Health Information Protection Regulations, 2023, H-0.021 Reg 2

1 HEALTH INFORMATION PROTECTION, 2023 H-0.021 REG 2 The Health Information Protection Regulations, 2023 being Chapter H-0.021 Reg 2 (effective August 1, 2023) as amended by Saskatchewan Regulations 68/2023. NOTE: This consolidation is not official. Amendments have been incorporated for convenience of reference and the original statutes and regulations should be consulted for all purposes of interpretation and application of the law. In order to preserve the integrity of the original statutes and regulations, errors that may have appeared are reproduced in this consolidation. 2 H-0.021 REG 2 HEALTH INFORMATION PROTECTION, 2023 Table of Contents 1 Title 13 Disclosure of personal health information by trustees 2 Definitions and interpretation 14 Disclosure to cancer agency 3 Genetic information 15 Collection, use and disclosure by a health professional body of certain personal health information 4 Trustees 16 Disclosure by a health professional body of personal 5 Duty to protect personal health information health information obtained from another 6 Retention and destruction of personal health professional body health information 17 Disclosure by health professional of certain personal 7 Agreement with information management health information service provider 18 Disclosure by eHealth Saskatchewan of registration 8 Designated archives information 9 Use of personal health information by trustees 19 Disclosure to Ministry of Education 10 Disclosure to health quality council 20 Use and disclosure for fundraising purposes 11 Disclosure to police officers 21 RRS c H-0.021 Reg 1 repealed 12 Disclosure of personal health information to a party 22 Coming into force to an information sharing agreement 3 HEALTH INFORMATION PROTECTION, 2023 H-0.021 REG 2 CHAPTER H-0.021 REG 2 The Health Information Protection Act Title 1 These regulations may be cited as The Health Information Protection Regulations, 2023. Definitions and interpretation 2(1) In these regulations: “Act” means The Health Information Protection Act; “employee” means: (a) an individual: (i) who is employed by a trustee, including an individual retained under a contract to perform services for the trustee; and (ii) who has access to personal health information; or (b) an individual who, with the authorization of a trustee, acts on behalf of the trustee with respect to personal health information and for the purposes of the trustee, and not for the individual’s own purposes, whether or not the individual has the authority to bind the trustee, is paid by the trustee or is remunerated by the trustee; but does not include a health professional who is retained under a contract, that is not an employment agreement, to perform services for the provincial health authority; “health professional”, except in sections 15 to 17, means an individual who is licensed or registered pursuant to an Act for which the minister is responsible; “health quality council” means the Health Quality Council established pursuant to The Health Quality Council Act; “health services” means health services as defined in The Provincial Health Authority Act. (2) For the purposes of the Act, “research” means an undertaking intended to extend knowledge through a disciplined inquiry, a systematic investigation, or both. 7 Jly 2023 H-0.021 Reg 2 s2. 4 H-0.021 REG 2 HEALTH INFORMATION PROTECTION, 2023 Genetic information 3 For the purposes of subclause 2(1)(m)(i) of the Act: (a) information with respect to the physical or mental health of the individual includes genetic information with respect to the individual; (b) genetic information includes information respecting: (i) the individual’s genetic test results; (ii) the genetic test results of the individual’s family members; and (iii) the individual’s family medical history; and (c) “genetic test” has the same meaning as in the Genetic Non-Discrimination Act (Canada). 7 Jly 2023 H-0.021 Reg 2 s3. Trustees 4 For the purposes of subclause 2(1)(t)(xv) of the Act, the following are prescribed as trustees: (a) the health quality council; (b) every person who owns or operates a privately-owned facility in or from which health services are provided by a health professional; (c) hearing aid dealers within the meaning of The Hearing Aid Sales and Services Act. 7 Jly 2023 H-0.021 Reg 2 s4. Duty to protect personal health information 5 To ensure compliance with the Act by its employees, a trustee that has custody or control of personal health information must: (a) provide orientation and ongoing training for its employees about the trustee’s policies and procedures respecting the protection of personal health information; and (b) ensure that each of its employees signs a pledge of confidentiality that includes an acknowledgement that the employee: (i) is bound by the trustee’s policies and procedures mentioned in clause (a); and (ii) is aware of the consequences of breaching those policies and procedures. 7 Jly 2023 H-0.021 Reg 2 s5. Retention and destruction of personal health information 6 For the purposes of clause 17(1)(a) of the Act, a written policy concerning the retention and destruction of personal health information must include: (a) either: (i) a requirement that personal health information be retained by a trustee for at least 10 years after the date of the last episode of care or until age 20 if the subject individual is a minor, whichever period is longer; or 5 HEALTH INFORMATION PROTECTION, 2023 H-0.021 REG 2 (ii) a retention schedule that sets out: (A) all legitimate purposes for retaining the information; and (B) the retention period and destruction schedule associated with each purpose set out pursuant to paragraph (A); (b) measures to provide for the secure retention and destruction of records to minimize the risk of any unauthorized use or disclosure of, or unauthorized access to, personal health information; and (c) a process to keep a record of: (i) the name of each individual whose personal health information is destroyed; (ii) a summary of what personal health information was destroyed; (iii) the time period of the personal health information; (iv) the method of destruction of the personal health information; and (v) the name and job title of the individual responsible for supervising the destruction of the personal health information. 7 Jly 2023 H-0.021 Reg 2 s6; 4 Aug 2023 SR 68/2023 s3. Agreement with information management service provider 7 For the purposes of subsection 18(2) of the Act, a written agreement that is entered into between a trustee and an information management service provider must include: (a) a description of the specific service the information management service provider will deliver; (b) provisions setting out the obligations of the information management service provider respecting the security and safeguarding of the personal health information; (c) provisions for the destruction of the personal health information, if applicable; (d) a requirement that the information management service provider not use, disclose, obtain access to, process, store, archive, modify or destroy personal health information received from a trustee except for the purposes set out in subsection 18(1) of the Act; (e) a requirement that the information management service provider comply with the terms of the agreement entered into with the trustee; and (f) a requirement that the information management service provider notify the trustee at the first reasonable opportunity of any breach of the agreement. 7 Jly 2023 H-0.021 Reg 2 s7. 6 H-0.021 REG 2 HEALTH INFORMATION PROTECTION, 2023 Designated archives 8(1) For the purposes of section 22 of the Act, the following are designated archives: (a) affiliates; (b) the Ministry of Health; (c) health professional bodies that regulate members of a health profession pursuant to an Act; (d) the provincial health authority; (e) Saskatchewan Archives Board; (f) eHealth Saskatchewan; (g) University of Regina Archives; (h) University of Saskatchewan Archives. (2) Nothing in this section requires a designated archive to accept personal health information from a trustee. 7 Jly 2023 H-0.021 Reg 2 s8. Use of personal health information by trustees 9 For the purposes of clause 26(2)(d) of the Act, a trustee may use personal health information without the consent of the subject individual: (a) for the purpose of educating its employees to provide health services, if it is not reasonably practicable for the consent of the subject individual to be obtained; and (b) for the purpose of risk management, error management or for the purpose of activities to improve or maintain the quality of care or to improve or maintain the quality of related programs or services of the trustee. 7 Jly 2023 H-0.021 Reg 2 s9. Disclosure to health quality council 10 For the purposes of clause 27(4)(p) of the Act, the minister or eHealth Saskatchewan may disclose personal health information, without the consent of the subject individual, to the health quality council for use by the council in carrying out any of the objects of the council set out in clauses 5(a) to (l) of The Health Quality Council Act, if: (a) before the personal health information is disclosed to the health quality council, the minister or eHealth Saskatchewan ensures that reasonable steps have been taken: (i) to remove any information that by itself may reasonably be expected to identify the subject individual; and (ii) to replace the subject individual’s health services number or any other number assigned to the individual as part of a system of unique identifying numbers with a unique encrypted identifier; and 7 HEALTH INFORMATION PROTECTION, 2023 H-0.021 REG 2 (b) the health quality council has entered into a written agreement with the minister or eHealth Saskatchewan that: (i) governs the personal health information to be disclosed; (ii) governs the health quality council’s collection and use of personal health information; (iii) requires the health quality council to use the personal health information only for the objects set out in clauses 5(a) to (l) of The Health Quality Council Act; (iv) prohibits the health quality council from disclosing the personal health information without the approval of the minister; (v) prohibits the health quality council from attempting to re-identify the personal health information; and (vi) requires the health quality council to: (A) take reasonable steps to ensure the security and confidentiality of the personal health information; and (B) ensure that, in any publication or report made by the health quality council, information is disclosed only in a manner that will prevent the direct or indirect identification of subject individuals. 7 Jly 2023 H-0.021 Reg 2 s10. Disclosure to police officers 11(1) For the purposes of clause 27(4)(p) of the Act, personal health information may be disclosed, without the consent of the subject individual, to a member of the Royal Canadian Mounted Police, or to a member of a police service within the meaning of The Police Act, 1990, in the following circumstances: (a) by the minister or eHealth Saskatchewan if: (i) the personal health information is required to locate the subject individual for any of the following purposes: (A) to enforce an outstanding warrant for arrest that has been issued by a court, person or body that has the lawful authority to issue that warrant; (B) to serve a subpoena with respect to the prosecution of an indictable offence; (C) to locate an individual reported missing; and (ii) the personal health information to be disclosed is limited to: (A) the name, address, date of birth and telephone number of the subject individual; or (B) information respecting the location that the subject individual last received or was offered a health service; 8 H-0.021 REG 2 HEALTH INFORMATION PROTECTION, 2023 (b) by a trustee if: (i) the personal health information is requested for any of the following purposes: (A) to enforce the Criminal Code or the Controlled Drugs and Substances Act (Canada); (B) to carry out a lawful investigation pursuant to the Criminal Code or the Controlled Drugs and Substances Act (Canada); (ii) for the purpose of making a decision to undertake an investigation to determine whether an offence has taken place pursuant to the Criminal Code or the Controlled Drugs and Substances Act (Canada), the trustee reasonably suspects that such an offence has taken place, or is taking place, in the trustee’s facility or in relation to a program of the trustee; and (iii) the personal health information to be disclosed is limited to the following: (A) the name, address, date of birth and telephone number of the subject individual; (B) the nature and severity of an injury that: (I) was suffered by the subject individual or another individual; and (II) is connected with the enforcement or lawful investigation mentioned in subclause (i); (C) information respecting the location where the subject individual is receiving or received a health service; (c) by a trustee if: (i) an individual received or was offered health services directly as a result of an incident that has been made the subject of a lawful investigation pursuant to the Criminal Code or the Controlled Drugs and Substances Act (Canada); (ii) the personal health information to be disclosed is limited to: (A) the factual circumstances surrounding the incident mentioned in subclause (i); and (B) the factual circumstances surrounding the provision of, or offer to provide, health services; and (iii) in the opinion of the trustee, the factual circumstances mentioned in subclause (ii) do not include the health history of the subject individual from before the incident mentioned in subclause (i). 9 HEALTH INFORMATION PROTECTION, 2023 H-0.021 REG 2 (2) For the purposes of clause 27(4)(p) of the Act, the minister or a trustee may disclose personal health information, without the consent of the subject individual, to the chief coroner or a coroner appointed pursuant to The Coroners Act, 1999 with respect to the conduct of an investigation or inquest by the chief coroner or other coroner pursuant to that Act. 7 Jly 2023 H-0.021 Reg 2 s11; 4 Aug 2023 SR 68/2023 s4. Disclosure of personal health information to a party to an information sharing agreement 12(1) In this section: “common or integrated service” means a program or activity designed to benefit the health, safety, welfare or social well-being of an individual that is delivered by a government institution and one or more of the following: (a) another government institution; (b) a local authority; (c) a trustee as defined in the Act; (d) a First Nation; (e) a police service or regional police service as defined in The Police Act, 1990; (f) the Royal Canadian Mounted Police; (g) a non-profit organization that provides a service of the type to be included in the common or integrated service; (h) any other agency or organization that the minister determines is appropriate; “information sharing agreement” means an agreement that governs the collection, use and disclosure of personal health information by the parties involved in the provision of a common or integrated service and that meets the requirements of subsection (2). (2) An information sharing agreement must contain the following: (a) a description of the common or integrated service to be provided; (b) a description of the purposes or expected outcomes of the common or integrated service; (c) provisions setting out the obligations of a party respecting the security and safeguarding of personal health information received by that party; (d) provisions that prohibit the subsequent use and disclosure of the personal health information for purposes not related to the common or integrated service except: (i) with the consent of the individual to whom the information relates; or (ii) if required or authorized by law; 10 H-0.021 REG 2 HEALTH INFORMATION PROTECTION, 2023 (e) provisions for the withdrawal of a party and, in the case of a withdrawal, provisions that: (i) prohibit any further use or disclosure of the personal health information received by that party except: (A) with the consent of the individual to whom the information relates; or (B) if required or authorized by law; and (ii) specify the ongoing obligations of that party to secure and safeguard the personal health information; (f) provisions for the termination of the information sharing agreement and, in the case of a termination, provisions that: (i) prohibit any further use or disclosure of the personal health information received by the parties except: (A) with the consent of the individual to whom the information relates; or (B) if required or authorized by law; and (ii) specify the ongoing obligations of the parties to secure and safeguard the personal health information; (g) any other provisions that the minister considers necessary. (3) For the purposes of clause 27(4)(p) of the Act, personal health information may be disclosed, without the consent of the subject individual, to a party to an information sharing agreement entered into for the purposes of providing a common or integrated service: (a) if the information is disclosed in accordance with the agreement for any or all of the following purposes: (i) determining the subject individual’s eligibility to receive the common or integrated service; (ii) assessing and planning the common or integrated service and delivering that service to the subject individual or the subject individual’s family; or (b) if consent to the disclosure was obtained pursuant to any other Act or regulation that does not require the consent to be in writing. (4) If the Royal Canadian Mounted Police participates in providing a common or integrated service, the requirements of subsection (3) are met if the Royal Canadian Mounted Police enters into a single arrangement in writing with a government institution that is involved in the provision of the common or integrated service, under which the Royal Canadian Mounted Police signifies that it will comply with the terms governing the collection, use and disclosure of personal information contained in the information sharing agreement applicable to the common or integrated service in which the Royal Canadian Mounted Police participates. 7 Jly 2023 H-0.021 Reg 2 s12. 11 HEALTH INFORMATION PROTECTION, 2023 H-0.021 REG 2 Disclosure of personal health information by trustees 13(1) For the purposes of clause 27(4)(p) of the Act, a trustee may disclose personal health information without the consent of the subject individual: (a) for the purpose of complying with an Act of the Parliament of Canada or a regulation made pursuant to any Act of the Parliament of Canada; (b) to a committee established by the provincial health authority to review or study requests for, or the delivery of services associated with, medical assistance in dying as defined in section 241.1 of the Criminal Code, and in those cases, the committee: (i) must use the information only for the purpose for which it was disclosed; (ii) subject to subsection (2), must not make a further disclosure of the information; and (iii) must take reasonable steps to preserve the confidentiality of the information; (c) to the minister for the purpose of establishing and maintaining a system for processing medical claims; (d) to the minister for the purpose of establishing, administering and maintaining a system for processing claims related to health services, drugs and medical supplies; (e) to another trustee for the purpose of providing health services education, if it is not reasonably practicable for the consent of the subject individual to be obtained; (f) to another trustee for the purpose of improving or maintaining the quality of care provided by the trustee receiving the personal health information to: (i) the individual to whom the personal health information relates; or (ii) to individuals provided with similar health care; (g) to other trustees for the purpose of planning, delivering, evaluating or monitoring a program; or (h) if the subject individual is deceased: (i) if the disclosure is being made for the purpose of identifying the deceased individual; or (ii) if the disclosure is being made to the deceased individual’s next-of-kin: (A) if the recipient of the information reasonably requires the information to make a decision respecting the recipient’s own health care or the health care of the recipient’s child; or (B) if the disclosure is necessary to provide health services to the recipient. 12 H-0.021 REG 2 HEALTH INFORMATION PROTECTION, 2023 (2) A committee mentioned in clause (1)(b) may make a further disclosure of personal health information, as may be permitted by the Act or these regulations, but the further disclosure must be made only through or by the chairperson of the committee. 7 Jly 2023 H-0.021 Reg 2 s13. Disclosure to cancer agency 14(1) In this section, “cancer agency” means the Saskatchewan Cancer Agency continued pursuant to The Cancer Agency Act. (2) Pursuant to subsection 28(8) of the Act, registration information may be disclosed to the cancer agency and by the cancer agency for any of the purposes set out in subsections 28(1) to (3) of the Act as if the cancer agency were the provincial health authority or an affiliate. 7 Jly 2023 H-0.021 Reg 2 s14. Collection, use and disclosure by a health professional body of certain personal health information 15(1) In this section and in sections 16 and 17: “drug” means a drug that is: (a) listed in section 18.1 of the bylaws of the College of Physicians and Surgeons of the Province of Saskatchewan; and (b) approved by the minister; “health professional” means a health professional who is authorized by The Drug Schedules Regulations, 1997 to prescribe or dispense a drug; “health professional body” means a body that regulates members of a health profession pursuant to an Act; “out-of-province professional body” means a body that regulates members of a health profession pursuant to an Act of another province or territory of Canada; “program” means a program to monitor the prescribing, dispensing or use of drugs that is authorized by a bylaw that: (a) is made pursuant to an Act that regulates a health professional body; and (b) is approved by the minister. (2) A health professional body may use or disclose personal health information in its custody or control without the consent of the subject individual if: (a) the use or disclosure is made for the purposes of a program; (b) the disclosure is to a trustee who controls the operation of a proprietary pharmacy as defined in The Pharmacy and Pharmacy Disciplines Act; (c) the disclosure is made to a health professional; (d) the disclosure is made to another health professional body; or 13 HEALTH INFORMATION PROTECTION, 2023 H-0.021 REG 2 (e) the disclosure is made to an out-of-province professional body for the following purposes: (i) to carry out the duties of the out-of-province professional body with respect to regulation of the profession; (ii) to monitor, prevent or reveal fraudulent, abusive or dangerous use of publicly funded health services. (3) A health professional body may collect and use personal health information from an out-of-province professional body for the following purposes: (a) to carry out the duties of the health professional body with respect to regulation of the profession; (b) to monitor, prevent or reveal fraudulent, abusive or dangerous use of publicly funded health services. 7 Jly 2023 H-0.021 Reg 2 s15. Disclosure by a health professional body of personal health information obtained from another health professional body 16(1) A health professional body to which personal health information is disclosed pursuant to clause 15(2)(d) or section 17 may disclose the information: (a) subject to subsection (2), to another health professional body if the disclosure is made for the purposes of a program; or (b) to a health professional if the disclosure is made for the purposes of a program. (2) A health professional body to which personal health information is disclosed pursuant to clause (1)(a), clause 15(2)(d) or section 17 shall only use or disclose that personal health information for one or more of the following purposes: (a) for a purpose authorized by a bylaw that: (i) is made pursuant to an Act that regulates a health professional body; and (ii) is approved by the minister; (b) to carry out the duties of the health professional body with respect to regulating the members of its profession; (c) for the purposes of a program. (3) For the purposes of this section, a health professional body may disclose personal health information in its custody or control to another health professional body without the consent of the subject individual. 7 Jly 2023 H-0.021 Reg 2 s16. Disclosure by health professional of certain personal health information 17 A health professional may disclose personal health information in the health professional’s custody or control to a health professional body without the consent of the subject individual if the disclosure is made for the purposes of a program. 7 Jly 2023 H-0.021 Reg 2 s17. 14 H-0.021 REG 2 HEALTH INFORMATION PROTECTION, 2023 Disclosure by eHealth Saskatchewan of registration information 18(1) For the purposes of subsection 28(8) of the Act, eHealth Saskatchewan may disclose registration information without the consent of the subject individual: (a) to a trustee in connection with the provision of health services by the trustee; (b) to the minister, another government institution, the provincial health authority or an affiliate for the purpose of verifying the eligibility of an individual to participate in a program of, or receive a service from, the minister, government institution, provincial health authority or affiliate: (i) in the course of processing an application made by or on behalf of the individual; or (ii) if the individual is participating in the program or receiving the service; (c) to the minister, another government institution, the provincial health authority or an affiliate for the purpose of verifying the accuracy of registration information held by the minister, government institution, provincial health authority or affiliate; or (d) to the Chief Electoral Officer as defined in The Election Act, 1996 for the purpose of establishing, maintaining or revising the register of voters as defined in that Act. (2) For the purposes set out in subsection (3), registration information may be disclosed without the consent of the subject individual: (a) by eHealth Saskatchewan to the provincial health authority or an affiliate; (b) by the provincial health authority or an affiliate to eHealth Saskatchewan; (c) by eHealth Saskatchewan to the minister; (d) by the minister to eHealth Saskatchewan; (e) by eHealth Saskatchewan to a trustee; or (f) by a trustee to eHealth Saskatchewan. (3) Registration information may be disclosed pursuant to subsection (2) for the purpose of planning, delivering, evaluating or monitoring a program of the minister, eHealth Saskatchewan, the provincial health authority or an affiliate that relates to the provision of health services or payment for health services. (4) eHealth Saskatchewan may disclose registration information to the Government of Canada or the government of a province or territory of Canada without the consent of the subject individual. (5) Any disclosure of registration information pursuant to this section is to be: (a) subject to subsection (6), limited to the name, address, date of birth and telephone number of the subject individual; and (b) in accordance with an agreement that contains a provision that the party to whom the registration information is disclosed shall only use the information for the purposes specified in the agreement. 15 HEALTH INFORMATION PROTECTION, 2023 H-0.021 REG 2 (6) Registration information in addition to the information mentioned in clause (5)(a) may be disclosed in accordance with clause (1)(d) or subsection (2) only if the information is necessary to fulfil obligations under an agreement mentioned in clause (5)(b). 7 Jly 2023 H-0.021 Reg 2 s18. Disclosure to Ministry of Education 19(1) Pursuant to subsection 28(8) of the Act, the minister or eHealth Saskatchewan may disclose registration information in accordance with subsection (2) to the Ministry of Education for the purpose of enabling the Ministry of Education to administer a database for the tracking of individuals of an age up to and including compulsory school age. (2) In a disclosure made pursuant to subsection (1), the minister or eHealth Saskatchewan: (a) may disclose registration information with respect to individuals of an age up to and including compulsory school age and the parents or guardians of those individuals; and (b) shall disclose only the following types of registration information with respect to the subject individual that are necessary for the purpose described in that subsection: (i) name; (ii) date of birth; (iii) name of the individual’s parents or guardians; (iv) address and telephone number of the individual’s parents or guardians. 7 Jly 2023 H-0.021 Reg 2 s19. Use and disclosure for fundraising purposes 20(1) In this section: “client” means an individual who has received a health service, as an in-patient or an out-patient, at a hospital operated by a designated trustee; “client information” means the name and address of a client; “client list” means a client list prepared in accordance with subsection (4); “consent to fundraising statement” means a brief statement to the effect that, unless a client opts out, client information may be used by the designated trustee for fundraising purposes or disclosed to a fundraising agency for fundraising purposes; “designated trustee” means: (a) the provincial health authority; (b) an affiliate; or (c) the Athabasca Health Authority; 16 H-0.021 REG 2 HEALTH INFORMATION PROTECTION, 2023 “eligible client” means a client who meets the criteria set out in subsection (5); “fundraising activity” means a fundraising activity for a health-related charitable purpose; “fundraising agency” means a registered charity as defined in the Income Tax Act (Canada) that: (a) is incorporated in Saskatchewan for the sole purpose of carrying out fundraising activities for the benefit of a designated trustee; and (b) has entered into a fundraising agreement with a designated trustee; “fundraising agreement” means an agreement between a designated trustee and a fundraising agency by which the fundraising agency is authorized to carry out fundraising activities on behalf of the designated trustee; “health-related charitable purpose” means a charitable purpose related to a health services facility situated in Saskatchewan or to the provision in Saskatchewan of a health service or program; “hospital” means a facility designated as a hospital pursuant to The Facility Designation Regulations, and includes a hospital operated by the Athabasca Health Authority; “opt out” means to inform a designated trustee or a fundraising agency, in accordance with subsection (10), that a client does not consent to the use or disclosure of the client information by the designated trustee or the fundraising agency for the purposes of a fundraising activity; “opting-out procedure” means a procedure by which a client may inform a designated trustee or a fundraising agency, as the case may be, that the client wishes to opt out; “personal care home” means a personal care home as defined in The Personal Care Homes Act; “preparation date” means the date on which a client list is prepared; “special-care home” means a facility designated as a special-care home pursuant to The Facility Designation Regulations. (2) A designated trustee may, in accordance with this section: (a) use client information for fundraising purposes; or (b) disclose client information to a fundraising agency for fundraising purposes. (3) Before using client information for fundraising purposes or disclosing client information to a fundraising agency, a designated trustee must: (a) prepare a consent to fundraising statement and post it, or otherwise make it available in a manner likely to come to the attention of clients, in places where health services are provided; (b) develop an opting-out procedure; 17 HEALTH INFORMATION PROTECTION, 2023 H-0.021 REG 2 (c) at the time of providing a health service to a client, provide the client with written information respecting: (i) the opting-out procedures of the designated trustee; and (ii) the fundraising agencies that are authorized to carry out fundraising activities on behalf of the designated trustee; and (d) prepare a client list in accordance with subsection (4). (4) A designated trustee may, from time to time, use the personal health information of eligible clients in the custody or control of the trustee for the purpose of preparing a client list that sets out: (a) the client information of clients who, as of the preparation date, are eligible clients; and (b) the preparation date of the client list. (5) A client is an eligible client if: (a) the client is 18 years of age or older at the date of discharge from a hospital or the date of receiving a health service; (b) the client was not a resident of a personal care home or a special-care home immediately before being admitted to a hospital or at the time of receiving a health service; (c) in the case of a client who was an in-patient in a hospital, the client did not become a resident of a personal care home or a special-care home on discharge from the hospital; (d) as of the preparation date, a period of not less than 60 days has elapsed since the most recent date on which the client: (i) was discharged from the hospital; or (ii) received a health service at the hospital on an out-patient basis; and (e) the client: (i) has not opted out pursuant to subsection (10); or (ii) has revoked a decision to opt out pursuant to subsection (11). (6) Subject to subsections (7) to (14), a designated trustee may: (a) use client information in a client list to carry out a fundraising activity; or (b) provide a client list to a fundraising agency with which it has entered into a fundraising agreement that meets the requirements of subsection (8). (7) A designated trustee shall not reveal any personal health information other than client information: (a) when contacting or attempting to contact a client for the purposes of a fundraising activity; or (b) when disclosing client information to a fundraising agency. 18 H-0.021 REG 2 HEALTH INFORMATION PROTECTION, 2023 (8) A fundraising agreement must: (a) require the fundraising agency: (i) to provide to any client who receives a solicitation from the agency a simple procedure for opting out of future solicitations; (ii) to notify the designated trustee promptly of any opting out by a client that is communicated to the fundraising agency; (iii) to protect and secure the client information disclosed to it by the designated trustee by means that include, without limiting the generality of the foregoing: (A) establishing policies and procedures to maintain administrative, technical and physical safeguards for the client information; (B) appointing a person to be responsible for the client information; (C) ensuring that the client information is accessible only to those of its employees who perform fundraising activities; and (D) providing for the continuation of all duties imposed by the fundraising agreement with respect to the protection of client information in the custody or control of the fundraising agency after the expiration or termination of the fundraising agreement until the fundraising agency transfers the custody or control of the client information back to the designated trustee or to a designated archive; and (iv) to advise the designated trustee immediately on discovery if any client information has been compromised or any requirement of the agreement has been breached; and (b) prohibit the fundraising agency from: (i) soliciting a client who: (A) is not listed in the current client list; or (B) has opted out, unless the opting out has not been communicated to the fundraising agency; or (ii) using or disclosing client information for any purpose other than the purposes of a fundraising activity on behalf of the designated trustee that is authorized by the agreement. (9) Subject to subsections (10) to (14), a fundraising agency may, in accordance with the terms of a fundraising agreement with a designated trustee, use client information in a client list provided by the designated trustee for the purpose of carrying out a fundraising activity on behalf of the designated trustee. 19 HEALTH INFORMATION PROTECTION, 2023 H-0.021 REG 2 (10) A client may, at any time, opt out of receiving fundraising solicitations: (a) by following the opting-out procedure of the designated trustee or fundraising agency; or (b) by any other means that communicates the client’s intention to opt out to the designated trustee or fundraising agency. (11) A client may, at any time, revoke the decision to opt out. (12) If a client’s intention to opt out is communicated to a designated trustee, the designated trustee shall: (a) promptly advise each fundraising agency with which it has entered into a fundraising agreement that the client has opted out; and (b) immediately remove the client’s name from the current client list. (13) If a client’s intention to opt out is communicated to a fundraising agency, the fundraising agency shall: (a) promptly advise the designated trustee with which it has entered into a fundraising agreement that the client has opted out; and (b) immediately remove the client’s name from the current client list. (14) A fundraising agency shall not disclose client information to any person or agency except: (a) for the purposes of carrying out a fundraising activity authorized by a fundraising agreement; and (b) in accordance with the provisions of the fundraising agreement mentioned in clause (a) that are required by subclause (8)(a)(iii). 7 Jly 2023 H-0.021 Reg 2 s20. RRS c H-0.021 Reg 1 repealed 21 The Health Information Protection Regulations are repealed. 7 Jly 2023 H-0.021 Reg 2 s21. Coming into force 22(1) Subject to subsection (2), these regulations come into force on August 1, 2023. (2) If these regulations are filed with the Registrar of Regulations after August 1, 2023, these regulations come into force on the day on which they are filed with the Registrar of Regulations. Jly 2023 H-0.021 Reg 2 s22. 20 H-0.021 REG 2 HEALTH INFORMATION PROTECTION, 2023 REGINA, SASKATCHEWAN PrINTEd by THE AuTHorITy of THE KING’S PrINTEr Copyright©2023