Government Notices — Other

Notice of Minister of Health

Notice of Proposed Regulation

Personal Health Information Protection Act, 2004

The Minister of Health on behalf of the Government of Ontario invites public comments on regulations proposed to be made under the Personal Health Information Protection Act, 2004 (“PHIPA”).

PHIPA came into force on November 1, 2004. Ontario Regulation 329/04, “General,” made under PHIPA (“the PHIPA Regulation”) also came into force on November 1, 2004. The Government is proposing amendments to the PHIPA Regulation. PHIPA requires that the Minister publish a notice of the proposed regulation and allow 60 days for public comment, after which the Minister reports to the Lieutenant Governor in Council, who may then finalize the regulation with or without changes.

Content of Proposed Regulation

The proposed regulation would make the following amendments to the PHIPA Regulation:

1. Amendments to existing regulation
   • Clarify that the requirement on a health information custodian to notify the Information and Privacy Commissioner of the existence of a circumstance set out in s. 6.3 (1) of the Regulation shall be done at the first reasonable opportunity.
   • Add a paragraph under s. 6.4 (1) of the Regulation adding that personal health information collected from the electronic health record without authority must be included in the annual report that health information custodians must provide to the Commissioner as outlined in that section.
2. Regulations Pertaining to Part V.1
   • Name Ontario Health as the prescribed organization under Part V.1 of PHIPA.
   • Establish prescribed data elements that may be used for unique identification of individuals for the purposes of collecting their information from the electronic health record for the purposes of s. 55.5 (2) of PHIPA.
   • Clarify that health information custodians collecting from the electronic health record are required to notify the Commissioner for the purposes of s.55.5 (7)(b) under any circumstances where they would be required to notify the Commissioner if the collection were for a use or disclosure outlined in s.6.3 of the Regulation, and to do so at the earliest opportunity.
   • Set out a series of requirements for consent directives under the electronic health record:
     • Require the prescribed organization to put into place practices and procedures for the purposes of managing consent directives that are approved by the Commissioner under paragraph 14 of section 55.3 and s. 55.12 of the Act.
     • Prescribe the level of specificity (granularity) at which personal health information may be subject to a consent directive. The granularity is set at the entirety of the electronic health record.
     • Prescribe the data elements in section 18.2 that may not be subject to any consent directive.
     • Require the prescribed organization to maintain existing consent directives if the individuals so desire, and ensure that existing consent directives apply to information newly entered into the electronic health record;
   • Set out the requirements of notices of override of consent directives for the purposes of ss. 55.7 (6), 55.7 (7)(a), and 55.7 (7)(b).
   • Exempt health information custodians that disclosed information that was collected from the electronic health record from ss. 12 (1) and 12 (3) of the Act with respect to personal health information where a health information custodian that collected personal health information is required to notify an individual under s. 55.5 (7)(a) or to notify the Commissioner under s. 55.5 (7)(b) of the Act.
   • Set out a variety of regulatory provisions for coroners accessing the electronic health record for the purposes of the Coroners Act:
     • Require a coroner to whom the prescribed organization provides information under section 55.9.1 (1) of the Act to comply with section 11.1, subsections 12 (1) and (3), subsection 13 (1) and sections 17, 17.1, 30 and 31 of the Act as if the coroner were a health information custodian.
     • Clarify that a coroner acting under the Coroners Act may only use and disclose information for the purposes for which the information was collected.
     • Require the coroner to comply with the obligations set out in subsection 12 (1) of the Act with respect to the transmitted information, regardless of whether the coroner has viewed, handled or otherwise dealt with the information, if a coroner requests that prescribed organization transmit personal health information to the coroner by means of the electronic health record and the prescribed organization transmits the information as requested.

Invitation to Provide Comments on Proposed Regulation

The public is invited to provide written comments on the proposed regulation over a 60-day period, commencing on May 2, 2020 and ending on July 1, 2020.

In providing comments, please consider whether the proposed amendments to the PHIPA Regulation should be made, with or without changes. Furthermore, please consider whether any other amendments should be made to the proposed PHIPA Regulation. Please be as specific as possible, and provide a full rationale for any suggested changes or additions.

Written comments may be addressed to:

Ms. Christine Sham
Director, IM Strategy and Policy Branch
Ministry of Health
Health System Information Management
1075 Bay Street, 13^th Floor
Toronto ON M5S 2B1
Email: healthprivacy.moh@ontario.ca

The text of the proposed regulation is set out following this notice in English and French. We welcome your input in either English or French. All comments and submissions received during the comment period will be considered during final preparation of the regulation. The content, structure and form of the proposed regulation is subject to change as a result of the consultation process and is in the discretion of the Lieutenant Governor in Council, who has the final decision on the contents of any regulation.

Information respecting PHIPA and the PHIPA Regulation, and electronic copies of this notice, including the text of the proposed regulation, may be accessed through Ontario’s Regulatory Registry web-site at the following address: https://www.ontariocanada.com/registry.

Copies of PHIPA and the PHIPA Regulation are available at https://www.ontario.ca/laws

Please note that all materials or comments received from organizations in response to this Notice will be considered public information and may be used and disclosed by the Ministry to assist the Ministry in evaluating and revising the proposed regulation. This may involve disclosing materials or comments, or summaries of them, to other interested parties during and after the request for public comment process. An individual who provides materials or comments and who indicates an affiliation with an organization will be considered to have submitted those comments or materials on behalf of the organization so identified. Materials or comments received from individuals who do not indicate an affiliation with an organization will not be considered public information unless expressly stated otherwise by the individual. However, materials or comments provided by individuals may be used and disclosed by the Ministry to assist in evaluating and revising the proposed regulation. Personal information of those who do not specify an organizational affiliation, such as an individual’s name and contact details, will not be disclosed by the Ministry without the individual’s consent unless required by law. If you have any questions about the collection of this information, you can contact the Freedom of Information and Privacy Coordinator of the Ministry of Health at 416-327-7040.

The Honourable Christine Elliott
Minister of Health

Caution:

This consultation draft is intended to facilitate dialogue concerning its contents. Should the decision be made to proceed with the proposal, the comments received during consultation will be considered during the final preparation of the regulation. The content, structure, form and wording of the consultation draft are subject to change as a result of the consultation process and as a result of review, editing and correction by the Office of Legislative Counsel.

consultation draft

ontario regulation

to be made under the

personal health information protection act, 2004

Amending O. Reg. 329/04

(general)

1. Section 6.3 of Ontario Regulation 329/04 is amended by adding the following subsection:
   2. 1. A health information custodian shall notify the Commissioner of the existence of a circumstance set out in subsection (1) at the first reasonable opportunity.

2. 1. Subsection 6.4 (1) of the Regulation is amended by adding the following paragraph:
      5. Personal health information was collected by the custodian by means of the electronic health record without authority.
   2. Section 6.4 of the Regulation is amended by adding the following subsection:
   3. A health information custodian that disclosed the information collected by means of the electronic health record without authority is not required to include this disclosure in its annual report.

3. The Regulation is amended by adding the following sections:

Prescribed organization

18. 1. The Agency is prescribed as the organization for the purposes of Part V.1 of the Act.

Data elements

18. 2. 1. The following are prescribed as data elements for the purposes of subsection 55.5 (2) of the Act:
          1. A health number.
          2. Either or both of a number or version code assigned to an insured person by a province or territory in Canada other than Ontario for the purposes of a health care insurance plan within the meaning of the Canada Health Act.
          3. A medical record number or other unique number assigned by a health information custodian to uniquely identify individuals receiving health care from the custodian.
          4. A unique number relating to an individual on a form of identification that,
             1. has been issued by a government or governmental agency, and
             2. bears the name of the individual.
          5. The name or names of an individual, including a legal name, an alternate name or an alias.
          6. The date of birth of an individual.
          7. The administrative gender of an individual.
          8. The address of an individual
          9. A telephone number of an individual.
          10. The primary or preferred language of an individual.
          11. A binary value indicating if an individual is deceased.
          12. The date of death of an individual.

Clause 55.5 (7) (b) of the Act

18. 3. 1. A health information custodian is required to notify the Commissioner for the purposes of clause 55.5 (7) (b) of the Act under any circumstance where the custodian would be required to notify the Commissioner if the collection by means of the electronic health record had been for a use or disclosure to which section 6.3 of this Regulation applied.
       2. The health information custodian shall inform the Commissioner of an unauthorized collection to which subsection (1) applies at the first reasonable opportunity.

Consent directives

18. 4. 1. This section applies to consent directives made under section 55.6 of the Act.
       2. For the purposes of paragraph 17 of section 55.3 of the Act, the prescribed organization shall put into place and comply with practices and procedures that are for the purposes of managing consent directives and that are approved by the Commissioner under paragraph 14 of section 55.3 of the Act and under section 55.12 of the Act.
       3. Where an individual makes a consent directive, it applies to all of the individual’s personal health information that is accessible by means of the electronic health record, unless it is reasonably possible for the prescribed organization to apply the consent directive only to the specific personal health information that has been identified by the individual, in which case the consent directive applies only to that personal health information.
       4. Despite subsection (3), the data elements prescribed under section 18.2 may not be made subject to a consent directive.
       5. Where an individual has made a consent directive and additional personal health information has subsequently been added to the individual’s personal health information that is accessible by means of the electronic health record, the prescribed organization shall implement the consent directive with respect to the additional information in accordance with subsection (3).

Transitional, consent directives

18. 5. 1. Where, before section 55.6 of the Act came into force, an individual made a directive withholding or withdrawing, in whole or in part, the individual’s consent to the collection, use or disclosure of personal health information that is accessible by means of the electronic health record developed and maintained by the prescribed organization, the prescribed organization shall continue to implement the individual’s directive as it existed before the coming into force, subject to subsection (2).
       2. Where an individual has made a directive described in subsection (1) and has subsequently made a consent directive under subsection 55.6 (1) of the Act, the prescribed organization shall implement the consent directive.

Notice requirements, s. 55.7 (6) of the Act

18. 6. Where the prescribed organization is required to provide written notice under subsection 55.7 (6) of the Act, the notice must include,
       1. the name of the individual to whom the information relates;
       2. the identity of any health information custodian that disclosed the information;
       3. the identity of any health information custodian that collected the information;
       4. the name of any agent of the health information custodian who collected the information;
       5. a general description of information, other than personal health information, that was collected;
       6. the reason or reasons for the consent override as described in subsection 55.7 (1), (2) or (3) of the Act; and
       7. the date and time of the collection.

Notice requirements, clause 55.7 (7) (a) of the Act

18. 7. 1. Where a health information custodian is required to notify an individual under clause 55.7 (7) (a) of the Act, the notice must include,
          1. the name of the individual to whom the information relates;
          2. the identity of any health information custodian that disclosed the information;
          3. a general description of the information, other than personal health information, that was collected;
          4. the date and time of the collection;
          5. the reason or reasons for the consent override as described in subsection 55.7 (1), (2) or (3) of the Act;
          6. the name of the individual, including a substitute decision-maker, who provided express consent under subsection 55.7 (1) of the Act, if applicable;
          7. the name of any agent of the health information custodian who authorized the override;
          8. contact information for the health information custodian that collected the information;
          9. contact information for and information about the process of filing a complaint with the Commissioner; and
          10. contact information for the Commissioner and the fact that the individual may make a complaint to the Commissioner under Part VI of the Act.
       2. Despite subsection (1), in the event that the custodian collected the personal health information in the circumstances described in subsection 55.7 (3) of the Act, the custodian may, in their discretion, decide not to include any identifying information in the notice about any person other than the individual to whom the information relates if the custodian believes on reasonable grounds that not providing the identifying information is necessary for the purpose of eliminating or reducing a significant risk of serious bodily harm to a person or group of persons.

Notice requirements, clause 55.7 (7) (b) of the Act

18. 8. Where a health information custodian is required to provide written notice under clause 55.7 (7) (b) of the Act, the notice must include,
       1. the identity of any health information custodian that disclosed the information;
       2. a description of the significant risk of serious bodily harm to a person or group of persons other than the individual to whom the information relates;
       3. the reason the personal health information was necessary for the purpose of eliminating or reducing the significant risk of serious bodily harm;
       4. the name of any agent of the health information custodian who collected the information;
       5. a description of the personal health information collected by the custodian; and
       6. the date and time of the collection.

Exemption

18. 9. Where a health information custodian that collected personal health information is required to notify an individual under clause 55.5 (7) (a) or notify the Commissioner under clause 55.5 (7) (b) of the Act, the health information custodian that disclosed the personal health information is exempt from the notice obligations under subsections 12 (2) and (3) of the Act with respect to the personal health information.

Provision to coroner

18. 10. 1. A coroner to whom the prescribed organization provides information under subsection 55.9.1 (1) of the Act shall comply with section 11.1, subsections 12 (1) and (3), subsection 13 (1) and sections 17, 17.1, 30 and 31 of the Act as if the coroner were a health information custodian.
        2. A coroner to whom the prescribed organization provides information under subsection 55.9.1 (1) of the Act may only use or disclose the information for the purpose for which the information was collected.
        3. If a coroner requests that the prescribed organization transmit personal health information to the coroner by means of the electronic health record and the prescribed organization transmits the information as requested, the coroner shall comply with the obligations set out in subsection 12 (1) of the Act with respect to the transmitted information, regardless of whether the coroner has viewed, handled or otherwise dealt with the information.
        4. If personal health information about an individual is collected without authority by a coroner by means of the electronic health record, the coroner shall,
           1. notify the individual at the first reasonable opportunity of the unauthorized collection and include in the notice a statement that the individual is entitled to make a complaint to the Commissioner under Part VI of the Act; and
           2. notify the Commissioner of the unauthorized collection.
        5. A coroner to whom the prescribed organization provides information under subsection 55.9.1 (1) of the Act shall comply with section 6.4 of this Regulation, with any necessary modification, as if the coroner were a health information custodian.

Commencement

2. [Commencement]

(153-G148E)

Marriage Act

certificate of permanent registration as a person authorized to solemnize marriage in Ontario have been issued to the following:

April 13, 2020 to April 19, 2020

Re-Registrations

certificates of temporary registration as person authorized to solemnize marriage in Ontario have been issued to the following:

April 13, 2020 to April 19, 2020

Alexandra Schmidt
Deputy Registrar General

(153-G149)