Health Information Protection Act, H-0.021

1 HEALTH INFORMATION PROTECTION c H-0.021 The Health Information Protection Act being Chapter H‑0.021* of the Statutes of Saskatchewan, 1999 (effective September 1, 2003, except for subsections 17(1), 18(2) and 18(4), effective August 1, 2023; section 69 not yet proclaimed) as amended by the Statutes of Saskatchewan, 2002, c R‑8.2; 2003, c 25; 2004, c A‑26.1 and c 65; 2005, c Y‑1.1; 2006, c C‑1.1 and c 19; 2008, c V‑7.3; 2009, c 32; 2013, c W‑17.11; 2014, c E‑13.1, c 16 and c 17; 2015, c A‑26.11, c M‑23.001, c 11, c 12 and c 17; 2016, c P‑4.11; 2017, c P‑30.3; 2018, c 42; 2019, c R‑21.3; 2020, c 13; 2022, c 9 and c 26; and 2024, c 4. *NOTE: Pursuant to subsection 33(1) of The Interpretation Act, 1995, the Consequential Amendment sections, schedules and/or tables within this Act have been removed. Upon coming into force, the consequential amendments contained in those sections became part of the enactment(s) that they amend, and have thereby been incorporated into the corresponding Acts. Please refer to the Separate Chapter to obtain consequential amendment details and specifics. NOTE: This consolidation is not official. Amendments have been incorporated for convenience of reference and the original statutes and regulations should be consulted for all purposes of interpretation and application of the law. In order to preserve the integrity of the original statutes and regulations, errors that may have appeared are reproduced in this consolidation. 2 c H-0.021 HEALTH INFORMATION PROTECTION Table of Contents PART I 36 Response to written request Preliminary Matters 37 Extension of time 1 Short title 38 Refusing access 2 Interpretation 39 Fee 3 Application of Act 40 Right of amendment 4 Act prevails PART VI PART II Review and Appeal Rights of the Individual 41 Interpretation of Part 5 Consent required for use or disclosure 42 Application for review 6 Consent 43 Review or refusal to review 7 Right to revoke consent 44 Notice of intention to review 8 Rights re comprehensive health record 45 Conduct of review 9 Right to be informed 46 Powers of commissioner 10 Right to information about disclosures without consent 47 Burden of proof 11 Rights re production of health services number 48 Commissioner to report 12 Right to access by individual 49 Decision of trustee 13 Right to request amendment 50 Appeal to court 14 Right to review or appeal 51 Powers of court on appeal 15 Right to designate PART VII PART III Commissioner Duty of Trustee to Protect 52 Privacy powers of commissioner Personal Health Information 53 General powers of commissioner 16 Duty to protect 54 Confidentiality 17 Retention and destruction policy 55 Non‑compellability 18 Information management service provider PART VIII 18.1 Comprehensive health record General 20 Duty to collect accurate information 56 Exercise of rights by other persons 21 Duty where one trustee discloses to another 57 Information about trustees 22 Duty where disclosing to persons other than trustees 58 Decisions of trustees 23 Continuing duties of trustees 59 Repealed PART IV 60 Annual report Limits on Collection, Use and Disclosure of Personal 61 Proceedings prohibited Health Information by Trustees 62 Immunity from prosecution 23 Collection, use and disclosure on need‑to‑know basis 63 Regulations 24 Restrictions on collection 64 Offences 25 Manner of collection 26 Restrictions on use PART IX Transitional, Consequential Amendments 27 Disclosure and Coming into Force 28 Disclosure of registration information 65 Transitional 29 Use and disclosure for research 66 SS 1990‑91, c F‑22.01 amended 30 Use or disclosure prohibited 67 RSS 1978, c H‑15, section 12 repealed PART V 68 SS 1990‑91, c L‑27.1 amended Access of Individuals to Personal Health Information 69 Not yet proclaimed 31 Interpretation of Part 70 RSS 1978, c S‑29, section 37 amended 32 Right of access 71 Coming into force 33 Oral request for access 34 Written request for access 35 Duty to assist 3 HEALTH INFORMATION PROTECTION c H-0.021 CHAPTER H-0.021 An Act respecting the Collection, Storage, Use and Disclosure of Personal Health Information, Access to Personal Health Information and the Privacy of Individuals with respect to Personal Health Information and making consequential amendments to other Acts WHEREAS the Legislative Assembly recognizes the following principles with respect to personal health information: THAT personal health information is private and shall be dealt with in a manner that respects the continuing interests of the individuals to whom it relates; THAT individuals provide personal health information with the expectation of confidentiality and personal privacy; THAT trustees of personal health information shall protect the confidentiality of the information and the privacy of the individuals to whom it relates; THAT the primary purpose of the collection, use and disclosure of personal health information is to benefit the individuals to whom it relates; THAT, wherever possible, the collection, use and disclosure of personal health information shall occur with the consent of the individuals to whom it relates; THAT personal health information is essential to the provision of health services; THAT, wherever possible, personal health information shall be collected directly from the individual to whom it relates; THAT personal health information shall be collected on a need‑to‑know basis; THAT individuals shall be able to obtain access to records of their personal health information; THAT the security, accuracy and integrity of personal health information shall be protected; THAT trustees shall be accountable to individuals with respect to the collection, use, disclosure and exercise of custody and control of personal health information; THAT trustees shall be open about policies and practices with respect to the collection, use and disclosure of personal health information; THEREFORE HER MAJESTY, by and with the advice and consent of the Legislative Assembly of Saskatchewan, enacts as follows: 4 c H-0.021 HEALTH INFORMATION PROTECTION PART I Preliminary Matters Short title 1 This Act may be cited as The Health Information Protection Act. Interpretation 2(1) In this Act: (a) “affiliate” means an affiliate as defined in The Provincial Health Authority Act; (b) “collect” means to gather, obtain access to, acquire, receive or obtain personal health information from any source by any means; (c) “commissioner” means the Information and Privacy Commissioner appointed pursuant to section 38 of The Freedom of Information and Protection of Privacy Act; (c.1) “comprehensive health record” means a comprehensive health record described in subsection 18.1(2); (d) “de-identified personal health information” means personal health information from which any information that may reasonably be expected to identify an individual has been removed; (e) “designated archive” means an archive designated in the regulations for the purposes of section 22; (f) Repealed. 2002, c R‑8.2, s 77. (f.1) “eHealth Saskatchewan” means eHealth Saskatchewan created by the Lieutenant Governor in Council as a Crown corporation pursuant to The Crown Corporations Act, 1993; (g) “fiscal year” means the period commencing on April 1 in one year and ending on March 31 in the following year; (h) “government institution” means a government institution as defined in The Freedom of Information and Protection of Privacy Act; (h.1) “health care organization” means a health care organization as defined in The Provincial Health Authority Act; (h.2) Repealed. 2017, c P‑30.3, s 11‑9. (i) “health services number” means a unique number assigned to an individual who is or was registered as a beneficiary to receive insured services within the meaning of The Saskatchewan Medical Care Insurance Act; (j) “information management service provider” means a person who or body that processes, stores, archives or destroys records of a trustee containing personal health information or that provides information management or information technology services to a trustee with respect to records of the trustee containing personal health information, and includes a trustee that carries out any of those activities on behalf of another trustee, but does not include a trustee that carries out any of those activities on its own behalf; 5 HEALTH INFORMATION PROTECTION c H-0.021 (k) “minister” means the member of the Executive Council to whom for the time being the administration of this Act is assigned; (l) Repealed. 2003, c 25, s 3. (m) “personal health information” means, with respect to an individual, whether living or deceased: (i) information with respect to the physical or mental health of the individual; (ii) information with respect to any health service provided to the individual; (iii) information with respect to the donation by the individual of any body part or any bodily substance of the individual or information derived from the testing or examination of a body part or bodily substance of the individual; (iv) information that is collected: (A) in the course of providing health services to the individual; or (B) incidentally to the provision of health services to the individual; or (v) registration information; (n) “prescribed” means prescribed in the regulations; (o) “primary purpose” means the purpose for which personal health information was originally collected, and includes any purpose that is consistent with that purpose; (o.1) “provincial health authority” means the provincial health authority continued pursuant to The Provincial Health Authority Act; (p) “record” means a record of information in any form and includes informa‑ tion that is written, photographed, recorded, digitized or stored in any manner, but does not include computer programs or other mechanisms that produce records; (p.1) Repealed. 2017, c P‑30.3, s 11‑9. (q) “registration information” means information about an individual that is collected for the purpose of registering the individual for the provision of health services, and includes the individual’s health services number and any other number assigned to the individual as part of a system of unique identifying numbers that is prescribed in the regulations; (r) Repealed. 2015, c 12, s 3. (s) “subject individual” means the individual to whom personal health information relates; (t) “trustee” means any of the following that have custody or control of personal health information: (i) a government institution; (ii) the provincial health authority or a health care organization; (iii) Repealed. 2002, c R‑8.2, s 77. 6 c H-0.021 HEALTH INFORMATION PROTECTION (iv) a licensee as defined in The Personal Care Homes Act; (v) a person who operates a facility as defined in The Mental Health Services Act; (vi) a licensee as defined in The Health Facilities Licensing Act; (vi.1) a licensee as defined in The Patient Choice Medical Imaging Act; (vii) an operator as defined in The Ambulance Act; (viii) a licensee as defined in The Medical Laboratory Licensing Act, 1994; (ix) a proprietor as defined in The Pharmacy and Pharmacy Disciplines Act; (x) a community clinic: (A) as defined in section 263 of The Co-operatives Act, 1996; (B) Repealed. 2014, c 17, s 7. (C) incorporated or continued pursuant to The Non-profit Corporations Act, 2022; (xi) the Saskatchewan Cancer Foundation; (xi.1) subject to subsection (2), Health Shared Services Saskatchewan within the meaning of The Health Shared Services Saskatchewan (3sHealth) Act; (xii) a person, other than an employee of a trustee, who is: (A) a health professional licensed or registered pursuant to an Act for which the minister is responsible; or (B) a member of a class of persons designated as health professionals in the regulations; (xiii) a health professional body that regulates members of a health profession pursuant to an Act; (xiv) a person, other than an employee of a trustee, who or body that provides a health service pursuant to an agreement with another trustee; (xv) any other prescribed person, body or class of persons or bodies; (u) “use” includes reference to or manipulation of personal health information by the trustee that has custody or control of the information, but does not include disclosure to another person or trustee. (2) This Act does not apply to plan trusts within the meaning of The Health Shared Services Saskatchewan (3sHealth) Act and the trustees of those plan trusts. 1999, c H‑0.021, s 2; 2002, c R‑8.2, s 77; 2003, c 25, s 3; 2014, c 17, s 7; 2015, c 17, s 30; 2015, c M‑23.001, s 31; 2015, c 12, s 3; 2016, c P‑4.11, s 34; 2017, c P‑30.3, s 11; 2017, c P‑30.3, s 11‑9; 2022, c 9, s 9‑2; 2022, c 26, s 11. 7 HEALTH INFORMATION PROTECTION c H-0.021 Application of Act 3(1) This Act binds the Crown. (2) This Act does not apply to: (a) statistical information or de-identified personal health information that cannot reasonably be expected, either by itself or when combined with other information available to the person who receives it, to enable the subject individuals to be identified; (b) personal health information about an individual who has been dead for more than 30 years; or (c) records that are more than 120 years old. 1999, c H‑0.021, s 3. Act prevails 4(1) Subject to subsections (3) to (6), where there is a conflict or inconsistency between this Act and any other Act or regulation with respect to personal health information, this Act prevails. (2) Subsection (1) applies notwithstanding any provision in the other Act or regulation that states that the provision is to apply notwithstanding any other Act or law. (3) Except where otherwise provided, The Freedom of Information and Protection of Privacy Act and The Local Authority Freedom of Information and Protection of Privacy Act do not apply to personal health information in the custody or control of a trustee. (4) Subject to subsections (5) and (6), Parts II, IV and V of this Act do not apply to personal health information obtained for the purposes of: (a) The Adoption Act or The Adoption Act, 1998; (b) Part VIII of The Automobile Accident Insurance Act; (c) Repealed. 2006, c C‑1.1, s 26. (d) The Child and Family Services Act; (e) Repealed. 2014, c 16, s 47. (f) The Public Disclosure Act; (g) The Public Health Act, 1994; (g.1) The Vital Statistics Act, 2009 or any former Vital Statistics Act; (g.2) The Vital Statistics Administration Transfer Act; (h) The Workers’ Compensation Act, 2013; (h.1) The Youth Drug Detoxification and Stabilization Act; or (i) any prescribed Act or regulation or any prescribed provision of an Act or regulation. 8 c H-0.021 HEALTH INFORMATION PROTECTION (5) Sections 8 and 11 apply to the enactments mentioned in subsection (4). (6) The Freedom of Information and Protection of Privacy Act and The Local Authority Freedom of Information and Protection of Privacy Act apply to an enactment mentioned in subsection (4) unless the enactment or any provision of the enactment is exempted from the application of those Acts by those Acts or by regulations made pursuant to those Acts. 1999, c H‑0.021, s 4; 2003, c 25, s 4; 2005, c.Y‑1.1, s22; 2006, c C‑1.1, s 26; 2008, c V‑7.3, s 17; 2009, c 32, s 6; 2013, c W‑17.11, s 189; 2014, c 16, s 47. PART II Rights of the Individual Consent required for use or disclosure 5(1) Subject to subsection (2), an individual has the right to consent to the use or disclosure of personal health information about himself or herself. (2) A trustee shall use or disclose personal health information about an individual only: (a) with the consent of the subject individual; or (b) in accordance with a provision of this Act that authorizes the use or disclosure. (3) Repealed. 2003, c 25, s 5. (4) Repealed. 2003, c 25, s 5. 1999, c H‑0.021, s 5; 2003, c 25, s 5. Consent 6(1) Where consent is required by this Act for the collection, use or disclosure of personal health information, the consent: (a) must relate to the purpose for which the information is required; (b) must be informed; (c) must be given voluntarily; and (d) must not be obtained through misrepresentation, fraud or coercion. (2) A consent to the collection, use or disclosure of personal health information is informed if the individual who gives the consent is provided with the information that a reasonable person in the same circumstances would require in order to make a decision about the collection, use or disclosure of personal health information. (3) A consent may be given that is effective for a limited period. (4) Consent may be express or implied unless otherwise provided. (5) An express consent need not be in writing. 9 HEALTH INFORMATION PROTECTION c H-0.021 (6) A trustee, other than the trustee who obtained the consent, may act in accordance with an express consent in writing or a record of an express consent having been given without verifying that the consent meets the requirements of subsection (1) unless the trustee who intends to act has reason to believe that the consent does not meet those requirements. 1999, c H‑0.021, s 6. Right to revoke consent 7(1) An individual may revoke his or her consent to the collection of personal health information or to the use or disclosure of personal health information in the custody or control of a trustee. (2) A consent may be revoked at any time, but no revocation shall have retroactive effect. (3) A trustee must take all reasonable steps to comply with a revocation of consent promptly after receiving the revocation. 1999, c H‑0.021, s 7. Rights re comprehensive health record 8(1) An individual has the right to prevent access to a comprehensive health record of that individual’s personal health information. (2) In the case of a comprehensive health record created and controlled by eHealth Saskatchewan, the subject individual may require that the record not be disclosed to trustees by giving a written direction, in the prescribed form, to eHealth Saskatchewan. (3) In the case of a comprehensive health record created and controlled by a person prescribed for the purposes of subsection 18.1(1), the subject individual may require that the record not be disclosed to trustees by giving a written direction, in the prescribed form, to the prescribed person. (4) eHealth Saskatchewan shall comply with every written direction pursuant to subsection (2) that it receives, and each prescribed person shall comply with every written direction pursuant to subsection (3) that the prescribed person receives. 2003, c 25, s 6; 2015, c 12, s 4. Right to be informed 9(1) An individual has the right to be informed about the anticipated uses and disclosures of the individual’s personal health information. (2) When a trustee is collecting personal health information from the subject individual, the trustee must take reasonable steps to inform the individual of the anticipated use and disclosure of the information by the trustee. (3) A trustee must establish policies and procedures to promote knowledge and awareness of the rights extended to individuals by this Act, including the right to request access to their personal health information and to request amendment of that personal health information. 1999, c H‑0.021, s 9. 10 c H-0.021 HEALTH INFORMATION PROTECTION Right to information about disclosures without consent 10(1) A trustee must take reasonable steps to ensure that the trustee is able to inform an individual about any disclosures of that individual’s personal health information made without the individual’s consent after the coming into force of this section. (2) This section does not apply to the disclosure of personal health information for the purposes or in the circumstances set out in subsection 27(2). 1999, c H‑0.021, s 10; 2003, c 25, s 7. Rights re production of health services number 11(1) An individual has the right to refuse to produce his or her health services number or any other prescribed identifying number to any person, other than a trustee who is providing a health service, as a condition of receiving a service. (2) Except as provided in subsection (3), no person shall require an individual to produce a health services number as a condition of receiving any product or service. (3) A person may require the production of another person’s health services number: (a) for purposes related to: (i) the provision of publicly funded health services to the other person; (ii) the provision of a health service or program by a trustee; or (b) where authorized to do so by an Act or regulation. 1999, c H‑0.021, s 11. Right to access by individual 12 In accordance with Part V, an individual has the right to request access to personal health information about himself or herself that is contained in a record in the custody or control of a trustee. 1999, c H‑0.021, s 12. Right to request amendment 13 In accordance with Part V, an individual who is given access to a record that contains personal health information with respect to himself or herself is entitled: (a) to request amendment of the personal health information contained in the record if the person believes that there is an error or omission in it; or (b) if an amendment is requested but not made, to require that a notation to that effect be made in the record. 1999, c H‑0.021, s 13. Right to review or appeal 14 In accordance with Part VI, an individual has the right to apply to the commissioner to request a review of an action taken or a decision made by a trustee with respect to the individual’s personal health information and to appeal to the court a decision made by a trustee with respect to the trustee’s compliance or non‑compliance with a recommendation by the commissioner. 1999, c H‑0.021, s 14. 11 HEALTH INFORMATION PROTECTION c H-0.021 Right to designate 15 An individual may designate in writing another person to exercise on behalf of the individual any of the individual’s rights or powers with respect to personal health information. 1999, c H‑0.021, s 15; 2003, c 25, s 8. PART III Duty of Trustee to Protect Personal Health Information Duty to protect 16 Subject to the regulations, a trustee that has custody or control of personal health information must establish policies and procedures to maintain administrative, technical and physical safeguards that will: (a) protect the integrity, accuracy and confidentiality of the information; (b) protect against any reasonably anticipated: (i) threat or hazard to the security or integrity of the information; (ii) loss of the information; or (iii) unauthorized access to or use, disclosure or modification of the information; and (c) otherwise ensure compliance with this Act by its employees. 1999, c H‑0.021, s 16. Retention and destruction policy 17(1) A trustee must: (a) have a written policy concerning the retention and destruction of personal health information that meets the requirements set out in the regulations; and (b) comply with that policy and any prescribed standards with respect to the retention and destruction of personal health information. (2) A trustee must ensure that: (a) personal health information stored in any format is retrievable, readable and useable for the purpose for which it was collected for the full retention period of the information established in the policy mentioned in subsection (1); and (b) personal health information is destroyed in a manner that protects the privacy of the subject individual. 1999, c H‑0.021, s 17. 12 c H-0.021 HEALTH INFORMATION PROTECTION Information management service provider 18(1) A trustee may provide personal health information to an information management service provider: (a) for the purpose of having the information management service provider process, store, archive or destroy the personal health information for the trustee; (b) to enable the information management service provider to provide the trustee with information management or information technology services; (c) for the purpose of having the information management service provider take custody and control of the personal health information pursuant to section 22 when the trustee ceases to be a trustee; or (d) for the purpose of combining records containing personal health information. (2) Before providing personal health information to an information management service provider, a trustee must enter into a written agreement with the information management service provider that: (a) governs the access to and use, disclosure, storage, archiving, modification and destruction of the information; (b) provides for protection of the information; and (c) meets the requirements of the regulations. (3) An information management service provider shall not use, disclose, obtain access to, process, store, archive, modify or destroy personal health information received from a trustee except for the purposes set out in subsection (1). (4) An information management service provider must comply with the terms of the agreement entered into pursuant to subsection (2). (5) If a trustee is also an information management service provider and has received personal health information from another trustee in accordance with subsection (1), the trustee receiving the information is deemed to be an information management service provider for the purposes of that personal health information and does not have any of the rights and duties of a trustee with respect to that information. 1999, c H‑0.021, s 18; 2003, c 25, s 9. Comprehensive health record 18.1(1) Subject to the terms of any agreements made pursuant to subsection 18(2), eHealth Saskatchewan or a prescribed person may create comprehensive health records with respect to individuals. (2) A comprehensive health record with respect to an individual: (a) consists of records containing the individual’s personal health information that are provided by two or more trustees; 13 HEALTH INFORMATION PROTECTION c H-0.021 (b) is created for the purposes of: (i) compiling a complete health history of the individual; and (ii) providing access to that history to any trustee; and (c) is stored and controlled by eHealth Saskatchewan or the prescribed person that created it. (3) eHealth Saskatchewan or a prescribed person shall provide a trustee with access to a comprehensive health record only if: (a) access is authorized by each trustee whose records were used to compile the comprehensive health record; and (b) either: (i) the subject individual has provided consent in writing authorizing the trustee to have access; or (ii) one of the purposes or circumstances set out in subsection 27(2) or (4) exists and the subject individual has not made a direction pursuant to subsection 8(2) or (3). (4) Nothing in this section prevents the combining of records of personal health information where the combination is not for the purpose of creating a comprehensive health record. 2003, c 25, s 10; 2015, c 12, s 5. Duty to collect accurate information 19 In collecting personal health information, a trustee must take reasonable steps to ensure that the information is accurate and complete. 2003, c 25, s 11. Duty where one trustee discloses to another 20(1) Where one trustee discloses personal health information to another trustee, the information may become a part of the records of the trustee to whom it is disclosed, while remaining part of the records of the trustee that makes the disclosure. (2) Where personal health information disclosed by one trustee becomes a part of the records of the trustee to whom the information is disclosed, the trustee to whom the information is disclosed is subject to the same duties with respect to that information as the trustee that discloses the information. 1999, c H‑0.021, s 20. Duty where disclosing to persons other than trustees 21 Where a trustee discloses personal health information to a person who is not a trustee, the trustee must: (a) take reasonable steps to verify the identity of the person to whom the information is disclosed; and 14 c H-0.021 HEALTH INFORMATION PROTECTION (b) where the disclosure is made without the consent of the subject individual, take reasonable steps to ensure that the person to whom the information is disclosed is aware that the information must not be used or disclosed for any purpose other than the purpose for which it was disclosed unless otherwise authorized pursuant to this Act. 1999, c H‑0.021, s 21; 2003, c 25, s 12. Continuing duties of trustees 22(1) Where a trustee ceases to be a trustee with respect to any records containing personal health information, the duties imposed by this Act on a trustee with respect to personal health information in the custody or control of the trustee continue to apply to the former trustee until the former trustee transfers custody and control of the personal health information to another trustee or to an information management service provider that is a designated archive. (2) Where a former trustee fails to carry out the duties continued pursuant to subsection (1), the minister may appoint a person or body to act in place of the former trustee until custody and control of the personal health information is transferred to another trustee or to an information management service provider that is a designated archive. (2.1) If a trustee fails to keep secure personal health information in the custody or control of the trustee, the minister may appoint a person or body to act in place of the trustee until custody or control of the personal health information is re‑established, transferred to another trustee or transferred to an information management service provider that is a designated archive. (3) Where a trustee dies, the duties imposed by this Act on a trustee with respect to personal health information in the custody or control of the trustee become the duties of the personal representative of the trustee and continue to apply to the personal representative until the personal representative transfers custody and control of the personal health information to another trustee or to an information management service provider that is a designated archive. 1999, c H‑0.021, s 22; 2015, c 12, s 6. PART IV Limits on Collection, Use and Disclosure of Personal Health Information by Trustees Collection, use and disclosure on need-to-know basis 23(1) A trustee shall collect, use or disclose only the personal health information that is reasonably necessary for the purpose for which it is being collected, used or disclosed. (2) A trustee must establish policies and procedures to restrict access by the trustee’s employees to an individual’s personal health information that is not required by the employee to carry out the purpose for which the information was collected or to carry out a purpose authorized pursuant to this Act. (3) Repealed. 2003, c 25, s 13. 15 HEALTH INFORMATION PROTECTION c H-0.021 (4) A trustee must, where practicable, use or disclose only de-identified personal health information if it will serve the purpose. 1999, c H‑0.021, s 23; 2003, c 25, s 13. Restrictions on collection 24(1) A trustee shall ensure that the primary purpose for collecting personal health information is for the purposes of a program, activity or service of the trustee that can reasonably be expected to benefit the subject individual. (2) A trustee may collect personal health information for a secondary purpose if the secondary purpose is consistent with any of the purposes for which personal health information may be disclosed pursuant to section 27, 28 or 29. (3) Nothing in this Act prohibits the collection of personal health information where that collection is authorized by another Act or by a regulation made pursuant to another Act. (4) A trustee may collect personal health information for any purpose with the consent of the subject individual. 1999, c H‑0.021, s 24. Manner of collection 25(1) Subject to subsection (2), a trustee shall collect personal health information directly from the subject individual, except where: (a) the individual consents to collection of the information by other methods; (b) the individual is unable to provide the information; (c) the trustee believes, on reasonable grounds, that collection directly from the subject individual would prejudice the mental or physical health or the safety of the subject individual or another individual; (d) the information is collected, and is necessary, for the purpose of: (i) determining the eligibility of the individual to participate in a program of the trustee or receive a product or service from the trustee, in the course of processing an application made by or on behalf of the individual; or (ii) verifying the eligibility of the individual who is participating in a program of the trustee or receiving a product or service from the trustee; (e) the information is available to the public; (f) the trustee collects the information by disclosure from another trustee pursuant to section 27, 28 or 29; or (g) prescribed circumstances exist. (2) Where the collection is for the purpose of assembling the family health history of an individual, a trustee may collect personal health information from the individual about other members of the individual’s family. (3) Where a trustee collects personal health information from anyone other than the subject individual, the trustee must take reasonable steps to verify the accuracy of the information. 16 c H-0.021 HEALTH INFORMATION PROTECTION (3.1) Subsection (3) does not apply to personal health information collected by the Provincial Archives of Saskatchewan for the purposes of The Archives and Public Records Management Act. 1999, c H‑0.021, s 25; 2004, c A‑26.1, s 37; 2015, c A‑26.11, s 43. Restrictions on use 26(1) A trustee shall not use personal health information in the custody or control of the trustee except with the consent of the subject individual or in accordance with this section. (2) A trustee may use personal health information: (a) for a purpose for which the information may be disclosed by the trustee pursuant to section 27, 28 or 29; (b) for the purposes of de‑identifying the personal health information; (c) for a purpose that will primarily benefit the subject individual; or (d) for a prescribed purpose. (3) Nothing in subsection (2) authorizes a trustee as an employer to use or obtain access to the personal health information of an individual who is an employee or prospective employee for any purpose related to the employment of the individual without the individual’s consent. 2003, c 25, s 14. Disclosure 27(1) A trustee shall not disclose personal health information in the custody or control of the trustee except with the consent of the subject individual or in accordance with this section, section 28 or section 29. (2) A subject individual is deemed to consent to the disclosure of personal health information: (a) for the purpose for which the information was collected by the trustee or for a purpose that is consistent with that purpose; (b) for the purpose of arranging, assessing the need for, providing, continuing, or supporting the provision of, a service requested or required by the subject individual; or (c) to the subject individual’s next of kin or someone with whom the subject individual has a close personal relationship if: (i) the disclosure relates to health services currently being provided to the subject individual; and (ii) the subject individual has not expressed a contrary intention to a disclosure of that type. 17 HEALTH INFORMATION PROTECTION c H-0.021 (3) A trustee shall not disclose personal health information on the basis of a consent pursuant to subsection (2) unless: (a) in the case of a trustee other than a health professional, the trustee has established policies and procedures to restrict the disclosure of personal health information to those persons who require the information to carry out a purpose for which the information was collected or to carry out a purpose authorized pursuant to this Act; or (b) in the case of a trustee who is a health professional, the trustee makes the disclosure in accordance with the ethical practices of the trustee’s profession. (4) A trustee may disclose personal health information in the custody or control of the trustee without the consent of the subject individual in the following cases: (a) where the trustee believes, on reasonable grounds, that the disclosure will avoid or minimize a danger to the health or safety of any person; (b) where, in the opinion of the trustee, disclosure is necessary for monitoring, preventing or revealing fraudulent, abusive or dangerous use of publicly funded health services; (c) where the disclosure is being made to a trustee that is the successor of the trustee that has custody or control of the information, if the trustee makes a reasonable attempt to inform the subject individuals of the disclosure; (d) to a person who, pursuant to The Health Care Directives and Substitute Health Care Decision Makers Act, 2015, is entitled to make a health care decision, as defined in that Act, on behalf of the subject individual, where the personal health information is required to make a health care decision with respect to that individual; (e) if the subject individual is deceased: (i) where the disclosure is being made to the personal representative of the subject individual for a purpose related to the administration of the subject individual’s estate; or (ii) where the information relates to circumstances surrounding the death of the subject individual or services recently received by the subject individual, and the disclosure: (A) is made to a member of the subject individual’s immediate family or to anyone else with whom the subject individual had a close personal relationship; and (B) is made in accordance with established policies and procedures of the trustee, or where the trustee is a health professional, made in accordance with the ethical practices of that profession; (f) where the disclosure is being made in accordance with section 22 to another trustee or an information management service provider that is a designated archive; 18 c H-0.021 HEALTH INFORMATION PROTECTION (g) where the disclosure is being made to a standards or quality of care committee established by one or more trustees to study or evaluate health services practice in a health services facility, health region or other health service area that is the responsibility of the trustee, if the committee: (i) uses the information only for the purpose for which it was disclosed; (ii) does not make a further disclosure of the information; and (iii) takes reasonable steps to preserve the confidentiality of the information; (h) subject to subsection (5), where the disclosure is being made to a health professional body or a prescribed professional body that requires the information for the purposes of carrying out its duties pursuant to an Act with respect to regulating the profession; (i) where the disclosure is being made for the purpose of commencing or conducting a proceeding before a court or tribunal or for the purpose of complying with: (i) an order or demand made or subpoena or warrant issued by a court, person or body that has the authority to compel the production of information; or (ii) rules of court that relate to the production of information; (j) subject to subsection (6), where the disclosure is being made for the provision of health or social services to the subject individual, if, in the opinion of the trustee, disclosure of the personal health information will clearly benefit the health or well‑being of the subject individual, but only where it is not reasonably practicable to obtain consent; (k) where the disclosure is being made for the purpose of: (i) obtaining payment for the provision of services to the subject individual; or (ii) planning, delivering, evaluating or monitoring a program of the trustee; (l) where the disclosure is permitted pursuant to any Act or regulation; (m) where the disclosure is being made to the trustee’s legal counsel for the purpose of providing legal services to the trustee; (n) in the case of a trustee who controls the operation of a pharmacy as defined in The Pharmacy and Pharmacy Disciplines Act, a physician, a dentist or the minister, where the disclosure is being made pursuant to a program to monitor the use of drugs that is authorized by a bylaw made pursuant to The Medical Profession Act, 1981 and approved by the minister; 19 HEALTH INFORMATION PROTECTION c H-0.021 (o) in the case of a trustee who controls the operation of a pharmacy as defined in The Pharmacy and Pharmacy Disciplines Act, where the disclosure is being made pursuant to a program to monitor the use of drugs that is authorized by a bylaw made pursuant to The Pharmacy and Pharmacy Disciplines Act and approved by the minister; (p) in prescribed circumstances. (5) For the purposes of clause (4)(h), where the personal health information in question is about a member of the profession regulated by the health professional body or prescribed professional body, disclosure may be made only: (a) in accordance with clause (4)(i); (b) with the express consent of the subject individual; or (c) if the trustee has reasonable grounds to believe that the personal health information is relevant to the ability of the subject individual to practise his or her profession, on the request of the health professional body or prescribed professional body. (6) Disclosure of personal health information pursuant to clause (4)(j) may be made only where the person to whom the information is to be disclosed agrees: (a) to use the information only for the purpose for which it is being disclosed; and (b) not to make a further disclosure of the information in the course of carrying out any of the activities mentioned in that clause. 2003, c 25, s 14; 2015, c 17, s 30; 2015, c 11, s 4. Disclosure of registration information 28(1) The minister may disclose registration information without the consent of the subject individual: (a) to a trustee in connection with the provision of health services by the trustee; (b) to another government institution, the provincial health authority or an affiliate, for the purpose of verifying the eligibility of an individual to participate in a program of, or receive a service from, the government institution, the provincial health authority or the affiliate: (i) in the course of processing an application made by or on behalf of the individual; or (ii) if the individual is already participating in the program or receiving the service; (c) to another government institution, the provincial health authority or an affiliate, for the purpose of verifying the accuracy of registration information held by the government institution, the provincial health authority or the affiliate. 20 c H-0.021 HEALTH INFORMATION PROTECTION (2) For the purposes set out in subsection (3), registration information may be disclosed without the consent of the subject individual: (a) by the minister to the provincial health authority or an affiliate; (b) by the provincial health authority or affiliate to the minister; (c) by the provincial health authority to an affiliate; (d) by an affiliate to the provincial health authority; or (e) by one affiliate to another affiliate. (3) Registration information may be disclosed pursuant to subsection (2) for the purpose of planning, delivering, evaluating or monitoring a program of the minister, the provincial health authority or an affiliate that relates to the provision of health services or payment for health services. (4) The minister or the provincial health authority may, without the consent of the subject individuals, disclose the names, dates of birth, telephone numbers and addresses of individuals under the age of seven years to a board of education or the Conseil scolaire fransaskois within the meaning of The Education Act, 1995 for the purpose of planning or administration by the board of education or the Conseil scolaire fransaskois. (5) With the approval of the Lieutenant Governor in Council, the minister may enter into agreements for the sharing of registration information with: (a) the Government of Canada or the government of a province or territory of Canada; or (b) a prescribed person or body. (6) An agreement pursuant to subsection (5) must specify that the party to whom the registration information is disclosed shall use the information only for the purposes specified in the agreement. (7) The minister may disclose registration information without the consent of the subject individual in accordance with an agreement entered into pursuant to subsection (5). (8) Registration information may be disclosed without the consent of the subject individual in accordance with the regulations. 1999, c H‑0.021, s 28; 2002, c R‑8.2, s 77; 2017, c P‑30.3, s 11 and s 11‑9. Use and disclosure for research 29(1) A trustee or a designated archive may use or disclose personal health information for research purposes with the express consent of the subject individual if: (a) in the opinion of the trustee or designated archive, the research project is not contrary to the public interest; 21 HEALTH INFORMATION PROTECTION c H-0.021 (b) the research project has been approved by a research ethics committee approved by the minister; and (c) the person who is to receive the personal health information enters into an agreement with the trustee or designated archive that contains provisions: (i) providing that the person who is to receive the information must not disclose the information; (ii) providing that the person who is to receive the information will ensure that the information will be used only for the purpose set out in the agreement; (iii) providing that the person who is to receive the information will take reasonable steps to ensure the security and confidentiality of the information; and (iv) specifying when the person who is to receive the information must do all or any of the following: (A) return to the trustee or designated archive any original records or copies of records containing personal health information; (B) destroy any copies of records containing personal health information received from the trustee or designated archive or any copies made by the researcher of records containing personal health information received from the trustee or designated archive. (2) Where it is not reasonably practicable for the consent of the subject individual to be obtained, a trustee or designated archive may use or disclose personal health information for research purposes if: (a) the research purposes cannot reasonably be accomplished using de-identified personal health information or other information; (b) reasonable steps are taken to protect the privacy of the subject individual by removing all personal health information that is not required for the purposes of the research; (c) in the opinion of the research ethics committee, the potential benefits of the research project clearly outweigh the potential risk to the privacy of the subject individual; and (d) all of the requirements set out in clauses (1)(a) to (c) are met. (3) This section does not apply to personal health information disclosed in accordance with section 29 of The Archives and Public Records Management Act. 1999, c H‑0.021, s 29; 2015, c A‑26.11, s 43. Use or disclosure prohibited 30(1) No person who is aware, or should reasonably be aware, that he or she has received personal health information in contravention of this Act shall use or disclose the information without the consent of the subject individual or, where the subject individual is deceased, without the consent of a prescribed person. 22 c H-0.021 HEALTH INFORMATION PROTECTION (2) Subsection (1) does not apply to personal health information disclosed by a trustee to a member of the subject individual’s immediate family or to anyone else with whom the subject individual has a close personal relationship. (3) Repealed.

2003, c 25, s 15. 1999, c H‑0.021, s 30; 2003, c 25, s 15. PART V Access of Individuals to Personal Health Information Interpretation of Part 31 In this Part: (a) “applicant” means an individual who makes a written request for access to personal health information about himself or herself; (b) “written request for access” means a request made pursuant to section 34. 1999, c H‑0.021, s 31. Right of access 32 Subject to this Part, on making a written request for access, an individual has the right to obtain access to personal health information about himself or herself that is contained in a record in the custody or control of a trustee. 1999, c H‑0.021, s 32. Oral request for access 33 Nothing in this Act precludes: (a) an individual from making an oral request for access to personal health information about himself or herself that is contained in a record in the custody or control of a trustee; or (b) a trustee from responding to an oral request. 1999, c H‑0.021, s 33. Written request for access 34(1) An individual may, in accordance with the regulations, make a written request for access to personal health information about himself or herself that is contained in a record in the custody or control of a trustee. (2) A written request for access must: (a) be made to the trustee that the applicant believes has custody or control of the record containing the personal health information; and (b) contain sufficient detail to enable the trustee to identify the personal health information requested. (3) An applicant must prove his or her identity to the satisfaction of the trustee. 23 HEALTH INFORMATION PROTECTION c H-0.021 (4) The right to make an application for review pursuant to section 42 applies only to written requests for access. 1999, c H‑0.021, s 34. Duty to assist 35(1) Subject to sections 36 to 38, a trustee shall respond to a written request for access openly, accurately and completely. (2) On the request of an applicant, a trustee shall: (a) provide an explanation of any term, code or abbreviation used in the personal health information; or (b) if the trustee is unable to provide an explanation in accordance with clause (a), refer the applicant to a trustee that is able to provide an explanation. 1999, c H‑0.021, s 35. Response to written request 36(1) Within 30 days after receiving a written request for access, a trustee must respond to the request in one of the following ways: (a) by making the personal health information available for examination and providing a copy, if requested, to the applicant; (b) by informing the applicant that the information does not exist or cannot be found; (c) by refusing the written request for access, in whole or in part, and informing the applicant: (i) of the refusal and the reasons for the refusal; and (ii) of the applicant’s right to request a review of the refusal pursuant to Part VI; (d) by transferring the written request for access to another trustee if the personal health information is in the custody or control of the other trustee. (2) A trustee that transfers a written request for access pursuant to clause (1)(d) must notify the applicant of the transfer as soon as reasonably possible, and the trustee to whom the written request for access is transferred must respond to it within 30 days after the date of transfer. (3) The failure of a trustee to respond to a written request for access within the period mentioned in subsection (1) or (2) is deemed to be a decision to refuse to provide access to the personal health information, unless the written request for access is transferred to another trustee pursuant to clause (1)(d). 1999, c H‑0.021, s 36. 24 c H-0.021 HEALTH INFORMATION PROTECTION Extension of time 37(1) A trustee may extend the period set out in subsection 36(1) for a reasonable period not exceeding 30 days where: (a) the request is for access to a large number of records or necessitates a search through a large number of records or there is a large number of requests, and completing the work within the original period would unreasonably interfere with the operations of the trustee; or (b) consultations that are necessary to comply with the request cannot reasonably be completed within the original period. (2) A trustee who extends a period pursuant to subsection (1) shall give notice of the extension to the applicant within 30 days after the request is made. 1999, c H‑0.021, s 37. Refusing access 38(1) Subject to subsection (2), a trustee may refuse to grant an applicant access to his or her personal health information if: (a) in the opinion of the trustee, knowledge of the information could reasonably be expected to endanger the mental or physical health or the safety of the applicant or another person; (b) disclosure of the information would reveal personal health information about another person who has not expressly consented to the disclosure; (c) disclosure of the information could reasonably be expected to identify a third party, other than another trustee, who supplied the information in confidence under circumstances in which confidentiality was reasonably expected; (d) subject to subsection (3), the information was collected and is used solely: (i) for the purpose of peer review by health professionals, including joint professional review committees within the meaning of The Saskatchewan Medical Care Insurance Act; (ii) for the purpose of review by a standards or quality of care committee established to study or evaluate health services practice in a health services facility or health services agency, including a committee as defined in section 10 of The Evidence Act; or (iii) for the purposes of a body with statutory responsibility for the discipline of health professionals or for the quality or standards of professional services provided by health professionals; (e) the information was collected principally in anticipation of, or for use in, a civil, criminal or quasi‑judicial proceeding; or (f) disclosure of the information could interfere with a lawful investigation or be injurious to the enforcement of an Act or regulation. 25 HEALTH INFORMATION PROTECTION c H-0.021 (2) Where a record contains information to which an applicant is refused access, the trustee shall grant access to as much of the record as can reasonably be severed without disclosing the information to which the applicant is refused access. (3) Where access to personal health information is refused pursuant to clause (1)(d), a trustee must refer the applicant to the trustees from which the personal health information was collected. 1999, c H‑0.021, s 38; 2006, c 19, s 8. Fee 39 A trustee may charge a reasonable fee not exceeding the prescribed amount to recover costs incurred in providing access to a record containing personal health information. 1999, c H‑0.021, s 39. Right of amendment 40(1) An individual who is given access to a record that contains personal health information with respect to himself or herself is entitled: (a) to request amendment of the personal health information contained in the record if the person believes that there is an error or omission in it; or (b) if an amendment is requested but not made, to require that a notation to that effect be made in the record. (2) A request for amendment must be in writing. (3) Within 30 days after a request for amendment is received, the trustee shall advise the individual in writing that: (a) the amendment has been made; or (b) a notation pursuant to clause (1)(b) has been made. (4) Subject to subsection (6), where a trustee makes an amendment or adds a notation pursuant to clause (1)(b), the trustee must, where practicable, give notice of the amendment or notation to any other trustee or person to whom the personal health information has been disclosed by the trustee within the period of one year immediately before the amendment was requested. (5) A trustee that receives a notice pursuant to subsection (4) must make the amendment or add the notation to any record in the custody or control of the trustee that contains personal health information respecting the individual who requested the amendment. (6) A trustee is not required to notify other trustees where: (a) an amendment or a notation cannot reasonably be expected to have an impact on the ongoing provision of health services to the individual; or 26 c H-0.021 HEALTH INFORMATION PROTECTION (b) the personal health information was disclosed to the other trustees for any of the purposes or in any of the circumstances set out in subsection 27(2). (7) An amendment required to be made pursuant to this section must not destroy or obliterate existing information in the record being amended, other than registration information. 1999, c H‑0.021, s 40; 2003, c 25, s 16. PART VI Review and Appeal Interpretation of Part 41 In this Part: (a) “applicant” means a person who makes an application for review; (b) “application for review” means an application pursuant to section 42; (c) “court” means the Court of King’s Bench. 1999, c H‑0.021, s 41; 2024, c 4, s 32. Application for review 42(1) A person may apply to the commissioner for a review of the matter where: (a) the person is not satisfied with the decision of a trustee pursuant to section 36; (b) the person requests an amendment of personal health information pursuant to clause 40(1)(a), and the amendment is not made; or (c) the person believes that there has been a contravention of this Act. (2) Subject to subsection (3), an application must be made in accordance with the regulations: (a) in the case of an application pursuant to clause (1)(a), within one year after: (i) the applicant is given written notice of the decision of the trustee; or (ii) the period mentioned in subsection 36(2) or 37(1) expires; (b) in the case of an application pursuant to clause (1)(b), within one year after the expiry of the period mentioned in subsection 40(3); and (c) in the case of an application pursuant to clause (1)(c), within one year after the discovery of the alleged contravention. 27 HEALTH INFORMATION PROTECTION c H-0.021 (3) Where a person has commenced another review process, procedure or mechanism of a trustee, an application pursuant to subsection (1) must be made within one year after the day on which the other review process, procedure or mechanism is completed. 1999, c H‑0.021, s 42. Review or refusal to review 43(1) Where the commissioner is satisfied that there are reasonable grounds to review any matter set out in an application for review, the commissioner shall review the matter. (2) The commissioner may refuse to conduct a review or may discontinue a review if, in the opinion of the commissioner, the application for review: (a) is frivolous or vexatious; (b) is not made in good faith; (c) concerns a trivial matter; (d) does not affect the applicant personally; (e) concerns a trustee that has an internal review process that the applicant has not used; (f) concerns a professional who is governed by a health professional body or prescribed professional body mentioned in clause 27(4)(h) that regulates its members pursuant to an Act, and the applicant has not used a complaints procedure available through the professional body; or (g) is normally considered pursuant to another Act that provides a review or other mechanism to challenge a trustee’s decision with respect to the access to or collection, amendment, use or disclosure of personal health information, and the applicant has not used that review or mechanism. (3) The commissioner may suspend a review where the applicant has used another review process, procedure or mechanism and that process, procedure or mechanism has not been completed. 1999, c H‑0.021, s 43; 2003, c 25, s 17. Notice of intention to review 44 Not less than 30 days before commencing a review, the commissioner shall inform the trustee of: (a) the commissioner’s intention to conduct the review; and (b) the substance of the application for review. 1999, c H‑0.021, s 44. 28 c H-0.021 HEALTH INFORMATION PROTECTION Conduct of review 45(1) The commissioner shall conduct a review in private. (2) The applicant and the trustee whose decision is the subject of a review are entitled to make representations to the commissioner in the course of the review. (3) No one is entitled as of right: (a) to be present during a review; or (b) before or after a review, to have access to, or to comment on, representations made to the commissioner by any other person. 1999, c H‑0.021, s 45. Powers of commissioner 46(1) Notwithstanding any other Act or any privilege that is available at law, the commissioner may, in a review, require to be produced and examine any personal health information that is in the custody or control of a trustee. (2) For the purposes of conducting a review, the commissioner may summon and enforce the appearance of persons before the commissioner and compel them to give oral or written evidence on oath or affirmation and to produce any documents or things that the commissioner considers necessary for a full review, in the same manner and to the same extent as the court. (3) For the purposes of subsection (2), the commissioner may administer an oath or affirmation. 1999, c H‑0.021, s 46. Burden of proof 47 Where a review relates to a decision to refuse an individual access to all or part of a record, the onus is on the trustee to prove that the individual has no right of access to the record or part of the record. 1999, c H‑0.021, s 47. Commissioner to report 48(1) On completing a review, the commissioner shall: (a) prepare a written report setting out the commissioner’s recommendations with respect to the matter and the reasons for those recommendations; and (b) forward a copy of the report to the trustee and to the applicant. (2) In the report, the commissioner may make any recommendations with respect to the matter under review that the commissioner considers appropriate. 1999, c H‑0.021, s 48. 29 HEALTH INFORMATION PROTECTION c H-0.021 Decision of trustee 49 Within 30 days after receiving a report of the commissioner pursuant to subsection 48(1), the trustee shall: (a) make a decision to follow the recommendations of the commissioner or any other decision that the trustee considers appropriate; and (b) give written notice of the decision to the commissioner and the applicant. 1999, c H‑0.021, s 49. Appeal to court 50(1) Within 30 days after receiving a decision of the trustee pursuant to section 49 that the trustee will or will not comply with the recommendations of the commissioner, an applicant may appeal that decision to the court. (2) The commissioner shall not be a party to an appeal. 1999, c H‑0.021, s 50. Powers of court on appeal 51(1) On an appeal, the court: (a) shall determine the matter de novo; and (b) may examine any record in private in order to determine on the merits whether the information in the record may be withheld pursuant to this Act. (2) Notwithstanding any other Act or any privilege that is available at law, the court, on an appeal, may examine any record in the custody or control of a trustee, and no person shall withhold information from the court on any grounds. (3) The court shall take every reasonable precaution, including, where appropriate, receiving representations without notice and conducting hearings in private, to avoid disclosure by the court or any person of: (a) any information or other material if the nature of the information or material could justify a refusal by a trustee to give access to a record or part of a record; or (b) any information as to whether a record exists if the trustee, in refusing to give access, does not indicate whether the record exists. (4) If, in the opinion of the court, there is evidence of the commission of an offence against an Act, a regulation, an Act of the Parliament of Canada or a regulation made pursuant to an Act of the Parliament of Canada, the court may disclose to the Attorney General for Saskatchewan or the Attorney General of Canada information that relates to the commission of the offence. (5) Where, on an appeal, the court determines that a trustee has contravened this Act, the court may make any order that it considers appropriate. 1999, c H‑0.021, s 51; 2018, c 42, s 65. 30 c H-0.021 HEALTH INFORMATION PROTECTION PART VII Commissioner Privacy powers of commissioner 52 The commissioner may: (a) offer comment on the implications for personal health information of proposed legislative schemes or programs of trustees; (b) after hearing a trustee, recommend that the trustee: (i) cease or modify a specified practice of collecting, using or disclosing information that contravenes this Act; and (ii) destroy collections of personal health information collected in contravention of this Act; (c) in appropriate circumstances, comment on the collection of personal health information in a manner other than directly from the individual to whom it relates; (d) from time to time, carry out investigations with respect to personal health information in the custody or control of trustees to ensure compliance with this Act; (e) comment on the implications for protection of personal health information of any aspect of the collection, storage, use or transfer of personal health information. 1999, c H‑0.021, s 52. General powers of commissioner 53 The commissioner may: (a) engage in or commission research into matters affecting the carrying out of the purposes of this Act; (b) conduct public education programs and provide information concerning this Act and the commissioner’s role and activities; (c) receive representations concerning the operation of this Act. 1999, c H‑0.021, s 53. Confidentiality 54(1) Except as provided in this section, the commissioner shall not disclose any information that comes to the knowledge of the commissioner in the exercise of the powers, performance of the duties or carrying out of the functions of the commissioner pursuant to this Act. (2) Subsection (1) applies, with any necessary modification, to the staff of the commissioner. 31 HEALTH INFORMATION PROTECTION c H-0.021 (3) In the course of a review pursuant to section 45, the commissioner may disclose any information that the commissioner considers necessary to disclose to facilitate the review. (4) In a report prepared pursuant to this Act, the commissioner may disclose any information that the commissioner considers necessary to disclose to establish grounds for the findings and recommendations in the report. (5) When making a disclosure pursuant to subsection (3) or (4), the commissioner shall take every reasonable precaution to avoid disclosure of, and shall not disclose: (a) any information or other material if the nature of the information or material could justify a refusal by a trustee to give access to a record or part of a record; or (b) any information as to whether a record exists if the trustee, in refusing to give access, does not indicate whether the record exists. (6) If, in the opinion of the commissioner, there is evidence of the commission of an offence against an Act, a regulation, an Act of the Parliament of Canada or a regulation made pursuant to an Act of the Parliament of Canada, the commissioner may disclose to the Attorney General for Saskatchewan or the Attorney General of Canada information that relates to the commission of the offence. 1999, c H‑0.021, s 54. Non-compellability 55(1) The commissioner is not compellable to give evidence in a court or in a proceeding of a judicial nature concerning any information that comes to the knowledge of the commissioner in the exercise of the powers, performance of the duties or carrying out of the functions of the commissioner pursuant to this Act. (2) Subsection (1) applies, with any necessary modification, to the staff of the commissioner. 1999, c H‑0.021, s 55. PART VIII General Exercise of rights by other persons 56 Any right or power conferred on an individual by this Act may be exercised: (a) where the individual is deceased, by the individual’s personal representative if the exercise of the right or power relates to the administration of the individual’s estate; (b) where a personal guardian has been appointed for the individual, by the guardian if the exercise of the right or power relates to the powers and duties of the guardian; 32 c H-0.021 HEALTH INFORMATION PROTECTION (c) by an individual who is less than 18 years of age in situations where, in the opinion of the trustee, the individual understands the nature of the right or power and the consequences of exercising the right or power; (d) where the individual is less than 18 years of age, by the individual’s legal custodian in situations where, in the opinion of the trustee, the exercise of the right or power would not constitute an unreasonable invasion of the privacy of the individual; (e) where the individual does not have the capacity to give consent: (i) by a person designated by the Minister of Social Services if the individual is receiving services pursuant to The Residential Services Act, 2019 or The Rehabilitation Act; or (ii) by a person who, pursuant to The Health Care Directives and Substitute Health Care Decision Makers Act, 2015, is entitled to make a health care decision, as defined in that Act, on behalf of the individual; or (f) by any person designated in writing by the individual pursuant to section 15. 1999, c H‑0.021, s 56; 2004, c 65, s 11; 2015, c 11, s 4; 2019, c R‑21.3, s 39; 2020, c 13, s 7. Information about trustees 57 Where information about a trustee or the activities of a trustee is collected in conjunction with the collection of personal health information and regulations are made pursuant to clause 63(1)(w) governing that information, no person shall use or disclose the information about the trustee or the trustee’s activities except in accordance with those regulations. 1999, c H‑0.021, s 57. Decisions of trustees 58(1) Where this Act or the regulations require a decision to be made or an opinion to be formed by a trustee that is a government institution as defined in The Freedom of Information and Protection of Privacy Act, the person who is the head, as defined in that Act, of the government institution, or the designate of the head, shall make the decision or form the opinion on behalf of the trustee. (2) Where this Act or the regulations require a decision to be made or an opinion to be formed by a trustee that is a local authority as defined in The Local Authority Freedom of Information and Protection of Privacy Act, the person who is the head, as defined in that Act, of the local authority, or the designate of the head, shall make the decision or form the opinion on behalf of the trustee. (3) Where this Act or the regulations require a decision to be made or an opinion to be formed by a trustee to whom subsection (1) or (2) does not apply, the trustee shall designate a person to make the decision or form the opinion on behalf of the trustee. 1999, c H‑0.021, s 58. 59 Repealed. 2017, c P‑30.3, s 11‑9 33 HEALTH INFORMATION PROTECTION c H-0.021 Annual report 60(1) Within three months after the end of each fiscal year, the commissioner shall prepare and submit an annual report to the Speaker of the Assembly, and the Speaker shall cause the report to be laid before the Assembly in accordance with section 13 of The Executive Government Administration Act. (2) The annual report of the commissioner is to provide details of the activities of the office in relation to the commissioner’s responsibilities pursuant to this Act during that fiscal year and, in particular, concerning any instances where the commissioner’s recommendations made after a review have not been complied with. 1999, c H‑0.021, s 60; 2014, c E‑13.1, s 62. Proceedings prohibited 61(1) No action or proceeding lies or shall be commenced against a trustee, an information management service provider or the Government of Saskatchewan or an officer or employee of a trustee, an information management service provider or the Government of Saskatchewan with respect to: (a) the use or disclosure in good faith of personal health information pursuant to this Act; or (b) any consequences that flow from the use or disclosure mentioned in clause (a). (2) No action or proceeding lies or shall be commenced against the commissioner or any employee or agent of the commissioner for any loss or damage suffered by a person by reason of anything in good faith done, caused, permitted or authorized to be done, attempted to be done or omitted to be done, by any of them, pursuant to or in the exercise of or supposed exercise of any power conferred by this Act or the regulations or in the carrying out or supposed carrying out of any order made pursuant to this Act or any duty imposed by this Act or the regulations. 1999, c H‑0.021, s 61. Immunity from prosecution 62 No person is liable to prosecution for an offence against any Act or regulation by reason of that person’s compliance with a requirement or recommendation of the commissioner pursuant to this Act. 1999, c H‑0.021, s 62. Regulations 63(1) For the purpose of carrying out this Act according to its intent, the Lieutenant Governor in Council may make regulations: (a) defining, enlarging or restricting the meaning of any word or expression used in this Act but not defined in this Act; (b) for the purposes of subclause 2(t)(xii), designating classes of persons as health professionals; 34 c H-0.021 HEALTH INFORMATION PROTECTION (c) for the purposes of subclause 2(t)(xv), prescribing persons, bodies or classes of persons or bodies as trustees; (d) for the purposes of clause 4(4)(i), prescribing Acts or regulations or provisions of Acts or regulations to which Parts II, IV and V of this Act do not apply with respect to personal health information; (e) Repealed. 2003, c 25, s 18. (e.1) for the purposes of section 8, prescribing a form for a written direction; (f) for the purposes of subsection 11(1), prescribing other identifying numbers; (g) for the purposes of clause 11(3)(b), prescribing circumstances in which a person may require the production of another person’s health services number; (h) prescribing and governing administrative, technical and physical safeguards for the protection of personal health information; (i) prescribing and governing standards for the retention and destruction of personal health information and governing retention and destruction policies; (j) governing agreements between trustees and information management service providers; (j.1) for the purposes of subsection 18.1(1), prescribing persons who may create and control comprehensive health records; (k) for the purposes of section 22, designating information management service providers as archives to which trustees and former trustees can transfer custody and control of personal health information and governing access to and use, disclosure, processing, storing, archiving, modification and destruction of personal health information by designated archives; (l) for the purposes of clause 25(1)(g), prescribing circumstances in which a trustee may collect personal health information other than directly from the subject individual; (m) prescribing purposes for which a trustee may use personal health information pursuant to clause 26(2)(d); (n) Repealed. 2003, c 25, s 18. (o) for the purposes of clause 27(4)(p), prescribing circumstances in which personal health information in the custody or control of a trustee may be disclosed without the consent of the subject individual; (p) for the purposes of clause 27(4)(h), prescribing professional bodies to which personal health information may be disclosed; (q) prescribing persons with whom or bodies with which the minister may enter into agreements pursuant to clause 28(5)(b); (r) for the purposes of subsection 28(8), prescribing and governing: (i) circumstances in which registration information may be disclosed without the consent of the subject individual; 35 HEALTH INFORMATION PROTECTION c H-0.021 (ii) persons to whom registration information may be disclosed without the consent of the subject individual; (iii) purposes for which registration information may be disclosed without the consent of the subject individual; (r.1) for the purposes of subsection 30(1), prescribing persons who may give consent to the use or disclosure of personal health information where the subject individual is deceased; (s) governing the making of written requests for access to personal health information; (t) prescribing the maximum amounts that may be charged as fees to recover costs incurred in providing access to personal health information; (u) governing the making of requests for amendments to personal health information and the amending of personal health information by trustees; (v) governing applications for review pursuant to section 42; (w) for the purposes of section 57, governing the use and disclosure of information respecting trustees and their activities; (x) prescribing any matter or thing required or authorized by this Act to be prescribed in the regulations; (y) respecting any other matter or thing that the Lieutenant Governor in Council considers necessary to carry out the intent of this Act. (2) At least 30 days before the coming into force of a regulation made pursuant to clause (1)(d), (g), (l), (m), (o) or (r), the minister shall provide a copy of the proposed regulation to each of the health professional bodies that regulate members of a health profession pursuant to an Act. 1999, c H‑0.021, s 63; 2003, c 25, s 18; 2015, c 12, s 7. Offences 64(1) No person shall: (a) knowingly contravene any provision of this Act or the regulations; (b) without lawful justification or excuse, wilfully obstruct, hinder or resist the commissioner or any other person in the exercise of the powers, performance of the duties or the carrying out of the functions of the commissioner or other person pursuant to this Act; (c) without lawful justification or excuse, refuse or wilfully fail to comply with any lawful requirement of the commissioner or any other person pursuant to this Act; 36 c H-0.021 HEALTH INFORMATION PROTECTION (d) wilfully make any false statement to, or mislead or attempt to mislead, the commissioner or any other person in the exercise of the powers, performance of the duties or carrying out of the functions of the commissioner or other person pursuant to this Act; (e) wilfully destroy any record that is governed by this Act with the intent to evade a request for access to the record; or (f) obtain another person’s personal health information by falsely representing that he or she is entitled to the information. (1.1) No trustee or information management service provider, or former trustee or information management service provider, shall fail to keep secure the personal health information in its custody or control as required by this Act. (1.2) No person shall be found to have contravened subsection (1.1) if that person can establish that he or she took all reasonable steps to prevent the contravention. (2) Every person who contravenes subsection (1) or (1.1) is guilty of an offence and is liable on summary conviction: (a) in the case of an individual, to a fine of not more than $50,000, to imprisonment for not more than one year or to both; and (b) in the case of a corporation, to a fine of not more than $500,000. (3) Every director, officer or agent of a corporation who directed, authorized, assented to, acquiesced in or participated in an act or omission of the corporation that would constitute an offence by the corporation is guilty of that offence, and is liable on summary conviction to a fine of not more than $50,000, to imprisonment for not more than one year or to both, whether or not the corporation has been prosecuted or convicted. (3.1) An individual who is an employee of or in the service of a trustee or information management service provider and who knowingly discloses or directs another person to disclose personal health information in circumstances that would constitute an offence by the trustee or information management service provider pursuant to this Act is guilty of an offence and is liable on summary conviction to a fine of not more than $50,000, to imprisonment for not more than one year or to both, whether or not the trustee or information management service provider has been prosecuted or convicted. (3.2) An individual who is an employee of or in the service of a trustee and who wilfully accesses or uses or directs another person to access or use personal health information that is not reasonably required by that individual to carry out a purpose authorized pursuant to this Act is guilty of an offence and is liable on summary conviction to a fine of not more than $50,000, to imprisonment for not more than one year or to both, whether or not the trustee has been prosecuted or convicted. 37 HEALTH INFORMATION PROTECTION c H-0.021 (3.3) An individual who is an employee of or in the service of an information management service provider and who wilfully accesses or uses or directs another person to access or use personal health information for a purpose that is not authorized by subsection 18(1) of this Act is guilty of an offence and is liable on summary conviction to a fine of not more than $50,000, to imprisonment for not more than one year or to both, whether or not the information management service provider has been prosecuted or convicted. (4) No prosecution shall be commenced pursuant to this section except with the express consent of the Attorney General for Saskatchewan. (5) No prosecution shall be commenced pursuant to this section after the expiration of two years after the date of the discovery of the alleged offence. 1999, c H‑0.021, s 64; 2015, c 12, s 8. PART IX Transitional, Consequential Amendments and Coming into Force Transitional 65(1) The Lieutenant Governor in Council, on the recommendation of the minister, may, by order made within the first five years after the coming into force of this section, exempt any specified activities of a trustee from the application of this Act or any provision of this Act where: (a) in the minister’s opinion, the implementation of all or any provision of this Act will cause undue hardship to a trustee; and (b) the minister is satisfied that the exemption will not have a significant impact on the interests of individuals whose personal health information is in the custody or control of the trustee. (2) An order pursuant to subsection (1) must specify a date on which the exemption expires. 1999, c H‑0.021, s 65. 66 to 68 Dispensed. These sections make consequential amendments to other Acts. The amendments have been incorporated into the corresponding Acts. RSS 1978, c P-23, section 3.2 repealed 69 Not yet proclaimed. 1999, c H‑0.021, s 69. 70 Dispensed. This section makes consequential amendments to another Act. The amendments have been incorporated into the corresponding Act. Coming into force 71 This Act comes into force on proclamation. 1999, c H‑0.021, s 71. 38 c H-0.021 HEALTH INFORMATION PROTECTION REGINA, SASKATCHEWAN Printed by the authority of THE KING’S PRINTER Copyright©2024