toolkit for custodians: a guide to the personal health information act

194 Pages·2013·6.54 MB·English

TOOLKIT FOR CUSTODIANS:
A GUIDE TO THE
PERSONAL HEALTH INFORMATION ACT
Department of Health and Wellness
Privacy and Access Office
1894 Barrington Street
P.O. Box 488
Halifax, Nova Scotia
B3J 2R8
Phone: [phone]
Phone (toll-free in Nova Scotia): 1-855-640-4765
Fax: [phone]
Revised November 1st, 2013
Toolkit Updates

OFFENCES
JUNE 1, 2013

Chapter 1 Complying with PHIA
Chapter 2 PHIA and PIPEDA
Chapter 3 Duties of a Custodian
Template 3-1 Compliance Checklist
Template 3-2 Notice of Purposes
Chapter 4 Consent, Capacity and Substitute Decision Makers
Chapter 6 Access to and Correction of Personal Health Information
Chapter 7 Request to Access Personal Health Information held by a Custodian
Chapter 8 Information Practices EHR and EIS
Template 9-1 Complaint Form
Chapter 11 Offences and Penalties
JULY 1, 2013

Template 3-1 Compliance Checklist
NOVEMBER 1, 2013

Chapter 1 Complying with PHIA
Chapter 4 Consent, Capacity and Substitute Decision Makers
Chapter 6 Access to and Correction of Personal Health Information
Template 9-1 Complaint Form

Toolkit Updates Page 1 of 1
www.novascotia.ca/DHW/PHIA
PERSONAL HEALTH INFORMATION ACT
TOOLKIT FOR CUSTODIANS
TABLE OF CONTENTS
Disclaimer
Interpretation Note
1. Complying with the Personal Health Information Act (PHIA)
a. Background to PHIA
b. Application and Scope of the Act
i. What is personal health information?
ii. What is health care?
iii. Custodians
iv. Agents
v. Does PHIA apply to non-custodians?
c. When PHIA does not apply
i. Personal health information that is excluded
ii. Personal health information outside the health sector
d. When does another provision prevail over PHIA?
e. At what point does PHIA apply to a custodian’s records of personal health information?
2. PHIA and PIPEDA
a. The Personal Information Protection and Electronic Documents Act
b. PIPEDA Awareness Raising Tools (PARTs)
c. PHIA as “substantially similar” legislation
d. Complying with PHIA and PIPEDA
PHIA Toolkit Table of Contents Page 1 of 7
www.novascotia.ca/DHW/PHIA
Revised November 1st, 2013
3. Duties of a Custodian
a. Summary of custodian duties under PHIA
b. Notice of custodian’s purpose
i. Content of a “Notice of Purposes”
ii. Exceptions to an inference of knowledgeable implied consent
c. Retention and Destruction Schedule
i. Retention
ii. Destruction, Disposal and De-identification
d. Information Practices
e. Complaints Policy
i. Privacy Complaints Under PHIA
ii. Access and Correction Complaints
iii. Developing a Complaint Policy
f. Designation of a Contact Person
g. Written Privacy Statement
4. Consent, Capacity and Substitute Decision-Makers
a. Consent
b. General Rules of Consent
c. Express Consent
d. Knowledgeable Implied Consent
e. “Circle of Care”
f. Withdrawal of Consent
g. When Consent is Not Required
h. Capacity to Consent

PHIA Toolkit Table of Contents Page 2 of 7
www.novascotia.ca/DHW/PHIA
st
Revised November 1 , 2013
i. Mature Minors
j. Substitute Decision-Maker
5. Collection, Use and Disclosure
a. Limits on Collection, Use and Disclosure of Personal Health Information
b. Solicitor-Client Privilege
c. Collection
i. Indirect Collection
ii. Express Consent for Collection
d. Use
i. Use With Consent
ii. Use Without Consent
iii. Use With Express Consent
e. Disclosure
i. Knowledgeable Implied Consent Within The “Circle of Care”
ii. Disclosure Without Consent
iii. Documenting Disclosure Without Consent
iv. Disclosure to Non-Custodians: Assessment, Care and Treatment Services
v. Ministerial Authorizations Under the Hospitals Act
vi. Disclosure to Family Members or Others
vii. Disclosure of Personal Health Information Related to a Deceased Person
viii. Disclosure With Express Consent
f. Health Card Numbers
i. Collection and Use of Health Card Numbers
ii. Health Care Number Database/Common Client Registry

PHIA Toolkit Table of Contents Page 3 of 7
www.novascotia.ca/DHW/PHIA
st
Revised November 1 , 2013
g. Prescribed Entities
6. Access To and Correction of Personal Health Information
a. Access to Personal Health Information
i. Refusal to Grant Access to Personal Health Information
ii. “Frivolous or Vexatious” Requests to Access Personal Health Information
iii. Requirement for Access to Personal Health Information
iv. Purpose for Requesting Access to Personal Health Information
v. Fees for Access to Personal Health Information
vi. Fee for Viewing the Record
vii. Fee Waivers
viii. Refusing a Request for Access: Requirement for Notice
ix. Responding to Request for Access
b. Correction of Personal Health Information
i. “Frivolous or Vexatious” Requests to Correct a Record
ii. Refusing a Request for Correction: Requirement for Notice
c. Complaints to the Review Officer: Access and Correction
7. Research
a. Introduction
b. Definitions
i. “Research”
ii. “Planning and Management of the Health Care System”
c. Other Exceptions
d. Use of Personal Health Information in the Custody or Control of a Custodian for
Research

PHIA Toolkit Table of Contents Page 4 of 7
www.novascotia.ca/DHW/PHIA
st
Revised November 1 , 2013
e. “Impracticable”
f. Disclosure of Personal Health Information in the Custody or Control of a Custodian for
Research
8. Electronic information systems/Electronic health records
a. Definitions
i. Electronic health record
ii. Electronic information system
b. Overview
c. Information practices in an electronic environment
i. Administrative safeguards
ii. Physical safeguards
iii. Technical safeguards
d. Security and privacy breaches
e. Record of user activity
f. Audit log versus record of user activity
g. Secure destruction
9. Privacy Complaints under PHIA
a. Privacy provisions of PHIA
b. Requirement for a privacy complaint policy
c. Best practices for a privacy complaint policy
10. The Review Officer, Reviews and Mediation
a. The Review Officer
b. Privacy Review under PHIA
i. Individual requests a review

PHIA Toolkit Table of Contents Page 5 of 7
www.novascotia.ca/DHW/PHIA
st
Revised November 1 , 2013
ii. Custodian fails to respond to a complaint
1. Notice of Review
2. Review Officer’s discretion not to review: Privacy
iii. Review Officer initiates a review
c. Access and Correction Reviews under PHIA
i. Review Officer’s discretion not to review: Access and Correction
d. Mediation
e. Reviews: General Requirements
i. Representations to a review
ii. Review of records and inspection of premises
iii. Review Officer’s report
iv. Custodian’s response to Review Officer’s report
f. Appeals
i. Applicant’s appeal to the Supreme Court of Nova Scotia
ii. Order of the Supreme Court of Nova Scotia
11. Offences and Penalties
a. Offences
i. “Wilfully”
ii. List of Offences
b. Penalties
i. Penalties – General
ii. Penalties – Individual
iii. Penalties – Corporation

PHIA Toolkit Table of Contents Page 6 of 7
www.novascotia.ca/DHW/PHIA
st
Revised November 1 , 2013
12. Appendix of Templates
13. Appendix of Definitions
14. Appendix of Resources
15. Appendix of Regulated Health Professions
16. Table of Contents - Personal Health Information Act

PHIA Toolkit Table of Contents Page 7 of 7
www.novascotia.ca/DHW/PHIA
st
Revised November 1 , 2013
DISCLAIMER
TOOLKIT FOR CUSTODIANS
This Toolkit is intended to provide general commentary, templates and resources
for individuals and organizations designated as “custodians” under the Personal
Health Information Act.
It is not intended to provide advice or to replace the advice that a custodian
would normally seek on legal or regulatory matters.
It should be used in conjunction with the official text of the Personal Health
Information Act and its regulations. If there is any discrepancy between
references in this document to the Personal Health Information Act and its
regulations and the official text of the Personal Health Information Act and its
regulations, the official text should be considered the authoritative document.
The Department of Health and Wellness encourages custodians to consult their
own legal counsel for advice specific to their circumstances.
The Province of Nova Scotia holds copyright over the chapters in this Toolkit;
therefore, the information in the chapters may be referenced with appropriate
attribution. However, the Department encourages each custodian to review the
templates in the Toolkit and determine whether they may be useful to modify
and use as they implement the Personal Health Information Act.
Disclaimer Page 1 of 1
www.novascotia.ca/DHW/PHIA
Revised June 1st, 2013