BILL 24 – 2008
E-HEALTH (PERSONAL HEALTH INFORMATION ACCESS AND PROTECTION OF PRIVACY) ACT
HER MAJESTY, by and with the advice and
consent of the Legislative Assembly of the Province of British
Columbia, enacts as follows:
Part 1 — Definitions and Interpretation
Definitions
1 In this Act:
"administrator" means
(a) in the case of a health information bank in
the custody or under the control of the ministry of the minister, or a
ministry database, the chief data steward, and
(b) in the case of a health information bank in
the custody or under the control of a health care body other than the
ministry of the minister, a person authorized to administer the health
information bank under section 3 [establishment or designation of health information banks];
"chief data steward" means a
person employed in the ministry of the minister who is designated by
the minister as the chief data steward for the purposes of this Act;
"commissioner" means the commissioner under the Freedom of Information and Protection of Privacy Act;
"data stewardship committee" means the data stewardship committee established under section 12 [appointment of data stewardship committee];
"designation order" means an order establishing or designating a health information bank under section 3;
"disclosure directive" means a written instruction under section 9 [making and revoking disclosure directives];
"employee", in relation to a health care body, includes a volunteer and a person retained under a contract to perform services;
"health care body" means
(a) the ministry of the minister,
(b) a health care body as defined in the Freedom of Information and Protection of Privacy Act,
(c) the Provincial Health Services Authority, and
(d) a society that reports to the Provincial Health Services Authority;
"health information bank" means a health information bank established or designated under section 3;
"health research purpose" means the purpose described in section 4 (h) [collection and use of personal health information];
"ministry database" means a database that is
(a) in the custody or control of the ministry of the minister, and
(b) prescribed for the purposes of this Act;
"person" includes a health care body;
"personal health information"
means recorded information about an identifiable individual that is
related to the individual's health or the provision of health services
to the individual;
"planning or research purpose" means any purpose described in section 4 (g) or (h);
"regional health board" means a regional health board designated under section 4 of the Health Authorities Act;
"through", in relation to the
collection or disclosure of personal health information through a
health information bank, includes collection and disclosure of personal
health information both into and from a health information bank.
Interpretation
2 (1) If a provision of this Act refers to a provision of the Freedom of Information and Protection of Privacy Act, a reference in that Act to
(a) a "public body" is to be read for the purposes of this Act as a reference to a health care body, and
(b) the "head of a public body" is to be read for the purposes of this Act as a reference to the head of a health care body.
(2) For the purposes of
(a) Division 2 [Disclosure Directives] of Part 2, and
(b) section 17 [one's own personal health information to be available], in relation to a person's own personal health information,
a reference to a person includes a person having
authority under the common law or an enactment to make personal and
health care decisions in respect of the person.
Part 2 — Administration of Health Information Banks
Division 1 — Establishment or Designation of Health Information Banks
Establishment or designation of health information banks
3 (1) Subject
to the regulations, the minister may by order establish or designate a
database containing personal health information as a health information
bank, if
(a) the database is in the custody or under the control of a health care body, and
(b) the collection and use of personal health information through the database is for a purpose set out in section 4 [collection and use of personal health information].
(2) A designation order must do all of the following:
(a) identify the type or nature of personal
health information to be contained in the health information bank, and
the source of the personal health information;
(b) in the case of a health information bank in
the custody or under the control of a health care body other than the
ministry of the minister, authorize one individual who is an employee
of the health care body to administer the health information bank;
(c) identify the purposes, as set out in section
4, for which personal health information may be collected and used
through the health information bank;
(d) identify the purposes, if any, as set out in section 5 [disclosure of personal health information], for which personal health information may be disclosed from the health information bank;
(e) authorize one or more persons to collect, use or disclose personal health information through the health information bank;
(f) identify from whom personal health
information may be collected into the health information bank,
including identifying whether personal health information may be
collected other than directly from the individual whom the personal
health information is about;
(g) except in the case of disclosure for a
planning or research purpose, identify to whom personal health
information contained in the health information bank may be disclosed;
(h) identify the limits or conditions, if any,
on the collection, storage, use or disclosure of personal health
information contained in or disclosed from a health information bank.
(3) A designation order may describe a person by name, title, position or class.
(4) A designation order is not effective until notice of the designation order is published in the Gazette.
(5) If a health information bank is established
or designated by a designation order, personal health information may
be collected, used and, subject to sections 14 [disclosure for planning or research purposes] and 19 [information-sharing agreements required for disclosure],
disclosed through the health information bank by a person who is
authorized to do so by the designation order, according to the terms of
the designation order.
Collection and use of personal health information
4 A designation
order may authorize the collection and use of personal health
information only for one or more of the following purposes:
(a) to identify an individual who needs or is receiving health services;
(b) to provide health services to, or facilitate the care of, an individual;
(c) to identify a person who is providing health services;
(d) to prevent or manage chronic conditions, at the individual or population level;
(e) to facilitate health insurance and health service billing, including for the purposes of
(i) a payment in respect of health services
or prescribed drugs, devices or pharmaceutical services to be made to
or by the government of British Columbia or a public body,
(ii) authorizing, administering, processing, verifying or cancelling such a payment,
(iii) resolving an issue regarding such a payment, or
(iv) audits by a federal or Provincial
government payment agency that makes reimbursement for the cost of
health services or prescribed drugs, devices or pharmaceutical services;
(f) to assess and address public health needs;
(g) to engage in health services planning, maintenance or improvement, including
(i) health service development, management, delivery, monitoring and evaluation,
(ii) compiling statistical information, and
(iii) public health surveillance;
(h) to conduct or facilitate research into health issues;
(i) to assess and address threats to public health.
Disclosure of personal health information
5 A designation
order may authorize the disclosure of personal health information only
for one or more of the following purposes:
(a) if disclosure is inside Canada, a purpose set out in section 4 (a) to (f) [collection and use of personal health information];
(b) a planning or research purpose;
(c) if disclosure is inside or outside Canada, a purpose set out in section 4 (i).
Requests for information by authorized persons
6 (1) A person
authorized under a designation order to collect personal health
information into a health information bank may request a health care
body or a prescribed person to provide information or records that
contain personal health information and that are in the custody or
under the control of the health care body or prescribed person if
(a) the information or records being requested
have a reasonable and direct connection to the purpose for which
collection is authorized under the designation order, and
(b) the person making the request is acting in accordance with the terms of the designation order.
(2) Subject to any other enactment that prohibits
disclosure, a health care body or a prescribed person to whom a request
is made under subsection (1) must comply with the request in the manner
and at the times requested if the information or records are in the
custody or under the control of the health care body or prescribed
person.
Complaints respecting requests for information
7 (1) In this section, "request for information" means a request for information or records made under section 6 [requests for information by authorized persons].
(2) A person who receives a request for
information may make a complaint to the commissioner, and the
commissioner may investigate and attempt to resolve the complaint.
(3) Section 6 (2) is suspended, in respect of the
request for information that is the subject of the complaint, during
the period of the commissioner's investigation, if any.
(4) Sections 44 to 48 and 49 (1) and (2) of the Freedom of Information and Protection of Privacy Act
apply to an investigation under subsection (2) of this section, and,
for these purposes, a reference in those sections to an investigation,
inquiry or audit under that Act is to be read as a reference to an
investigation under this section.
(5) If an investigation is made under this
section, the commissioner must, after the investigation, do one of the
following by order:
(a) if the commissioner determines that the
person making the request for information is acting within that
person's authority under a designation order, either
(i) require the person making the complaint
to provide the information or records in accordance with the request
for information, or
(ii) require the person making the request for information to reconsider the request;
(b) if the commissioner determines that the
person making the request for information is not acting within that
person's authority under a designation order, require the person to
withdraw the request and, if applicable, destroy personal health
information collected outside the person's authority.
(6) If an order is made under subsection (5),
(a) the commissioner may specify terms or conditions in the order, and
(b) the persons affected by the order must comply within 30 days of its issuance.
(7) If an investigation is not made under this section, section 6 (2) applies.
Division 2 — Disclosure Directives
Authorization of disclosure directives
8 The minister may in a designation order
(a) authorize a person whose personal health
information is contained in the health information bank that is the
subject of the designation order to make a disclosure directive in
respect of
(i) one or more types of personal health information, as identified in the designation order under section 3 (2) (a) [establishment or designation of health information banks], contained in the health information bank,
(ii) one or more purposes, as identified in
the designation order under section 3 (2) (d), for which personal
health information may be disclosed from the health information bank,
and
(iii) one or more persons or classes of persons, as identified in the designation order under section 3 (2) (g), and
(b) put conditions on the making of disclosure directives.
Making and revoking disclosure directives
9 (1) If in a
designation order the minister authorizes the making of disclosure
directives, a person may, subject to the regulations,
(a) make a disclosure directive as authorized by the designation order, and
(b) revoke a disclosure directive the person has made.
(2) A person who makes or revokes a disclosure directive must
(a) make the disclosure directive or revocation in writing,
(b) comply with any conditions set out in the designation order respecting the making or revoking of disclosure directives, and
(c) forward to a prescribed person the disclosure directive or revocation and, if applicable, the prescribed records.
(3) Until the contrary is demonstrated, every
person is presumed to be capable of understanding the nature of a
disclosure directive and the consequences of making or revoking a
disclosure directive.
(4) A disclosure directive takes effect when activated in the health information bank to which it relates.
(5) If the minister amends a designation order in
respect of the authority to make a disclosure directive, any part of a
disclosure directive that is inconsistent with the amendment is deemed
to have been revoked.
Effect of disclosure directives
10 (1) A person
who is otherwise permitted to collect, use or disclose personal health
information from a health information bank must not do so in any manner
that is inconsistent with a disclosure directive except as follows:
(a) to notify a person that a disclosure
directive applies to personal health information that would otherwise
be available to the person;
(b) for a purpose described in section 33.1 (1) (c) of the Freedom of Information and Protection of Privacy Act;
(c) with the express consent of the person who made the disclosure directive;
(d) if section 12 [exception — urgent or emergency health care] of the Health Care (Consent) and Care Facility (Admission) Act
applies and a health care provider acting under that section reasonably
believes that the personal health information may be required to
provide health care in accordance with that section;
(e) if prescribed circumstances apply.
(2) For the purposes of subsection (1) (d), a reference in section 12 of the Health Care (Consent) and Care Facility (Admission) Act to an "adult" is to be read for the purposes of this section as a reference to a person having a disclosure directive.
Division 3 — Data Stewardship Committee
Role of data stewardship committee
11 The data
stewardship committee is solely responsible for managing the
disclosure, for a planning or research purpose, of information
contained in a health information bank or a ministry database.
Appointment of data stewardship committee
12 (1) The minister must appoint a data stewardship committee consisting of not more than 12 persons.
(2) The committee appointed under subsection (1) must include at least
(a) one person from within the ministry of the minister,
(b) one person chosen as representative of either regional health boards or the Provincial Health Services Authority,
(c) one person nominated by the council of the College of Physicians and Surgeons of British Columbia,
(d) one person nominated by the council of the College of Pharmacists of British Columbia,
(e) one person nominated by the board of the college established under section 15 (1) of the Health Professions Act for the health profession of the practice of nursing,
(f) one person engaged in health research, and
(g) 3 persons chosen as representative of the general public.
(3) The minister may designate a chair and one or
more vice chairs of the data stewardship committee from among the
persons appointed to that committee.
(4) Members of the data stewardship committee may be paid
(a) remuneration set by the minister, and
(b) reasonable and necessary travel and out of
pocket expenses incurred in carrying out the work of the data
stewardship committee.
Data stewardship committee
13 (1) Subject to this Act, the data stewardship committee may make rules governing the following:
(a) the calling and conduct of its meetings;
(b) the establishment of panels of the data stewardship committee to conduct business of that committee;
(c) the practices and procedures of the panels established under paragraph (b);
(d) the quorum of the data stewardship committee or of the panels established under paragraph (b);
(e) other matters respecting the conduct of the
work of the data stewardship committee or of the panels established
under paragraph (b), including the fees that may be charged by a health
care body for information to defray the cost to the health care body to
provide the information.
(2) The data stewardship committee must establish
policies and procedures respecting the disclosure of information under
this Division.
(3) A member of the data stewardship committee
must take reasonable steps, in accordance with the regulations, to
avoid or manage a conflict of interest.
Disclosure for planning or research purposes
14 (1) A person
who requires information for a planning or research purpose may request
information from a health information bank or ministry database only by
submitting to the data stewardship committee
(a) a request in the form and in the manner required by the data stewardship committee, and
(b) information required by the data stewardship committee for the purposes of evaluating the request.
(2) The data stewardship committee may approve the request if all of the following apply:
(a) the request is for a planning or research purpose;
(b) in the case of information from a health
information bank, the disclosure is authorized under the terms of the
designation order;
(c) in the case of personal health information requested for a health research purpose, the requirements of section 15 [disclosure for health research purposes] have been met;
(d) in the case of a request to disclose
personal health information outside Canada, there is express consent,
in writing, to the disclosure from each person who is the subject of
the personal health information.
(3) If the data stewardship committee approves
the request, the administrator may, subject to any conditions set by
the data stewardship committee on approving the request, disclose the
information to the person who made the request.
(4) An administrator must not disclose information under subsection (3) except under an information-sharing agreement
(a) with the person who made the request, and
(b) made, whether or not personal health information is disclosed, in accordance with section 19 (2) and (3) [information-sharing agreements required for disclosure].
Disclosure for health research purposes
15 If a request for personal health information under section 14 [disclosure for planning or research purposes]
is made for a health research purpose, the data stewardship committee
may approve the request only if all of the following criteria are met:
(a) the health research purpose cannot reasonably be accomplished unless personal health information is disclosed;
(b) personal health information is disclosed on
condition that it not be used for the purpose of contacting a person to
participate in the health research, unless the commissioner approves
(i) the health research purpose,
(ii) the use of disclosed personal health
information for the purpose of contacting a person to participate in
the health research, and
(iii) the manner in which contact is to be made, including the information to be made available to persons contacted;
(c) any record linkage is not harmful to the
individuals who are the subjects of the personal health information and
the benefits to be derived from the record linkage are clearly in the
public interest;
(d) the data stewardship committee has imposed conditions relating to
(i) security and confidentiality,
(ii) the removal or destruction of individual identifiers at the earliest reasonable time, and
(iii) the prohibition of any subsequent use
or disclosure of personal health information without the express
authorization of the data stewardship committee.
Reports by data stewardship committee
16 At least once each year, the data stewardship committee must report to the minister respecting
(a) the activities of the data stewardship committee,
(b) information-sharing agreements entered into by an administrator under this Division, and
(c) any matter the minister requires.
Division 4 — Other Matters Relating to Disclosure
One's own personal health information to be available
17 (1) Subject to this Act and the regulations made under it, an administrator must make available to a person
(a) that person's personal health information
contained in the health information bank for which the administrator is
responsible,
(b) a record of any disclosure directives made by the person that apply to the health information bank, and
(c) information respecting who has collected, used or disclosed that person's personal health information.
(2) Despite subsection (1), the administrator may
deny, for any reason for which a person may be denied access to
information under the Freedom of Information and Protection of Privacy Act, access to information or records described in subsection (1).
(3) Section 19 [information-sharing agreements] does not apply to disclosure of personal health information under this section.
Purposes for which disclosure always authorized
18 (1) An
administrator may disclose personal health information inside Canada
from a health information bank for one or more of the following
purposes:
(a) a purpose described in section 33.2 (b), (c) or (f) of the Freedom of Information and Protection of Privacy Act;
(b) to investigate or discipline a person
regulated by a governing body of a health profession that has
authority, under an enactment, to investigate or discipline the person;
(c) to monitor, by a governing body of a health
profession, the practice of a health profession that is, under an
enactment, regulated by that body;
(d) a purpose for which the person who is the subject of the personal health information has expressly consented.
(2) An administrator may disclose personal health
information inside or outside Canada from a health information bank for
one or more of the following purposes:
(a) a purpose described in section 33.1 (1) (a), (c), (e), (e.1), (g), (m), (n) or (p) of the Freedom of Information and Protection of Privacy Act, or
(b) a purpose for which the person who is the subject of the personal health information has expressly consented in writing.
(3) Section 19 [information-sharing agreements] does not apply to disclosure of personal health information under this section.
Information-sharing agreements required for disclosure
19 (1) Personal health information contained in a health information bank may be disclosed only if
(a) disclosure is authorized by the terms of the designation order that relates to the health information bank,
(b) the administrator of the health information bank enters into an information-sharing agreement under this section, and
(c) if personal health information is to be
disclosed on a bulk or regular basis, it is disclosed only to one or
more of the following persons:
(i) an agency or ministry of the government
of British Columbia, of another province or of Canada, including a
Crown corporation;
(ii) a health care body;
(iii) an aboriginal government, an educational body or a social services body, as those terms are defined in the Freedom of Information and Protection of Privacy Act;
(iv) a public body in another jurisdiction of Canada that is equivalent to one described in subparagraphs (ii) and (iii);
(v) a health service provider;
(vi) a body responsible for the regulation of health professionals;
(vii) an association of health professionals;
(viii) a prescribed body that is public in nature.
(2) An information-sharing agreement must identify all of the following:
(a) the persons, by name, title, position or class, who may collect, use or disclose information under the agreement;
(b) the circumstances in which information may be disclosed under the agreement;
(c) the limits, if any, on
(i) the disclosure of information by the administrator under the agreement, and
(ii) the use or disclosure of the information obtained under the agreement by persons identified under paragraph (a);
(d) the conditions, if any, on the disclosure of information under the agreement, including conditions respecting
(i) security and confidentiality,
(ii) the removal or destruction of individual identifiers at the earliest reasonable time,
(iii) the prohibition of any subsequent use or disclosure of personal health information without express authorization, and
(iv) the monitoring of compliance with the agreement;
(e) the term of the agreement and the circumstances in which the agreement may be renewed, suspended or terminated.
(3) An information-sharing agreement must include a requirement that
(a) if
(i) personal health information, or
(ii) any information related to a health service provider
is disclosed under the agreement, the personal
health information or information will not be used or disclosed for the
purpose of market research,
(b) if disclosure is for a planning or research
purpose, the person to whom information is disclosed must comply with
the data stewardship committee's policies and procedures established
under section 13 (2) [data stewardship committee], and
(c) if disclosure is for a health research
purpose, the person to whom personal health information is disclosed
must comply with the conditions imposed under section 15 (d) [disclosure for health research purposes].
No disclosure for market research purposes
20 Despite this Act or the terms of a designation order, or section 35 of the Freedom of Information and Protection of Privacy Act, a person must not disclose
(a) personal health information, or
(b) information related to health service providers
contained in a health information bank or ministry database for the purpose of market research.
Part 3 — General Matters
Protection of privacy
21 (1) Personal
health information must not be collected into a health information bank
or used in a health information bank for any purpose or in any manner
other than in accordance with the designation order in respect of the
health information bank.
(2) Personal health information contained in a
health information bank must not be disclosed for any purpose or in any
manner other than
(a) in accordance with the designation order in respect of the health information bank, or
(b) as permitted under this Act.
Whistle-blower protection
22 A person
must not dismiss, suspend, demote, discipline, harass or otherwise
disadvantage another person, or deny another person a benefit, because
(a) the other person, acting in good faith and
on the basis of reasonable belief, has notified the minister, an
administrator or the commissioner
(i) that a person has contravened or is about to contravene this Act, or
(ii) that a person has collected, used or
disclosed, or is about to collect, use or disclose, personal health
information in a manner that contravenes the terms or conditions of a
designation order,
(b) the other person, acting in good faith and
on the basis of reasonable belief, has done or stated an intention of
doing anything that is required to be done in order to avoid having any
person contravene this Act,
(c) the other person, acting in good faith and
on the basis of reasonable belief, has refused to do or stated an
intention of refusing to do anything that is in contravention of this
Act, or
(d) the person believes that the other person will do anything described in any of paragraphs (a) to (c).
Provider registry
23 (1) Despite section 3 [establishment or designation of health information banks],
the minister may by order designate a database that contains personal
information of health service providers as a health information bank.
(2) This Act applies to a database designated
under subsection (1) as if the database contained personal health
information, and a reference in this Act to "personal health
information" must be read as a reference to the personal information of
health service providers.
Offences and penalties
24 (1) A person who contravenes any of the following sections commits an offence and is liable to a fine of up to $200 000:
(a) section 10 [effect of disclosure directives];
(b) section 20 [no disclosure for market research purposes];
(c) section 21 [protection of privacy];
(d) section 22 [whistle-blower protection].
(2) If a corporation commits an offence under
this section, an officer, director or agent of the corporation who
authorizes, permits or acquiesces in the commission of the offence also
commits an offence, whether or not the corporation is prosecuted for
the offence.
(3) In a prosecution for an offence under this
section, it is a defence for the person charged to prove that the
person exercised due diligence to avoid the commission of the offence.
Offence Act does not apply
25 Section 5 [general offence] of the Offence Act does not apply in respect of this Act or the regulations made under it.
Regulations
26 (1) The Lieutenant Governor in Council may make regulations referred to in section 41 of the Interpretation Act.
(2) Without limiting subsection (1), the Lieutenant Governor in Council may make regulations as follows:
(a) defining "health services" and "health service provider" for the purposes of this Act;
(b) prescribing databases, by name or by class, that must not be designated as a health information bank under section 3 [establishment or designation of health information banks];
(c) limiting or prohibiting classes of persons from making disclosure directives;
(d) respecting the manner in which a disclosure
directive must be made, to whom a disclosure directive must be provided
and records that must accompany a disclosure directive;
(e) prescribing circumstances in which a person
may collect, use or disclose personal health information despite a
disclosure directive;
(f) respecting conflicts of interest in relation
to members of the data stewardship committee, including defining
conflicts of interest and providing rules for the management of
conflicts of interest;
(g) for the purposes of section 17 [one's own personal health information to be available], including
(i) respecting the types of information that may, or must not, be made available,
(ii) respecting how personal health
information is to be made available, including putting conditions on
direct access to personal health information,
(iii) respecting information that must be removed from a record before the record is made available, and
(iv) respecting fees that may be charged by
administrators for making available the information and records
referred to in that section;
(h) defining "bulk or regular" for the purposes of section 19 [information-sharing agreements required for disclosure];
(i) for any other matter for which regulations are contemplated by this Act.
(3) A power to make a regulation under this Act in respect of a person includes a power to
(a) establish classes of persons, and
(b) make regulations that are different for different classes of persons.
Amendments to this Act
27
Section 12 (2) (c) of the E-Health (Personal Health Information Access
and Protection of Privacy) Act is repealed and the following
substituted:
(c) one person nominated by the board of the college established under section 15 (1) of the Health Professions Act for the health profession of the practice of medicine, .
28 Section 12 (2) (d) is repealed and the following substituted:
(d) one person nominated by the board of the college established under section 15 (1) of the Health Professions Act for the health profession of the practice of pharmacy, .
Consequential Amendments
Adult Guardianship and Planning Statutes Amendment Act, 2007
29 Sections 102 and 103 of the Adult Guardianship and Planning Statutes Amendment Act, 2007, S.B.C. 2007, c. 34, are repealed.
Freedom of Information and Protection of Privacy Act
30 Section 35 of the Freedom of Information and Protection of Privacy Act, R.S.B.C. 1996, c. 165, is amended
(a) by renumbering the section as section 35 (1),
(b) by repealing subsection (1) (a.1) and substituting the following:
(a.1) subject to subsection (2), the information
is disclosed on condition that it not be used for the purpose of
contacting a person to participate in the research, , and
(c) by adding the following subsection:
(2) Subsection (1) (a.1) does not apply in respect of research in relation to health issues if the commissioner approves
(a) the research purpose,
(b) the use of disclosed information for the purpose of contacting a person to participate in the research, and
(c) the manner in which contact is to be made, including the information to be made available to persons contacted.
31 Section 69.1 is amended
(a) in subsection (1) in the definition of "health care body" by striking out "section 10.1 of the Health Act;" and substituting "section 1 of the E-Health (Personal Health Information Access and Protection of Privacy) Act;",
(b) in subsection (1) by repealing the definitions of "health information bank" and "health information-sharing agreement" and substituting the following:
"health information bank" means a health information bank and a ministry database within the meaning of the E-Health (Personal Health Information Access and Protection of Privacy) Act;
"health information-sharing agreement" means an agreement under section 14 or 19 of the E-Health (Personal Health Information Access and Protection of Privacy) Act; , and
(c) in subsection (3) (a) by striking out "section 10.2 (designation or establishment of health information banks) of the Health Act" and substituting "section 3 (establishment or designation of health information banks) of the E-Health (Personal Health Information Access and Protection of Privacy) Act".
32 Schedule 2 is amended by adding the following:
| Public Body: |
Data Stewardship Committee |
| Head: |
Chair . |
Health Act
33 Sections 10.1 to 10.7 of the Health Act, R.S.B.C. 1996, c. 179, are repealed.
Health Statutes Amendment Act, 2007
34 Section 21 (b) of the Health Statutes Amendment Act, 2007, S.B.C. 2007, c. 19, is repealed and the following substituted:
(b) by adding the following definitions:
"personal health information"
means recorded information about an identifiable individual that is
related to the individual's health or the provision of health services
to the individual;
"personal representative" means a
person having authority under the common law or an enactment to make
personal and health care decisions in respect of another person; .
35 Section 23 is repealed and the following substituted:
23 Section 36 is repealed and the following substituted:
Confidentiality
36 (1) A person must not record personal health information in PharmaNet except in accordance with this Act.
(2) Despite the Personal Information Protection Act,
a person who obtains information, files or records under this Act must
not use them, or disclose them to any other person, except
(a) as permitted under this Act, or
(b) for the purposes of
(i) court proceedings, or
(ii) enabling the college, or a person or
committee acting for the college, to carry out their powers, duties or
functions under this Act or the bylaws.
(3) Subsection (2) does not apply to a person in
respect of his or her own personal health information, or to the
person's personal representative when acting in the course of his or
her duties.
36 Sections 26 (b), 27 (a), 34 (b) and 35 (b) are repealed.
37 Section 29 (b) is repealed and the following substituted:
(b) by adding the following definitions:
"personal health information"
means recorded information about an identifiable individual that is
related to the individual's health or the provision of health services
to the individual;
"personal representative" means a
person having authority under the common law or an enactment to make
personal and health care decisions in respect of another person; .
38 Section 30 is repealed and the following substituted:
30 Section 12 is repealed and the following substituted:
Confidentiality
12 (1) A person must not record personal health information in PharmaNet except in accordance with this Act.
(2) Despite the Personal Information Protection Act,
a person who obtains information, files or records under this Act must
not use them, or disclose them to any other person, except
(a) as permitted under this Act, or
(b) for the purposes of
(i) court proceedings, or
(ii) enabling the college, or a person or
committee acting for the college, to carry out their powers, duties or
functions under this Act or the bylaws.
(3) Subsection (2) does not apply to a person in
respect of his or her own personal health information, or to the
person's personal representative when acting in the course of his or
her duties.
Pharmacists, Pharmacy Operations and Drug Scheduling Act
39 Section 38.1 of the Pharmacists, Pharmacy Operations and Drug Scheduling Act, R.S.B.C. 1996, c. 363, is amended
(a) in subsection (1) by striking out "any applicable regulation under subsection (2) (c)," and substituting "the regulations,",
(b) by adding the following subsection:
(1.1) Subject to this Act and the regulations, a person, or the person's personal representative, may have access to
(a) that person's personal health information on PharmaNet,
(b) a record of any disclosure directives made by the person that apply to PharmaNet, and
(c) information respecting who has collected, used or disclosed that person's personal health information through PharmaNet. ,
(c) in subsection (2) by striking out "In relation to access referred to in subsection (1), the Lieutenant Governor in Council may make regulations" and substituting "In
relation to access referred to in subsections (1) and (1.1), the
Lieutenant Governor in Council may make regulations as follows:",
(d) in subsection (2) by striking out ", and" at the end of paragraph (b),
(e) in subsection (2) by adding the following paragraph:
(d) respecting fees that may be charged for access to the information and records referred to in subsection (1.1). , and
(f) by adding the following subsection:
(3) Despite subsection (1.1) and without limiting
a regulation made under subsection (2) (c), an employee in the
ministry of the minister designated by the minister for this purpose
may deny, for any reason for which a person may be denied access to
information under the Freedom of Information and Protection of Privacy Act, access to personal health information under subsection (1.1).
40 Section 39 is amended
(a) by adding the following subsection:
(5.1) Despite subsection (5), the PharmaNet
committee may disclose the names and addresses of patients and
practitioners if the commissioner under the Freedom of Information and Protection of Privacy Act approves
(a) the research purpose,
(b) the use of disclosed information for the
purpose of contacting a patient or practitioner to participate in the
research, and
(c) the manner in which contact is to be made, including the information to be made available to persons contacted. , and
(b) by repealing subsection (6) and substituting the following:
(6) Except as provided in the bylaws,
(a) the PharmaNet committee, or
(b) a person who may access, under section 38.1, personal health information
must not disclose personal health information or any information related to a practitioner for the purposes of market research.
41 The following Part is added:
Part 4.1 — Disclosure Directives
Interpretation of this Part
39.2 (1) In this Part, "disclosure directive" means a written instruction under section 39.3 [making and revoking disclosure directives].
(2) A reference to a person in this Part in
relation to the making or revoking of a disclosure directive includes
the person's personal representative when acting in the course of his
or her duties.
Making and revoking disclosure directives
39.3 (1) If
by regulation the Lieutenant Governor in Council authorizes the making
of disclosure directives, a person may, subject to the regulations,
(a) make a disclosure directive as authorized by the regulation, and
(b) revoke a disclosure directive the person has made.
(2) A person who makes or revokes a disclosure directive must
(a) make the disclosure directive or revocation in writing,
(b) comply with any prescribed conditions respecting the making or revoking of disclosure directives, and
(c) forward to a prescribed person the disclosure directive or revocation and, if applicable, the prescribed records.
(3) Until the contrary is demonstrated, every
person is presumed to be capable of understanding the nature of a
disclosure directive and the consequences of making or revoking a
disclosure directive.
(4) A disclosure directive takes effect when activated in the PharmaNet system.
(5) If the Lieutenant Governor in Council amends
a regulation in respect of the authority to make a disclosure
directive, any part of a disclosure directive that is inconsistent with
the amendment is deemed to have been revoked.
Effect of disclosure directives
39.4 (1) A
person who is otherwise permitted to collect, use or disclose personal
health information from PharmaNet must not do so in any manner that is
inconsistent with a disclosure directive except as follows:
(a) to notify a person that a disclosure
directive applies to personal health information that would otherwise
be available to the person;
(b) as required under this Act;
(c) for a purpose described in section 33.1 (1) (c) of the Freedom of Information and Protection of Privacy Act;
(d) with the express consent of the person who made the disclosure directive;
(e) if section 12 [exception — urgent or emergency health care] of the Health Care (Consent) and Care Facility (Admission) Act
applies and a health care provider acting under that section reasonably
believes that the personal health information may be required to
provide health care in accordance with that section;
(f) if prescribed circumstances apply.
(2) For the purposes of subsection (1) (e), a reference in section 12 of the Health Care (Consent) and Care Facility (Admission) Act to an "adult" is to be read for the purposes of this section as a reference to a person having a disclosure directive.
Whistle-blower protection
39.5 A person
must not dismiss, suspend, demote, discipline, harass or otherwise
disadvantage another person, or deny another person a benefit, because
(a) the other person, acting in good faith and
on the basis of reasonable belief, has notified the minister or the
commissioner under the Freedom of Information and Protection of Privacy Act
that a person has disclosed, or is about to disclose, personal health
information in a manner that is inconsistent with a disclosure
directive,
(b) the other person, acting in good faith and
on the basis of reasonable belief, has done or stated an intention of
doing anything that is required to be done in order to avoid having any
person contravene section 39.4,
(c) the other person, acting in good faith and
on the basis of reasonable belief, has refused to do or stated an
intention of refusing to do anything that is in contravention of
section 39.4, or
(d) the person believes that the other person will do anything described in any of paragraphs (a) to (c).
Regulations in respect of this Part
39.6 (1) The Lieutenant Governor in Council may make regulations as follows:
(a) authorizing, with or without conditions, the making of disclosure directives;
(b) limiting or prohibiting classes of persons from making disclosure directives;
(c) limiting persons from making disclosure directives in respect of
(i) one or more types of personal health information contained in the PharmaNet system,
(ii) one or more purposes for which personal health information may be disclosed from the PharmaNet system, and
(iii) one or more persons or classes of persons;
(d) respecting the manner in which a disclosure
directive must be made, to whom a disclosure directive must be provided
and records that must accompany a disclosure directive;
(e) prescribing circumstances in which a person
may collect, use or disclose personal health information despite a
disclosure directive.
(2) A power to make a regulation under this Act in respect of a person includes a power to
(a) establish classes of persons, and
(b) make regulations that are different for different classes of persons.
42 Section 78 is amended
(a) in subsection (2) by striking out "39 (1), (6) or (7)," and substituting "39 (1) or (7),",
(b) in subsection (3) by adding "other than section 39 (6), 39.4 or 39.5," after "If a person contravenes this Act,", and
(c) by adding the following subsections:
(6) A person who contravenes section 39 (6), 39.4 or 39.5 commits an offence and is liable to a fine of up to $200 000.
(7) In a prosecution for an offence under this
section, it is a defence for the person charged to prove that the
person exercised due diligence to avoid the commission of the offence.
Pharmacy Operations and Drug Scheduling Act
43 Section 15 of the Pharmacy Operations and Drug Scheduling Act, S.B.C. 2003, c. 77, is amended
(a) in subsection (1) by striking out "any applicable regulation under subsection (2) (h)," and substituting "the regulations,",
(b) by adding the following subsection:
(1.1) Subject to this Act and the regulations, a person, or the person's personal representative, may have access to
(a) that person's personal health information on PharmaNet,
(b) a record of any disclosure directives made by the person that apply to PharmaNet, and
(c) information respecting who has collected, used or disclosed that person's personal health information through PharmaNet. ,
(c) in subsection (2) by striking out "In relation to access referred to in subsection (1), the Lieutenant Governor in Council may make regulations" and substituting "In
relation to access referred to in subsections (1) and (1.1), the
Lieutenant Governor in Council may make regulations as follows:",
(d) in subsection (2) by striking out ", or" at the end of paragraph (g) (iv),
(e) in subsection (2) by adding the following paragraph:
(i) respecting fees that may be charged for access to the information and records referred to in subsection (1.1). , and
(f) by adding the following subsection:
(7) Despite subsection (1.1) and without limiting
a regulation made under subsection (2) (c), an employee in the ministry
of the minister designated by the minister for this purpose may deny,
for any reason for which a person may be denied access to information
under the Freedom of Information and Protection of Privacy Act, access to personal health information under subsection (1.1).
44 Section 16 is amended
(a) by adding the following subsection:
(2.1) Despite subsection (2), the PharmaNet
stewardship committee may disclose patient or practitioner names or
addresses or other information that could allow a patient or
practitioner to be identified or contacted if the commissioner under
the Freedom of Information and Protection of Privacy Act approves
(a) the research purpose,
(b) the use of disclosed information for the
purpose of contacting a patient or practitioner to participate in the
research, and
(c) the manner in which contact is to be made, including the information to be made available to persons contacted. , and
(b) by repealing subsection (3) and substituting the following:
(3) Despite other provisions of this Act or section 35 of the Freedom of Information and Protection of Privacy Act,
(a) the PharmaNet stewardship committee, or
(b) a person who may access, under section 15, personal health information on PharmaNet,
must not disclose personal health information or any information related to a practitioner for the purpose of market research.
45 The following Part is added:
Part 2.1 — Disclosure Directives
Interpretation of this Part
16.2 (1) In this Part, "disclosure directive" means a written instruction under section 16.3 [making and revoking disclosure directives].
(2) A reference to a person in this Part in
relation to the making or revoking of a disclosure directive includes
the person's personal representative when acting in the course of his
or her duties.
Making and revoking disclosure directives
16.3 (1) If
by regulation the Lieutenant Governor in Council authorizes the making
of disclosure directives, a person may, subject to the regulations,
(a) make a disclosure directive as authorized by the regulation, and
(b) revoke a disclosure directive the person has made.
(2) A person who makes or revokes a disclosure directive must
(a) make the disclosure directive or revocation in writing,
(b) comply with any prescribed conditions respecting the making or revoking of disclosure directives, and
(c) forward to a prescribed person the disclosure directive or revocation and, if applicable, the prescribed records.
(3) Until the contrary is demonstrated, every
person is presumed to be capable of understanding the nature of a
disclosure directive and the consequences of making or revoking a
disclosure directive.
(4) A disclosure directive takes effect when activated in the PharmaNet system.
(5) If the Lieutenant Governor in Council amends
a regulation in respect of the authority to make a disclosure
directive, any part of a disclosure directive that is inconsistent with
the amendment is deemed to have been revoked.
Effect of disclosure directives
16.4 (1) A
person who is otherwise permitted to collect, use or disclose personal
health information from PharmaNet under this Act must not do so in any
manner that is inconsistent with a disclosure directive except as
follows:
(a) to notify a person that a disclosure
directive applies to personal health information that would otherwise
be available to the person;
(b) as required under this Act;
(c) for a purpose described in section 33.1 (1) (c) of the Freedom of Information and Protection of Privacy Act;
(d) with the express consent of the person who made the disclosure directive;
(e) if section 12 [exception — urgent or emergency health care] of the Health Care (Consent) and Care Facility (Admission) Act
applies and a health care provider acting under that section reasonably
believes that the personal health information may be required to
provide health care in accordance with that section;
(f) if prescribed circumstances apply.
(2) For the purposes of subsection (1) (e), a reference in section 12 of the Health Care (Consent) and Care Facility (Admission) Act to an "adult" is to be read for the purposes of this section as a reference to a person having a disclosure directive.
Whistle-blower protection
16.5 A person
must not dismiss, suspend, demote, discipline, harass or otherwise
disadvantage another person, or deny another person a benefit, because
(a) the other person, acting in good faith and
on the basis of reasonable belief, has notified the minister or the
commissioner under the Freedom of Information and Protection of Privacy Act
that a person has disclosed, or is about to disclose, personal health
information in a manner that is inconsistent with a disclosure
directive,
(b) the other person, acting in good faith and
on the basis of reasonable belief has done or stated an intention of
doing anything that is required to be done in order to avoid having any
person contravene section 16.4,
(c) the other person, acting in good faith and
on the basis of reasonable belief has refused to do or stated an
intention of refusing to do anything that is in contravention of
section 16.4, or
(d) the person believes that the other person will do anything described in any of paragraphs (a) to (c).
Regulations in respect of this Part
16.6 (1) The Lieutenant Governor in Council may make regulations as follows:
(a) authorizing, with or without conditions, the making of disclosure directives;
(b) limiting or prohibiting classes of persons from making disclosure directives;
(c) limiting persons from making disclosure directives in respect of
(i) one or more types of personal health information contained in the PharmaNet system,
(ii) one or more purposes for which personal health information may be disclosed from the PharmaNet system, and
(iii) one or more persons or classes of persons;
(d) respecting the manner in which a disclosure
directive must be made, to whom a disclosure directive must be provided
and records that must accompany a disclosure directive;
(e) prescribing circumstances in which a person
may collect, use or disclose personal health information despite a
disclosure directive.
(2) A power to make a regulation under this Act in respect of a person includes a power to
(a) establish classes of persons, and
(b) make regulations that are different for different classes of persons.
46 Section 29 is amended
(a) in subsection (2) by striking out "16 (3) or (4)," and substituting "16 (4),",
(b) in subsection (3) by adding "other than section 16 (3), 16.4 or 16.5," after "If a person contravenes this Act,", and
(c) by adding the following subsections:
(6) A person who contravenes section 16 (3), 16.4 or 16.5 commits an offence and is liable to a fine of up to $200 000.
(7) In a prosecution for an offence under this
section, it is a defence for the person charged to prove that the
person exercised due diligence to avoid the commission of the offence.
Commencement
47 The
provisions of this Act referred to in column 1 of the following table
come into force as set out in column 2 of the table:
| Item |
Column 1
Provisions of Act |
Column 2
Commencement |
| 1 |
Anything not elsewhere covered by this table |
The date of Royal Assent |
| 2 |
Sections 1 to 28 |
By regulation of the Lieutenant Governor in Council |
| 3 |
Sections 30 to 33 |
By regulation of the Lieutenant Governor in Council |
| 4 |
Sections 39 to 46 |
By regulation of the Lieutenant Governor in Council |
Explanatory Notes
This Bill
- repeals and replaces sections 10.1 to 10.7 of the Health Act in respect of health information banks;
- provides for the making of disclosure directives, giving
individuals limited control over the collection, use and disclosure of
their personal health information that is contained in a health
information bank or the PharmaNet system;
- provides for the establishment of a data stewardship
committee to manage disclosure, for the purposes of health planning and
research, of information contained in health information banks and
prescribed ministry databases.
|