Health Information Regulations

(1) For the purposes of paragraph (d) of the definition "health information custodian" in subsection 1(1) of the Act, the following organizations, responsible under the Hospital Insurance and Health and Social Services Administration Act for the management, control and operation of one or more facilities from which health services are provided, are prescribed as health information custodians:

(2) The chief executive officer of each organization listed in subsection (1) is prescribed, for the purposes of paragraph 7(b) of the Act, as the person responsible, on behalf of the organization, for the exercise of powers and performance of duties and other functions of that organization under the Act and the regulations. R-073-2016,s.2.

(1) In this section,

"relative" means a relative as defined in subsection 47(1) of the Act; (parent)

"tissue" means tissue as defined in section 1 of the Human Tissue Donation Act. (tissu)

(2) The following are prescribed under subsection 25(1) as individuals who may exercise a right or power of another individual under this Act:

(1) The following are persons or organizations to which personal health information may be disclosed under section 61 of the Act:

(2) For the purposes of section 61 of the Act, an information sharing agreement referred to in that section must contain a provision prohibiting the disclosure of identifiable personal health information without the consent of the individual whose information is to be disclosed.

(3) For the purposes of paragraph 61(3)(a) of the Act, consent is only required if the statistical information to be disclosed may reasonably be considered identifiable personal health information and, in that case, an information sharing agreement may only authorize disclosure of that information if the public custodian obtains the consent of the affected individuals prior to disclosure.

(1) For the purposes of section 63 of the Act, a public custodian is prescribed as a health information custodian who must disclose personal health information to designated electronic health information systems.

(2) For the purposes of section 63 of the Act

(3) Disclosure to electronic health information systems required under section 63 of the Act must occur as those systems become available to a public custodian or an agent of a public custodian.

(1) In this section, "Tri-Council Policy Statement" means the Canadian Institutes of Health Research, Natural Sciences and Engineering Research Council of Canada, and Social Sciences and Humanities Research Council of Canada, Tri-Council Policy Statement: Ethical Conduct for Research Involving Humans, December 2010.

(2) The Tri-Council Policy Statement, as amended from time to time, is adopted for the purposes of this section.

(3) A research ethics committee designated under section 68 of the Act shall operate in conformity with the Tri-Council Policy Statement.

(1) In this section, "record of activity" means a report prepared by a health information custodian in respect of an individual’s personal health information, containing

(2) If an individual requests a record of activity from a health information custodian, the health information custodian shall process the request in accordance with Part 5 of the Act.

(3) The rules and procedures governing access requests set out in the Act apply equally to a request for a record of activity.

(1) An individual who makes an access request under section 96 of the Act shall pay a fee to a health information custodian in accordance with this section if the health information custodian estimates that the costs associated with providing access will be greater than $100.

(2) For each activity associated with providing access and described in Column 2 of the table set out in Part 1 of the Schedule, the fee payable for that activity is the corresponding amount set out in Column 3 of that table.

(3) There is no fee for the following:

(1) For the purposes of paragraph 104(4)(d), an invoice under subsection 104(3) of the Act must be given to an applicant, along with the custodian’s written response required under subsection 101(1) of the Act, within 10 days after the health information custodian receives the applicant’s confirmation under paragraph 104(2)(b) of the Act to proceed with the access request.

(2) The amount of an invoice provided under subsection 104(3) of the Act must not exceed the amount set out in a corresponding estimate provided under subsection 104(2) of the Act.

(3) If the actual cost of providing access is less than the amount paid in accordance with an invoice provided under subsection 104(3) of the Act, the health information custodian shall refund the overpayment.

(1) If, under subsection 80(2) of the Act, an agreement between a health information custodian and a researcher requires the payment of fees and disbursements, those fees and disbursements shall be paid in accordance with this section.

(2) For each activity associated with providing access and described in Column 2 of the table set out in Part 2 of the Schedule, the fee payable for that activity is the corresponding amount set out in Column 3 of that table.

(3) Access to records under an agreement between a health information custodian and a researcher is subject to the payment of applicable fees and disbursements.

(1) The administrative, technical and physical safeguards required under section 85 of the Act must include

(2) For the purposes of section 85 of the Act, measures to maintain safeguards must be proportionate to any threat to the security, confidentiality or integrity of personal health information.

(3) A health information custodian shall review its compliance with and the effectiveness of its administrative, technical and physical safeguards on an annual basis.

(1) For the purposes of section 87 of the Act and subject to subsection (2), a health information custodian shall give notice to

(2) A health information custodian is not required to give notice to the Information and Privacy Commissioner of an incident involving the loss or unauthorised use, destruction or alteration of personal health information if the loss, use, destruction or alteration does not present a reasonable risk of harm to the affected individual.

(1) The time referred to in subsections 101(1), 104(1), (2) and (4), 105(2), 107(2), 120(1), 122(1) and (2), 124(2), 129(2), 142(1), 153(2), 156(1) and (2) and 159(3), 160(1) and (2) and 161(1) and (2) of the Act begins to run,

(2) A request, information, decision, report or notice sent by mail is deemed to have been received 10 days after the day it was sent.

(1) The time referred to in subsections 104(5) and 122(3) of the Act begin to run,

(2) A request, estimate or invoice sent by mail is deemed to have been received 10 days after the day it was sent.