Stewart McKelvey

Privacy, please Nova Scotia brings in new rules for personal health information By Karen Bennett-Clayton O n June 1, 2013 Nova Scotia followed suit with most other provinces by bringing into force privacy legislation for personal health information. The Personal Health Information Act, S.N.S. 2010, c 41 ("PHIA") governs the collection, use, disclosure, retention, disposal and destruction of personal health information. If your business is involved in the provision of health care in Nova Scotia, or if you are seeking access to personal health care information about anyone who has been provided health care in Nova Scotia, you need to be aware of PHIA. Does PHIA Apply to You? PHIA applies to the collection, use and disclosure of personal health information by a custodian or an individual to whom a custodian has disclosed the information. To determine whether PHIA applies to you, you must understand what is meant by personal health information. You must also determine whether you are a custodian. Personal health information is identifying information about an individual if the information relates to: • The physical or mental health of that individual. • The health history of the individual's family. • The provision of health care to the individual. • Payments or eligibility for health care in respect of the individual. • The donation by the individual of any of their body parts or bodily substances. 6 FALL 2013 Doing Business in Atlantic Canada Personal health information is also identifying information if it: • Is derived from the testing or examination of any such body part or bodily substance. • Is the individual's registration information, including the individual's health-card number. • Identifies an individual's substitute decision-maker. Personal health information includes information both in recorded and unrecorded form; it does not matter whether the person whose information is being collected or disclosed is alive or dead. Even identifying oneself as a provider of healthcare to a person could constitute disclosure of that person's personal health information. A custodian is an individual or organization defined in PHIA who has custody or control of personal health information as a result of, or in connection with, performing the individual's or organization's powers or duties. You must check the defined list of custodians in PHIA to determine whether your organization falls under this definition. Defined custodians include the provincial district health authorities, provincially regulated health professionals, the Canadian Blood Services, licensed pharmacies and registered continuing care facilities and home care agencies. If you are a custodian and you are collecting, using or disclosing personal health information, PHIA applies to you.

• Cover