Second Session, Thirty-Ninth Legislature
This version is based on the printed bill that was distributed in the Legislature after First Reading. It is not the official version. If accuracy is critical, you can obtain a copy of the printed bill from Statutory Publications or view the online bilingual version (PDF).
Bill 32
THE PERSONAL HEALTH INFORMATION AMENDMENT ACT
| Explanatory Note |
THE PERSONAL HEALTH INFORMATION
AMENDMENT ACT
(Assented to )
HER MAJESTY, by and with the advice and consent of the Legislative Assembly of Manitoba, enacts as follows:
The Personal Health Information Act is amended by this Act.
The English version of the second paragraph of the preamble is amended by replacing "to correct" with "to request the correction of".
Subsection 1(1) is amended by adding the following definitions:
"adjudicator" means the Information and Privacy Adjudicator appointed under The Freedom of Information and Protection of Privacy Act; (« arbitre »)
"demographic information" means an individual's name, address, telephone number and e-mail address; (« renseignements signalétiques »)
Clauses 2(c) and (d) are replaced with the following:
(c) to establish rules governing the collection, use, disclosure, retention and destruction of personal health information in a manner that recognizes
(i) the right of individuals to privacy of their personal health information, and
(ii) the need for health professionals to collect, use and disclose personal health information in order to provide health care to individuals;
Clauses 2(e) and (f) are renumbered as clauses 2(d) and (e).
Section 3 is replaced with the following:
This Act does not apply to statistical health information, or to health information that does not, either by itself or when combined with other information available to the holder, allow an individual to be readily identified.
Subsection 6(1) is replaced with the following:
A trustee shall respond to a request as promptly as required in the circumstances but no later than
(a) 72 hours after receiving it, if the information is about health care the trustee is currently providing; and
(b) 30 days after receiving it in any other case, unless the request is transferred to another trustee under section 8.
Subsection 6(3) is amended by striking out "30-day period" and substituting "time frame required under subsection (1)".
The following is added after section 9:
Notice of right to access information
In accordance with the regulations, a trustee must take reasonable steps to inform individuals
(a) of their right to examine and receive a copy of their personal health information that the trustee maintains; and
(b) about how they can exercise that right.
Subsection 14(2) is amended by striking out "or" at the end of clause (d) and by adding the following as clause (d.1):
(d.1) the information is collected for the purpose of
(i) compiling an accurate family or genetic health history of the individual, or
(ii) determining or verifying the individual's eligibility to participate in a program of or receive a benefit or service from the trustee or from the government, and is collected in the course of processing an application made by or on behalf of the individual; or
The following is added after Division 2 of Part 3:
DIVISION 2.1
CONSENT RE PERSONAL HEALTH INFORMATION
When this Act requires an individual's consent for the use or disclosure of personal health information, the consent must
(a) relate to the purpose for which the information is used or disclosed;
(b) be knowledgeable;
(c) be voluntary; and
(d) not be obtained through misrepresentation.
Consent is knowledgeable if the individual who gives it has been provided with the information that a reasonable person in the same circumstances would need in order to make a decision about the use or disclosure of the information.
Consent may be express or implied.
Consent must be express, and not implied, if
(a) a trustee makes a disclosure to a person that is not a trustee; or
(b) a trustee makes a disclosure to another trustee, but the disclosure is not for the purpose of providing health care or assisting in providing health care.
Subsection (4) does not apply to a disclosure made under section 23.1 (disclosure to religious organization) or section 23.2 (disclosure for charitable fundraising).
Express consent need not be written
An express consent need not be in writing.
Express consent can be relied on
A trustee (other than the trustee who obtained the consent) may act in accordance with an express written consent or a record of an express consent having been given without verifying that the consent meets the requirements of subsection (1), unless he or she has reason to believe that the requirements have not been met.
An individual may give consent subject to conditions. But a condition that has the effect of restricting or prohibiting a trustee from recording personal health information is not effective if the recording is required by law or by established standards of professional or institutional practice.
An individual who has given consent, whether express or implied, to the use or disclosure of personal health information may withdraw it by notifying the trustee. A withdrawal does not have retroactive effect.
Subsection 20(3) is amended by striking out "and disclosure".
The following is added after clause 21(c):
(c.1) the information is demographic information about an individual, or is his or her PHIN, and is used to
(i) confirm eligibility for health care or payment for health care, or
(ii) verify the accuracy of the demographic information or PHIN;
(c.2) the information is demographic information about an individual and is used to collect a debt the individual owes to the trustee, or to the government if the trustee is a department;
Subsection 22(2) is amended
(a) in clause (a), by striking out "is providing" and substituting "is or will be providing";
(b) by replacing clause (f) with the following:
(f) in accordance with subsection 22(2.2) (disclosure to another government), section 23 (disclosure to patient's family), section 23.1 (disclosure to religious organization), section 23.2 (disclosure for fundraising), section 24 or 24.1 (disclosure for health research) or section 25 (disclosure to an information manager);
(c) by adding the following after clause (g):
(g.1) to another trustee who requires the information to evaluate or monitor the quality of services the other trustee provides;
(g.2) for the purpose of determining or verifying the individual's eligibility for a program, service or benefit, if the information disclosed is limited to the individual's demographic information;
(g.3) to another trustee for the purpose of de-identifying the personal health information;
(d) by replacing clause (h) with the following:
(h) to a computerized health information network established by a body specified in subsection (2.1), in which personal health information is recorded for the purpose of
(i) providing health care,
(ii) facilitating the evaluation or monitoring of a program that relates to the provision of health care or payment for health care, or
(iii) facilitating research and planning that relates to the provision of health care or payment for health care;
(e) by adding the following after clause (i):
(i.1) for the purpose of collecting a debt owed by the individual to the trustee, or to the government if the trustee is a department, if the information disclosed is limited to demographic information;
(f) by replacing clause (k) with the following:
(k) required in anticipation of or for use in a civil or quasi-judicial proceeding to which the trustee is a party, or to which the government is a party if the trustee is a department;
(k.1) required in anticipation of or for use in the prosecution of an offence;
(g) by adding the following after clause (l):
(l.1) required by police to assist in locating an individual reported as being a missing person, if the information disclosed is limited to demographic information;
The following is added after subsection 22(2):
Computerized health information network
For the purpose of clause (2)(h), a computerized health information network may be established by
(a) the government or a government agency;
(b) the Government of Canada or of another province or territory or an agency of such a government;
(c) an organization representing one or more governments; or
(d) a trustee that is a public body specified in the regulations.
Disclosure by minister to another government
The minister or his or her designate may disclose an individual's personal health information to the government of another jurisdiction in Canada, or an agency of such a government, without the individual's consent, if
(a) the individual the information is about normally resides in the other jurisdiction;
(b) the information is about health care he or she received in Manitoba; and
(c) the government of the other jurisdiction requires the information for the purpose of monitoring or evaluating the extra-jurisdictional provision of health care to its residents.
Subsection 22(3) is amended by adding ", (2.1) or (2.2)" after ''subsection (2)".
Subsection 23(1) is amended in the part before clause (a) by adding "or is receiving health care services from a trustee at home," after "health care facility,".
The following is added after subsection 23(1):
When an immediate family member, or someone else with whom the patient or resident is known to have a close personal relationship, asks a trustee to disclose information under subsection (1), the trustee must disclose the information as soon as reasonably possible but no later than 72 hours after the request is made, as long as the requirements of that subsection are met.
The following is added after section 23:
Disclosure to religious organization
In the case of an individual who is a patient in a hospital or is a resident of a personal care home, the hospital or personal care home may disclose
(a) the individual's name and general health status; and
(b) the individual's location, unless disclosing the location would reveal specific information about the individual's health;
to a representative of a religious organization.
A disclosure may be made under subsection (1) only if
(a) the trustee has notified the individual in writing that the trustee might disclose personal health information about the individual to a representative of a religious organization, or has posted a notice to that effect where it is likely to come to the individual's attention;
(b) the notice is in a form that the individual can reasonably be expected to understand; and
(c) the individual has been given a reasonable opportunity to object to the disclosure and has not done so.
A trustee that is a hospital or personal care home may disclose the name and mailing address of an individual who has been a patient of the hospital, or who is or has been a resident of the personal care home, to a fundraising charitable foundation affiliated with the hospital or personal care home, if
(a) the trustee has notified the individual in writing that the trustee might disclose personal health information about the individual to a charitable foundation, or has posted a notice to that effect where it is likely to come to the individual's attention;
(b) the notice is in a form that the individual can reasonably be expected to understand;
(c) the individual has been given a reasonable opportunity to object to the disclosure and has not done so; and
(d) the trustee and the charitable foundation comply with any additional requirements specified in the regulations.
Subsection 24(1) is replaced with the following:
Disclosure for health research
A trustee may disclose personal health information to a person conducting health research if the research has been approved under this section.
Clause 24(3)(d) is replaced with the following:
(d) the research proposal contains
(i) reasonable safeguards to protect the confidentiality and security of the personal health information, and
(ii) procedures to destroy or remove, at the earliest opportunity consistent with the purposes of the research, any information that, either by itself or when combined with other information available to the holder, allows individuals to be readily identified.
The following is added after section 24:
Disclosure to health research organization
A trustee may disclose personal health information to a health research organization for a purpose mentioned in subsection (2) only if the organization is prescribed in the regulations and meets the requirements of this section.
A trustee may disclose personal health information to a prescribed organization under this section for any of the following purposes:
(a) analyzing the health status of the population;
(b) identifying and describing patterns of illness;
(c) describing and analyzing how health services are used;
(d) analyzing the availability and adequacy of human resources required to provide health services;
(e) measuring health system performance;
(f) health system planning.
A prescribed health research organization must
(a) use personal health information disclosed to it under this section for the purpose for which it was disclosed and no other;
(b) have in place policies and procedures that protect the privacy of the individuals whose information is disclosed to it and that ensure the security and integrity of the information; and
(c) as soon as reasonably possible having regard to the use of the information, remove any information that, either by itself or when combined with other information available to the organization, allows the identity of the individuals to be readily ascertained.
Before disclosing personal health information to a prescribed health research organization, the trustee must enter into an agreement with the organization that includes any requirements specified in the regulations.
Duties of health research organization
A prescribed health research organization must
(a) comply with the terms of the agreement entered into under subsection (4); and
(b) if the organization is not a trustee, comply with the same requirements concerning the protection, retention and destruction of personal health information that the trustee is required to comply with under this Act.
Subsection 32(1) is amended by striking out "or" at the end of clause (b) and replacing clause (c) with the following:
(c) in a review conducted by the adjudicator under this Act when the Ombudsman is a party; or
(d) in an application for judicial review of an adjudicator's order under this Act.
Subsection 34(4) is amended by striking out "in the course of a prosecution or an appeal referred to in subsection 32(1)" and substituting "for a purpose mentioned in clauses 32(1)(a) to (d)".
Section 38 is amended by adding the following definition:
"complaint" includes a complaint initiated by the Ombudsman under subsection 39(4); (« plainte »)
Clause 41(1)(b) is amended by striking out "or vexatious" and substituting ", vexatious or an abuse of process".
Subsection 48(5) is amended by striking out everything after "inform the complainant" and substituting the following:
(a) as to whether the Ombudsman intends to ask the adjudicator to review the decision under section 48.1; and
(b) that, if the Ombudsman does not ask for a review, the complainant may appeal the decision to the court under section 49 and of the time limit for an appeal.
The following is added after subsection 48(6):
The Ombudsman must make recommendations made under this section available to the public, and may do so by publishing them on a website on the Internet.
The following is added after section 48:
REQUEST FOR ADJUDICATOR'S REVIEW
The Ombudsman may ask the adjudicator to review a matter described in subsection (2) if he or she has given a report to the trustee under section 48 and
(a) the trustee's response indicates that it refuses to take action to implement any of the Ombudsman's recommendations;
(b) the trustee's response indicates that it accepts the Ombudsman's recommendations, but the trustee does not take action to implement them within the required time; or
(c) the trustee fails to respond as required by subsection 48(4).
The Ombudsman may ask the adjudicator to review
(a) any decision, act or failure to act by the trustee relating to an individual's request to examine or receive a copy of his or her personal health information, or for correction of such information; or
(b) a matter relating to privacy, if the Ombudsman considers that an individual's personal health information has been collected, used or disclosed contrary to this Act.
The Ombudsman's request for review must be made
(a) within 15 days after the Ombudsman receives the trustee's response to the Ombudsman's report under subsection 48(4); or
(b) if the trustee does not respond, within 15 days after the deadline for a response has expired.
As soon as practicable after receiving a request from the Ombudsman, the adjudicator must notify the complainant, the trustee concerned and any other person who, in the adjudicator's opinion, is affected by it.
CONDUCT OF REVIEW BY ADJUDICATOR
On receiving a request from the Ombudsman, the adjudicator must conduct a review of the matter and decide all questions of fact and law arising in the course of the review.
The adjudicator may make rules of procedure for conducting a review under section 48.3.
The adjudicator may receive and accept any evidence and other information that he or she considers appropriate, whether on oath or by affidavit or otherwise, and whether or not it is admissible in a court of law.
A review may be conducted in private.
Powers and protections of adjudicator
For the purpose of conducting a review, the adjudicator has the same powers and protections as the Ombudsman has under section 29 (Evidence Act powers and production of records).
The complainant, the trustee concerned and any person given notice under section 48.2
(a) must be given an opportunity to make representations to the adjudicator during a review under section 48.3; and
(b) are entitled to be represented by counsel or an agent.
The adjudicator may decide
(a) whether representations are to be made orally or in writing; and
(b) whether a person is entitled to be present during representations made to the adjudicator by another person, or is entitled to have access to those representations or to comment on them.
The Ombudsman has a right to be a party in any review conducted by the adjudicator if the Ombudsman considers that the review raises an issue of public interest.
Review to be completed within 90 days
A review under section 48.3 must be completed within 90 days after the adjudicator receives the request from the Ombudsman, unless the adjudicator extends the period.
If the 90-day period is extended, the adjudicator must notify the complainant, the trustee concerned, the Ombudsman and any other person given notice under section 48.2, and he or she must also inform them of the date by which the review is expected to be completed.
Burden of proof if access denied
In a review of a decision to refuse to permit an applicant to examine or receive a copy of personal health information, it is up to the trustee to prove that the refusal is justified.
ADJUDICATOR'S ORDER
Upon completing a review under section 48.3, the adjudicator must dispose of the issues by making an order under this section.
If the review concerns a complaint about access, the adjudicator may, by order,
(a) require the trustee to permit the applicant to examine or copy all of part of the personal health information, if the adjudicator determines that the trustee was not justified under section 11 in refusing to permit the applicant to do so;
(b) confirm the trustee's decision, if the adjudicator determines that the trustee was justified under section 11 in refusing to permit the applicant to examine or copy the information;
(c) confirm or reduce a fee, or order a refund of a fee, in the appropriate circumstances;
(d) confirm a decision not to correct personal health information, or specify how personal information is to be corrected.
If the review concerns a complaint about privacy, the adjudicator may, by order,
(a) require the trustee to cease or modify a specified practice of collecting, using, disclosing, retaining or destroying personal health information contrary to this Act;
(b) require the trustee to destroy personal health information collected in contravention of this Act.
Order may contain terms or conditions
The adjudicator may specify terms or conditions in an order made under this section.
The adjudicator must give a copy of an order made under this section to each of the following:
(a) the complainant;
(b) the trustee concerned;
(c) the Ombudsman;
(d) any other person given notice under section 48.2.
The adjudicator must make orders made under this section available to the public, and may do so by publishing them on a website on the Internet.
Unless an application for judicial review is made under subsection (2), the trustee concerned must comply with an adjudicator's order
(a) within 30 days after being given a copy; or
(b) within any longer period specified in the order.
An application for judicial review of an adjudicator's order must be made within 25 days after the person making the application is given a copy of the order, unless the court extends the period.
Order stayed if application made for judicial review
If an application for judicial review is made under subsection (2), the adjudicator's order is stayed until the court deals with the application.
GENERAL PROVISIONS RE THE ADJUDICATOR
Adjudicator to take precautions against disclosing
The adjudicator shall take every reasonable precaution, including receiving representations ex parte, conducting hearings in private and examining records in private, to avoid disclosure to the complainant of personal health information the trustee is justified in refusing to disclose under section 11.
Statements made to adjudicator not admissible in evidence
A statement made or an answer given by a person during a review by the adjudicator is inadmissible as evidence in court or in any other proceeding, except
(a) in a prosecution for perjury in respect of sworn testimony;
(b) in a prosecution for an offence under this Act; or
(c) in an application for judicial review or an appeal from a decision with respect to that application.
Evidence of proceeding before adjudicator
Subsection (1) applies also in respect of evidence of the existence of proceedings conducted before the adjudicator.
Information provided under qualified privilege
Anything said, any information supplied, and any record produced by a person during a review by the adjudicator under this Act is privileged in the same manner as if it were said, supplied or produced in a proceeding in a court.
No proceedings lie against the adjudicator or deputy adjudicator, or against any person acting for or under the direction of either of them, for anything done, reported or said in good faith in the exercise or performance or the intended exercise or performance of a duty or power under this Act.
The adjudicator must make an annual report to the Speaker of the Assembly about the exercise of the adjudicator's responsibilities under this Act.
The Speaker must table a copy of the report in the Assembly within 15 days after receiving it if the Assembly is sitting or, if it is not, within 15 days after the next sitting begins.
Subsections 49(2) and (3) are replaced with the following:
An appeal may be made under this section only if
(a) the individual has made a complaint about access to the Ombudsman and the Ombudsman has provided a report under section 47; and
(b) the deadline set out in subsection 48.1(3) for the Ombudsman to request the adjudicator to review the matter has expired, and the Ombudsman did not request a review.
An appeal is to be made by filing an application with the court within 30 days after the deadline set out in subsection 48.1(3) expires, or within any longer period that the court may allow in special circumstances.
Subsections 50(1) and (3) are repealed and subsection 50(2) is renumbered as section 50.
Section 60 is amended by renumbering it as subsection 60(1) and adding the following as subsections 60(2) and (3):
If the trustee reasonably believes that no person listed in subsection (1) exists or is available, the adult person listed first in the following clauses who is readily available and willing to act may exercise the rights of an individual who lacks the capacity to do so:
(a) the individual's spouse, or common-law partner, with whom the individual is cohabiting;
(b) a son or daughter;
(c) a parent, if the individual is an adult;
(d) a brother or sister;
(e) a person with whom the individual is known to have a close personal relationship;
(f) a grandparent;
(g) a grandchild;
(h) an aunt or uncle;
(i) a nephew or niece.
The older or oldest of two or more relatives described in any clause of subsection (2) is to be preferred to another of those relatives.
Subsections 63(2), (3) and (4) are amended by striking out "or information manager" wherever it occurs and substituting ", information manager or health research organization".
Subsections 65(1) and (2) are amended by adding "or adjudicator" after "Ombudsman" wherever it occurs.
Subsection 66(1) is amended
(a) by replacing subclause (d)(i) with the following:
(i) their rights to information under this Act, and
(b) in clause (i), by striking out "clause 22(2)(h)" and substituting "22(2.1)(d)";
(c) by adding the following after clause (i):
(i.1) specifying additional requirements for the purpose of section 23.2 (charitable fundraising);
(d) in clause (j), by adding ", 24.1(4)" after "24(4)"; and
(e) by adding the following after clause (j):
(j.1) prescribing health research organizations for the purpose of section 24.1;
Section 67 is replaced with the following:
The minister must undertake a comprehensive review of the operation of this Act, which involves public representations, within five years after an adjudicator is first appointed under section 58.1 of The Freedom of Information and Protection of Privacy Act.
The minister must submit a report on the review to the Legislative Assembly within one year after the review is undertaken, or within such further time as the Assembly may allow.
This Act comes into force on a day to be fixed by proclamation.