Stewart McKelvey

PRIVACY LAWS FOR PERSONAL HEALTH INFORMATION By Robert J. Aske, Janet L. Grant, Stéphanie Luce, Rosemary Scott, Q.C. formation. Rob Aske, a partner in Stewart McKelvey's Halifax office, says it is anticipated that the NS Act will be in force within six to nine months. Prince Edward Island currently has no similar health Nova Scotia, and Stewart McKelvey's IP/IT/Entertain- ment group has been monitoring the progress of this legislation. New Brunswick was first off the mark with full implementation of its Personal Health Information Privacy and Access Act, which came into force on September 1, 2010. Stéphanie Luce, an associate in Stewart McKelvey's Moncton office, indicates that our New Brunswick colleagues are noticing the impact of the new law, as health professionals and their agents wrestle with its interpretation. Newfoundland and Labrador's health privacy stat- T ute known as the Personal Health Information Act, came partially into force on November 20, 2009. Janet Grant, an associate in our St. John's office, explains that those sections in force support the functions of the N.L. Pharmacy Network, which is part of the elec- tronic health record system and assists pharmacists in identifying potential adverse drug reactions. Access to this network is limited to authorized health care profes- sionals who prescribe and update medications or sup- port system operations. The remainder of NL's Act is expected to be fully in force by April 2011. In the fall of 2010, Nova Scotia passed its Personal Health Information Act, which has been in develop- ment within the province's health bureaucracy for several years. Like the statutes in New Brunswick and Newfoundland and Labrador, this Act includes a de- tailed structure for the handling of personal health in- he biggest recent development in privacy law in Atlantic Canada involves the pass- ing of health privacy statutes in New Bruns- wick, Newfoundland and Labrador, and privacy statute in place. Rosemary Scott, a partner in our Charlottetown office, says PE is looking at the legislative developments and that we may see a similar law in the future. Public sector health care bodies and their "employees" (broadly defined to include a person who performs a service for a public body under con- tract with a public body) are currently governed by the PE Freedom of Information and Protection of Privacy Act (FOIPP). Private sector health care operators are governed by the federal Personal Information Protec- tion and Electronic Documents Act (PIPEDA). FOIPP and PIPEDA both deal with many aspects of handling personal health information. Each of the new NB, NL and NS Acts are intended to deal with all aspects of handling personal health in- formation and recognize both the right of individuals to protect their information and the needs of others to use it for health care purposes. The Acts apply to "custodians," which include vari- ous government health bodies, and also health care professionals. "Personal health information" is defined broadly in respect of an individual's health care but only includes information which identifies an individual, or where it is reasonably foreseeable that it will identify the indi- vidual in association with other information. Like most privacy legislation, the cornerstone is consent, and custodians shall only collect, use and dis- close personal health information with an individual's consent, and when reasonably necessary for a lawful purpose. Consent must be either express or implied, but the standard for implied consent is high (knowledgeable, relating to the information and voluntary). The Acts also set out various circumstances where personal health information may be collected, used and dis- closed without consent, and are intended to provide a comprehensive set of exceptions for custodians and others to consider in such circumstances. Some of the duties imposed on custodians include the following: • Designate a contact person for compliance and for addressing inquiries; DOING BUSINESS IN ATLANTIC CANADA SPRING 2011 7

• Cover