodian shall refuse to disclose to an applicant

(3) A health information custodian may disclose to an applicant a quality assurance record that consists of results of or recommendations in relation to a quality assurance activity.

(1) A health information custodian may refuse to disclose personal health information about an applicant to the applicant if, in the opinion of a medical or mental health expert, the disclosure could reasonably be expected to result in

(2) A health information custodian may refuse to disclose personal health information about an applicant to the applicant if the disclosure could reasonably be expected to result in

(1) An individual who believes there is an error or omission in a record containing personal health information about him or her may, in writing, request the health information custodian that has the record in its custody or under its control to correct the information.

(2) On receiving a correction request, a health information custodian shall make every reasonable effort to

(3) A health information custodian shall not charge fees or disbursements in respect of a correction request.

(1) Subject to subsection (3), a health information custodian shall, not later than 30 days after receiving a correction request,

(2) A health information custodian that refuses to make a requested correction shall include the following information with the response referred to in paragraph (1)(b):

(3) The 30 day time limit in subsection (1) does not apply if subsection 122(2) or 123(3) or section 124 applies to the time limit for complying with the requirements of subsection (1).

(1) A health information custodian that requires further information from an applicant to identify a record, or for the purpose of clarification in respect of a requested correction, shall, as soon as reasonably possible, and not later than 10 days after receiving a correction request, make a request in writing to the applicant for the further information.

(2) If subsection (1) applies, a health information custodian shall comply with the requirements of subsection 120(1) in respect of the correction request not later than 30 days after receiving the requested information.

(3) A health information custodian may deem a correction request to be abandoned by an applicant if the applicant fails to respond within 60 days after he or she receives a request from the custodian under subsection (1) to provide further information.

(4) A health information custodian shall inform an applicant about subsection (3) in a request under subsection (1) for further information.

(5) Deemed abandonment of a correction request does not prevent an applicant from making a further correction request in respect of the same record.

(1) A health information custodian may extend the time limit for complying with the requirements of subsection 120(1) in respect of a correction request for a reasonable period not exceeding 30 days after the expiration of the applicable time limit under subsection 120(1) or 122(2), if

(2) A health information custodian that extends the time limit for complying with the requirements of subsection 120(1) shall give notice to the applicant, without delay,

(3) Subject to section 124, a health information custodian that, under subsection (1), extends the time limit for complying with the requirements of subsection 120(1), shall comply with those requirements before the expiration of the extension.

(1) If under subsection 132(2) a health information custodian requests the Information and Privacy Commissioner to authorize a further extension of the time limit for complying with the requirements of subsection 120(1) in respect of a correction request, the time limit referred to in that subsection is suspended from the day the custodian makes the request to the day the custodian receives the decision from the IPC.

(2) If the Information and Privacy Commissioner denies a request by a health information custodian under subsection 132(2) to authorize an extension of the time limit for complying with the requirements of subsection 120(1), the custodian shall comply with those requirements not later than 30 days after receiving the decision from the IPC.

(3) If under subsection 133(2) the Information and Privacy Commissioner authorizes an extension of the time limit for complying with the requirements of subsection 120(1) in respect of a correction request, the health information custodian shall comply with those requirements before the expiration of the extension.

(1) In this section and section 127, "statement of disagreement" means a statement by an applicant setting out reasons for disagreeing with a decision of a health information custodian to refuse to make a correction to information in a record that was requested in a correction request.

(2) If a health information custodian refuses under section 125 to make a correction requested by an applicant in a correction request, the applicant may do one or more of the following:

(1) Subject to the regulations, on receiving a statement of disagreement, a health information custodian shall attach the statement to the record that is the subject of the correction request or include a cross-reference in the record to the statement, if the record is in the custody or under the control of the custodian and contains personal health information about the applicant.

(2) Subject to the regulations, on receiving a request to attach a correction request to a record that is the subject of the correction request, a health information custodian shall attach the correction request to the record or include a cross-reference in the record to the correction request, if the record is in the custody or under the control of the custodian and contains personal health information about the applicant.

(3) Subject to the regulations, a heath information custodian that is required under subsection (1) to attach a statement of disagreement to a record, or under subsection (2) to attach a correction request to a record, shall take reasonable steps to give a copy of the statement or correction request to each person and organization to which the custodian had disclosed the record within one year before the applicable correction request was made.

(4) Subject to subsection (5) and the regulations, a health information custodian that receives a statement of disagreement or correction request from another custodian under subsection (3), shall attach the statement or correction request to the record that was the subject of the correction request or include a cross-reference in the record to the statement or correction request.

(5) Subsection (4) does not apply if the applicable record is an electronic record stored in an electronic health information system and the statement of disagreement or correction request has already been attached or cross-referenced.

(1) Subject to subsections (2) and (3) and the regulations, a health information custodian that has corrected personal health information in a record shall take reasonable steps to provide the corrected information to each person and organization to which the custodian had disclosed the record within one year before the correction was made.

(2) The requirement in subsection (1) does not apply if the applicant informs the custodian in writing that it is not necessary to provide the corrected information to other persons and organizations.

(3) Subject to subsection (4), the requirement in subsection (1) does not apply if the health information custodian has reasonable grounds to believe that refraining from providing the corrected information to a person or organization will not

(4) The exception in subsection (3) does not apply if the individual has provided an express instruction that the corrected personal health information should be provided to persons and organizations as required under subsection (1).

(5) Subject to subsection (6) and the regulations, a health information custodian that receives a correction from another custodian under subsection (1), shall make the correction, attach the corrected information to the record that is the subject of the correction or include a cross-reference in the record to the correction.

(6) Subsection (5) does not apply if the applicable record is an electronic record stored in an electronic health information system and the correction has already been made, attached or cross-referenced.

PART 6 REVIEW AND APPEAL

Request for Authorization to Disregard Access Request

(1) A health information custodian may request the Information and Privacy Commissioner to authorize the custodian to disregard an access request.

(2) A request under subsection (1) must be made in writing to the Information and Privacy Commissioner as soon as reasonably possible and not later than 30 days after the health information custodian receives the access request.

(3) A health information custodian that makes a request under subsection (1) shall, without delay, give notice and a copy of the request to the individual who made the access request.

(1) Subject to subsection (2), the Information and Privacy Commissioner shall conduct a review of a request by a health information custodian made under subsection 129(1).

(2) After an initial review of a request made under subsection (1), the Information and Privacy Commissioner may deny the request without hearing representations or conducting a full review of the matter.

(3) A decision under subsection (2) must be in writing and does not require reasons.

(4) The Information and Privacy Commissioner shall give a copy of the decision under subsection (2) to

(5) A decision under subsection (2) is final and is not subject to appeal.

(1) On completing a review of a request under subsection 130(1), the Information and Privacy Commissioner may authorize the health information custodian to disregard an access request if the IPC is satisfied that that the access request

(2) A decision under subsection (1) must be in writing and must include reasons.

(3) The Information and Privacy Commissioner shall give a copy of the decision to

(4) A decision under subsection (1) is final and is not subject to appeal.

Request for Extension of Time Limit for Responding to Access Requests and Correction Requests

(1) A health information custodian that has, under subsection 106(1), extended the time limit for responding to an access request, may request the Information and Privacy Commissioner to authorize a further extension of the time limit for responding to an individual under subsection 101(1) on the grounds that

(2) A health information custodian that has, under subsection 123(1), extended the time limit for complying with the requirements of subsection 120(1) in respect of a correction request, may request the Information and Privacy Commissioner to authorize a further extension of the time limit on the grounds that

(3) A request under subsection (1) or (2) must be made in writing to the Information and Privacy Commissioner as soon as reasonably possible and before the expiration of the time limit for the extension under subsection 106(1) or 123(1).

(4) A health information custodian that makes a request under subsection (1) or (2) shall, without delay, give notice and a copy of the request to the individual who made the access request or correction request.

(1) The Information and Privacy Commissioner shall conduct a review of a request by a health information custodian made under subsection 132(1) or (2).

(2) On completing a review of a request made under subsection 132(1) or (2), the Information and Privacy Commissioner may authorize an extension of the time limit for responding to an individual under subsection 101(1) in respect of an access request or for complying with the requirements of subsection 120(1) in respect of a correction request, for the period that he or she considers appropriate, if the IPC is satisfied that

(3) A decision under subsection (2) must be in writing and must include reasons.

(4) The Information and Privacy Commissioner shall give a copy of the decision to

(5) A decision under subsection (2) is final and is not subject to appeal.

Reviews Relating to Collection, Use and Disclosure of Personal Health Information

(1) An individual may request the Information and Privacy Commissioner to review whether a health information custodian has collected, used or disclosed personal health information about the individual in contravention of this Act.

(2) A request for review must be in writing.

(3) On receiving a request for review, the Information and Privacy Commissioner

(4) Before giving a copy of a request for review to a person or organization referred to in subsection (3), the Information and Privacy Commissioner may sever any information from the request that he or she considers appropriate.

(1) Subject to subsection (2) and section 136, the Information and Privacy Commissioner shall conduct a review requested under subsection 134(1).

(2) The Information and Privacy Commissioner may refuse to conduct a review and may discontinue a review if he or she is satisfied that

(1) After a request for review is made under subsection 134(1), the Information and Privacy Commissioner may, without conducting a full review, assist the individual who requested the review and the health information custodian to achieve a resolution of the matter through a formal or informal alternative dispute resolution process.

(2) If the matter is resolved under subsection (1), the Information and Privacy Commissioner shall make a record in respect of the resolution.

(1) If the Information and Privacy Commissioner is satisfied that a review is warranted in the circumstances, he or she may, without receiving a request under subsection 134(1), initiate a review of whether a health information custodian has collected, used or disclosed personal health information about one or more individuals in contravention of this Act.

(2) On initiating a review under subsection (1), the Information and Privacy Commissioner

(3) The Information and Privacy Commissioner may at any time discontinue a review that he or she initiated under subsection (1).

(4) The Information and Privacy Commissioner shall give notice of discontinuance of a review to the health information custodian concerned.

(1) The Information and Privacy Commissioner may, without completing a review initiated under subsection 137(1), work with the health information custodian to achieve a resolution of the matter through a formal or informal alternative dispute resolution process.

(2) If the matter is resolved under subsection (1), the Information and Privacy Commissioner shall make a record in respect of the resolution.

(1) On completing a review under subsection 135(1) or 137(1), the Information and Privacy Commissioner shall prepare a report in writing that includes findings in respect of whether the health information custodian has collected, used or disclosed personal health information about one or more individuals in contravention of this Act.

(2) The Information and Privacy Commissioner may set out in the report referred to in subsection (1) any recommendations for action by the health information custodian that the IPC considers appropriate, whether or not the IPC finds that the custodian collected, used or disclosed personal health information in contravention of this Act.

(3) The Information and Privacy Commissioner shall include reasons for any recommendations made in a report referred to in subsection (1).

(1) The Information and Privacy Commissioner shall give a copy of the report referred to in subsection 139(1) to

(2) The Information and Privacy Commissioner may give a copy of the report referred to in subsection 139(1) to any person or organization that made representations at the review.

Request for Review: Access Request and Correction Request

(1) An individual who makes an access request under subsection 96(1) may request the Information and Privacy Commissioner to review any decision, act or failure to act of a health information custodian that relates to the access request.

(2) An individual who makes a correction request under subsection 119(1) may request the Information and Privacy Commissioner to review any decision, act or failure to act of a health information custodian that relates to the correction request.

(1) A request for review under subsection 141(1) or (2) must be made in writing to the Information and Privacy Commissioner

(2) The Information and Privacy Commissioner may, if he or she considers it appropriate, accept a request for review submitted after the time limit referred to in subsection (1).

(3) On receiving a request for review, the Information and Privacy Commissioner

(4) Before giving a copy of a request for review to a person or organization referred to in subsection (3), the Information and Privacy Commissioner may sever any information from the request that he or she considers appropriate.

(1) Subject to subsection (2) and section 144, the Information and Privacy Commissioner shall conduct a review requested under subsection 141(1) or (2).

(2) The Information and Privacy Commissioner may refuse to conduct a review and may discontinue a review if he or she is satisfied that

(1) After a request for review is made under subsection 141(1) or (2), the Information and Privacy Commissioner may, without conducting a full review, assist the individual who requested the review and the health information custodian to achieve a resolution of the matter through a formal or informal alternative dispute resolution process.

(2) If the matter is resolved under subsection (1), the Information and Privacy Commissioner shall make a record in respect of the resolution.

(1) On completing a review under subsection 143(1), the Information and Privacy Commissioner shall prepare a report in writing with respect to the matter that sets out whether or not he or she fully concurs with the decision, act or failure to act of the health information custodian and the reasons for concurring or not concurring.

(2) The Information and Privacy Commissioner may set out in the report referred to in subsection (1) any recommendations for action by the health information custodian that the IPC considers appropriate, whether or not the IPC concurs with the decision, act or failure to act of the health information custodian.

(3) The Information and Privacy Commissioner shall include reasons for any recommendations made in a report referred to in subsection (1).

(1) The Information and Privacy Commissioner shall give a copy of the report referred to in subsection 146(1) to

(2) The Information and Privacy Commissioner may give a copy of the report referred to in subsection 146(1) to any person or organization that made representations at the review.

(1) An individual who has made an access request must be given the opportunity to make representations to the Information and Privacy Commissioner during a review conducted under subsection 130(1).

(2) A health information custodian that is subject to a review initiated by the Information and Privacy Commissioner under subsection 137(1) must be given the opportunity to make representations to the IPC during the review.

(3) The following persons or organizations must be given the opportunity to make representations to the Information and Privacy Commissioner during a review conducted under subsection 135(1) or 143(1):

(4) During a review under subsection 135(1), 137(1) or 143(1), the Information and Privacy Commissioner may give the opportunity to make representations to a person or organization that may be affected by the results of the review.

(5) The Information and Privacy Commissioner may decide whether representations are to be made in writing or verbally.

(6) A person or organization that may make representations to the Information and Privacy Commissioner may be represented by counsel or an agent.

(7) No person is entitled as of right to be present during a review or to have access to, or to comment on, representations made to the Information and Privacy Commissioner by any other person.

(1) Notwithstanding any other Act or any privilege available at law, and subject to the regulations, the Information and Privacy Commissioner may, in conducting a review under this Act, require the production of and examine any record that may be relevant to a review under this Act, that is in the custody or under the control of the health information custodian concerned.

(2) Notwithstanding any other Act or any privilege available at law, and subject to subsection (3) and the regulations, a health information custodian shall produce copies of the required records for examination by the Information and Privacy Commissioner within 14 days after receiving a request for production.

(3) Subject to the regulations, if the Information and Privacy Commissioner is satisfied that it is not practical for the health information custodian to physically produce a copy of a record for examination by the IPC, the custodian shall, within the time limit set in subsection (2), facilitate the examination of the record at a site satisfactory to the IPC.

(4) After completing a review under this Part, the Information and Privacy Commissioner shall, subject to the regulations, destroy all copies of records produced.

(1) In conducting a review under this Part, the Information and Privacy Commissioner

(2) Notwithstanding any other Act or any privilege available at law, no person shall withhold evidence, on any grounds, from the Information and Privacy Commissioner during a review under this Part.

(3) Evidence given by a person during a review conducted by the Information and Privacy Commissioner under this Part is inadmissible in a court or in any other proceeding, except

(1) Subject to the regulations, if a report by the Information and Privacy Commissioner under section 139 or 146 sets out recommendations for action by a health information custodian, the custodian shall, within 30 days after the day he or she receives the report,

(2) Subject to the regulations, if a health information custodian fails to make a decision under paragraph (1)(a) and give notice of the decision to the individual who requested the review within 30 days after the day the custodian receives the report of the Information and Privacy Commissioner, the custodian is deemed to have decided not to follow the recommendations of the IPC.

(1) An individual who requested a review under subsection 134(1) may appeal a finding by the Information and Privacy Commissioner under subsection 139(1) that a health information custodian has not collected, used or disclosed personal health information in contravention of this Act.

(2) An individual who requested a review under section 141 may appeal a finding by the Information and Privacy Commissioner under subsection 146(1) that he or she concurs with a decision, act or failure to act of a health information custodian that relates to an access request or correction request.

(3) An appeal referred to in subsection (1) or (2) must be commenced by filing a notice of appeal with the Supreme Court and serving the notice on the health information custodian within 30 days after the day the individual receives the report that includes the finding.

(1) An individual who requested a review under subsection 134(1) or section 141 may appeal a decision made by a health information custodian under subsection 156(1) to the Supreme Court by filing a notice of appeal with the Supreme Court and serving the notice on the custodian within 30 days after the day the individual receives notice of the decision.

(2) An individual who requested a review under subsection 134(1) or section 141 may appeal a deemed decision of a health information custodian under subsection 156(2) to the Supreme Court by filing a notice of appeal with the Supreme Court and serving the notice on the custodian within 90 days after the day the individual receives the report of the Information and Privacy Commissioner referred to in section 139 or 146.

(1) The Information and Privacy Commissioner may appeal a decision made by a health information custodian under subsection 156(1), in respect of a matter reviewed by the IPC under subsection 137(1), to the Supreme Court by filing a notice of appeal with the Supreme Court and serving the notice on the custodian within 30 days after the day the IPC receives notice of the decision.

(2) The Information and Privacy Commissioner may appeal a deemed decision of a health information custodian under subsection 156(2), in respect of a matter reviewed by the IPC under subsection 137(1), to the Supreme Court by filing a notice of appeal with the Supreme Court and serving the notice on the custodian within 90 days after the day the IPC gives his or her report to the custodian under section 139.

(3) The Information and Privacy Commissioner is not a party to an appeal under this Part except an appeal under this section.

(1) On an appeal or a review of a matter under this Act, a court shall take every reasonable precaution to avoid the disclosure by the court or a person of

(2) For the purposes of subsection (1), reasonable precautions may include, where appropriate, any of the following measures:

(1) On the determination of an appeal, the Supreme Court may make any order that it considers appropriate, and an order may be made subject to any conditions the Court considers appropriate.

(2) A person or organization shall comply with an order of the Supreme Court within the time set in the order, or if no time is set, within 45 days after the day the order is issued.

(1) The Information and Privacy Commissioner appointed under subsection 61(1) of the Access to Information and Protection of Privacy Act is the Information and Privacy Commissioner for the purposes of this Act.

(2) An acting Information and Privacy Commissioner appointed under section 63 of the Access to Information and Protection of Privacy Act is an acting Information and Privacy Commissioner for the purposes of this Act. SNWT 2020,c.13,s.3(2).

(1) If, for any reason, the Information and Privacy Commissioner determines that he or she should not act in respect of a particular matter under this Act, the Speaker of the Legislative Assembly, on the recommendation of the Board of Management of the Legislative Assembly, may appoint a person as a Special Information and Privacy Commissioner to act in the place of the IPC in respect of that matter.

(2) A Special Information and Privacy Commissioner holds office until the conclusion of the matter in respect of which he or she has been appointed. SNWT 2020,c.13,s.3(3).

(1) The Information and Privacy Commissioner may employ any person whom the Information and Privacy Commissioner considers necessary to assist in carrying out the powers, duties and functions of the Information and Privacy Commissioner under this Act.

(2) Persons employed under subsection (1) are members of the public service to whom the Public Service Act applies.

(3) The Information and Privacy Commissioner may, from time to time, engage the services of any person whom the Information and Privacy Commissioner considers necessary to assist in carrying out the powers, duties and functions of the Information and Privacy Commissioner under this Act.

(4) A person employed by the office of the Information and Privacy Commissioner under subsection (1) shall take an oath, administered by the Information and Privacy Commissioner, undertaking to not disclose any information received by that person under this Act except in accordance with this Act.

(5) The Information and Privacy Commissioner may require a person engaged under subsection (3) to take an oath, administered by the Information and Privacy Commissioner, undertaking to not disclose any information received by that person under this Act except in accordance with this Act.

(6) The form of oaths required under this section shall be determined by the Speaker of the Legislative Assembly. SNWT 2020,c.13,s.3(4).

(1) The Information and Privacy Commissioner may delegate to any person any power, duty or function of the IPC under this Act except the following:

(2) A delegation under subsection (1) must be in writing and may contain the conditions or restrictions that the Information and Privacy Commissioner considers appropriate.

(1) The Information and Privacy Commissioner shall maintain a public register of reports and decisions of the IPC made under Part 6.

(2) Before registering a report or decision in the public register, the Information and Privacy Commissioner shall take measures to protect the identity of any individual whose personal health information is included.

(1) The Information and Privacy Commissioner shall not disclose any information that comes to his or her knowledge in the exercise of the powers or performance of the duties or functions of the IPC under this Act.

(2) A person employed in or engaged by the Office of the Information and Privacy Commissioner shall not disclose any information that comes to his or her knowledge in the course of his or her employment in or engagement by that office.

(3) Notwithstanding subsections (1) and (2), the Information and Privacy Commissioner may disclose, or may authorize a person employed in or engaged by the Office of the IPC to disclose,

(4) When making a disclosure in accordance with subsection (3), the Information and Privacy Commissioner and a person employed in or engaged by the Office of the IPC, shall not disclose

(5) Notwithstanding subsection (1), the Information and Privacy Commissioner may disclose to a law enforcement agency, or may authorize a person employed in or engaged by the Office of the IPC to disclose to a law enforcement agency, information that relates to the commission of an offence.

(6) Notwithstanding subsection (1), the Information and Privacy Commissioner may disclose, or may authorize a person employed in or engaged by the Office of the IPC to disclose, information in the course of a prosecution, application or appeal referred to in subsection 154(3).

(1) Subject to subsection (2), the Information and Privacy Commissioner or a person employed in or engaged by the Office of the IPC may not be compelled to give evidence in a court or in a proceeding of a judicial nature concerning any information that comes to his or her knowledge in the exercise of the powers or performance of the duties or functions of the IPC under this Act.

(2) Subsection (1) does not apply in respect of an appeal by the Information and Privacy Commissioner under section 161.

(1) Subject to subsection (2), where notice must be given to a person under Part 5 or Part 6, the notice must be given

(2) Subsection (1) does not apply in respect of a notice of appeal.

(2) Subsection (1.1) applies notwithstanding the Access to Information and Protection of Privacy Act and the Health Information Act. SNWT 2014,c.19,s.45.

(4.1) This section applies notwithstanding the Health Information Act.

(3) Subsection (2) applies notwithstanding the Access to Information and Protection of Privacy Act and the Health Information Act.

(1.1) Sections 48 to 50 apply notwithstanding the Health Information Act.

(1) The Public Health Act is amended by this section.

(2) Subsection 38(1) is amended by

(3) The following is added after subsection 38(1):

(1.1) The Chief Public Health Officer may disclose personal health information to a public health official in another jurisdiction, in accordance with an agreement with the government of that jurisdiction.

(4) Subsection 38(2) is repealed and the following is substituted:

(2) The Health Information Act applies in respect of disclosure by the Chief Public Health Officer of personal health information for a research purpose.

(5) Section 39 is repealed and the following is substituted:

(1) The Workers’ Compensation Act is amended by this section.

(2) Section 161 is amended by

(3) Section 162 is amended by adding "and the Health Information Act" after "the Access to Information and Protection of Privacy Act".