Privacy Legislation
by Province or Territory
This table shows the availability of specific types of information about health data and its usage in privacy legislation across different provinces and territories. This table does not indicate whether specific actions are permitted.
Click on the province, territory or each of the icons to learn more about the specific type of information available.
Legend:
Information available
Information unavailable
| Type of Information | BC | AB | SK | MB | ON | QC | NB | NS | PE | NL | YK | NT | NU |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Policy/Law | |
|
|
|
|
|
|
|
|
|
|
|
|
| Personal Information (PI) / Personal Health Information (PHI) | |
|
|
|
|
|
|
|
|
|
|
|
|
| Reference to De-identified PI / PHI | |
|
|
|
|
|
|
|
|
|
|
|
|
| De-identified / Pseudonymous Data Defined | |
|
|
|
|
|
|
|
|
|
|
|
|
| PI / PHI Access for Research Secondary Use Permitted | |
|
|
|
|
|
|
|
|
|
|
|
|
| Provides Information Specifically for "Research Data Centre" | |
|
|
|
|
|
|
|
| |
|
|
|
| Role of Research Data "Holder" Defined | |
|
|
|
|
|
|
|
|
|
|
|
|
| Reference to Data Transfer Outside of the Province | |
 |
|
|
|
|
|
|
|
|
|
|
|
| Consent Requirement | |
|
|
|
|
|
|
|
|
|
|
|
|
| Consent Required for Transfer Outside of Province | |
|
|
|
|
|
|
|
|
|
|
|
|
| Agreement Directives | |
|
|
|
|
|
|
|
|
|
|
|
|
| Ministerial Discretion to Disclose | |
|
|
|
|
|
|
|
|
|
|
|
|
| Research Ethics Review Directive | |
|
|
|
|
|
|
|
|
|
|
|
|
| Additional Regulation Directives | |
|
|
|
|
|
|
|
|
|
|
|
|
| Other Specific Directives | |
|
|
|
|
|
|
|
|
|
|
|
|
| Policy Interpretation in Legislation or Regulations | |
|
|
|
|
|
|
|
|
|
|
|
|
| Reference to Unique Medical Number | |
|
|
|
|
|
|
|
|
|
|
|
|
| Reference to Data Linking/Matching for Research | |
|
|
|
|
|
|
|
|
|
|
|
|
Policy / Law
British Columbia
Manitoba
Quebec
New Brunswick
Nova Scotia
Prince Edward Island
Newfoundland and Labrador
Northwest Territories
Personal Information (PI) / Personal Health Information (PHI)
British Columbia
2 (1)The purposes of this Act (FIPPA) are to make public bodies more accountable to the public and to protect personal privacy by
(a) giving the public a right of access to records,
(b) giving individuals a right of access to, and a right to request correction of, personal information about themselves,
(c) specifying limited exceptions to the rights of access,
(d) preventing the unauthorized collection, use or disclosure of personal information by public bodies, and
(e) providing for an independent review of decisions made under this Act.
(2)This Act does not replace other procedures for access to information or limit in any way access to information that is not personal information and is available to the public.
Alberta
s. 1(1) (k) “health information” means one or both of the following:
(i) diagnostic, treatment and care information;
(ii) registration information;
Saskatchewan
s2(m) “personal health information” means, with respect to an individual, whether living or deceased:
(i) information with respect to the physical or mental health of the individual;
(ii) information with respect to any health service provided to the individual;
(iii) information with respect to the donation by the individual of any body part or any bodily substance of the individual or information derived from the testing or examination of a body part or bodily substance of the individual;
(iv) information that is collected:
(A) in the course of providing health services to the individual; or
(B) incidentally to the provision of health services to the individual;
or
(v) registration information;
Manitoba
This legislation does not limit disclosure outside of the province. Approvals are required from REB and from Health Information Privacy Committee (HIPC) - HIPC has limitations on disclosure outside of province. It is clear that data can be disclosed to Health Research Organizations outside of the province as CIHI is identified in regulation.
Ontario
4 (1) “personal health information”, subject to subsections (3) and (4), means identifying information about an individual in oral or recorded form, if the information,
(a) relates to the physical or mental health of the individual, including information that consists of the health history of the individual’s family,
(b) relates to the providing of health care to the individual, including the identification of a person as a provider of health care to the individual,
(c) is a plan of service within the meaning of the Home Care and Community Services Act, 1994 for the individual,
(c.1) is a plan that sets out the home and community care services for the individual to be provided by a health service provider or Ontario Health Team pursuant to funding under section 21 of the Connecting Care Act, 2019,
(d) relates to payments or eligibility for health care, or eligibility for coverage for health care, in respect of the individual,
(e) relates to the donation by the individual of any body part or bodily substance of the individual or is derived from the testing or examination of any such body part or bodily substance,
(f) is the individual’s health number, or
(g) identifies an individual’s substitute decision-maker.
Identifying information
(2) In this section, “identifying information” means information that identifies an individual or for which it is reasonably foreseeable in the circumstances that it could be utilized, either alone or with other information, to identify an individual.
Quebec
Act respecting Access to documents: 2. Personal information is any information which relates to a natural person and allows that person to be identfied.
New Brunswick
Information TBD
Nova Scotia
s4 (1) In addition to the matters referred to in clause 3(r) and subject to subsection 8(2), personal health information includes identifying information about an individual that is not personal health information but that is contained in a record that contains personal health information about the individual within the meaning of that clause.
Prince Edward Island
S1(t) “personal health information” means identifying information about an individual in oral or recorded form that
(i) relates to the individual’s physical or mental health, family health history or health care history, including genetic information about the individual,
(ii) relates to information about an individual that is collected for the purpose of registering the individual for the provision of health care, including a health number, medical record number and any other identifier assigned to an individual,
(iii) relates to the provision of health care to the individual,
(iv) relates to an individual’s entitlement to benefits under or participation in a health care program or service,
(v) is collected in the course of, and is incidental to, the provision of a health care program or service or payment for a health care program or service,
(vi) relates to a drug, a health care aid, device, product, equipment or other item provided to an individual under a prescription or other authorization issued by a health care provider,
(vii) relates to information about payments or eligibility for health care in respect of the individual, or eligibility for coverage for health care in respect of the individual,
(viii) relates to the donation by the individual of any body part or bodily substance of the individual or is derived from the testing or examination of any body part or bodily substance,
(ix) identifies the individual’s substitute decision maker, or
(x) identifies the individual’s health care provider;
Newfoundland and Labrador
S 5. (1) In this Act, "personal health information" means identifying information in oral or recorded form about an individual that relates to
(a) the physical or mental health of the individual, including information respecting the individual's health care status and history and the health history of the individual's family;
(b) the provision of health care to the individual, including information respecting the person providing the health care;
(c) the donation by an individual of a body part or bodily substance, including information derived from the testing or examination of a body part or bodily substance;
(d) registration information;
(e) payments or eligibility for a health care program or service in respect of the individual, including eligibility for coverage under an insurance or payment arrangement with respect to health care;
(f) an individual's entitlement to benefits under or participation in a health care program or service;
(g) information about the individual that is collected in the course of, and is incidental to, the provision of a health care program or service or payment for a health care program or service;
(h) a drug as defined in the Pharmacy Act, 2012 , a health care aid, device, product, equipment or other item provided to an individual under a prescription or other authorization issued by a health care professional; or
(i) the identity of a person referred to in section 7.
Yukon
s. 2(1) “personal health information” of an individual means
(a) health information of the individual, and
(b) except as prescribed, prescribed registration information and prescribed provider registry information in respect of the individual;
“Personal information” has the same meaning as in the Access to Information and Protection of Privacy Act.
Northwest Territories
s. 1(1) "personal health information" means the following information in any form that identifies an individual, or in respect of which it is reasonably foreseeable in the circumstances that the information could be used, either alone or with other information, to identify an individual.
Nunavut
“health information" means information in any format collected or maintained under this Act concerning the health of an individual, living or deceased, and includes any of the following information:
(a) information about a pathogen with which an individual is infected or to which the individual has been exposed,
(b) information about other health conditions to which an individual is subject,
(c) information about health services provided to an individual,
(d) information about individual's health care history,
(e) information that is collected in the course of, or incidental to, the provision of health services to an individual,
(f) information in respect of the examination or testing of an individual by, or on referral from, a health care professional,
(g) information in respect of an individual's receipt, donation or transfusion of cellular material, an organ, tissue, blood or a blood product,
(h) an identifying number, symbol or other particular assigned to an individual in respect of health services or health information; (renseignements sur la santé)
Reference to De-identified PI / PHI
British Columbia
According to FIPPA, "personal information" means recorded information about an identifiable individual other than contact information. And "contact information" means information to enable an individual at a place of business to be contacted and includes the name, position name or title, business telephone number, business address, business email or business fax number of the individual.
Alberta
s. 1(1) (p) “individually identifying”, when used to describe health information, means that the identity of the individual who is the subject of the information can be readily ascertained from the information;
26 A custodian may use non‑identifying health information for any purpose.
Saskatchewan
s3(2) This Act does not apply to: (a) statistical information or de-identified personal health information that cannot reasonably be expected, either by itself or when combined with other information available to the person who receives it, to enable the subject individuals to be identified.
Manitoba
Personal Health Information Act: Yes (but only if contact is required). Approval bodies may interpret this more broadly. Consent requirement is covered in several sections but with regard to research section 24(5) If a research project will require direct contact with individuals, a trustee shall not disclose personal health information about those individuals under this section without first obtaining their consent. However, the trustee need not obtain their consent if the information consists only of the individuals' names and addresses.
Freedom of Information and Protection of Privacy Act: Collection of public data requires consent at the time of collection under section 37(2)
Ontario
PHIPA and its Regulation to clarify the definition of de-identify (Bill 188 - March 2020)
Quebec
No reference made.
New Brunswick
Personal Health Information Privacy and Access Act:
s 30 "A custodian may collect personal health information that has been de-identified for any purpose"
s 33 "A custodian may use personal health information that has been de-identified for any purpose."
s34 (h) permits a custodian to use PHI for disposing or de-identifying the information, and s34 (q) to produce de-identified information that does not, either by itself or in combination with other information in the custody of or under the control of the custodian, permit an individual to be identified.
s 36 "A custodian may disclose personal health information that has been de-identified for any purpose."
37(5)A custodian may disclose personal health information relating to an individual who is deceased or presumed to be deceased...(e) for research purposes under section 43 if the information has been de-identified.
s43 speaks to disclosure for research purposes if the review body has been informed of (d)(ii) procedures to destroy the information or de-identify the information at the earliest opportunity, consistent with the purposes of the project.
s51 A custodian may strip, encode or otherwise transform personal health information in order to create or produce de-identified information.
Nova Scotia
Does not apply to 'de-identified data' as defined in this act.
s5(2)(b)This Act does not apply to (a) statistical, aggregate or de-identified health information.
Prince Edward Island
s1(g) “de-identified information” means personal health information that has been stripped, encoded or otherwise transformed so as to ensure that the identity of the individual who was the subject of the personal health information cannot be readily ascertained from the de-identified information.
Newfoundland and Labrador
No reference made
Yukon
s. 14 Non-identifying information
Nothing in this Act limits any person’s right to collect, use or disclose information that is not identifying information.
Northwest Territories
s. 1(4) Nothing in this Act shall be construed so as to identifying health prevent a health information custodian from collecting, information using or disclosing non-identifying information. S.N.W.T. 2015,c.14,s.27. S36 Subject to the regulations, a health mation of information custodian may strip, encode or otherwise transform personal health information to create or produce non-identifying information
Nunavut
There does not appear to be authority for the Minister to disclose PHI.
De-identified / Pseudonymous Data Defined
British Columbia
The BC Ministry of Health's 2018 Policy Instrument: Access to Health Data for Research provides some helpful definitions for researchers that are consistent with what you find in TCPS:
- “de-identification” means a process that removes, or transforms, direct and indirect identifiers in a record using methods that can include generalization, suppression, aggregation and randomization, and for unstructured data can include redacting or severing, with deidentification processes resulting in partial de-identification or anonymization;
- “direct identifiers” means information that identifies an individual without additional information, with examples including an individual’s name or a unique identifier such as a personal health number;
- "indirect identifiers” means information that is not a direct identifier but which may identify an individual when it is connected with other pieces of information to single out an individual, with indirect identifiers being considered personal information if they can be combined together to identify an individual, due to what is commonly referred to as the mosaic effect;
- “partial de-identification” means a de-identification process that removes direct identifiers and manages the indirect identifiers that could potentially be combined to identify an individual. Partially de-identified records contain personal information. Therefore, the disclosure of partially de-identified records would require appropriate authorization under Part 3 of Freedom of Information and Protection of Privacy Act.
Alberta
A custodian may collect, use, and disclose non-identifying health information for any purpose (s 19, 26, and 32) “non‑identifying”, when used to describe health information, means that the identity of the individual who is the subject of the information cannot be readily ascertained from the information.
Saskatchewan
s2(d) "de-identified personal health information” means personal health information from which any information that may reasonably be expected to identify an individual has been removed.
Manitoba
Personal Health Information Act: Express consent is required if there is any direct contact or identification anticipated. Although not under the research sections disclosure without consent outside of the jurisdiction may be permitted (S 22 (2.2) by minister but only for the purpose of monitoring or evaluating extra-jurisdictional provision of health care. This appears to only be for specific individuals.
Freedom of Information and Protection of Privacy Act: There is no requirement beyond the purpose of the collection.
Ontario
Relating to s 47 (health data institute) “de-identify”, in relation to the personal health information of an individual, means to remove any information that identifies the individual or for which it is reasonably foreseeable in the circumstances that it could be utilized, either alone or with other information, to identify the individual, and “de-identification” has a corresponding meaning; (“anonymiser”).
Quebec
No reference made.
New Brunswick
“De-identified” (anonymisé), when referring to personal health information, means personal health information from which all identifying information has been removed.
Nova Scotia
s3 (g) “de-identified information” is information that has had all identifiers removed that
(i) identify the individual, or
(ii) where it is reasonably foreseeable in the circumstances, could be utilized, either alone or with other information, to identify the individual;
Prince Edward Island
s1(g) “de-identified information” means personal health information that has been stripped, encoded or otherwise transformed so as to ensure that the identity of the individual who was the subject of the personal health information cannot be readily ascertained from the de-identified information.
Newfoundland and Labrador
No reference made
Yukon
s. 14 Non-identifying information
Nothing in this Act limits any person’s right to collect, use or disclose information that is not identifying information.
Northwest Territories
s. 28(1) Subject to subsection (3) and the regulations, a health information custodian shall not collect, use or
disclose personal health information if non-identifying health information would be adequate for the intended purposes of the collection, use or disclosure.
Nunavut
The Chief Public Health Officer can, relevantly, disclose PHI with consent (s 19(a)) or to a public health official in another Canadian jurisdiction under an arrangement for the sharing of information to prevent or control the spread of a disease or condition or for the purpose of public health surveillance (s 19(d)).
PI / PHI Access for Research Secondary Use Permitted
British Columbia
FIPPA authorizes public bodies to disclose personal information for research purposes with or without consent. FIPPA provides a number of ways to release information for research purposes. One must pick a section of FIPPA and simply follow the criteria within that section. The most common are with consent (Section 27 (2)) or under Section 35 (please see section below).
Section 35 of the Freedom of Information and Protection of Privacy Act
A public body may disclose personal information or may cause personal information in its custody or under its control to be disclosed for a research purpose, including statistical research, only if
- (a) the research purpose cannot reasonably be accomplished unless that information is provided in individually identifiable form or the research purpose has been approved by the commissioner,
- (a.1) the information is disclosed on condition that it not be used for the purpose of contacting a person to participate in the research,
- (b) any record linkage is not harmful to the individuals that information is about and the benefits to be derived from the records linkage are clearly in the public interest,
- (c) the head of the public body concerned has approved conditions relating to the following:
- security and confidentiality;
- the removal or destruction of individual identifiers at the earliest reasonable time;
- the prohibition of any subsequent use or disclosure of that information in individually identifiable form without the express authorization of that public body, and
- (d) the person to whom that information is disclosed has signed an agreement to comply with the approved conditions, this Act and any of the public body’s policies and procedures relating to the confidentiality of personal information.
Alberta
s. 1(1) (v) “research” means academic, applied or scientific research that necessitates the use of individually identifying health information;
27(1) A custodian may use individually identifying health information in its custody or under its control for the following purposes: (d) conducting research or performing data matching or other services to facilitate another person’s research
49 A person who intends to conduct research using health information in the custody or under the control of a custodian or health information repository must submit a proposal to a research ethics board for review by that board containing
(a) the information specified by the regulations, and
(b) any other information required by the research ethics board.
Saskatchewan
29(1) A trustee or a designated archive may use or disclose personal health information for research purposes with the express consent of the subject individual if:
(a) in the opinion of the trustee or designated archive, the research project is not contrary to the public interest;
(b) the research project has been approved by a research ethics committee approved by the minister; and
(c) the person who is to receive the personal health information enters into an agreement with the trustee or designated archive that contains provisions:
(i) providing that the person who is to receive the information must not disclose the information;
(ii) providing that the person who is to receive the information will ensure that the information will be used only for the purpose set out in the agreement;
(iii) providing that the person who is to receive the information will take reasonable steps to ensure the security and confidentiality of the information; and
(iv) specifying when the person who is to receive the information must do all or any of the following:
(A) return to the trustee or designated archive any original records or copies of records containing personal health information;
(B) destroy any copies of records containing personal health information received from the trustee or designated archive or any copies made by the researcher of records containing personal health information received from the trustee or designated archive.
(2) Where it is not reasonably practicable for the consent of the subject individual to be obtained, a trustee or designated archive may use or disclose personal health information for research purposes if:
(a) the research purposes cannot reasonably be accomplished using de-identified personal health information or other information;
(b) reasonable steps are taken to protect the privacy of the subject individual by removing all personal health information that is not required for the purposes of the research;
(c) in the opinion of the research ethics committee, the potential benefits of the research project clearly outweigh the potential risk to the privacy of the subject individual; and
(d) all of the requirements set out in clauses (1)(a) to (c) are met.
Manitoba
Personal Health Information Act: Individuals need to enter into an agreement under section 24(4) the sets expectations about publication, use, and safeguards. Disclosure to a Health Research Organization (24.1 (4)) also has an agreement required as outlined in regulation and meeting the purpose for use under 24.1(2). Regulation 8.4 (for researchers) an d8.5 for research organizations.
Freedom of Information and Protection of Privacy Act: S 47(4) requires an agreement to be completed with the head of the public body.
Ontario
Disclosure for research
44 (1) A health information custodian may disclose personal health information about an individual to a researcher if the researcher,
(a) submits to the custodian,
(i) an application in writing,
(ii) a research plan that meets the requirements of subsection (2), and
(iii) a copy of the decision of a research ethics board that approves the research plan; and
(b) enters into the agreement required by subsection (5). 2004, c. 3, Sched. A, s. 44 (1).
(1.1) For greater certainty, the decision of only one research ethics board is sufficient for the purposes of subclause (1)
(a) (iii). 2020, c. 5, Sched. 6, s. 6.
Research plan
(2) A research plan must be in writing and must set out,
(a) the affiliation of each person involved in the research;
(b) the nature and objectives of the research and the public or scientific benefit of the research that the researcher anticipates; and
(c) all other prescribed matters related to the research.
Consideration by board
(3) When deciding whether to approve a research plan that a researcher submits to it, a research ethics board shall consider the matters that it considers relevant, including,
(a) whether the objectives of the research can reasonably be accomplished without using the personal health information that is to be disclosed;
(b) whether, at the time the research is conducted, adequate safeguards will be in place to protect the privacy of the individuals whose personal health information is being disclosed and to preserve the confidentiality of the information;
(c) the public interest in conducting the research and the public interest in protecting the privacy of the individuals whose personal health information is being disclosed; and
(d) whether obtaining the consent of the individuals whose personal health information is being disclosed would be impractical.
Decision of board
(4) After reviewing a research plan that a researcher has submitted to it, the research ethics board shall provide to the researcher a decision in writing, with reasons, setting out whether the board approves the plan, and whether the approval is subject to any conditions, which must be specified in the decision.
Agreement respecting disclosure
(5) Before a health information custodian discloses personal health information to a researcher under subsection (1), the researcher shall enter into an agreement with the custodian in which the researcher agrees to comply with the conditions and restrictions, if any, that the custodian imposes relating to the use, security, disclosure, return or disposal of the information.
Compliance by researcher
(6) A researcher who receives personal health information about an individual from a health information custodian under subsection (1) shall,
(a) comply with the conditions, if any, specified by the research ethics board in respect of the research plan;
(b) use the information only for the purposes set out in the research plan as approved by the research ethics board;
(c) not publish the information in a form that could reasonably enable a person to ascertain the identity of the individual;
(d) despite subsection 49 (1), not disclose the information except as required by law and subject to the exceptions and additional requirements, if any, that are prescribed;
(e) not make contact or attempt to make contact with the individual, directly or indirectly, unless the custodian first obtains the individual’s consent to being contacted;
(f) notify the custodian immediately in writing if the researcher becomes aware of any breach of this subsection or the agreement described in subsection (5); and
(g) comply with the agreement described in subsection (5).
Mixed disclosures
(7) If a researcher submits a research plan under subsection (1) that proposes that a health information custodian that is an institution within the meaning of the Freedom of Information and Protection of Privacy Act or the Municipal Freedom of Information and Protection of Privacy Act or that is acting as part of such an institution disclose to the researcher personal health information, together with personal information within the meaning of those two Acts that is not personal health information, those two Acts do not apply to the disclosure and this section applies to the disclosure. “research” means a systematic investigation designed to develop or establish principles, facts or generalizable knowledge, or any combination of them, and includes the development, testing and evaluation of research; (“recherche”) “researcher” means a person who conducts research; (“chercheur”) “research ethics board” means a board of persons that is established for the purpose of approving research plans under section 44 and that meets the prescribed requirements; (“commission d’éthique de la recherche”)
Quebec
Act respecting the sharing of certain health information: 27. At the request of an authorized provider or body, the operations manager of a health information bank in the medication domain releases to them, in accordance with their access authorizations, the information that can be released through the Québec Health Record.
Act respecting Access to documents: 18. A person carrying on an enterprise may, without the consent of the person concerned, communicate personal information contained in a file he holds on that person
(8) to a person who is authorized to use the information for study, research or statistical purposes in accordance with section 21
21. The Commission d'accèss à l'information […] may, on written request, grant a person authorized to receive communication of personal information for study, research or statistical purposes, without the consent of the persons concerned, if it is of the opinion that
(1) the intended use is not frivolous and the ends contemplated cannot be achieved unless the information is communicated with a form allowing the persons to be identified
(2) the information will be used in a manner that will ensure its confidentiality
New Brunswick
PHI access, use and disclosure are permitted under section 43 "Disclosure for Research Purposes"
43(1) A custodian may disclose personal health information to a person conducting a research project only if the project has been approved under this section."; and specially 43.1 "Disclosure to a research data centre"
Nova Scotia
A custodian may disclose personal health information about an individual collected in the Province to a person outside the Province if the disclosure is permitted in the act or regulations (s 44(1)(b)). There are two applicable scenarios. Custodian permitted to disclose to CIHI within the terms of their agreement (s 38(1)(i)). More generally, disclosure to researchers appears to be allowed under s 57 without consent if it is for research purposes and the conditions listed in s 56-60 are met.
Prince Edward Island
Research Using Personal Health Information s30-s33: detailed requirements provided.
Newfoundland and Labrador
Personal Health Information Act: Disclosure for research purposes
s44.A custodian may disclose personal health information without the consent of the individual who is the subject of the information for research purposes but only where the research project has been approved by a research ethics board or research ethics body under the Health Research Ethics Authority Act .
This appears to directly contradict s 25(1)(a), which requires consent for disclosure to a non-custodian. A permitted collection and usage for research with approval for Research Ethics Body or Research Ethics Board. A custodian can disclose for a research if a person is deceased s38(e) Also "indirect collection" s31(d) the custodian collects the information from a person who is not a custodian for the purpose of carrying out a research project that has been approved by the research ethics board or a research ethics body.
Disclosure also permitted to CIHI if it is for management/evaluation of the health care system and within the confines of their agreement with the province (s 39(1)(h)).
Health Research Ethics Authority Act: s. 2(d) "health research involving human subjects" means activities whose primary goal is to generate knowledge in relation to human health, health care and health care systems, and involving human beings as research subjects, health care information respecting human beings and human biological material.
Access to Information and Protection of Privacy Act: s. 70(a) A public body may disclose personal information for a research purpose, including statistical research, only where
(a) the research purpose cannot reasonably be accomplished unless that information is provided in individually identifiable form
Yukon
s. 2(1) “research” means a systematic investigation (other than a designated investigation) of personal health information designed to develop or establish principles, facts or general knowledge, and includes the development, testing and evaluation of research;
s. 66(1) Subject to subsection (2), a custodian may, for the purpose of research, collect an individual’s personal health information from the individual or any other person.
Northwest Territories
s. 76(1) Subject to sections 79 and 80, a health information custodian may disclose personal health information to a researcher in accordance with section 77 or 78.
Nunavut
S16 (3) Authorized purposes Health information may only be accessed, used or disclosed under this Act for one or more of the following purposes:
(a) any purpose for which it may be collected under subsection 17(1);
(b) any purpose authorized under section 19;
(c) any purpose authorized under the Access to Information and Protection of Privacy Act.
Personal health information (4) Under this Act, personal health information may only be (a) accessed or used to the extent that it is necessary for the purposes authorized under subsection (3); and 9 S.Nu. 2016,c.13
Public Health Act, Consolidation of Current to: 2019-12-19 (b) disclosed to the extent that is necessary for the purposes authorized under paragraphs (3)(b) and (c).
Access to Information and Protection of Privacy Act
S49 Disclosure for research. A public body may only disclose personal information for a research purpose, including statistical research, where
(a) the research purpose cannot reasonably be accomplished unless that information is provided in individually identifiable form;
(b) any record linkage resulting from the disclosure is not harmful to the individuals the information is about and the benefits to be derived from the record linkage are clearly in the public interest;
(c) the head of the public body has approved conditions relating to the following:
(i) security and confidentiality,
(ii) the removal or destruction of individual identifiers at the earliest reasonable time,
(iii) the prohibition of any subsequent use or disclosure of that information in individually identifiable form without the express authorization of that public body; and
(d) the person to whom the information is disclosed has signed an agreement to comply with the approved conditions, this Act and the regulations and any of the public body's policies and procedures relating to the confidentiality of personal information.
Provides Information Specifically for "Research Data Centre"
British Columbia
The Ministry of Health 2018 Policy Instrument talks about Population Data BC (PopData) when it states that the Ministry will disclose data from which direct identifiers have been removed, and will disclose personal information, only on the conditions set out in this policy.
This underscores the fact that the policy is aimed at the vast majority of data access requests, which are for “data” provisioned through PopData, from which direct identifiers have been removed. The discretion of the Chief Data Steward to approve access to fully-identifiable personal information recognizes that in some cases access to fully-identifiable personal information may be warranted, subject to compliance with the other conditions set out in this policy. This section does not affect the discretion of the Data Stewardship Committee under certain of the applicable laws to approve access to fully-identifiable personal information.
Alberta
s. 66 (1) In this section, “information manager” means a person or body that
(a) processes, stores, retrieves or disposes of health information,
(b) in accordance with the regulations, strips, encodes or otherwise transforms individually identifying health information to create non‑identifying health information, or
(c) provides information management or information technology services
Saskatchewan
No information provided.
Manitoba
Personal Health Information Act: Section 22 (2.2) is limited to other governments and the data is limited to individuals in that jurisdiction.
Freedom of Information and Protection of Privacy Act: S 47(4) The head of the public body must be satisfied that a number of conditions are met.
Ontario
No information provided.
Quebec
Act respecting the sharing of certain health information: 28. As soon as possible, an institution or a person or partnership operating a medical biology laboratory must release to the operations manager of a health information bank in the laboratory domain the health information listed in section 29 concerning any results of a medical biology analysis they produce for a person’s file or that are produced, at their request, by the laboratory of Héma-Québec, the laboratory of Centre de toxicologie du Québec or the Laboratoire de santé publique du Québec.
New Brunswick
“Custodian” means an individual or organization that collects, maintains or uses personal health information for the purpose of providing or assisting in the provision of health care or treatment or the planning and management of the health care system or delivering a government program or service.
Nova Scotia
No reference made.
Prince Edward Island
s1 (z) “research data repository” means an organization that has entered into an agreement with the province for the purpose of (i) conducting and facilitating research to describe and explain health care patterns and profiles of health and illness, (ii) assisting in the evaluation of monitoring of health care service planning or the delivery of a government service, or (iii) facilitating research between or among areas such as health care, justice, education and social services;
Newfoundland and Labrador
Personal Health Information Act: s(2) (c) "Centre for Health Information" means the Newfoundland and Labrador Centre for Health Information continued as a corporation under the Centre for Health Information Act, 2018;
(i) the Centre for Health Information
Yukon
s. 2(1) “custodian” means a person (other than a person who is prescribed not to be a custodian) who is
(a) the Department,
(b) the operator of a hospital or health facility,
(c) a health care provider,
(d) a prescribed branch, operation or program of a Yukon First Nation,
(e) the Minister,
(f) a person who, in another province
(i) performs functions substantially similar to the functions performed by a health care provider, and
(ii) is, in the performance of those functions, subject to an enactment, of Canada or a province, that governs the collection, use and disclosure of personal information or personal health information, or
(g) a prescribed person.
Northwest Territories
No information provided.
Nunavut
No information provided.
Role of Research Data "Holder" Defined
British Columbia
The closest mention is Population Data BC (PopData) as outlined above.
Alberta
s. 1(1) (f) "custodian" means (i) the board of an approved hospital as defined in the Hospitals Act other than an approved hospital that is
(A) owned and operated by a regional health authority established under the Regional Health Authorities Act, or
(ii) the operator of a nursing home as defined in the Nursing Homes Act other than a nursing home that is owned and operated by a regional health authority established under the Regional Health Authorities Act;
(ii.1) an ambulance operator as defined in the Emergency Health Services Act;
(iii) a provincial health board established pursuant to regulations made under section 17(1)(a) of the Regional Health Authorities Act;
(iv) a regional health authority established under the Regional Health Authorities Act;
(v) a community health council as defined in the Regional Health Authorities Act;
(vi) a subsidiary health corporation as defined in the Regional Health Authorities Act.
Saskatchewan
(t) “trustee” means any of the following that have custody or control of personal health information:
(i) a government institution;
(ii) the provincial health authority or a health care organization;
(iii) Repealed. 2002, c.R-8.2, s.77.
(iv) a licensee as defined in The Personal Care Homes Act;
(v) a person who operates a facility as defined in The Mental Health Services Act;
(vi) a licensee as defined in The Health Facilities Licensing Act;
(vi.1) a licensee as defined in The Patient Choice Medical Imaging Act;
(vii) an operator as defined in The Ambulance Act;
(viii) a licensee as defined in The Medical Laboratory Licensing Act, 1994;
(ix) a proprietor as defined in The Pharmacy and Pharmacy Disciplines Act;
(x) a community clinic:
(A) as defined in section 263 of The Co-operatives Act, 1996;
(B) Repealed. 2014, c.17, s.7.
(C) incorporated or continued pursuant to The Non-profit Corporations Act, 1995;
(xi) the Saskatchewan Cancer Foundation;
(xii) a person, other than an employee of a trustee, who is:
(A) a health professional licensed or registered pursuant to an Act for which the minister is responsible; or
(B) a member of a class of persons designated as health professionals in the regulations;
(xiii) a health professional body that regulates members of a health profession pursuant to an Act;
(xiv) a person, other than an employee of a trustee, who or body that provides a health service pursuant to an agreement with another trustee;
(xv) any other prescribed person, body or class of persons or bodies;
Manitoba
Personal Health Information Act: Section 24(3) identifies that approval is required by Health Information Privacy Committee (HIPC) as established in the act and directed by Regulation. An institutional research review committee is required. Interesting the legislation only if information is maintained by a non government agency (although HIPC requires REB approval).
Freedom of Information and Protection of Privacy Act: Section 47 does not specifically identify research ethics review beyond satisfaction of the head of the public body.
Ontario
No information provided.
Quebec
Act respecting the sharing of certain health information: s. 16 The agreement also sets out the cases and circumstances in which and the conditions under which the operations manager of a health information bank in a clinical domain may entrust all or some of the services dedicated to hosting, operating and using the health information bank under its management to a third person, by means of a mandate or a service contract or contract of enterprise.
Act respecting Access to documents: 18.2. The person to whom the information is communicated must preserve the confidentiality of the personal information throughout the period during which it may not be communicated without the consent of the person concerned.
New Brunswick
“Research data centre” means a public body that compiles and links personal information or personal health information for the purposes of research, analysis or evidence-based decision-making.
Nova Scotia
Research s52-60 references custodian and:
s29 (1) Where a custodian is authorized to use personal health information for a purpose, the custodian may provide the information to an agent who may use it for that purpose on behalf of the custodian.
(2) For the purpose of this Act, the providing of personal health information between a custodian and an agent of the custodian is a use by the custodian, and not a disclosure by the custodian or a collection by the agent.
Prince Edward Island
Research data repository is a custodian.
s1(e) “custodian” means a person or organization that collects, maintains, uses or discloses personal health information for the purpose of providing or assisting in the provision of health care or treatment or the planning and management of the health care system or delivering a government program or service related to health care, and, without limiting the foregoing, includes...(vi.1) a research data repository...authority of custodian
Authorized purposes
s22(5)A custodian may use personal health information in its custody or under its control for one or more of the following purposes:
(m) for a research project approved by a research ethics board under section 30;
(n) for the purpose of conducting research or performing other services to facilitate another person’s research
(i) if the custodian or researcher has submitted a research plan to a research ethics board in accordance with section 30,
(ii) if the research ethics board has approved the research plan,
(iii) if the custodian or researcher has complied with or undertaken to comply with any conditions imposed by the research ethics board, and
(iv) where the research ethics board recommends that consents should be obtained from the individuals whose personal health information is to be used, if those consents have been obtained;
(o) for the purpose of performing data-matching;
Newfoundland and Labrador
Personal Health Information Act: "Centre for Health Information" means the Newfoundland and Labrador Centre for Health Information continued as a corporation under the Centre for Health Information Act, 2018; is a custodian under s4
Custodian
(i) In this Act, "custodian" means a person described in one of the following paragraphs who has custody or control of personal health information as a result of or in connection with the performance of the person's powers or duties or the work described
Access to Information and Protection of Privacy Act: s. 6(1) (a) a public body is a custodian; and
(b) the information or record that is in the custody or control of a public body that is a custodian is personal health information.
(2) For the purpose of this section, "custodian" and "personal health information" have the meanings ascribed to them in the Personal Health Information Act.
Yukon
s. 66(2) If a custodian intends to collect an individual’s personal health information for the purpose of research (other than research that is incidental to a purpose for which this Act otherwise allows the custodian to collect the personal health information), the custodian must
(a) where the custodian is a public body, a branch, operation or program of a Yukon First Nation or a prescribed person, meet the prescribed requirements, if any; or
(b) where the custodian is not a person described in paragraph (a), obtain prior approval of the collection by an institutional research review committee.
Northwest Territories
s. 1(1) "health information custodian" means
(a) the Department,
(b) a medical practitioner, other than a medical practitioner acting as an agent of a health information custodian,
(c) a pharmacist as defined in subsection 1(1) of the Pharmacy Act, other than a pharmacist acting as an agent of a health information custodian,
(d) a prescribed organization responsible under the Hospital Insurance and Health and Social Services Administration Act for the management, control and operation of one or more facilities from which health services are provided, or
(e) a prescribed person or class of persons, or a prescribed organization other than an organization prescribed as a health information custodian under paragraph (d);
s. 1(1) "researcher" means a person or organization, including a health information custodian, that collects or uses, or wishes to collect or to use, personal health information for research purposes.
Nunavut
Due to its lack of PHI legislation, there are virtually no relevant guiding documents available.
Reference to Data Transfer Outside of the Province
British Columbia
No reference made.
Alberta
Nothing appears to explicitly allow or disallow cross-border data sharing. Disclosure for research is allowed subject to Research Ethics Board approval (s 49) and an agreement between researcher and custodian (s 54(1)).
Saskatchewan
There do not appear to be any limitation on cross-jurisdictional disclosure in the Act or regulations.
Manitoba
Regulations are used to identify access and use requirements, safeguard precautions, auditing, policy and procedure requirements, functioning of Health Information Privacy Committee (HIPC), ID of Health Research Organization and content of agreement, what information can be shared as "demographic" data for linkage and eligibility.
Ontario
50 (1) A health information custodian may disclose personal health information about an individual collected in Ontario to a person outside Ontario only if,
(a) the individual consents to the disclosure;
(b) this Act permits the disclosure;
In the case of section 50(1)(b), the requirements of section 44(10) must be satisfied.
Research approved outside Ontario
44(10) Subject to subsection (11), a health information custodian may disclose personal health information to a researcher or may use the information to conduct research if,
(a) the research involves the use of personal health information originating wholly or in part outside Ontario;
(b) the research has received the prescribed approval from a body outside Ontario that has the function of approving research; and
(c) the prescribed requirements are met.
(11) Subsections (1) to (4) and clauses (6) (a) and (b) do not apply to a disclosure or use made under subsection (10) and references in the rest of this section to subsection (1) shall be read as references to this subsection with respect to that disclosure or use.
Quebec
Act respecting Access to documents: 17. Every person carrying on an enterprise in Québec who communicates personal information outside Québec or entrusts a person outside Québec with the task of holding, using or communicating such information on his behalf must first take all reasonable steps to ensure
(1) that the information will not be used for purposes not relevant to the object of the file or communicated to third persons without the consent of the persons concerned, except in cases similar to those described in sections 18 and 23;
(2) in the case of nominative lists, that the persons concerned have a valid opportunity to refuse that personal information concerning them be used for purposes of commercial or philanthropic prospection and, if need be, to have such information deleted from the list.
If the person carrying on an enterprise considers that the information referred to in the first paragraph will not receive the protection afforded under subparagraphs 1 and 2, the person must refuse to communicate the information or refuse to entrust a person or a body outside Québec with the task of holding, using or communicating it on behalf of the person carrying on the enterprise.
New Brunswick
Personal Health Information Privacy and Access Act: Disclosure to a person outside of New Brunswick is allowed only with the express consent of the individual (s 19(1)(d)). - (Section 47 Disclosure outside of the Province was repealed in 2017).
79(1)The Lieutenant-Governor in Council may make regulations [.]
Nova Scotia
No information provided.
Prince Edward Island
s35 Disclosure can be made out of province without consent if the disclosure is for a purpose specified in s 23(7), (10), and (13).
s23(13)(h) permits disclosure to a research data repository in accordance with the terms of an agreement between the research data repository and the custodian; the Lieutenant Governor may make regulations
s81(1)(s) prescribes for the purposes of section 35 the circumstances in which a custodian may disclose personal health information relating to an individual that is collected in the province to a person outside the province.
Newfoundland and Labrador
Personal Health Information Act: s47(1) A custodian may disclose personal health information about an individual collected in the province to a person outside the province but only where
(a) the individual who is the subject of the information consents to the disclosure;
(b) the disclosure is permitted by this Act or the regulations.
Regulations 90. (1) The Lieutenant-Governor in Council may make regulations
(n) prescribing circumstances in which personal health information may be stored, transferred, used or disclosed outside the province;
Access to Information and Protection of Privacy Act: s. 5(1) This Act (b) does not prohibit the transfer, storage or destruction of a record in accordance with an Act of the province or Canada or a by-law or resolution of a local public body;
s. 95(1) (ii) In addition to the commissioner’s powers and duties under Parts II and III, the commissioner may using information technology in the collection, storage, use or transfer of personal information.
Yukon
No reference made.
Northwest Territories
Does not specify whether within or outside of province.
s. 108(1) A health information custodian may transfer an access request or part of an access request to another custodian, if the access request or part relates to a record
(a) that was made by or for the other custodian;
(b) that was first obtained by the other custodian; or
(c) that is in the custody or under the control of the other custodian.
Nunavut
No reference made.
Consent Requirement
British Columbia
FIPPA authorizes public bodies to disclose personal information for research purposes with or without consent. FIPPA provides a number of ways to release information for research purposes. One must pick a section of FIPPA and simply follow the criteria within that section. The most common are with consent (Section 27 (2)) or under Section 35.
Alberta
s. 23 A custodian that collects health information from an individual using a recording device or camera or any other device that may not be obvious to the individual must, before collecting the information, obtain the written consent of the individual to the use of the device or camera.
s. 34 (1) Subject to sections 35 to 40, a custodian may disclose individually identifying health information to a person other than the individual who is the subject of the information if the individual has consented to the disclosure.
(2) A consent referred to in subsection (1) must be provided in writing or electronically and must include
(a) an authorization for the custodian to disclose the health information specified in the consent,
(b) the purpose for which the health information may be disclosed,
(c) the identity of the person to whom the health information may be disclosed,
(d) an acknowledgment that the individual providing the consent has been made aware of the reasons why the health information is needed and the risks and benefits to the individual of consenting or refusing to consent,
(e) the date the consent is effective and the date, if any, on which the consent expires, and
(f) a statement that the consent may be revoked at any time by the individual providing it.
(3) A disclosure of health information pursuant to this section must be carried out in accordance with the terms of the consent.
Saskatchewan
s29(1) with express consent of the subject individual
s29(2) Where it is not reasonably practicable for the consent of the subject individual to be obtained, a trustee or designated archive may use or disclose personal health information for research purposes if:
(a) the research purposes cannot reasonably be accomplished using de-identified personal health information or other information;
(b) reasonable steps are taken to protect the privacy of the subject individual by removing all personal health information that is not required for the purposes of the research
(c) in the opinion of the research ethics committee, the potential benefits of the research project clearly outweigh the potential risk to the privacy of the subject individual; and
(d) all of the requirements set out in clauses (1)(a) to (c) are met.
Manitoba
Definitions includes "demographic information", institutional research review committee, personal health information. Use, disclosure sections includes exceptions that allow for research without consent and allows for use/disclosure for purpose of de-identification.
Ontario
s 44 Consideration by board
(3) When deciding whether to approve a research plan that a researcher submits to it, a research ethics board shall consider the matters that it considers relevant, including,
(d) whether obtaining the consent of the individuals whose personal health information is being disclosed would be impractical.
Quebec
Act respecting the sharing of certain health information: s 8. Every person receiving health services or social services is presumed to have consented to the release of his or her health information through the Québec Health Record, unless the person has expressed refusal under section 46.
s. 100 That information may only be released to a third person with the written consent of the person concerned. In such a case, only the information needed to fulfill the third person’s request may be released.
s. 102 The Minister may, without the consent of the person concerned, release his or her information that is held in the health information banks in the clinical domains or in the register of users in order to prevent an act of violence, including a suicide, where there is reason to believe there is a serious risk of death or serious bodily injury threatening a person or an identifiable group of persons and where the nature of the threat generates a sense of urgency.
Act respecting Access to documents: 20. In the carrying on of an enterprise, authorized employees, mandataries or agents or any party to a contract for work or services may have access to personal information without the consent of the person concerned only if the information is needed for the performance of their duties or the carrying out of their mandates or contracts.
New Brunswick
Personal Health Information Privacy and Access Act: Express consent is required for research unless otherwise provided for in the Act - s19(1)e which it is. Disclosure for research purposes.
43(1) A custodian may disclose personal health information to a person conducting a research project only if the project has been approved under this section.
43(2) An approval may be given by a research review body that meets the requirements prescribed by regulation.
43(3) An approval may be given under this section only if the research review body has determined that
(a) the research is of sufficient importance to outweigh the intrusion into privacy that would result from the disclosure of the personal health information,
(b) the research purpose cannot reasonably be accomplished unless the personal health information is
provided in a form that identifies or may identify individuals,
(c) the individuals to whom the information relates have consented to its use and disclosure or it is unreasonable or impractical for the person proposing the research to obtain consent from the individuals to whom the information relates, and
(d) the research project contains
(i) reasonable safeguards to protect the privacy and security of the personal health information, and
(ii) procedures to destroy the information or deidentify the information at the earliest opportunity, consistent with the purposes of the project.
Nova Scotia
Express consent not required for disclosure for research if conditions are met.
s 57 A custodian may disclose personal health information about an individual to a researcher without the consent of the subject individual if
(a) the researcher has met the requirements in s 56;
(b) a research ethics board has determined that the consent of the subject individuals is not required;
(c) the custodian is satisfied that
(i) the research cannot be conducted without using the personal health information,
(ii) the personal health information is limited to that necessary to accomplish the purpose of the research,
(iii) the personal health information is in the most de-identified form possible for the conduct of the research,
(iv) the personal health information will be used in a manner that ensures its confidentiality, and
(v) it is impracticable to obtain consent; and
(d) the custodian informs the Review Officer.
Prince Edward Island
S32(4) Disclosure to researcher
Disclosure to researcher (4) A custodian may disclose to the researcher the personal health information requested under section 31 or perform data matching or other services to facilitate the research
(a) with the consent of the individuals who are the subjects of the personal health information, where the research ethics board recommends that consents should be obtained; or
(b) without the consent of the individuals who are the subjects of the personal health information, where the research ethics board does not recommend that consents be obtained.
Newfoundland and Labrador
Personal Health Information Act: s44 Disclosure for research purposes
A custodian may disclose personal health information without the consent of the individual who is the subject of the information for research purposes but only where the research project has been approved by a research ethics board or research ethics body under the Health Research Ethics Authority Act .Consent must be express when a custodian discloses to a person who is not a custodian or to another custodian for a purpose other than the provision of health care (s 25(1)(a) and (b).
Part III S23-S28 specifically address consent - S23 Elements of Consent, S24 Consent may be express or implied, S25 Where consent must be express s 26 Assumption of validity, s27 Limited consent, s28 Withdrawal of consent
Access to Information and Protection of Privacy Act: s. 66 (1) A public body may use personal information only (b) where the individual the information is about has identified the information and has consented to the use, in the manner set by the minister responsible for this Act; or
s. 68 (1) A public body may disclose personal information only
(a) in accordance with Part II;
(b) where the individual the information is about has identified the information and consented to the disclosure in the manner set by the minister responsible for this Act.
Yukon
s. 68 Disclosure without consent for research allowed with institutional research review committee approval and custodian/researcher agreement.
Northwest Territories
Express consent may or may not be required. The determination must be made by the REB or extra-territorial research ethics committee (s 79).
s. 76(1) Subject to sections 79 and 80, a health information custodian may disclose personal health information to a researcher in accordance with section 77 or 78
Nunavut
Access to Information and Protection of Privacy Act
S43 Use of personal information. A public body may use personal information only
(a) for the purpose for which the information was collected or compiled, or for a use consistent with that purpose;
(b) if the individual the information is about has identified the information and consented, in the prescribed manner, to the use; or
(c) for a purpose for which the information may be disclosed to that public body under Division C of this Part.
Consent Required for Transfer Outside of Province
British Columbia
No information provided.
Alberta
A custodian may disclose individually identifying diagnostic, treatment and care information without the consent of the individual who is the subject of the information (s 35(1)). The Commissioner must be informed of any data matching that will be done before it takes place (s 35(2)).
Saskatchewan
No information provided.
Manitoba
With regard to non-consented use of administrative data researchers are being directed to the Manitoba Centre for Health Policy (MCHP) for data and analysis support. Recently there seems to have been a change around consented access to administrative data but researchers should contact Manitoba Health and the Health Information Privacy Committee (HIPC) to ensure that the consent being used meets Manitoba requirements.
There is an expectation that there is an institutional ethics review body providing approvals.
Ontario
Disclosure outside Ontario
50 (1) A health information custodian may disclose personal health information about an individual collected in Ontario to a person outside Ontario only if,
(a) the individual consents to the disclosure
Quebec
Act respecting Access to documents: 17. Every person carrying on an enterprise in Québec who communicates personal information outside Québec or entrusts a person outside Québec with the task of holding, using or communicating such information on his behalf must first take all reasonable steps to ensure
(1) that the information will not be used for purposes not relevant to the object of the file or communicated to third persons without the consent of the persons concerned, except in cases similar to those described in sections 18 and 23;
(2) in the case of nominative lists, that the persons concerned have a valid opportunity to refuse that personal information concerning them be used for purposes of commercial or philanthropic prospection and, if need be, to have such information deleted from the list.
If the person carrying on an enterprise considers that the information referred to in the first paragraph will not receive the protection afforded under subparagraphs 1 and 2, the person must refuse to communicate the information or refuse to entrust a person or a body outside Québec with the task of holding, using or communicating it on behalf of the person carrying on the enterprise.
New Brunswick
Personal Health Information Privacy and Access Act: s19(1): Unless otherwise provided in this Act, express consent of an individual is required in relation to the collection, use or disclosure of his or her personal health information by a custodian, including when the custodian discloses information to:
(d) a person outside New Brunswick, and
(e) a person for the purpose of research.
Nova Scotia
s44 (1) A custodian may disclose personal health information about an individual collected in the Province to a person outside the Province if
(a) the individual who is the subject of the information consents to the disclosure;
(b) the disclosure is permitted by this Act or the regulations
Prince Edward Island
s35. Disclosure outside province
A custodian may disclose personal health information relating to an individual that is collected in the province to a person outside the province without the consent of the individual only in the circumstances described in subsections 23(7), (10) and (13) or as specified in the regulations.
(h) to a research data repository in accordance with the terms of an agreement between the research data repository and the custodian
Newfoundland and Labrador
47. (1) A custodian may disclose personal health information about an individual collected in the province to a person outside the province but only where
(a) the individual who is the subject of the information consents to the disclosure;
(b) the disclosure is permitted by this Act or the regulations;
(c) the person receiving the information performs functions similar to the functions performed by a person to whom this Act would permit the custodian to disclose the information in the province under subsection 40(2);
(d) the following conditions are met:
(i) the disclosure is for the purpose of health planning or health administration,
(ii) the information relates to health care provided in the province to a person who is a resident of another province or territory of Canada , and
(iii) the disclosure is made to the government of that other province or territory of Canada ;
(e) the disclosure is reasonably necessary for the provision of health care to the individual and the individual has not expressly instructed the custodian not to make the disclosure in its entirety; or
(f) the disclosure is reasonably necessary for the administration of payments in connection with the provision of health care to the individual or for contractual or legal requirements in that connection.
(a) the individual who is the subject of the information consents to the disclosure;
(b) the disclosure is permitted by this Act or the regulations;
(c) the person receiving the information performs functions similar to the functions performed by a person to whom this Act would permit the custodian to disclose the information in the province under subsection 40(2);
(d) the following conditions are met:
(i) the disclosure is for the purpose of health planning or health administration,
(ii) the information relates to health care provided in the province to a person who is a resident of another province or territory of Canada , and
(iii) the disclosure is made to the government of that other province or territory of Canada ;
(e) the disclosure is reasonably necessary for the provision of health care to the individual and the individual has not expressly instructed the custodian not to make the disclosure in its entirety; or
(f) the disclosure is reasonably necessary for the administration of payments in connection with the provision of health care to the individual or for contractual or legal requirements in that connection.
Yukon
No information provided.
Northwest Territories
s. 108(2) A health information custodian that transfers an access request shall, without delay, give notice to the applicant
(a) that the access request has been transferred;
(b) of the reason for the transfer;
(c) of the health information custodian to which the access request has been transferred; and
(d) that the applicant may, under subsection 141(1), request a review of the transfer.
Nunavut
No information provided.
Agreement Directives
British Columbia
As noted under FIPPA Section 35.
Alberta
s. 54 (1) If the custodian decides to disclose health information to a researcher or perform data matching or other services to facilitate the research, the researcher must enter into an agreement with the custodian in which the researcher agrees
(a) to comply with
(i) this Act and the regulations made under this Act,
(2) When an agreement referred to in subsection (1) has been entered into, the custodian may disclose to the researcher the health information requested under section 52 or perform data matching or other services to facilitate the research
(a) with the consent of the individuals who are the subjects of the information, where the research ethics board recommends that consents should be obtained, or
(b) without the consent of the individuals who are the subjects of the information, where the research ethics board does not recommend that consents be obtained.
Saskatchewan
Required and must include:
s29(1)(c)(c) the person who is to receive the personal health information enters into an agreement with the trustee or designated archive that contains provisions:
(i) providing that the person who is to receive the information must not disclose the information;
(ii) providing that the person who is to receive the information will ensure that the information will be used only for the purpose set out in the agreement;
(iii) providing that the person who is to receive the information will take reasonable steps to ensure the security and confidentiality of the information; and
(iv) specifying when the person who is to receive the information must do all or any of the following:
(A) return to the trustee or designated archive any original records or copies of records containing personal health information;
(B) destroy any copies of records containing personal health information received from the trustee or designated archive or any copies made by the researcher of records containing personal health information received from the trustee or designated archive.
Manitoba
"PHIN" means the personal health identification number assigned to an individual by the minister to uniquely identify the individual for health care purposes.
Ontario
Agreement respecting disclosure (section 44)
(5) Before a health information custodian discloses personal health information to a researcher under subsection (1), the researcher shall enter into an agreement with the custodian in which the researcher agrees to comply with the conditions and restrictions, if any, that the custodian imposes relating to the use, security, disclosure, return or disposal of the information.
Compliance by researcher
(6) A researcher who receives personal health information about an individual from a health information custodian under subsection (1) shall,
(a) comply with the conditions, if any, specified by the research ethics board in respect of the research plan;
(b) use the information only for the purposes set out in the research plan as approved by the research ethics board;
(c) not publish the information in a form that could reasonably enable a person to ascertain the identity of the individual;
(d) despite subsection 49 (1), not disclose the information except as required by law and subject to the exceptions and additional requirements, if any, that are prescribed;
(e) not make contact or attempt to make contact with the individual, directly or indirectly, unless the custodian first obtains the individual’s consent to being contacted;
(f) notify the custodian immediately in writing if the researcher becomes aware of any breach of this subsection or the agreement described in subsection (5); and
(g) comply with the agreement described in subsection (5).
Quebec
No information provided.
New Brunswick
Personal Health Information Privacy and Access Act: s43.1 A custodian may disclose personal health information to a research data centre if the research data centre has entered into
(a) a written agreement with the Province with respect to its establishment as a research data centre and the approval of research projects, and
(b) a written agreement with the custodian with respect to the sharing of personal health information that meets the requirements of section 50.
Nova Scotia
Custodian-researcher agreement
60 (1) Where a custodian discloses personal health information to a researcher, the researcher shall enter into an agreement with the custodian to adhere to the requirements in subsection (2).
S60(2) includes requirements for agreement content.
Prince Edward Island
s23 (13) A custodian may disclose personal health information relating to an individual without the consent of the individual if the disclosure is …
(h) to a research data repository in accordance with the terms of an agreement between the research data repository and the custodian
s41 Written agreement with agent of custodian A custodian that retains the services of an agent for the collection, use, disclosure, retention or secure destruction of personal health information shall enter into a written agreement with the agent requiring the agent to comply with (a) the duties imposed on the agent under the agreement; and (b) the same requirements concerning the protection, retention and secure destruction of personal health information that the custodian is required to comply with under this Act.
s42 Provision of personal health information to information manager A custodian may provide personal health information to an information manager for the purpose of processing, storing or destroying the personal health information or providing the custodian with information management or information technology services.
Idem - written agreement A custodian that proposes to provide personal health information to an information manager shall enter into a written agreement with the information manager that provides for the protection of the personal health information against risks such as unauthorized access to or use or disclosure, secure destruction or alteration of the personal health information.
Newfoundland and Labrador
Health Research Ethics Authority Act: s. 2.1 This Act and regulations made under this Act shall be read and applied in conjunction with the Labrador Inuit Land Claims Agreement Act and, where a provision of this Act or regulations made under this Act is inconsistent or conflicts with a provision, term or condition of the Labrador Inuit Land Claims Agreement Act, the provision, term or condition of the Labrador Inuit Land Claims Agreement Act shall have precedence over the provision of this Act or a regulation made under this Act.
Access to Information and Protection of Privacy Act: s. 68 (1) A public body may disclose personal information only
(d) for the purpose of complying with an Act or regulation of, or with a treaty, arrangement or agreement made under an Act or regulation of the province or Canada.
Yukon
s. 69 An agreement under this section between a custodian and a researcher must be in writing and must require the researcher, in respect of the personal health information to be disclosed by the custodian under subsection 68(1).
s. 83 The Minister may require a custodian, including an authorized user (a) to enter into an agreement with the Minister with respect to the custodian’s powers, duties and functions under this Part.
Northwest Territories
s. 61(2) Personal health information may only be disclosed under subsection (1) in accordance with an information sharing agreement.
s. 61(3) An information sharing agreement referred to in subsection (2) may authorize a prescribed person or organization to which personal health information is disclosed under paragraph (1)(b), to disclose the statistical information that the person or organization has compiled and analyzed to a government or organization, referred to in paragraph 60(a) or (b),
(a) if consent is provided in accordance with the regulations; and
(b) subject to the conditions of the information sharing agreement.
Nunavut
S 49. A public body may only disclose personal information for a research purpose, including statistical research, where…
(d) the person to whom the information is disclosed has signed an agreement to comply with the approved conditions, this Act and the regulations and any of the public body's policies and procedures relating to the confidentiality of personal information.
Ministerial Discretion to Disclose
British Columbia
The OIPC explains that the “E-Health Act governs the collection, use and disclosure of personal health information in Ministry of Health or health authority databases that are designated by the Minister of Health as health information banks. The following databases are designated as health information banks:
- the Provincial Laboratory Information Solution (PLIS) repository, which contains personal health information pertaining to lab services delivered by health authorities and private labs;
- the Client Registry System/Enterprise Master Patient Index, which contains demographic information for all individuals receiving publicly-funded health care services in British Columbia; and
- the Provider Registry, which contains personal information about health service providers.
The E-Health Act permits disclosure of personal information without consent for a health research purpose if it is authorized by the designation order. Furthermore, disclosures for a research purpose must be approved by the Data Stewardship Committee. The Data Stewardship Committee is an arm’s length body appointed by the Minister of Health, comprised of health professionals and members of the public. Statutory terms and conditions for disclosure for research purposes are the same as those in FIPPA with two additional prohibitions:
- any subsequent use or disclosure of personal health information must be expressly authorized by the Data Stewardship Committee, and
- personal health information and information related to a health service provider cannot be disclosed for market research purposes. Because of its commercial nature, market research is distinct from health research.
Pharmaceutical Services Act, ss. 22 and 26: In addition, the Pharmaceutical Services Act permits the disclosure of personal information contained in PharmaNet for the purpose of research. PharmaNet is an electronic health record system for all prescriptions dispensed in the province. The Data Stewardship Committee decides if and how personal information may be disclosed from PharmaNet for research purposes.
Medicare Protection Act and the Public Health Act : These health statutes govern the disclosure of personal information collected for the Medical Services Plan and public health services. In both cases, the statutory terms and conditions of FIPPA apply to disclosures for research purposes. There may be other terms and conditions that must be met before the Ministry of Health, health authorities, or the Data Stewardship Committee approve access to data for health research purposes. These are imposed in accordance with their own policies and procedures.
Alberta
The Minister may disclose identifying diagnostic, treatment, and care information without consent to another minister for the purpose of policy development (s 39(1)). Disclose to the Minister without consent if the custodian feels the disclosure is reasonably necessary for the Minister to carry out their duties (s 40).
Saskatchewan
With the approval of the Lieutenant Governor in Council, the Minister may enter into agreements for the sharing of registration information with a prescribed person or body (s 28(5)(b)).
Manitoba
Section 22 of the Personal Health Information Act allows for disclosure to another trustee for de-identification. The only reference to linage is under the powers and duties of the Ombudsman - that office can comment on the use, disclosure of PHI for record linkage.
Ontario
No information provided.
Quebec
Act respecting the sharing of certain health information: s. 6 In order to assess the efficiency, performance and benefits resulting from the establishment of the information assets governed by this Act, in particular the Québec Health Record, the Minister may demand from the Régie de l’assurance maladie du Québec any information obtained for the carrying out of the Health Insurance Act (chapter A-29) or the Act respecting prescription drug insurance (chapter A-29.01), provided the information cannot be associated with a particular person.
30. At the request of an authorized provider or body, the operations manager of a health information bank in the laboratory domain releases to them, in accordance with their access authorizations, the information that can be released through the Québec Health Record.
102. The Minister may, without the consent of the person concerned, release his or her information that is held in the health information banks in the clinical domains or in the register of users in order to prevent an act of violence, including a suicide, where there is reason to believe there is a serious risk of death or serious bodily injury threatening a person or an identifiable group of persons and where the nature of the threat generates a sense of urgency.
New Brunswick
Personal Health Information Privacy and Access Act: 44(2) With the approval of the Lieutenant-Governor in Council, the Minister may enter into agreements for the sharing of registration information without the consent of the individual to whom the information relates with
(a) the Government of Canada or the government of a province or territory of Canada, or
(b) a person or body designated in the regulations (i.e. could ask for regulation change to permit)
Nova Scotia
No information provided.
Prince Edward Island
s23(15)(d) and s23(16) The Minister can disclose and be disclosed to without consent if the disclosure is necessary for the purpose of evaluation and monitoring of health programs or public safety.
s23(13)(h) permits disclosure to a research data repository in accordance with the terms of an agreement between the research data repository and the custodian; the Lieutenant Governor may make regulations.
s81(1)(s) prescribes for the purposes of section 35 the circumstances in which a custodian may disclose personal health information relating to an individual that is collected in the province to a person outside the province.
Newfoundland and Labrador
Personal Health Information Act: Minister allowed to disclose to another public body on the approval of and terms and conditions set out by the Lieutenant Governor in Council (s 45(1)(b)).
Health Research Ethics Authority Act: s. 2(f) "minister" means the minister appointed under the Executive Council Act to administer this Act.
Access to Information and Protection of Privacy Act: ss. 34-41 describe instances where the head of a public body could refuse to disclose personal information
s. 2(q) "minister" means a member of the executive council appointed under the Executive Council Act;
s. 102. (1) The commissioner and a person acting for or under the direction of the commissioner, shall not disclose information obtained in performing duties or exercising powers under this Act, except as provided in subsections (2) to (5).
Yukon
Minister has discretion under the regulations to disclose for the purposes of research.
Northwest Territories
No information provided.
Nunavut
S16 (2) Authorized persons. The following persons have authority to access, use or disclose health information under this Act:
(a) the Chief Public Health Officer;
(b) a person acting under the direction and on behalf of the Chief Public Health Officer;
(c) a person specifically authorized in this Act.
Research Ethics Review Directive
British Columbia
The OIPC for British Columbia states in their 2018 Access to Data for Health Research document that “the Ministry of Health and health authorities generally require researchers to obtain approval from a REB for their study before they disclose data to researchers. This helps ensure, among other things, that individually identifiable data is necessary to conduct the research and that the research is in the public interest."
Alberta
s. 50 (1) The research ethics board must
(a) consider whether the researcher should be required to obtain consents for the disclosure of the health information to be used in the research from the individuals who are the subjects of the information, and
(b) assess whether, in the opinion of the research ethics board,
(i) the proposed research is of sufficient importance that the public interest in the proposed research outweighs to a substantial degree the public interest in protecting the privacy of the individuals who are the subjects of the health information to be used in the research,
(ii) the researcher is qualified to carry out the research,
(iii) adequate safeguards will be in place at the time the research will be carried out to protect the privacy of the individuals who are the subjects of the health information to be used in the research and the confidentiality of that information, and
(iv) obtaining the consents referred to in clause (a) is unreasonable, impractical or not feasible.
Saskatchewan
s29(1)(b) the research project has been approved by a research ethics committee approved by the minister; and must be approved by the Minister.
Manitoba
No information provided
Ontario
See above - PI / PHI Access for Research Secondary Use Permitted
Quebec
Act respecting Access to documents: 21. The Commission d'accèss à l'information […] may, on written request, grant a person authorized to receive communication of personal information for study, research or statistical purposes, without the consent of the persons concerned, if it is of the opinion that
(1) the intended use is not frivolous and the ends contemplated cannot be achieved unless the information is communicated with a form allowing the persons to be identified
(2) the information will be used in a manner that will ensure its confidentiality
New Brunswick
Personal Health Information Privacy and Access Act: s43(3) An approval may be given under this section only if the research review body has determined that
(c) the individuals to whom the information relates have consented to its use and disclosure or it is unreasonable or impractical for the person proposing the research to obtain consent from the individuals to whom the information relates, and
(d) the research project contains
(i) reasonable safeguards to protect the privacy and security of the personal health information, and
(ii) procedures to destroy the information or de-identify the information at the earliest opportunity, consistent with the purposes of the project
Nova Scotia
s52 (d) “research ethics board” means a research ethics board established and operating in conformity with the Tri-Council Policy Statement;
(e) “Tri-Council Policy Statement” means the Tri-Council Policy Statement “Ethical Conduct for Research Involving Humans” adopted in August 1998 by the Medical Research Council of Canada, the Natural Sciences and Engineering Research Council of Canada and the Social Sciences and Humanities Research Council of Canada, and includes any amendments or successor statements.
Prince Edward Island
s1(aa)“research ethics board” means a research ethics board designated in the regulations;
s30(3) A research ethics board to which a research plan is submitted shall
(a) consider whether the custodian of the personal health information specified in the research plan should be required to obtain consents for the disclosure of the personal health information to be used in the research from the individuals to whom it relates;
(b) consider whether the objectives of the research could reasonably be accomplished without the disclosure or use of personal health information; and
(c) assess whether, in the opinion of the research ethics board,
(i) the proposed research is of sufficient importance that the public interest in the proposed research outweighs to a substantial degree the public interest in protecting the privacy of the individuals who are the subjects of the personal health information to be used in the research,
(ii) the researcher is qualified to carry out the research,
(iii) adequate safeguards will be in place at the time the research will be carried out to protect the privacy of the individuals whose personal health information will be used in the research and the confidentiality of the personal health information, and
(iv) obtaining the consents referred to in clause (a) is unreasonable, impractical or not feasible.
s30(4)-s30(9) describe the details of responsibility for the Research Ethics Board.
Newfoundland and Labrador
Personal Health Information Act: s2 (w) "research ethics board" means the research ethics board appointed by the Health Research Ethics Authority for Newfoundland and Labrador under the Health Research Ethics Authority Act;
s2 (x) "research ethics body" means a research ethics body approved by the Health Research Ethics Authority for Newfoundland and Labrador under the Health Research Ethics Authority Act.
Health Research Ethics Board Policy Manual Section 13 — Export of PHI to Researchers Outside of Newfoundland and Labrador: PHI that is collected in the context of a research project will be retained by the local Principal Investigator and will not be sent outside the province without the express approval of the HREB subcommittee which originally approved it. Such requests will be reviewed on a case by case basis and for approval, four conditions must be met:
1. the explicit consent of the participant to allow his or her PHI to be entered in a database held outside the province;
2. if relevant, an additional consent to provide personal identifiers for contact in future by the same or new investigators;
3. the approval by the HREB subcommittee of a completed checklist of privacy protections submitted provided by the recipient data guardian and
4. the approval by the HREB subcommittee of the recipient data guardian’s plan for succession
Health Research Ethics Authority Act: s. 2(h) (h) "research ethics board" means the Health Research Ethics Board established under section 7.
Yukon
s. 65 In this Division, “institutional research review committee" means a committee
(a) that a university, a hospital affiliated with a university or a prescribed person establishes
(i) to review the efficacy and scientific and ethical value of a research proposal involving human subjects or involving the review of records containing personal health information, and
(ii) to ensure that the person proposing the research has adequate safeguards in place to protect the confidentiality of personal health information.
Northwest Territories
s. 1(1) "extra-territorial research ethics committee" means a body, recognized by or established pursuant to the legislation of a jurisdiction other than the Northwest Territories, that
(a) reviews and approves proposals for research that would include the collection or use of personal health information, and
(b) takes into consideration, during its review of research proposals, the protection of the privacy interests of individuals whose personal health information would be collected or used in the context of proposed research;
s. 69 role of research ethics committee
Nunavut
No information provided.
Additional Regulation Directives
British Columbia
The OIPC explains that the “E-Health Act governs the collection, use and disclosure of personal health information in Ministry of Health or health authority databases that are designated by the Minister of Health as health information banks. The following databases are designated as health information banks:
- the Provincial Laboratory Information Solution (PLIS) repository, which contains personal health information pertaining to lab services delivered by health authorities and private labs;
- the Client Registry System/Enterprise Master Patient Index, which contains demographic information for all individuals receiving publicly-funded health care services in British Columbia; and
- the Provider Registry, which contains personal information about health service providers.
The E-Health Act permits disclosure of personal information without consent for a health research purpose if it is authorized by the designation order. Furthermore, disclosures for a research purpose must be approved by the Data Stewardship Committee. The Data Stewardship Committee is an arm’s length body appointed by the Minister of Health, comprised of health professionals and members of the public. Statutory terms and conditions for disclosure for research purposes are the same as those in FIPPA with two additional prohibitions:
- any subsequent use or disclosure of personal health information must be expressly authorized by the Data Stewardship Committee, and
- personal health information and information related to a health service provider cannot be disclosed for market research purposes. Because of its commercial nature, market research is distinct from health research.
Pharmaceutical Services Act, ss. 22 and 26: In addition, the Pharmaceutical Services Act permits the disclosure of personal information contained in PharmaNet for the purpose of research. PharmaNet is an electronic health record system for all prescriptions dispensed in the province. The Data Stewardship Committee decides if and how personal information may be disclosed from PharmaNet for research purposes.
Medicare Protection Act and the Public Health Act : These health statutes govern the disclosure of personal information collected for the Medical Services Plan and public health services. In both cases, the statutory terms and conditions of FIPPA apply to disclosures for research purposes. There may be other terms and conditions that must be met before the Ministry of Health, health authorities, or the Data Stewardship Committee approve access to data for health research purposes. These are imposed in accordance with their own policies and procedures.
Alberta
No information provided.
Saskatchewan
No information provided.
Manitoba
Personal Health Information Act, CCSM c P33.5: Disclosure without individual's consent S 22(2) (g.3) to another trustee for the purpose of de-identifying the PHI.
Although not referencing 'de-identified' Health Research S 24 (3)(d)(iii) Conditions for approval, procedures to destroy or remove, at earliest opportunity....any information that ...allows individuals to be readily identified.
S 24.1(3)(c) with regard to health research organizations. procedures to destroy or remove, at earliest opportunity....any information that ...allows individuals to be readily identified.
Ontario
ONTARIO REGULATION 329/04
Research ethics boards
15. The following are prescribed as requirements that must be met by a research ethics board:
1. The board must have at least five members, including,
i. at least one member with no affiliation with the person or persons that established the research ethics board,
ii. at least one member knowledgeable in research ethics, either as a result of formal training in research ethics, or practical or academic experience in research ethics,
iii. at least two members with expertise in the methods or in the areas of the research being considered, and
iv. at least one member knowledgeable in considering privacy issues.
2. The board may only act with respect to a proposal to approve a research plan where there is no conflict of interest existing or likely to be perceived between its duty under subsection 44 (3) of the Act and any participating board member’s personal interest in the disclosure of the personal health information or the performance of the research.
Requirements for research plans
16. The following are prescribed as additional requirements that must be set out in research plans for the purposes of clause 44 (2) (c) of the Act:
1. A description of the research proposed to be conducted and the duration of the research.
2. A description of the personal health information required and the potential sources.
3. A description of how the personal health information will be used in the research, and if it will be linked to other information, a description of the other information as well as how the linkage will be done.
4. An explanation as to why the research cannot reasonably be accomplished without the personal health information and, if it is to be linked to other information, an explanation as to why this linkage is required.
5. An explanation as to why consent to the disclosure of the personal health information is not being sought from the individuals to whom the information relates.
6. A description of the reasonably foreseeable harms and benefits that may arise from the use of the personal health information and how the researchers intend to address those harms.
7. A description of all persons who will have access to the information, why their access is necessary, their roles in relation to the research, and their related qualifications.
8. The safeguards that the researcher will impose to protect the confidentiality and security of the personal health information, including an estimate of how long information will be retained in an identifiable form and why.
9. Information as to how and when the personal health information will be disposed of or returned to the health information custodian.
10. The funding source of the research.
11. Whether the researcher has applied for the approval of another research ethics board and, if so the response to or status of the application.
12. Whether the researcher’s interest in the disclosure of the personal health information or the performance of the research would likely result in an actual or perceived conflict of interest with other duties of the researcher.
Quebec
No information provided.
New Brunswick
REGULATION 2010-112 Research Review Body s17: For the purposes of subsection 43(2) of the Act, a research review body shall operate in conformity with the Tri-Council Policy Statement.
Personal health information stored outside Canada: s 22 Information managers providing a public body with information management or information technology services may store personal health information in their custody or in their control outside Canada.
Nova Scotia
No information provided.
Prince Edward Island
s(2) Research ethics board
For the purpose of clause 1(aa) of the Act, the Prince Edward Island Research Ethics Board is designated as a research ethics board.
s5 Contents of research plan In addition to the matters set out in clauses 30(2)(a) and (b) of the Act, a research plan shall include
(a) a research protocol, including a description of the specific information or variables required for the research;
(b) a plan for the de-identification of data, including a data flow diagram, if applicable; and
(c) any information known to the person submitting the research plan relevant to the consideration of the research ethics board under clause 30(3)(a) of the Act.
Newfoundland and Labrador
No information provided.
Yukon
s. 70(1) Subject to subsections (2) to (4), a custodian may enter into an agreement under which the custodian may
(a) collect an individual’s personal health information from the individual or any other person; or
(b) use or disclose an individual’s personal health information.
s. 70(4) No agreement under this section has any force or effect unless the Minister
(a) is a party to the agreement; or
(b) approves the agreement in writing.
Northwest Territories
Extra-jurisdictional disclosure is permitted to a researcher conducting a multi-jurisdictional research project who has extra-territorial research ethics committee approval and meets certain conditions (s 78).
Nunavut
No information provided.
Other Specific Directives
British Columbia
The OIPC explains that the “E-Health Act governs the collection, use and disclosure of personal health information in Ministry of Health or health authority databases that are designated by the Minister of Health as health information banks. The following databases are designated as health information banks:
- the Provincial Laboratory Information Solution (PLIS) repository, which contains personal health information pertaining to lab services delivered by health authorities and private labs;
- the Client Registry System/Enterprise Master Patient Index, which contains demographic information for all individuals receiving publicly-funded health care services in British Columbia; and
- the Provider Registry, which contains personal information about health service providers.
The E-Health Act permits disclosure of personal information without consent for a health research purpose if it is authorized by the designation order. Furthermore, disclosures for a research purpose must be approved by the Data Stewardship Committee. The Data Stewardship Committee is an arm’s length body appointed by the Minister of Health, comprised of health professionals and members of the public. Statutory terms and conditions for disclosure for research purposes are the same as those in FIPPA with two additional prohibitions:
- any subsequent use or disclosure of personal health information must be expressly authorized by the Data Stewardship Committee, and
- personal health information and information related to a health service provider cannot be disclosed for market research purposes. Because of its commercial nature, market research is distinct from health research.
Pharmaceutical Services Act, ss. 22 and 26: In addition, the Pharmaceutical Services Act permits the disclosure of personal information contained in PharmaNet for the purpose of research. PharmaNet is an electronic health record system for all prescriptions dispensed in the province. The Data Stewardship Committee decides if and how personal information may be disclosed from PharmaNet for research purposes.
Medicare Protection Act and the Public Health Act : These health statutes govern the disclosure of personal information collected for the Medical Services Plan and public health services. In both cases, the statutory terms and conditions of FIPPA apply to disclosures for research purposes. There may be other terms and conditions that must be met before the Ministry of Health, health authorities, or the Data Stewardship Committee approve access to data for health research purposes. These are imposed in accordance with their own policies and procedures.
Alberta
No information provided.
Saskatchewan
No information provided.
Manitoba
No definition provided.
Ontario
No information provided.
Quebec
No information provided.
New Brunswick
Research is defined in Act: “research” means a systematic investigation designed to develop or establish principles, facts or general knowledge, or any combination of them, and includes the development, testing and evaluation of research.
Source of Information (i.e. authority to disclose)
s28(n) the custodian is the Minister, a research data centre or a researcher and is collecting the information from another custodian for the purpose of a research project that has been approved in accordance with an agreement referred to in paragraph 43.1(a).
Nova Scotia
The requirement of a research plan is specifically outlined.
Research plan s59 (1) Before commencing research, a researcher seeking to conduct research utilizing personal health information shall submit a research plan to a research ethics board.
(2) The research plan must be in writing.
(3) In order to meet the requirements for a custodian under this Act, the research plan must include
(a) a description of the research proposed to be conducted;
(b) a statement regarding the duration of the research;
(c) a description of the personal health information required and the potential sources of the information;
(d) a description as to how the personal information will be used in the research;
(e) where the personal health information will be linked to other information, a description of the other information as well as how the linkage will be conducted;
(f) where the researcher is conducting the research on behalf of or with the support of a person or organization, the name of the person or organization;
(g) the nature and objectives of the research and the public or scientific benefit anticipated as a result of the research;
(h) where consent is not being sought, an explanation as to why seeking consent is impracticable;
(i) an explanation as to why the research cannot reasonably be accomplished without the use of personal health information;
(j) where there is to be data matching, an explanation of why data matching is required;
(k) a description of the reasonably foreseeable risks arising from the use of personal health information and how those risks are to be mitigated;
(l) a statement that the personal health information is to be used in the most de-identified form possible for the conduct of the research;
(m) a description of all individuals who will have access to the information, and
(i) why their access is necessary
(ii) their roles in relation to the research, and
(iii) their qualifications;
(n) a description of the safeguards that the researcher will impose to protect the confidentiality and security of the personal health information;
(o) information as to how and when the personal health information will be destroyed or returned to the custodian;
(p) the funding source of the research;
(q) whether the researcher has applied for the approval of another research ethics board and, if so, the response to or status of the application; and
(r) whether the researcher’s interest in the disclosure of the personal health information or the conduct of the research would potentially result in an actual or perceived conflict of interest on the part of the researcher.
Prince Edward Island
s1(bb)“researcher” means a person whose research plan has been submitted to a research ethics board pursuant to section 30;
Powers of custodian
s33 (3) Where authorized to do so by an order under subsection (2), a custodian may
(a) enter and search any premises of the researcher where the research is conducted;
(b) operate or cause to be operated any computer system of the researcher to search any data contained in or available to the system and produce a document from the data; and
(c) seize and make copies of any documents of the researcher that are or may be relevant to the investigation.
Newfoundland and Labrador
Personal Health Information Act: s2 (v) "research" means a systematic investigation designed to develop or establish principles or facts or to generate knowledge, or any combination of principles, facts and knowledge, and includes the development, testing and evaluation of research;
Interpretations
s6(1) A provision of this Act that applies to the collection, use or disclosure of personal health information about an individual by a custodian with the consent of the individual, whether express or implied, does not affect the collection, use or disclosure that this Act permits or requires the custodian to make of the information without the consent of the individual.
Health Research Ethics Authority Act: s. 2(i) "tri-council policy statement" means the Tri-Council Policy Statement "Ethical Conduct for Research Involving Humans" adopted in August, 1998 by the Medical Research Council of Canada, the Natural Sciences and Engineering Research Council of Canada and the Social Sciences and Humanities Research Council of Canada, and includes amendments to the statement and another statement of principles and guidelines respecting ethical conduct for research involving humans adopted by those councils in substitution for the tri-council policy statement.
Yukon
No information provided.
Northwest Territories
s. 13(1) "information management agreement" means an agreement in writing in respect of the protection of personal health information and privacy of individuals the information is about;
s. 13(2) Subject to subsection (3) and any exceptions set out in the regulations, before using the services of an information manager, a health information custodian shall enter into an information management agreement with the information manager.
Nunavut
No information provided.
Policy Interpretation in Legislation or Regulations
British Columbia
No information provided.
Alberta
A Practical Guide to the Health Information Act: The Act allows disclosure of health information to a health information repository. The Minister may designate, by regulation, an agency, corporation or other entity to act as a health information repository. Powers, duties and functions of a health information repository will be in accordance with the regulations.
Saskatchewan
Government policies and documents provide no guidance or elaboration as to whether cross-border disclosure for research purposes is permitted.
Manitoba
Health Research is explicitly identified, including use, collection, disclosure of secondary data and approvals required. Section 24 covers health research for researchers and individual projects. Section 24.1 covers Health Research Organizations.
Ontario
No information provided.
Quebec
No information provided.
New Brunswick
Department of Health Privacy Notice states that Medicare information may be disclosed to other authorized provincial or federal departments, authorized agencies, or Medicare programs in other Canadian jurisdictions. However, nothing explicitly mentions disclosure for research.
Nova Scotia
The Nova Scotia Health Authority Use and Disclosure of PHI Policy s 4.2.1. states that "Personal information must not be transferred to parties outside NSHA without the participant’s written permission unless otherwise approved by the REB." Section 4.2.2. states that Nova Scotia’s Personal Information International Disclosure Protection Act (PIIDPA) restricts the transfer and storage of, and access to personal information outside Canada.
Prince Edward Island
Government policies and documents provide no guidance or elaboration as to whether cross-border disclosure for research purposes is permitted.
Newfoundland and Labrador
Personal Health Information Act: The PHI Policy Development Manual Policy 2.50: Disclosure Without Consent — Consent is not required for the following discretionary disclosures of personal health Information: For research purposes approved by a research ethics board or research ethics body under the Health Research Ethics Authority Act.
Policy 5.100: Disclosure of Personal Health Information Outside the Province — A custodian is permitted to disclose personal health information to entities outside of the province of Newfoundland and Labrador under any of the following circumstances: The individual who is the subject of the information consents to the disclosure; The disclosure is permitted by the Personal Health Information Act or the regulations enacted under the Personal Health Information Act.
Yukon
HIPMA Discussion Paper: Page 23-24 Permitted disclosures without your consent could include these circumstances: For the purpose of national health analysis if the disclosure is through an agreement with a recognized health data institute (such as the Canadian Institute for Health Information or similar institute approved by the Minister) that assists in the development of the Canadian health system.
Northwest Territories
Health Information Act Guide Chapter 7 — Disclosure for Research and Research Ethics Committee: A custodian can share information with a researcher whose proposal was approved by another jurisdiction’s REC if the following conditions are met:
The research is a multi-jurisdictional project.
The researcher submits to the custodian an application, an Aurora Research Institute license, the research proposal, the REC’s decision, and any other information the custodian needs.
The disclosure is not disallowed by the HIA.
The researcher enters into a research agreement with the custodian.
Nunavut
No information provided.
Reference to Unique Medical Number
British Columbia
No reference made.
Alberta
s. 1 (1) (s) “personal health number” means the number assigned to an individual by the Department to uniquely identify the individual;
s. 21(1) Only the following have the right to require an individual to provide the individual’s personal health number:
(a) custodians;
(b) persons authorized by the regulations to do so.
(2) When requesting a personal health number from an individual, the person referred to in subsection (1) must advise the individual of the person’s authority under subsection (1).
(3) An individual may refuse to provide the individual’s personal health number where the person requesting it is not a person referred to in subsection (1).
Saskatchewan
s2(i) “health services number” means a unique number assigned to an individual who is or was registered as a beneficiary to receive insured services within the meaning of The Saskatchewan Medical Care Insurance Act;
Rights regarding production of health services number
s11(1) An individual has the right to refuse to produce his or her health services number or any other prescribed identifying number to any person, other than a trustee who is providing a health service, as a condition of receiving a service.
Manitoba
Identified as a Health Research Organization in section 24.1 of Personal Health Information Act. The organizations are identified (prescribed) in regulation. Disclosure follows requirements outlined in Section 2.
Ontario
Definition of PHI found in section 4(1) includes:
(f) is the individual’s health number
Quebec
Act respecting the sharing of certain health information: 21. The operations manager of a health information bank in a clinical domain logs the name and unique provider number of the person who releases or receives health information governed by this chapter and the date and time it is released or received. The operations manager also logs the name and unique identification number of a body that releases or receives health information and the date and time it is released or received.
26. The medication domain is made up of the following health information, if available:
(1) the unique user identification number of the person concerned;
s. 87 The Régie de l’assurance maladie du Québec assigns a unique provider number to every health and social service provider it registers.The Régie de l’assurance maladie du Québec assigns a unique provider number to every health and social service provider it registers.
s 89(1) The register of providers contains the following information on every person registered:
(1) the person’s unique provider number
New Brunswick
Medicare s48
Nova Scotia
Yes - 'health care number' - the Minister has the authority to decide who may access s46; regulations
Prince Edward Island
s1(n) "health number” means a health number as defined in the Provincial Health Number Act R.S.P.E.I. 1988, Cap. P-27.01.
Newfoundland and Labrador
Personal Health Information Act: s2 (m) "MCP" means the Newfoundland and Labrador Medical Care Plan administered under the Medical Care and Hospital Insurance Act
Yukon
s. 2(1) “Yukon public health insurance plan number” means the registration number or other unique identifier assigned to an insured person for the purposes of the Health Care Insurance Plan Act.
Northwest Territories
No reference made.
Nunavut
No reference made.
Reference to Data Linking/Matching for Research
British Columbia
Section 35 of FIPPA states in (b) that any data linking must not be harmful to the individuals that information is about and the benefits to be derived from the data linking are clearly in the public interest.
Alberta
s. 1(1) (g) “data matching” means the creation of individually identifying health information by combining individually identifying or non‑identifying health information or other information from 2 or more electronic databases, without the consent of the individuals who are the subjects of the information;
s. 27 (1) A custodian may use individually identifying health information in its custody or under its control for the following purposes:
(d) conducting research or performing data matching or other services to facilitate another person’s research
s. 53(1) A custodian who has received the documents referred to in section 52 may, but is not required to, disclose the health information or perform data matching or other services to facilitate the research.
Saskatchewan
No reference made.
Manitoba
In Personal Health Information Act, this role is split to identify specific researchers under section 24, and to an organization supporting research under section 24.1.
Under section 47(4) of Freedom of Information and Protection of Privacy Act, research must be bona fide research purpose.
Ontario
No information provided.
Quebec
No information provided.
New Brunswick
"Data matching” means the creation of identifying information by combining identifying information or de-identified personal health information or other information from 2 or more electronic data bases or 2 or more electronic records.
48(1.1) Despite subsection (1) (i.e. conditions for requiring Medicare number), a public body may collect and use an individual’s Medicare number, including the use to perform data matching, for the purpose of a research project approved.
Permitted uses:
s34(1) (m.2) if the custodian is the Minister or a researcher, to perform data matching for the purpose of a research project approved by a research review body under section 43;
(m.3) if the custodian is the Minister or a research data centre, to perform data matching for the purpose of a research project approved in accordance with an agreement referred to in paragraph 43.1(a)
(a) by a research review body under section 43, or
(b) in accordance with an agreement referred to in paragraph 43.1(a).
Nova Scotia
Research s59(1) Before commencing research, a researcher seeking to conduct research utilizing personal health information shall submit a research plan to a research ethics board...
(e) where the personal health information will be linked to other information, a description of the other information as well as how the linkage will be conducted;
In the Act “data linkage” means the bringing together of two or more records of personal health information to form a composite record.
Prince Edward Island
s1(f) “data matching” means the creation of individually identifying personal health information by combining individually identifying personal health information, de-identified personal health information or other information from 2 or more electronic databases or 2 or more electronic records, without the consent of the individuals to whom the information relates;
Disclosure for research s32(1)-s32(5) described the conditions for data matching include [??]
s32(4) A custodian may disclose to the researcher the personal health information requested under section 31 or perform data matching or other services to facilitate the research
(a) with the consent of the individuals who are the subjects of the personal health information, where the research ethics board recommends that consents should be obtained; or
(b) without the consent of the individuals who are the subjects of the personal health information, where the research ethics board does not recommend that consents be obtained. "Link" is used in the Act but in reference to joining electronic records.
Data matching for research
s29 For the purposes of this Part, a privacy impact assessment shall
(a) specify how the proposed administrative practices and information systems relating to the collection, use and disclosure of personal health information may affect the privacy of the individual to whom the information relates;
(b) describe how the personal health information to be used in the data matching is to be collected; and
(c) set out how the personal health information that is created through data matching is to be used or disclosed.
Newfoundland and Labrador
Personal Health Information Act: s45 Disclosure of registration information
(1) The minister may disclose registration information without the consent of an individual...with the approval of the Lieutenant Governor in Council, the minister may enter into agreements for the sharing of registration information without the consent of the subject individual with
(a) the Government of Canada or the government of a province or territory of Canada; or
(b) a person or body designated in the regulations.
(4) An agreement made under subsection (3) shall specify that the party to whom the registration information is disclosed shall use the information only for the purposes specified in the agreement.
Yukon
No reference made.
Northwest Territories
s. 36(2) Subject to the regulations, a health information custodian may, for a purpose for which personal health information may be used or disclosed under this Act,
(a) create or produce personal health information by combining information from two or more electronic databases or records; or
(b) compare personal health information about an individual on two or more electronic databases or records.
Nunavut
No reference made.