Acts and Regulations

2010-112 - General

Full text
Current to 9 August 2023
NEW BRUNSWICK
REGULATION 2010-112
under the
Personal Health Information
Privacy and Access Act
(O.C. 2010-271)
Filed August 23, 2010
Under section 79 of the Personal Health Information Privacy and Access Act, the Lieutenant-Governor in Council makes the following Regulation:
Citation
1This Regulation may be cited as the General Regulation - Personal Health Information Privacy and Access Act.
Definitions
2The following definitions apply in this Regulation.
“Act” means the Personal Health Information Privacy and Access Act.(Loi)
“electronic health record” means an electronic record of an individual’s personal health information that is accessible from interoperable systems within an information network.(dossier électronique de santé)
“information network” means an information network designated by the Minister under paragraph 37(6)(c) of the Act.(réseau d’information )
“Tri-Council Policy Statement” means the Tri-Council Policy Statement: Ethical Conduct for Research Involving Humans, 2nd Edition (December 2008), as amended from time to time.(Énoncé de politique des trois Conseils)
GENERAL
Designation of custodians
3The following persons are designated as custodians for the purpose of the definition “custodian” in section 1 of the Act:
(a) a school or school district;
(b) a coroner appointed under the Coroners Act; and
(c) a successor who obtains custody of records containing personal health information held by a custodian.
Health care prescribed
2016-5
3.1The donation of blood, tissue or organs is a health care service for the purposes of paragraph (f) of the definition “health care” in section 1 of the Act.
2016-5
Designation of health care facilities
4A facility located within a building or premises, including a private residence or a provincial jail, in or from which health care is provided by a health care provider is designated as a health care facility for the purposes of the definition “health care facility” in section 1 of the Act.
Designation of health care providers
5The following classes of persons are designated for the purpose of the definition “health care provider” in section 1 of the Act:
(a) social workers registered under the New Brunswick Association of Social Workers Act, 1988; and
(b) New Brunswick members of the Canadian Health Information Management Association.
Personal health information prescribed
6Personal health information collected by an individual or organization for the purpose of providing or assisting in the provision of health care or treatment or the planning and management of the health care system or delivering a government program or service is prescribed for the purposes of paragraph 3(1)(b) of the Act.
Individuals or organizations to which the Act does not apply
7The Act does not apply to the following individuals or organizations:
(a) the New Brunswick Insurance Board;
(b) the New Brunswick Human Rights Commission;
(c) the Labour and Employment Board established under the Labour and Employment Board Act;
(d) the Designation Appeal Board established under the Post-Secondary Student Financial Assistance Act;
(e) Premier’s Council on Disabilities;
(f) a review board appointed under section 30 of the Mental Health Act;
(g) the Mental Health Services Advisory Committee established under the Mental Health Services Act;
(h) a tribunal appointed under section 7.5 of the Mental Health Act;
(i) a person, service or organization designated as psychiatric patient advocate services under the Mental Health Act;
(j) a review board established by the Restigouche Hospital Center Inc.; and
(k) the Workers’ Compensation Appeals Tribunal established under the Workplace Health, Safety and Compensation Commission and Workers’ Compensation Appeals Tribunal Act.
2014, c.49, s.36; 2018, c.7, s.11; 2019, c.12, s.27
Acts to which the Act does not apply
8The following Acts or provisions of Acts of the Legislature are prescribed for the purpose of paragraph 4(2)(b) of the Act:
(a) the Archives Act;
(b) the Family Income Security Act; and
(c) section 38.1 of the Vital Statistics Act.
2013-30
FEES
Search and preparation fees
9(1)An individual shall pay a search and preparation fee to a custodian if the custodian estimates that search and preparation related to the individual’s request to examine or receive a copy of the individual’s personal health information takes more than 2 hours.
9(2)The fee payable for search and preparation shall be $15 for each half-hour beyond the first 2 hours of search and preparation related to the individual’s request.
Copying fees
10An individual shall pay the following copying fees to the custodian when the individual makes a request to examine or receive a copy of the individual’s personal health information:
(a) if the information in relation to the request is stored or recorded in printed form and able to be copied using a photocopier or computer printer, 25 cents for each page copied;
(b) if the information in relation to the request is not able to be copied using a photocopier or computer printer, the actual cost of providing copies of the request.
Computer programming and data processing fees
11If a custodian requires the use of computer programming or incurs data processing costs in responding to a request to examine or receive a copy of an individual’s personal health information, the individual shall pay to the custodian
(a) ten dollars for each 15 minutes of internal programming or data processing; or
(b) the actual cost of external programming or data processing incurred by the custodian.
Mail and courier delivery
12(1)No fee shall be payable by an individual to a custodian for mailing a request to examine or receive a copy of his or her personal health information by regular mail.
12(2)If courier delivery costs are necessary in responding to a request to examine or receive a copy of an individual’s personal heath information, the custodian may charge to the individual the actual cost of the courier delivery.
Waiver of fees
13A custodian may waive all or part of the fees payable under this Regulation if the custodian is satisfied that payment would impose an unreasonable financial hardship on the individual.
INFORMATION NETWORKS AND ELECTRONIC HEALTH RECORDS
Information networks
14(1)Before designating an information network, the Minister, in writing, shall
(a) identify the type or nature of personal health information to be contained in the information network,
(b) identify the source, including other information networks, from which the personal health information may be collected in or by the information network,
(c) identify one or more of the purposes referred to in subparagraphs 37(6)(c)(i), (ii) and (iii) of the Act for which the information network is established,
(d) identify the purpose for which personal health information is recorded in or by the information network,
(e) identify the purpose for which personal health information may be disclosed by or from the information network,
(f) identify to whom personal health information contained in the information network may be disclosed, and
(g) identify and impose on the custodian limits or conditions on the collection, storage, use or disclosure of personal health information contained in or disclosed from an information network that are, in the opinion of the Minister, required for the privacy and security of the personal health information.
14(2)The information referred to in subsection (1) may be published on the Internet or disseminated in such other manner as the Minister considers appropriate.
Electronic health record
15An electronic health record, once created by the Minister, is established for each individual and compiled within an information network designated by the Minister for the purpose referred to in subparagraph 37(6)(c)(iii) of the Act.
MISCELLANEOUS
Registry of personal health information
16The following custodians are designated for the purpose of compiling or maintaining a registry of personal health information under paragraph 37(6)(d) of the Act:
(a) the Minister;
(b) a regional health authority;
(b.1) Service New Brunswick;
(c) Repealed: 2015, c.44, s.100
(d) EM/ANB Inc.; and
(e) the Canadian Blood Services.
2015, c.44, s.100; 2017, c.45, s.6
Research review body
17For the purposes of subsection 43(2) of the Act, a research review body shall operate in conformity with the Tri-Council Policy Statement.
2013-56
Collection and use of Medicare number
2018-88
17.1(1)The following definitions apply in this section.
“child” means a child as defined in the Early Childhood Services Act.(enfant)
“infant” Repealed:  2021, c.1, s.32
“parent” means a parent as defined in section 45 of the Early Childhood Services Act.(parent)
“preschool child” Repealed:  2021, c.1, s.32
“pupil” means a pupil as defined in the Education Act.(élève)
17.1(1.1)For the purposes of subsection 48(1.2) of the Act, a public body may collect and use an individual’s Medicare number for the purposes of identifying and verifying the identity of an individual in the health care system.
17.1(2)For the purposes of subsection 48(1.2) of the Act, the Minister of Education and Early Childhood Development may collect and use an individual’s Medicare number for the following purposes:
(a) to uniquely identify a child in the on-line registry established under subsection 2.02(1) of the Early Childhood Services Act, or, if the child does not have a Medicare number, the parent of the child;
(b) to verify the eligibility of a child to participate in a program or receive a service under the Early Childhood Services Act; and
(c) to verify the eligibility of a parent to receive assistance under section 46 of the Early Childhood Services Act.
17.1(3)For the purposes of subsection 48(1.2) of the Act, the Minister of Education and Early Childhood Development and a District Education Council, through the superintendent of the school district, may collect and use an individual’s Medicare number for the purpose of uniquely identifying
(a) a pupil in the records maintained under sections 10, 20, 40.1 and 54 of the Education Act, and
(b) a new pupil who is required to obtain a permit to attend school under subsection 11(1) of New Brunswick Regulation 97-150.
17.1(4)For the purposes of subsection 48(1.2) of the Act, the Minister may collect and use an individual’s Medicare number for the following purposes: 
(a) validating a unique identification number created for a child under the Early Childhood Services Act; and
(b) validating a unique identification number created for a pupil under the Education Act.
2018-88; 2021, c.1, s.32; 2023-44
Disclosure outside the Province
Repealed: 2017, c.30, s.4
2017, c.30, s.4
18Repealed: 2017, c.30, s.4
2017, c.30, s.4
Breach of privacy
19(1)If a breach of privacy referred to in subparagraph 49(1)(c)(i), (ii) or (iii) of the Act occurs, the custodian of the personal health information shall, at the first reasonable opportunity, give notice to
(a) the person to whom the information relates in person, by telephone or in writing, and
(b) the Commissioner.
19(2)When giving notice under subsection (1), the custodian shall provide the following information:
(a) the name of the custodian;
(b) the name and contact information of the person designated by the custodian to respond to inquiries about the custodian’s information practices;
(c) a description of the nature of the breach of privacy;
(d) the date and location of the breach of privacy; and
(e) the date the breach of privacy came to the attention of the custodian.
Security requirements
20(1)A custodian shall establish and comply with a written policy and procedures with respect to information practices for the protection of personal health information containing the following requirements:
(a) measures to protect the security of personal health information during its collection, use, disclosure, storage and destruction;
(b) measures, for example by the use of passwords and encryption, to ensure that removable media used to record, transport or transfer personal health information is appropriately protected when in use;
(c) measures to ensure that removable media used to record personal health information is stored securely when not in use;
(d) measures to ensure that personal health information is maintained in a designated area and is subject to appropriate security safeguards;
(e) measures that limit physical access to designated areas containing personal health information to authorized persons;
(f) procedures that provide for the recording of security breaches; and
(g) corrective procedures to address security breaches.
20(2)A custodian shall keep a record of all security breaches by recording the security breaches and corrective procedures taken to diminish the likelihood of future breaches.
Information managers
21A written agreement for the provision of personal health information between a custodian and information manager referred to in subsection 52(3) of the Act shall describe
(a) the services to be provided to the custodian, and
(b) the administrative, technical and physical safeguards employed by the information manager relating to the confidentiality, security, accuracy and integrity of the personal health information.
Personal health information stored outside Canada
22Information managers providing a public body with information management or information technology services may store personal health information in their custody or in their control outside Canada.
Commencement
23This Regulation comes into force on September 1, 2010.
N.B. This Regulation is consolidated to August 9, 2023.