BILL 9

An Act to Amend the Personal Health Information Privacy and Access Act

Her Majesty, by and with the advice and consent of the Legislative Assembly of New Brunswick, enacts as follows:

1 Section 1 of the Personal Health Information Privacy and Access Act, chapter P-7.05 of the Acts of New Brunswick, 2009, is amended in the definition “custodian”

(a)  by striking out the portion before paragraph (a) and substituting the following:

“custodian” means an individual or organization that collects, maintains or uses personal health information for the purpose of providing or assisting in the provision of health care or treatment or the planning and management of the health care system or delivering a government program or service and includes (dépositaire)

(b)  by striking out subparagraph d)(ii) of the French version and substituting the following:

(ii) le Conseil du Nouveau-Brunswick en matière de santé,

2 Section 4 of the Act is amended

(a)  by repealing subsection (1) and substituting the following:

4(1) Unless otherwise provided in the regulations, if a provision of this Act is in conflict with a provision of another Act of the Legislature, this Act prevails.

(b)  by repealing subsection (2) and substituting the following:

4(2) Unless otherwise provided in this Act or the regulations, this Act does not apply to a record created or information held by a person under or for the purpose of the provisions of the following Acts of the Legislature, notwithstanding that the information would otherwise be considered to be personal health information or the person would otherwise be considered to be a custodian within the meaning of this Act:

(a)  the Family Services Act; and

(b)  any Act of the Legislature or any provision of an Act of the Legislature prescribed by regulation.

3 Paragraph 25(2)(a) of the English version of the Act is repealed and the following is substituted:

(a)  is capable of consenting to the collection, use or disclosure of personal health information by a custodian, and

4 Subsection 35(2) of the Act is amended by striking out “used” and substituting “disclosed”.

5 Paragraph 37(6)(c) of the Act is repealed in the portion preceding subparagraph (i) and the following is substituted:

(c)  to or via an information network designated by the Minister in accordance with the regulations in which personal health information is recorded for the purpose of facilitating

6 Paragraph 43(3)(c) of the Act is repealed and the following is substituted:

(c)  the individuals to whom the information relates have consented to its use and disclosure or it is unreasonable or impractical for the person proposing the research to obtain consent from the individuals to whom the information relates, and

7 Section 47 of the Act is repealed and the following is substituted:

47 A custodian may disclose personal health information relating to an individual that is collected in the Province to a person outside the Province but only in circumstances described in section 37, 38 or 44 or in circumstances described in the regulations.

8 Section 48 of the Act is repealed and the following is substituted:

48(1) No person may require the production of an individual’s Medicare number or collect or use an individual’s Medicare number except a person that requires its production, collection or use for the following purposes:

(a)  for the provision of health care;

(b)  to verify the individual’s eligibility to participate in a health care program or receive a health care service; and

(c)  for the payment and management of the health care system.

48(2) An individual may refuse to provide his or her Medicare number to any person not authorized to require the production of the individual’s Medicare number or collect or use the individual’s Medicare number.

48(3) If a person requests a Medicare number from an individual, the person shall advise the individual of his or her authority to do so.

9 Subsection 55(2) of the Act is amended

(a)  in paragraph (a) by striking out “or accessed from”;

(b)  by repealing paragraph (b) and substituting the following:

(b)  if the information is stored in another jurisdiction for the purpose of disclosure allowed under this Act;

10 Subsection 56(2) of the Act is repealed and the following is substituted:

56(2) A privacy impact assessment shall describe, in the form and manner as may be prescribed by regulation, how the proposed administrative practices and information systems relating to the collection, use and disclosure of individually identifying health information may affect the privacy of the individual to whom the information relates.

11 Subsection 57(3) of the Act is amended by striking out “With the consent of the Minister, a custodian” and substituting “A custodian”.

12 Subsection 79(1) of the Act is amended

(a)  by repealing paragraph (f) and substituting the following:

(f)  prescribing the personal health information to which this Act does apply for the purposes of subsection 3(2);

(b)  by adding after paragraph (f) the following:

(f.1)  prescribing the individuals or organizations referred to in paragraph 3(2)(c) that collect, maintain or use personal health information for purposes other than health care or treatment and the planning and management of the health care system;

(c)  by repealing paragraph (h);

(d)  by repealing paragraph (p) and substituting the following:

(p)  respecting information networks referred to in paragraph 37(6)(c);

(e)  by adding after paragraph (u) the following:

(u.1)  describing the circumstances in which a custodian may disclose personal health information relating to an individual that is collected in the Province to a person outside the Province;

(f)  by repealing paragraph (cc) and substituting the following:

(cc)  respecting the personal health information in the custody or under the control of a custodian that may be stored outside Canada;

(g)  by adding after paragraph (cc) the following:

(cc.1)  prescribing a custodian that is a public body for the purposes of subsection 56(1);

(cc.2)  prescribing the form and manner of a privacy impact assessment;