Home | Data Access Support Hub | DASH Resources | Privacy | Privacy Legislation

Privacy Legislation

by Province or Territory

This table shows the availability of specific types of information about health data and its usage in privacy legislation across different provinces and territories. This table does not indicate whether specific actions are permitted.

Click on the type of information to learn more about the specific information available.

Legend:
Information available
Information unavailable

Type of Information	BC	AB	SK	MB	ON	QC	NB	NS	PE	NL	YK	NT	NU
Policy/Law
Relevant Explanatory Notes / Preamble for Researchers
Definition of Personal Information (PI) / Personal Health Information (PHI)
Reference to De-identified PI / PHI
Definition of De-identified / Pseudonymous Data Defined
Disclosure for Research Purposes
Provides Information Specifically for “Data Centre” (Or Synonymous terms)
Defined Role of Data Centre or Synonymous Terms
Reference to Data Disclosure Outside of the Province/Territory
Consent Requirement for Data Use/Disclosure for Research
Consent Required for Use/Disclosure for Research Outside of Province/Territory
Agreement Directives and Requirements
Ministerial Discretion to Disclose
Research Ethics Review Directive
Reference to Unique Medical Number
Reference to Data Linking / Matching for Research
Interpretation Resources
Other Specific Directives or Considerations
Additional Regulation Directives

Type of Information

British Columbia

Alberta

Saskatchewan

Manitoba

Ontario

Quebec

New Brunswick

Nova Scotia

Prince Edward Island

Newfoundland and Labrador

Yukon

Northwest Territories

Nunavut

British Columbia

BC Ministry of Health: “Access to Health Data for Research” Directive Document

This policy’s objective is to increase knowledge through research while appropriately protecting privacy. By assisting with the establishment of principles, facts and generalizable knowledge this policy will contribute to improvements in health care and health services, which can be expected to improve health outcomes for British Columbians. This policy at the same time provides for significant privacy protections in compliance with applicable legislative privacy requirements.

This policy acknowledges the mandate of the Data Stewardship Committee, which has a significant role in the approval of disclosure of certain data for research purposes. The Data Stewardship Committee establishes policies and procedures respecting those disclosures and the Ministry will work with the Data Stewardship Committee to align Ministry and Data Stewardship Committee policies and procedures, noting that consistency between their approaches is in the public interest.

Alberta

No information found

Saskatchewan

No information found

Manitoba

No information found

Ontario

BILL 3: Explanatory Notes

In addition, a researcher who meets certain conditions may be authorized to have access to health and social services information held by any health and social services body where the information is necessary for carrying out a research project approved by an ethics committee, by addressing a request either to a health and social services body or to the public body designated by the Government to act as a research access centre, depending on which body the researcher is attached to.

The act sets out the cases in which and conditions on which a health and social services body must communicate health and social services information it holds, including to a service provider or to a researcher, as well as the cases in which and conditions on which it may communicate such information. The delegated manager of government digital data for the Ministere de la Sante et des Services sociaux is entrusted with responsibility for authorizing certain communications. The MInsiter is empowered to determine, by regulation, the procedure nad means by which service providers and researchers can have access to the information, as well as the procedure and means for certain communications.

Quebec

BILL 3: Explanatory Notes

New Brunswick

No information found

Nova Scotia

No information found

Prince Edward Island

No information found

Newfoundland and Labrador

No information found

Yukon

No information found

Northwest Territories

No information found

Nunavut

No information found

British Columbia

E-Health (Personal Health Information Access and Protection of Privacy) Act, SBC 2008, c 38

Definitions
1 In this Act:

“Personal health information” means recorded information about an identifiable individual that is related to the individual’s health or the provision of health services to the individual.

Freedom of Information and Protection of Privacy Act [RSBC 1996] CHAPTER 165

Schedule 1: Definitions
In this Act:

“personal information” means recorded information about an identifiable individual other than contact information;

Alberta

Health Information Act

Interpretation
1 in this Act

“health information” means one or both of the following:

(i) Diagnostic, treatment and care information
(ii) Registration information;

“diagnostic, treatment and care information” means information about any of the following:

(i) the physical and mental health of an individual;
(ii) a health service provided to an individual, including the following information respecting a health services provider who provides a health service to that individual,

(a) name;
(b) business title;
(c) business mailing address and business electronic address;
(d) business telephone number and business facsimile number;
(e) type of health services provider;
(f) licence number or any other number assigned to the health services provider by a health professional body to identify that health services provider;
(g) profession;
(h) job classification;
(i) employer;
(j) municipality in which the health services provider’s practice is located;
(k) provincial service provider identification number that is assigned to the health services provider by the Minister to identify the health services provider;
(l) any other information specified in the regulations;

(iii) the donation by an individual of a body part or bodily substance, including information derived from the testing or examination of a body part or bodily substance;
(iv) a drug as defined in the Pharmacy and Drug Act provided to an individual;
(v) a health care aid, device, product, equipment or other item provided to an individual pursuant to a prescription or other authorization;
(vi) the amount of any benefit paid or payable under the Alberta Health Care Insurance Act or any other amount paid or payable in respect of a health service provided to an individual,

and includes any other information about an individual that is collected when a health service is provided to the individual, but does not include information that is not written, photographed, recorded or stored in some manner in a record;

Freedom of Information and Protection of Privacy Act (FOIP)

Definitions
1 In this Act,

“personal information” means recorded information about an identifiable individual, including

(i) the individual’s name, home or business address or home or business telephone number,
(ii) the individual’s race, national or ethnic origin, colour or religious or political beliefs or associations,
(iii) the individual’s age, sex, marital status or family status,
(v) an identifying number, symbol or other particular assigned to the individual,
(vi) the individual’s fingerprints, other biometric information, blood type, genetic information or inheritable characteristics,
(vii) information about the individual’s health and health care history, including information about a physical or mental disability, information about the individual’s educational, financial, employment or criminal history, including criminal records where a pardon has been given,
(viii) anyone else’s opinions about the individual, and

the individual’s personal views or opinions, except if they are about someone else

Saskatchewan

The Health Information Protection Act

Interpretation
2(1) In this Act

“personal health information” means, with respect to an individual, whether living or deceased:

(i) information with respect to the physical or mental health of the individual;
(ii) information with respect to any health service provided to the individual;
(iii) information with respect to the donation by the individual of any body part or any bodily substance of the individual or information derived from the testing or examination of a body part or bodily substance of the individual;
(iv) information that is collected:

(A) in the course of providing health services to the individual; or
(B) incidentally to the provision of health services to the individual; or

(v) registration information

Manitoba

Personal Health Information Act

Definitions
1(1) In this Act,

“personal health information” means recorded information about an identifiable individual that relates to:

(a) the individual’s health, or health care history, including genetic information about the individual,
(b) the provision of health care to the individual, or
(c) payment for health care provided to the individual,

and includes

(d) the PHIN as defined in The Personal Health Information Act and any other identifying number, symbol or particular assigned to an individual, and
(e) any identifying information about the individual that is collected in the course of, and is incidental to, the provision of health care or payment for health care;

Freedom of Information and Protection of Privacy Act

“personal information” means recorded information about an identifiable individual, including

(a) the individual’s name,
(b) the individual’s address, telephone or facsimile number or e-mail address,
(c) information about the individual’s age, sex, sexual orientation, marital or family status,
(d) information about the individual’s ancestry, race, colour, nationality, or national or ethnic origin,
(e) information about the individual’s religion or creed, or religious belief, association or activity,
(f) personal health information about the individual,
(g) the individual’s blood type, fingerprints or other hereditary characteristics,
(h) information about the individual’s political belief, association or activity
(i) information about the individual’s education, employment or occupation, or educational, employment or occupational history,
(j) information about the individual’s source of income or financial circumstances, activities or history,
(k) information about the individual’s criminal history, including regulatory offences,
(l) the individual’s own personal views or opinions, except if they are about another person,
(m) the views or opinions expressed about the individual by another person, and
(n) an identifying number, symbol or other particular assigned to the individual;

Ontario

Personal Health Information Protection Act, 2004, SO 2004, c 3, Sch A

Personal health information
4(1) In this Act,

“personal health information”, subject to subsections (3) and (4), means identifying information about an individual in oral or recorded form, if the information,

(a) relates to the physical or mental health of the individual, including information that consists of the health history of the individual’s family,
(b) relates to the providing of health care to the individual, including the identification of a person as a provider of health care to the individual,
(c) Repealed

(c.1) is a plan that sets out the home and community care services for the individual to be provided by a health service provider or Ontario Health Team pursuant to funding under section 21 of the Connecting Care Act, 2019,

(d) relates to payments or eligibility for health care, or eligibility for coverage for health care, in respect of the individual,
(e) relates to the donation by the individual of any body part or bodily substance of the individual or is derived from the testing or examination of any such body part or bodily substance,
(f) is the individual’s health number, or
(g) identifies an individual’s substitute decision-maker.

4(2) In this section,
“identifying information” means information that identifies an individual or for which it is reasonably foreseeable in the circumstances that it could be utilized, either alone or with other information, to identify an individual. 2004, c. 3, Sched. A, s. 4 (2).

4(3) Personal health information includes identifying information that is not personal health information described in subsection (1) but that is contained in a record that contains personal health information described in that subsection. 2009, c. 33, Sched. 18, s. 25 (3).

Quebec

Bill 3: Access to information by a service provider or by a researcher and amending various legislative provisions

Chapter I General Provisions
2 Within the meaning of this Act, health and social services information is any information that allows a person to be identified, even indirectly, and that has any of the following characteristics:

(1) it concerns the person’s state of physical or mental health and his or her health determinants, including the person’s medical or family history;
(2) it concerns any material taken from the person, including biological material, collected in the context of an assessment or treatment, or any implants, ortheses, prostheses or other aids that compensate for a disability of the person;
(3) it concerns the health services or social services provided to the person, including the nature of those services, their results, the location where they were provided and the identity of the persons or groups that provided them;
(4) it was obtained in the exercise of a function under the Public Health Act (chapter S-2.2); or
(5) any other characteristic determined by government regulation.

In addition, information allowing a person to be identified, such as the person’s name, date of birth, contact information or health insurance number, is health and social services information when it appears with information referred to in the first paragraph or when it is collected for registration, enrolment or admission of the person concerned at, in or to an institution or for the taking in charge of the person concerned by another health and social services body.

Despite the first and second paragraphs, information that concerns a personnel member of a health and social services body or a professional who practises his or her profession within the body, including a student or trainee, or that concerns a mandatary or a provider of services of such a body, is not health and social services information if collected for human resources management purposes.

Unless the context indicates otherwise, “information” used without a qualifier in this Act means health and social services information.

New Brunswick

Personal Health Information Privacy and Access Act, SNB 2009, cP-7.05

Definitions
1 The following definitions apply in this Act
“personal health information” means identifying information about an individual in oral or recorded form if the information

(a) Relates to the individual’s physical or mental health, family history or health care history, including genetic information about the individual,
(b) is the individual’s registration information, including the Medicare number of the individual,
(c) relates to the provision of health care to the individual,
(d) relates to information about payments or eligibility for health care in respect of the individual, or eligibility for coverage for health care in respect of the individual,
(e) relates to the donation by the individual of any body part or bodily substance of the individual or is derived from the testing or examination of any body part or bodily substance,
(f) identifies the individual’s substitute decisionmaker, or (g) identifies an individual’s health care provider.

Right to Information and Protection of Privacy, SNB 2009, c R-10.6

Definitions
1 The following definitions apply in this Act
“personal information” means recorded information about an identifiable individual, including but not limited to,

(a) the individual’s name,
(b) the individual’s home address or electronic mail address or home telephone or facsimile number,
(c) information about the individual’s age, gender, sexual orientation, marital status or family status,
(d) information about the individual’s ancestry, race, colour, nationality or national or ethnic origin,
(e) information about the individual’s religion or creed or religious belief, association or activity,
(f) personal health information about the individual,
(g) the individual’s blood type, fingerprints or other hereditary characteristics,
(h) information about the individual’s political belief, association or activity,
(i) information about the individual’s education, employment or occupation or educational, employment or occupational history,
(j) information about the individual’s source of income or financial circumstances, activities or history,
(k) information about the individual’s criminal history, including regulatory offences,
(l) the individual’s own personal views or opinions, except if they are about another person,
(m) the views or opinions expressed about the individual by another person, and
(n) an identifying number, symbol or other particular assigned to the individual.

Nova Scotia

Personal Health Information Act, SNS 2010, c41

Interpretation
3 in this Act

(r) “personal health information” means identifying information about an individual, whether living or deceased, and in both recorded and unrecorded forms, if the information

(i) relates to the physical or mental health of the individual, including information that consists of the health history of the individual’s family,
(ii) relates to the application, assessment, eligibility and provision of health care to the individual, including the identification of a person as a provider of health care to the individual,
(iii) relates to payments or eligibility for health care in respect of the individual,
(iv) relates to the donation by the individual of any body part or bodily substance of the individual or is derived from the testing or examination of any such body part or bodily substance,
(v) is the individual’s registration information, including the individual’s health-card number, or
(vi) identifies an individual’s substitute decision-maker;

Personal health information
4(1) In addition to the matters referred to in clause 3(r) and subject to subsection 8(2), personal health information includes identifying information about an individual that is not personal health information but that is contained in a record that contains personal health information about the individual within the meaning of that clause

4(2) Notwithstanding subsection (1), personal health information does not include identifying information contained in a record that is in the custody or under the control of a custodian if

(a) the identifying information contained in the record relates primarily to an employee or agent of the custodian; and
(b) the record is created or maintained for a purpose other than the provision of health care or assistance in providing healthcare to the employee or agent

Freedom of Information and Protection of Privacy Act

Interpretation
3(1) In this act

(i) “personal information” means recorded information about an identifiable individual, including

(i) the individual’s name, address or telephone number
(ii) the individual’s race, national or ethnic origin, colour, or religious or political beliefs of associations
(iii) the individual’s age, sex, sexual orientation, marital status or family status,
(iv) an identifying number, symbol or other particular assigned to the individual,
(v) the individual’s fingerprints, blood type or inheritable characteristics,
(vi) information about the individual’s health-care history, including a physical or mental disability
(vii) information about the individual’s educational, financial, criminal or employment history,
(viii) anyone else’s opinions about the individual, and
(ix) the individual’s personal views or opinions, except if they are about someone else;

Prince Edward Island

Health Information Act, RSPEI 1988, c H-1.41

Definitions
1 In this Act
(t) “personal health information” means identifying information about an individual in an oral or recorded form that

(i) Relates to the individual’s physical or mental health, family health history or health care history, including genetic information about the individual,
(ii) relates to information about an individual that is collected for the purpose of registering the individual for the provision of health care, including a health number, medical record number and any other identifier assigned to an individual,
(iii) relates to the provision of health care to the individual,
(iv) relates to an individual’s entitlement to benefits under or participation in a health care program or service,
(v) is collected in the course of, and is incidental to, the provision of a health care program or service or payment for a health care program or service,
(vi) relates to a drug, a health care aid, device, product, equipment or other item provided to an individual under a prescription or other authorization issued by a health care provider,
(vii) relates to information about payments or eligibility for health care in respect of the individual, or eligibility for coverage for health care in respect of the individual,
(viii) relates to the donation by the individual of any body part or bodily substance of the individual or is derived from the testing or examination of any body part or bodily substance,
(ix) identifies the individual’s substitute decision maker, or
(x) identifies the individual’s health care provider;

Freedom of Information and Protection of Privacy Act, RSPEI 1988, c F-15.01

Definitions
1 In this Act

(a) “personal information” means recorded information about an identifiable individual including

(i) The individual’s name, home or business address or home or business telephone number
(ii) The individual’s race, national or ethnic origin, colour or religious or political beliefs or associations,
(iii) the individual’s age, sex, marital status or family status,
(iv) an identifying number, symbol or other particular assigned to the individual
(v) the individual’s fingerprints, other biometric information, blood type, genetic information or inheritable characteristics,
(vi) information about the individual’s health and health care history, including information about a physical or mental disability,
(vii) information about the individual’s educational, financial, employment or criminal history, including criminal records where a pardon has been given,
(viii) anyone else’s opinions about the individual, and
(ix) the individual’s personal views or opinions, except if they are about someone else;

Newfoundland and Labrador

Personal Health Information Act, SNL 2008, c P-7.01

Personal health information
5(1) In this Act, “personal health information” means identifying information in oral or recorded form about an individual that relates to

(a) the physical or mental health of the individual, including information respecting the individual’s health care status and history and the health history of the individual’s family;
(b) the provision of health care to the individual, including information respecting the person providing the health care;
(c) the donation by an individual of a body part or bodily substance, including information derived from the testing or examination of a body part or bodily substance;
(d) registration information;
(e) payments or eligibility for a health care program or service in respect of the individual, including eligibility for coverage under an insurance or payment arrangement with respect to health care;
(f) an individual’s entitlement to benefits under or participation in a health care program or service;
(g) information about the individual that is collected in the course of, and is incidental to, the provision of a health care program or service or payment for a health care program or service;
(h) a drug as defined in the Pharmacy Act, 2012 , a health care aid, device, product, equipment or other item provided to an individual under a prescription or other authorization issued by a health care professional; or
(i) the identity of a person referred to in section 7.

Access to Information and Protection of Privacy Act, 2015, SNL 2015, c A-1.2

Definitions
2 In this Act

(u) “personal information” means recorded information about an identifiable individual, including

i. the individual’s name address, or telephone number
ii. the individual’s race, national or ethnic origin, colour or religious or political beliefs of associations
iii. the individual’s age, sex, sexual orientation, marital status or family status,
iv. an identifying number, symbol or other particular assigned to the individual,
v. the individual’s finger prints, blood type or inheritable characteristics
vi. information about the individual’s health are status or history, including a physical or mental disability
vii. information about the individual’s educational, financial, criminal or employment status or history
viii. the opinions of a person about the individual, and
ix. the individual’s personal views or opinions, except where they are about someone else

Yukon

Health Information Privacy and Management Act

Definitions
(1) In this Act

“health information” of an individual means identifying information of the individual, in unrecorded or recorded form, that

(a) relates to the individual’s health or the provision of health care to the individual,
(b) relates to payments for health care,
(c) relates to the donation by the individual of any body part, tissue or bodily substance of the individual,
(d) is derived from the testing, including genetic testing, or examination of any body part, tissue or bodily substance of the individual, or
(e) is prescribed

“personal health information” of an individual means

(a) health information of the individual, and
(b) except as prescribed, prescribed registration information and prescribed provider registry information in respect of the individual;

“personal information” has the same meaning as in the Access to Information and Protection of Privacy Act.

Access to Information and Protection of Privacy Act

Definitions
1 In this Act

“personal information” means, subject to section 3, recorded information about an identifiable individual, including

(a) their name
(b) their home, mailing or email address or phone number,
(c) their age, sex, gender identity or expression, or sexual orientation
(d) their skin colour, fingerprints, blood type or any other generic characteristic or biometric information
(e) their race, ethnicity, or nationality
(f) information about their current and past physical or mental health, including their personal health information
(g) information about their marital, family., education or employment status or history,
(h) information about their current or past

(i) political or religious beliefs, associations, or activities
(ii) amounts or sources of income, or
(iii) income tax returns

(i) information about

(i) an asset that the wholly or partially own or owned,
(ii) a liability for which they are or were wholly or partially liable
(iii) a transaction or banking activity in which they are or were involved
(iv) an assessment of credit-worthiness of which they are or were the subject
(v) a discretionary benefit in the nature of income assistance, legal aid or another similar type of benefit that they are receiving or have received, or
(vi) a law enforcement matter of which they are or were the subject

(j) a personal unique identifier that has been assigned to them
(k) another individual’s opinion or view about them, or
(l) their opinion or view about something other than their opinion or view about another individual

Northwest Territories

Health Information Act, SNWT 2014, c. 2

Definitions
1 In this Act

“personal health information” means the following information in any form that identifies an individual, or in respect of which it is reasonably foreseeable in the circumstances that the information could be used, either alone or with other information, to identify an individual:

(a) information about the health and health care history of an individual,
(b) information respecting health services provided to an individual,
(c) information about eligibility or registration of an individual for a health service or related product or benefit,
(d) information about the payment for a health service for an individual,
(e) information collected in the course of providing a health service to an individual or information that is collected incidentally to the provision of a health service to an individual, including the individual’s name and contact information,
(f) a personal health number, other identifying number, symbol, or other particular assigned to an individual in respect of health services or health information,
(g) prescribed information about a health service provider that provides a health service to an individual,
(h) information respecting the donation by an individual of a body part or bodily substance,
(i) information prescribed as personal health information

Access to Information and Protection of Privacy Act

Definitions
2 In this Act

“personal information” means information about an identifiable individual, including

(a) the individual’s name, home or business address or home or business telephone number
(b) the individual’s race, colour, national or ethnic origin or religious or political beliefs or associations,
(c) the individual’s age, sex, sexual orientation, marital status or family status,
(d) an identifying number, symbol or other particular assigned to the individual,
(e) the individual’s fingerprints, blood type or inheritable characteristics,
(f) information about the individual’s health and health care history, including information about a physical or mental disability,
(g) information about the individual’s educational, financial, criminal or employment history,
(h) anyone else’s opinions about the individual,

the individual’s personal opinions, except where they are about someone else;

Nunavut

Public Health Act

Definitions
3 In this Act

“health information” means information in any format collected or maintained under this Act concerning the health of an individual, living or deceased, and includes any of the following information:

(a) information about a pathogen with which an individual is infected or to which the individual has been exposed,
(b) information about other health conditions to which an individual is subject,
(c) information about health services provided to an individual,
(d) information about individual’s health care history,
(e) information that is collected in the course of, or incidental to, the provision of health services to an individual,
(f) information in respect of the examination or testing of an individual by, or on referral from, a health care professional,
(g) information in respect of an individual’s receipt, donation or transfusion of cellular material, an organ, tissue, blood or a blood product,
(h) an identifying number, symbol or other particular assigned to an individual in respect of health services or health information;

“personal health information” means health information related to a specific, identified individual or that could identify a specific individual

Access to Information and Protection of Privacy Act

Definitions
2 In this Act,

“personal information” means information about an identifiable individual, including

(a) the individual’s name, home or business address or home or business telephone number,
(b) the individual’s race, colour, national or ethnic origin or religious or political beliefs or associations,
(c) the individual’s age, sex, sexual orientation, marital status or family status,
(d) an identifying number, symbol or other particular assigned to the individual,
(e) the individual’s fingerprints, blood type or inheritable characteristics,
(f) information about the individual’s health and health care history, including information about a physical or mental disability,
(g) information about the individual’s educational, financial, criminal or employment history,
(h) anyone else’s opinions about the individual,
(i) the individual’s personal opinions, except where they are about someone else

British Columbia

BC Ministry of Health: “Access to Health Data for Research” Directive Document
(Provides helpful definitions for researchers that are consistent with TCPS):

Definitions
“Anonymization” is a de-identification process that removes or transforms all direct and indirect identifiers in a record for which there is a reasonable expectation that the identifiers could be used, either alone or with other information, to identify an individual;

“Direct identifiers” means information that identifies an individual without additional information, with examples including an individual’s name or a unique identifier such as a personal health number;

“Indirect identifiers” means information that is not a direct identifier but which may identify an individual when it is connected with other pieces of information to single out an individual, with indirect identifiers being considered personal information if they can be combined together to identify an individual, due to what is commonly referred to as the mosaic effect;

“partial de-identification” means a de-identification process that removes direct identifiers and manages the indirect identifiers that could potentially be combined to identify an individual. Partially de-identified records contain personal information. Therefore, the disclosure of partially de-identified records would require appropriate authorization under Part 3 of Freedom of Information and Protection of Privacy Act.

Alberta

Health Information Act

Interpretation
1 In this Act

“individually identifying”, when used to describe health information, means that the identity of the individual who is the subject of the information can be readily ascertained from the information;

Duty to collect, use or disclose health information with the highest degree of anonymity possible
57(1) In this section, “aggregate health information” means non-identifying health information about groups of individuals

Duty to collect, use or disclose health information in a limited manner
58(1) When collecting, using or disclosing health information, a custodian must, in addition to complying with section 57, collect, use or disclose only the amount of health information that is essential to enable the custodian or the recipient of the information, as the case may be, to carry out the intended purpose

107(5) No person to whom non-identifying health information is disclosed and who intends to use the information to perform data matching shall fail to comply with section 32(2).

Regulations
108(1) The Lieutenant Governor in Council may make regulations

(q) respecting the stripping, encoding or other transformation of individually identifying health information to create non-identifying health information pursuant to section 65;

Saskatchewan

The Health Information Protection Act

Application of Act
3(2) This Act does not apply to:

(a) statistical information or de-identified personal health information that cannot reasonably be expected, either by itself or when combined with other information available to the person who receives it, to enable the subject individuals to be identified;

Collection, use and disclosure on need-to-know basis
23(4) A trustee must, where practicable, use or disclose only de-identified personal health information if it will serve the purpose

Restrictions on Use
26(2) A trustee may use personal health information:

(b) for the purposes of de-identifying the personal health information

Use and disclosure for research
29(2) where it is not reasonably practicable for the consent of the subject individual to be obtained, a trustee or designated archive may use or disclose personal health information for research purposes if:

the research purposes cannot be reasonably accomplished using de-identified personal health information or other information;

Manitoba

Personal Health Information Act

Disclosure without individual’s consent
22(2) A trustee may disclose personal health information without the consent of the individual the information is about if the disclosure is:

(g.3) to another trustee for the purpose of de-identifying the personal health information

Conditions for approval
24(3) An approval may be given under this section only if the committee has determined that

(d) the research proposal contains
(i) reasonable safeguards to protect the confidentiality and security of the personal health information, and
(ii) procedures to destroy or remove, at the earliest opportunity consistent with the purposes of the research, any information that, either by itself or when combined with other information available to the holder, allows individuals to be readily identified; and

Protecting individual privacy
24.1(3) A prescribed health research organization must

as soon as reasonably possible having regard to the use of the information, remove any information that, either by itself or when combined with other information available to the organization, allows the identity of the individuals to be readily ascertained.

Ontario

Personal Health Information Protection Act, 2004, SO 2004, c 3, Sch A

Definitions
2 In this Act

“de-identify”, in relation to the personal health information of an individual, means to remove any information that identifies the individual or for which it is reasonably foreseeable in the circumstances that it could be utilized, either alone or with other information, to identify the individual, and “de-identification” has a corresponding meaning

Limits on use of de-identified information
11.2(1) Subject to subsection (2) and to any other exceptions that may be prescribed, no person shall use or attempt to use information that has been de-identified to identify an individual, either alone or with other information, unless this Act or another Act permits the information to be used to identify the individual

11.2(2) The limitation in subsection (1) does not prevent any of the following from using information that they de-identified, either alone or with other information, to identify an individual:

A health information custodian.
A prescribed entity mentioned in subsection 45 (1).
A prescribed person who compiles or maintains a registry of personal health information.

Any other prescribed person. 2019, c. 15, Sched. 30, s. 3.

Quebec

Bill 64: Act Respecting Access to Documents held by public bodies and protection of personal information

19. Section 65.1 of the Act is amended

(1) by replacing the first two paragraphs by the following paragraphs:

“Unless the person concerned gives his consent, personal information may not be used within a public body except for the purposes for which it was collected. Such consent must be given expressly when it concerns sensitive personal information.

A public body may, however, use personal information for another purpose without the consent of the person concerned, but only

(4) if its use is necessary for study or research purposes or for the production of statistics and the information is de-identified

(2) by adding the following paragraphs at the end:

“For the purposes of this Act, personal information is de-identified if it no longer allows the person concerned to be directly identified.

A public body that uses de-identified information must take reasonable measures to limit the risk of someone identifying a natural person using de-identified information.”

Bill 64: Act Respecting the Protection of Personal Information in the Private Sector

102. Sections 12 to 14 of the Act are replaced by the following sections:

“12. Unless the person concerned gives his consent, personal information may not be used within the enterprise except for the purposes for which it was collected. Such consent must be given expressly when it concerns sensitive personal information.

Personal information may, however, be used for another purpose without the consent of the person concerned, but only

(1) if it is used for purposes consistent with the purposes for which it was collected;
(2) if it is clearly used for the benefit of the person concerned; or
(3) if its use is necessary for study or research purposes or for the production of statistics and if the information is de-identified.

In order for a purpose to be consistent within the meaning of subparagraph 1 of the second paragraph, it must have a direct and relevant connection with the purposes for which the information was collected. However, commercial or philanthropic prospection may not be considered a consistent purpose.

For the purposes of this Act, personal information is

(1) de-identified if it no longer allows the person concerned to be directly identified;

sensitive if, due to its nature or the context of its use or communication, it entails a high level of reasonable expectation of privacy.

New Brunswick

Personal Health Information Privacy and Access Act, SNB 2009, cP-7.05

Permitted uses
34 A custodian may use personal health information in its custody or under its control for one or more of the following purposes:

(h) for the purpose of disposing of the information or de-identifying the information;

(q) to produce de-identified information that does not, either by itself or in combination with other information in the custody of or under the control of the custodian, permit an individual to be identified

Disclosure for health related purposes
37(5) A custodian may disclose personal health information relating to an individual who is deceased or presumed to be deceased

(e) for research purposes under section 43 if the information has been de-identified

Disclosure for research purposes
43(3) An approval may be given under this section only if the research review body has determined that

(d) the research project contains

(ii) procedures to destroy the information or de-identify the information at the earliest opportunity, consistent with the purposes of the project

Power to transform personal health information
51 A custodian may strip, encode or otherwise transform personal health information in order to create or produce de-identified information.

Right to Information and Protection of Privacy, SNB 2009, c R-10.6

Use of personal information
44 A public body may use personal information only

(e) for the purpose of producing de-identified information that does not, wither by itself or in combination with other information in the custody or under the control of the public body, permit an individual to be identified

Nova Scotia

Personal Health Information Act, SNS 2010, c41

Application of Act
5(2) This at does not apply to

(a) statistical, aggregate or de-identified health information; or

Prince Edward Island

Health Information Act, RSPEI 1988, c H-1.41

Collection of de-identified information
20 A custodian may collect for ay purpose personal health information that has been de-identified

Use of de-identified information
22(4) A custodian may use for any purpose personal health information that has been de-identified

Authorized purposes
22(5) A custodian may use personal health information in its custody or under its control for one or more of the following purposes

(r) to produce de-identified information

Disclosure of de-identified information
23(4) A custodian may disclose for any purpose personal health information that has been de-identified

Production of de-identified information
40 A custodian may strip, encode or otherwise transform personal health information in order to create or produce de-identified information

PRINCE EDWARD ISLAND ELECTRONIC HEALTH RECORD SYSTEM

Disclosure for reports, planning, or research
71.1(1) The Minister may disclose to any person non-identifying information or de-identified information stores in the PEI HER to be used for the purpose of

(b) research that has been approved by a research ethics board

DRUG INFORMATION SYSTEM

Disclosure for reports, planning, or research
73.6(1) the Minister may disclose to any person non-identifying information or de-identified information stored in the DIS to be used for the purpose of

(b) research that has been approved by a research ethics board

Newfoundland and Labrador

Personal Health Information Act, SNL 2008, c P-7.01

Personal health information
5(5) for the purpose of this section, “identifying information” means information that identifies an individual or for which it is reasonably foreseeable in the circumstances that it could be utilized, either alone or together with other information, to identify an individual

Yukon

Health Information Privacy and Management Act

Non-identifying information
14 Nothing in this Act limits any person’s right to collect, use or disclose information that is not identifying information

Northwest Territories

No information found

Nunavut

Public Health Act

Disclosure of aggregate or anonymous health information
18 Subject to section 19, health information collected under this Act shall only be disclosed in the form of

(a) aggregate health information that relates only to groups of individuals in the form of statistical information or aggregated, general or anonymous data; or

anonymous health information that relates to an unidentifiable individual

British Columbia

BC Ministry of Health: “Access to Health Data for Research” Directive Document
(Provides helpful definitions for researchers that are consistent with TCPS):

“De-identification” means a process that removes, or transforms, direct and indirect identifiers in a record using methods that can include generalization, suppression, aggregation and randomization, and for unstructured data can include redacting or severing, with deidentification processes resulting in partial de-identification or anonymization

Alberta

Health Information Act

A custodian may collect, use, and disclose non-identifying health information for any purpose (s 19, 26, and 32)

Interpretation
1 In this Act

“non-identifying”, when used to describe information means, that the identity of the individual who is the subject of the information cannot be readily ascertained from the information

Saskatchewan

The Health Information Protection Act

Interpretation
2(1) In this Act

“de-identified personal health information” means personal health information from which any information that may reasonably be expected to identify an individual has been removed

Manitoba

No information found

Ontario

No information found

Quebec

Bill 64: Act Respecting the Protection of Personal Information in the Private Sector

110. Sections 12 to 14 of the Act are replaced by the following sections:

For the purposes of this Act, personal information is

(1) de-identified if it no longer allows the person concerned to be directly identified;

New Brunswick

Personal Health Information Privacy and Access Act, SNB 2009, cP-7.05

Definitions
1 The following definitions apply in this Act

“de-identified”, when referring to personal health information, means personal health information from which all identifying information has been removed

Nova Scotia

Personal Health Information Act, SNS 2010, c41

Interpretation
3 In this Act,

(g) “de-identified information” is information that has had all identifiers removed that

(i) identify the individual
(ii) where it is reasonably foreseeable in the circumstances, could be utilized, either alone or with other information, to identify the individual;

Prince Edward Island

Health Information Act, RSPEI 1988, c H-1.41

Definitions
1 In this Act

(g) “De-identified information” means personal health information that has been stripped, encoded or otherwise transformed so as to ensure that the identity of the individual who was the subject of the personal health information cannot be readily ascertained from the de-identified information.

Newfoundland and Labrador

No information found

Yukon

No information found

Northwest Territories

No information found

Nunavut

No information found

British Columbia

Freedom of Information and Protection of Privacy Act [RSBC 1996] CHAPTER 165

Disclosure harmful to personal privacy
22(4) Disclosure of personal information is not an unreasonable invasion of a third party’s personal privacy if

(d) the disclosure is for a research or statistical purpose and is in accordance with section 33(3)(h)

Disclosure of personal information
33(3) A public body may disclose personal information in any of the following circumstances:

(h) for a research purpose, including statistical research, if

(i) the research purpose cannot be accomplished unless the information is disclosed in individually identifiable form, or the research purpose has been approved by the commissioner,
(ii) the information is disclosed on condition that it not be used for the purpose of contacting a person to participate in the research unless

(A) the research is in relation to health issues, and
(B) the commissioner has approved the research purpose, the use of the information for the purpose of contacting a person to participate in the research and the manner in which contact is to be made, including the information to be made available to the person contacted,

(iii) any data-linking is not harmful to the individual the information is about and the benefits to be derived from the data-linking are clearly in the public interest,
(iv) the head of the public body has approved conditions relating to the following:

(A) security and confidentiality;
(B) the removal or destruction of individual identifiers at the earliest reasonable time;
(C) the prohibition of subsequent use or disclosure of the information in individually identifiable form without the express authorization of the public body, and

the person to whom the information is disclosed has signed an agreement to comply with the approved conditions, this Act and the public body’s policies and procedures relating to the confidentiality of personal information

E-Health (Personal Health Information Access and Protection of Privacy) Act, SBC 2008, c 38

Collection and use of personal health information
4 A designation order may authorize the collection and use of personal health information only for one or more of the following purposes:

(h) to conduct or facilitate research into health issues

Disclosure of personal health information
5 A designation order may authorize the disclosure of personal health information only for one or more of the following purposes:

(c) if disclosure is inside or outside Canada, a purpose set out in section 4 (h) or (i).

Disclosure for Health Research Purposes
14(1) A person may request protected information for a health research purpose only by submitting to the data stewardship committee

(a) a request in the form and in the manner required by the data stewardship committee, and
(b) information required by the data stewardship committee for the purposes of evaluating the request.

14(2) The data stewardship committee may approve the request if both of the following apply:

(a) in the case of a request to disclose personal health information, all of the requirements set out in subsection (2.1) are met
(b) in the case of a request to disclose protected information outside Canada, there is express consent, in writing, to the disclosure from each person who is the subject of the protected information.

14(2.1) The requirements for the purposes of subsection (2) (a) are as follows:

(a) the request is for a health research purpose that cannot reasonably be accomplished unless personal health information is disclosed;
(b) if the protected information is contained in a health information bank, the disclosure is authorized under the terms of the applicable designation order;
(c) the disclosure is on condition that it not be used for the purpose of contacting a person to participate in the health research, unless the commissioner approves

(i) the health research purpose,
(ii) the use of disclosed personal health information for the purpose of contacting a person to participate in the health research, and
(iii) the manner in which contact is to be made, including the information to be made available to persons contacted;

(d) any data linkage is not harmful to the individuals who are the subjects of the personal health information, and the benefits to be derived from the record linkage are clearly in the public interest;
(e) the data stewardship committee has imposed conditions relating to

(i) security and confidentiality,
(ii) the removal or destruction of individual identifiers at the earliest reasonable time, and
(iii) the prohibition of any subsequent use or disclosure of personal health information without the express authorization of the data stewardship committee.

No market research
20(1) This section applies despite Part 2 of the Freedom of Information and Protection of Privacy Act, any provision of this Act, and any term of a designation order.

20(2) A person must not disclose, for the purpose of market research, any of the following information that is contained in a health information bank or ministry database:

(a) personal health information;
(b) information related to health service providers.

Alberta

Health Information Act

Interpretation
1 In this Act

“research” means academic, applied or scientific research that necessitates the use of individually identifying health information;

Use of individually identifying health information
27(1) A custodian may use individually identifying health information in its custody or under its control for the following purposes:

(d) conducting research or performing data matching or other services to facilitate another person’s research

(i) if the custodian or researcher has submitted a proposed research protocol to a research ethics board in accordance with section 49,
(ii) if the research ethics board is satisfied as to the matters referred to in section 50(1)(b),
(iii) if the custodian or researcher has complied with or undertaken to comply with the conditions, if any, suggested by the research ethics board, and
(iv) where the research ethics board recommends that consents should be obtained from the individuals who are the subjects of the health information to be used in the research, if those consents have been obtained;

Proposed research protocol
49 A person who intends to conduct research using health information in the custody or under the control of a custodian or health information repository must submit a proposal to a research ethics board for review by that board containing

(a) the information specified by the regulations, and
(b) any other information required by the research ethics board.

Bar to research
51 If the research ethics board is not satisfied as to any of the matters referred to in section 50(1)(b), the researcher may not apply to a custodian or health information repository under section 52

Application for disclosure of health information or to perform data matching
52 If the research ethics board is satisfied as to the matters referred to in section 50(1)(b), the researcher may forward to one or more custodians or health information repositories

(a) the researcher’s research protocol referred to in section 49,
(b) the response of the research ethics board to the researcher’s research protocol, and
(c) a written application for one or more of the following:

(i) disclosure of the health information to be used in the research;
(ii) performance of data matching;
(iii) performance of any other service to facilitate the research.

Freedom of Information and Protection of Privacy Act

Disclosure for research or statistical purposes
42 A public body may disclose personal information for a research purpose, including statistical research, only if
(a) the research purpose cannot reasonably be accomplished unless that information is provided in individually identifiable form or the research purpose has been approved by the Commissioner,
(b) any record linkage is not harmful to the individuals the information is about and the benefits to be derived from the record linkage are clearly in the public interest,
(c) the head of the public body has approved conditions relating to the following:

(i) security and confidentiality,
(ii) the removal or destruction of individual identifiers at the earliest reasonable time, and
(iii) the prohibition of any subsequent use or disclosure of the information in individually identifiable form without the express authorization of that public body,

and

the person to whom the information is disclosed has signed an agreement to comply with the approved conditions, this Act and any of the public body’s policies and procedures relating to the confidentiality of personal information

Saskatchewan

The Health Information Protection Act

Use and disclosure for research
29(1) A trustee or a designated archive may use or disclose personal health information for research purposes with the express consent of the subject individual if:

(a) in the opinion of the trustee or designated archive, the research project is not contrary to the public interest;
(b) the research project has been approved by a research ethics committee approved by the minister; and
(c) the person who is to receive the personal health information enters into an agreement with the trustee or designated archive that contains provisions:

(i) providing that the person who is to receive the information must not disclose the information;
(ii) providing that the person who is to receive the information will ensure that the information will be used only for the purpose set out in the agreement;
(iii) providing that the person who is to receive the information will take reasonable steps to ensure the security and confidentiality of the information; and
(iv) specifying when the person who is to receive the information must do all or any of the following:

(A) return to the trustee or designated archive any original records or copies of records containing personal health information;
(B) destroy any copies of records containing personal health information received from the trustee or designated archive or any copies made by the researcher of records containing personal health information received from the trustee or designated archive.

29(2) Where it is not reasonably practicable for the consent of the subject individual to be obtained, a trustee or designated archive may use or disclose personal health information for research purposes if:

(a) the research purposes cannot reasonably be accomplished using de-identified personal health information or other information;
(b) reasonable steps are taken to protect the privacy of the subject individual by removing all personal health information that is not required for the purposes of the research;
(c) (c) in the opinion of the research ethics committee, the potential benefits of the research project clearly outweigh the potential risk to the privacy of the subject individual; and (d)
(d) all of the requirements set out in clauses (1)(a) to (c) are met.

29(3) This section does not apply to personal health information disclosed in accordance with section 29 of The Archives and Public Records Management Act

Manitoba

Personal Health Information Act

HEALTH RESEARCH

Disclosure for health Research
24(1) A trustee may disclose personal health information to a person conducting health research if the research has been approved under this section.

Conditions for approval
24(3) An approval may be given under this section only if the committee has determined that

(a) the research is of sufficient importance to outweigh the intrusion into privacy that would result from the disclosure of personal health information;
(b) the research purpose cannot reasonably be accomplished unless the personal health information is provided in a form that identifies or may identify individuals;
(c) it is unreasonable or impractical for the person proposing the research to obtain consent from the individuals the personal health information is about;
(d) the research proposal contains

(i) reasonable safeguards to protect the confidentiality and security of the personal health information, and
(ii) procedures to destroy or remove, at the earliest opportunity consistent with the purposes of the research, any information that, either by itself or when combined with other information available to the holder, allows individuals to be readily identified; and

(e) any other requirements specified in the regulations are complied with.

Limitation for projects requiring direct contact with individuals
24(5) If a research project will require direct contact with individuals, a trustee shall not disclose personal health information about those individuals under this section without first obtaining their consent. However, the trustee need not obtain their consent if the information consists only of the individuals’ names and addresses.

Disclosure to a health research organization
24.1(1) A trustee may disclose personal health information to a health research organization for a purpose mentioned in subsection (2) only if the organization is prescribed in the regulations and meets the requirements of this section.

Purposes
24.1(2) A trustee may disclose personal health information to a prescribed organization under this section for any of the following purposes:

(a) analyzing the health status of the population;
(b) identifying and describing patterns of illness;
(c) describing and analyzing how health services are used;
(d) analyzing the availability and adequacy of human resources required to provide health services;
(e) measuring health system performance;
(f) health system planning.

Freedom of Information and Protection of Privacy Act

When disclosure not unreasonable
17(4) Despite subsection (2) disclosure of personal information is not an unreasonable invasion of a third party’s privacy if

(d) the disclosure is for research purposes and is in accordance with section 47

Disclosure for research purposes
47(1) A public body may disclose personal information for a research purpose only in accordance with this section.

Conditions of disclosure
47(4) The head of the public body may disclose personal information for a research purpose only if

(b) the head is satisfied that

(i) the personal information is requested for a bona fide research purpose,
(ii) the research purpose cannot reasonably be accomplished unless the personal information is provided in a form that identifies individuals,
(iii) it is unreasonable or impractical for the person proposing the research to obtain consent from the individuals the personal information is about, and
(iv) disclosure of the personal information, and any information linkage, is not likely to harm the individuals the information is about and the benefits to be derived from the research and any information linkage are clearly in the public interest

(c) the head of the public body has approved conditions relating to

(i) the protection of the personal information, including use, security and confidentiality,
(ii) the removal or destruction of individual identifiers at the earliest reasonable time, and
(iii) the prohibition of any subsequent use or disclosure of the personal information in a form that identifies individuals without the express written authorization of the public body; and

(d) the person to whom the personal information is disclosed has entered into a written agreement to comply with the approved conditions

Ontario

Personal Health Information Protection Act, 2004, SO 2004, c 3, Sch A

Disclosure for research
44(1) A health information custodian may disclose personal health information about an individual to a researcher if the researcher,

(a) submits to the custodian,

(i) an application in writing,
(ii) a research plan that meets the requirements of subsection (2), and
(iii) a copy of the decision of a research ethics board that approves the research plan; and

(b) enters into the agreement required by subsection (5)

Same
(1.1) For greater certainty, the decision of only one research ethics board is sufficient for the purposes of subclause (1)(a)(iii)

Research plan
44(2) A research plan must be in writing and must set out,

(a) the affiliation of each person involved in the research;
(b) the nature and objectives of the research and the public or scientific benefit of the research that the researcher anticipates; and
(c) all other prescribed matters related to the research.

Consideration by board
44(3) When deciding whether to approve a research plan that a researcher submits to it, a research ethics board shall consider the matters that it considers relevant, including,

(a) whether the objectives of the research can reasonably be accomplished without using the personal health information that is to be disclosed;
(b) whether, at the time the research is conducted, adequate safeguards will be in place to protect the privacy of the individuals whose personal health information is being disclosed and to preserve the confidentiality of the information;
(c) the public interest in conducting the research and the public interest in protecting the privacy of the individuals whose personal health information is being disclosed; and
(d) whether obtaining the consent of the individuals whose personal health information is being disclosed would be impractical.

Decision of board
44(4) After reviewing a research plan that a researcher has submitted to it, the research ethics board shall provide to the researcher a decision in writing, with reasons, setting out whether the board approves the plan, and whether the approval is subject to any conditions, which must be specified in the decision.

Agreement respecting disclosure
44(5) Before a health information custodian discloses personal health information to a researcher under subsection (1), the researcher shall enter into an agreement with the custodian in which the researcher agrees to comply with the conditions and restrictions, if any, that the custodian imposes relating to the use, security, disclosure, return or disposal of the information.

Compliance by researcher
44(6) A researcher who receives personal health information about an individual from a health information custodian under subsection (1) shall,

(a) comply with the conditions, if any, specified by the research ethics board in respect of the research plan;
(b) use the information only for the purposes set out in the research plan as approved by the research ethics board;
(c) not publish the information in a form that could reasonably enable a person to ascertain the identity of the individual;
(d) despite subsection 49 (1), not disclose the information except as required by law and subject to the exceptions and additional requirements, if any, that are prescribed;
(e) not make contact or attempt to make contact with the individual, directly or indirectly, unless the custodian first obtains the individual’s consent to being contacted;
(f) notify the custodian immediately in writing if the researcher becomes aware of any breach of this subsection or the agreement described in subsection (5); and
(g) comply with the agreement described in subsection (5)

Personal Health Information Protection Act, Regulations

Requirements for research plans
16. The following are prescribed as additional requirements that must be set out in research plans for the purposes of clause 44 (2) (c) of the Act:

1. A description of the research proposed to be conducted and the duration of the research.
2. A description of the personal health information required and the potential sources.
3. A description of how the personal health information will be used in the research, and if it will be linked to other information, a description of the other information as well as how the linkage will be done.
4. An explanation as to why the research cannot reasonably be accomplished without the personal health information and, if it is to be linked to other information, an explanation as to why this linkage is required.
5. An explanation as to why consent to the disclosure of the personal health information is not being sought from the individuals to whom the information relates.
6. A description of the reasonably foreseeable harms and benefits that may arise from the use of the personal health information and how the researchers intend to address those harms.
7. A description of all persons who will have access to the information, why their access is necessary, their roles in relation to the research, and their related qualifications.
8. The safeguards that the researcher will impose to protect the confidentiality and security of the personal health information, including an estimate of how long information will be retained in an identifiable form and why.
9. Information as to how and when the personal health information will be disposed of or returned to the health information custodian.
10. The funding source of the research.
11. Whether the researcher has applied for the approval of another research ethics board and, if so the response to or status of the application.

Whether the researcher’s interest in the disclosure of the personal health information or the performance of the research would likely result in an actual or perceived conflict of interest with other duties of the researcher.

Quebec

Bill 64: Amendments to Act Respecting Access to Documents held by public bodies and protection of personal information

20. Section 65.1 of the Act is amended
(1) by replacing the first two paragraphs by the following paragraphs:

A public body may, however, use personal information for another purpose without the consent of the person concerned, but only

(4) if its use is necessary for study or research purposes or for the production of statistics and the information is de-identified

22. Section 67.2 of the Act is amended by replacing the last paragraph by the following paragraph:

“Subparagraph 2 of the second paragraph does not apply if the mandatary or the person performing the contract is another public body or a member of a professional order.”

23. The Act is amended by inserting the following sections after section 67.2:

“67.2.1. A public body may release personal information without the consent of the persons concerned to a person or body wishing to use the information for study or research purposes or for the production of statistics.

The information may be released if an assessment of the privacy-related factors concludes that

(1) the objective of the study or research or of the production of statistics can be achieved only if the information is released in a form allowing the persons concerned to be identified;
(2) it is unreasonable to require the person or body to obtain the consent of the persons concerned;
(3) the objective of the study or research or of the production of statistics outweighs the impact of releasing and using the information on the privacy of the persons concerned;
(4) the personal information is used in such a manner as to ensure confidentiality; and
(5) only the necessary information is released.

“67.2.2. A person or body wishing to use personal information for study or research purposes or for the production of statistics must

(1) request it in writing;
(2) enclose the research protocol with the request;
(3) state the grounds supporting fulfillment of the criteria set out in subparagraphs 1 to 5 of the second paragraph of section 67.2.1;
(4) mention all the persons and bodies to whom or which the person or body is making a similar request for the purposes of the same study or research or production of statistics;
(5) if applicable, describe the different technologies that will be used to process the information; and (1)
(6) if applicable, submit the documented decision of a research ethics committee relating to the study or research or the production of statistics.

Bill 3: Access to information by a service provider or by a researcher

Division II Researcher
44. A researcher attached to a body referred to in Schedule I, to a public institution or to a private institution under agreement that operates a hospital centre may be informed of the existence of and have access to information held by a body and necessary for carrying out a research project, unless the person concerned has refused access to the information under subparagraph 2 of the first paragraph of section 8, if so authorized by the person exercising the highest authority within the body to which the researcher is attached.

To that end, the researcher must submit a written request for authorization to the person exercising the highest authority and enclose the following documents:

(1) a detailed presentation of the activities related to the research project setting out, in particular,

(a) the objectives pursued;
(b) all the information necessary for achieving those objectives; and
(c) the intended pairing of such information;

(2) a report containing a privacy impact assessment; and
(3) the documented decision of a research ethics committee formed or designated by the Minister under article 21 of the Civil Code with regard to the research project.

45. The privacy impact assessment referred to in subparagraph 2 of the second paragraph of section 39 must be proportionate to the sensitivity of the information concerned, the purposes for which it is to be used, the quantity and distribution of the information and the medium on which it is stored.

Moreover, where the research project involves the communication of information outside Québec, the assessment must take into account

(1) the sensitivity of the information;
(2) the purposes for which it is to be used;
(3) the protection measures, including those that are contractual, that would apply to it; and

the legal framework applicable in the State in which the information would be communicated, including the rules for the protection of health and social services information applicable in that State.

New Brunswick

Personal Health Information Privacy and Access Act, SNB 2009, cP-7.05

Disclosure for research purposes
43(1) A custodian may disclose personal health information to a person conducting a research project only if the project has been approved under this section

Disclosure to a research data centre
43.1 A custodian may disclose personal health information to a research data centre if the research data centre has entered into

(a) a written agreement with the Province with respect to its establishment as a research data centre and the approval of research projects

Right to Information and Protection of Privacy, SNB 2009, c R-10.6

Disclosure of personal information
46(1) A public body may disclose personal information only

(b.1) subject to subsection (1.1), to the minister of Health or a research data centre for the purpose of research conducted by the research data centre or by a researcher authorized by the research data centre

Nova Scotia

Personal Health Information Act, SNS 2010, c41

Research
53 Planning and management of the health system does not constitute research for the purpose of this Act.

Minimum amount of information
54 The use and disclosure of personal health information by a custodian is limited to the minimum amount of information necessary to accomplish the research purposes for which it is to be used or disclosed

Steps required prior to using information
55 A custodian may use personal health information for research if, before commencing the research, the custodian

(a) prepares a research plan that meets the requirements in Section 59;
(c) receives the approval of a research ethics board; and
(d) meets any conditions imposed by the research ethics board

Obligations of researcher
56 A custodian may disclose personal health information about an individual to a researcher if the researcher
(a) submits to the custodian

(i) an application in writing,
(ii) a research plan that meets the requirements of Section 59, and
(iii) a copy of the submission to and decision of a research ethics board that approves the research plan; and

(b) enters into the agreement required by Section 60

Research plan
59(1) Before commencing research, a researcher seeking to conduct research utilizing personal health information shall submit a research plan to a research ethics board

59(2) The research plan must be in writing

59(3) In order to meet the requirements for a custodian under this Act, the research plan must include

(a) a description of the research proposed to be conducted;
(b) a statement regarding the duration of the research;
(c) a description of the personal health information required and the potential sources of the information;
(d) a description as to how the personal information will be used in the research;
(e) where the personal health information will be linked to other information, a description of the other information as well as how the linkage will be conducted;
(f) where the researcher is conducting the research on behalf of or with the support of a person or organization, the name of the person or organization;
(g) the nature and objectives of the research and the public or scientific benefit anticipated as a result of the research;
(h) where consent is not being sought, an explanation as to why seeking consent is impracticable;
(i) an explanation as to why the research cannot reasonably be accomplished without the use of personal health information;
(j) where there is to be data matching, an explanation of why data matching is required;
(k) a description of the reasonably foreseeable risks arising from the use of personal health information and how those risks are to be mitigated;
(l) a statement that the personal health information is to be used in the most de-identified form possible for the conduct of the research;
(m) a description of all individuals who will have access to the information, and

(i) why their access is necessary,
(ii) their roles in relation to the research, and
(iii) their qualifications;

(n) a description of the safeguards that the researcher will impose to protect the confidentiality and security of the personal health information;
(o) information as to how and when the personal health information will be destroyed or returned to the custodian;
(p) the funding source of the research;
(q) whether the researcher has applied for the approval of another research ethics board and, if so, the response to or status of the application; and
(r) whether the researcher’s interest in the disclosure of the personal health information or the conduct of the research would potentially result in an actual or perceived conflict of interest on the part of the researcher. 2010, c. 41, s. 59.

Freedom of Information and Protection of Privacy Act

Disclosure for a research purpose
29 A public body may disclose personal information for a research purpose, including statistical research, if

(a) the research purpose cannot reasonably be accomplished unless that information is provided in individually identifiable form;
(b) any record linkage is not harmful to the individuals that information is about and the benefits to be derived from the record linkage are clearly in the public interest;
(c) the head of the public body concerned has approved conditions relating to

(i) security and confidentiality,
(ii) the removal or destruction of individual identifiers at the earliest reasonable time, and
(iii) the prohibition of any subsequent use or disclosure of that information in individually identifiable form without the express authorization of that public body; and

the person to whom that information is disclosed has signed an agreement to comply with the approved conditions, this Act and any of the public body’s policies and procedures relating to the confidentiality of personal information

Prince Edward Island

Health Information Act, RSPEI 1988, c H-1.41

RESEARCH USING PERSONAL HEALTH INFORMATION

Submission of research plan
30(1) A person who proposes to use personal health information for research purposes shall submit a research plan respecting the proposed research to a research ethics board for approval

Content of research plan
30(2) A research plan for the purposes of subsection (1) shall be in writing and shall set out

Consideration of research plan
30(3) A research ethics board to which a research plan is submitted shall

(a) consider whether the custodian of the personal health information specified in the research plan should be required to obtain consents for the disclosure of the personal health information to be used in the research from the individuals to whom it relates;
(b) consider whether the objectives of the research could reasonably be accomplished without the disclosure or use of personal health information; and
(c) assess whether, in the opinion of the research ethics board,

(i) the proposed research is of sufficient importance that the public interest in the proposed research outweighs to a substantial degree the public interest in protecting the privacy of the individuals who are the subjects of the personal health information to be used in the research,
(ii) the researcher is qualified to carry out the research,
(iii) adequate safeguards will be in place at the time the research will be carried out to protect the privacy of the individuals whose personal health information will be used in the research and the confidentiality of the personal health information, and
(iv) obtaining the consents referred to in clause (a) is unreasonable, impractical or not feasible.

Factors in assessment
30(4) In making an assessment under clause (3)(c), the research ethics board shall consider the degree to which the proposed research may contribute to

(a) identification, prevention or treatment of illness or disease;
(b) scientific understanding relating to health or illness;
(c) promotion and protection of the health of individuals and communities;
(d) improved delivery of health services; or
(e) improvements in health system management.

Response in writing
30(5) If the research ethics board approves the research plan, it shall prepare a written response to the researcher setting out

(a) its recommendation under subsection (3)(a)
(b) its assessment of the matters set out in subsection (3)(b);
(c) and any conditions that the research ethics board considers should be imposed on the researcher.

Idem
30(6) If the research ethics board refuses to approve a research plan, it shall prepare a written response to the researcher setting out its reasons for the refusal.

Copy to Commissioner
30(7) The research ethics board shall send a copy of its response prepared pursuant to subsection (5) to the Commissioner.

Publication of response
30(8) If the response of the research ethics board sent to the Commissioner under subsection (7) indicates that the research ethics board approves the research plan, the Commissioner may publish the response in any manner the Commissioner considers appropriate.

Bar to research
30(9) If the research ethics board refuses to approve the research plan, the researcher shall not apply to a custodian under section 31

Researcher may apply
31 If the research ethics board has approved a research plan submitted to it under section 30, the researcher may forward to one or more custodians

(a) the researcher’s proposed research plan referred to in subsection 30(2);
(b) the response of the research ethics board to the researcher’s proposed research plan; and
(c) a written application for one or more of the following: (

(i) disclosure of the personal health information to be used in the research,
(ii) if consents are required, a request that the custodian obtain the required consents,
(iii) performance of data-matching, or
(iv) performance of any other service to facilitate the research

Disclosure permitted
32(1) A custodian who has received the documents referred to in section 31 may, but is not required to, disclose the requested personal health information or perform data matching or other services to facilitate the research.

Conditions on disclosure
32(2) If a custodian decides to disclose the requested personal health information or perform data matching or other services to facilitate the research,

(a) the custodian

(v) shall impose on the researcher the conditions suggested by the research ethics board, and
(vi) may impose other conditions on the researcher, relating to the use, protection, disclosure, return or disposal of the personal health information or providing safeguards against the identification, direct or indirect, of the individuals who are the subjects of the personal health information, as the custodian considers necessary or advisable; and

(b) if the research ethics board recommended that consents referred to in clause 30(3)(a) be obtained, the custodian shall obtain the consents before the disclosure of the personal health information or performance of data matching or other services.

Conditions
32(3) If a custodian decides to disclose personal health information to a researcher or perform data matching or other services to facilitate the research, the researcher shall

(a) comply with

(i) this Act and the regulations made under this Act,
(ii) any conditions imposed by the custodian relating to the use, protection, disclosure, return or disposal of the health information, and
(iii) any requirements imposed by the custodian to provide safeguards against the identification, direct or indirect, of an individual who is the subject of the personal health information;

(b) use the personal health information only for the purpose of conducting the proposed research;
(c) not publish the personal health information in a form that could reasonably enable the identity of an individual who is the subject of the personal health information to be readily ascertained;
(d) not make any attempt to contact an individual who is the subject of the personal health information to obtain additional personal health information unless the individual has provided the custodian with the consent referred to in subsection (6);
(e) allow the custodian to access or inspect the researcher’s premises to confirm that the researcher is complying with the Act and regulations and the conditions and requirements referred to in clause (a); and
(f) pay the costs referred to in subsection

Disclosure to researcher
32(4) A custodian may disclose to the researcher the personal health information requested under section 31 or perform data matching or other services to facilitate the research

(a) with the consent of the individuals who are the subjects of the personal health information, where the research ethics board recommends that consents should be obtained; or
(b) without the consent of the individuals who are the subjects of the personal health information, where the research ethics board does not recommend that consents be obtained

Costs
32(5) A custodian may charge to a researcher the costs of

(a) preparing personal health information for disclosure, or performing data matching or other services;
(b) making copies of personal health information; and (c) obtaining the consents referred to in section 30, which shall not exceed the actual cost of the service provided.

Further consents needed
32(6) If a researcher wishes to contact the individuals whose personal health information was disclosed under subsection (4) to obtain additional personal health information, the custodian shall first obtain consents from those individuals to their being contacted for that purpose.

Health information Regulations PEI Reg EC359/17

Contents of research plan
5 In addition to the matters set out in clauses 30(2)(a) and (b) of the Act, a research plan shall include

(a) a research protocol, including a description of the specific information or variables required for the research;
(b) a plan for the de-identification of data, including a data flow diagram, if applicable; and
(c) any information known to the person submitting the research plan relevant to the consideration of the research ethics board under clause 30(3)(a) of the Act.

Freedom of Information and Protection of Privacy Act, RSPEI 1988, c F-15.01

Disclosure for research or statistical purposes
39 A public body may disclose personal information for a research purpose, including statistical research, only if

(a) the research purpose cannot reasonably be accomplished unless that information is provided in individually identifiable form or the research purpose has been approved by the Commissioner;
(b) any record linkage is not harmful to the individuals the information is about and the benefits to be derived from the record linkage are clearly in the public interest
(c) the head of a public body has approved conditions relating to the following:

(i) security and confidentiality
(ii) the removal or destruction of individual identifiers at the earliest reasonable time, and
(iii) the prohibition of any subsequent use or disclosure of the information in individually identifiable form without the express authorization of that public body; and

Newfoundland and Labrador

Personal Health Information Act, SNL 2008, c P-7.01

Indirect Collection
31 A custodian may collect personal health information from a source other than the individual who is the subject of the information where

(d) the custodian collects the information from a person who is not a custodian for the purpose of carrying out a research project that has been approved by the research ethics board or a research ethics body

Disclosure for research purposes
44 A custodian may disclose personal health information without the consent of the individual who is the subject of the information for research purposes but only where the research project has been approved by a research ethics board or research ethics body under Health Research Ethics Authority Act

Health Research Ethics Authority Act, SNL 2006, c H-1.2

Definitions
2 In this Act

(d) “health research involving human subjects” means activities whose primary goal is to generate knowledge in relation to human health, health care and health systems, and involving human beings as research subjects, health care information respecting human beings and human biological material

Access to Information and Protection of Privacy Act, 2015, SNL 2015, c A-1.2

Disclosure for research or statistical purpose
70 A public body may disclose personal information for a research purpose, including statistical research, only where

(a) the research purpose cannot reasonably be accomplished unless that information is provided in individually identifiable form
(b) any record linkage is not harmful to the individuals that information is about and the benefits to be derived form the record linkage are clearly in the public interest;
(c) the head of the public body concerned has approved conditions relating to the following

i. security and confidentiality
ii. the removal or destruction of individual identifiers at the earliest reasonable time, and
iii. the prohibition of any subsequent sue or disclosure of that information in individually identifiable form without the express authorization of that public body; and

the person to whom that information is disclosed has signed an agreement to comply with the approved conditions, this Act and the public body’s policies and procedures relating to the confidentiality of personal information

Yukon

Health Information Privacy and Management Act

Definitions
2(1) In this Act

“research” means a systematic investigation (other than a designated investigation) of personal health information designed to develop or establish principles, facts or general knowledge, and includes the development, testing and evaluation of research;

Disclosure for research
68(1) A custodian may, without an individual’s consent but subject to subsections (2) and (3), disclose the individual’s personal health information to a person (referred to in this section and section 69 as the “researcher”) for the purpose of the researcher’s research if

(a) an institutional research review committee has approved the research; and
(b) the custodian and the researcher have made an agreement under section 69

68(2) A custodian that is a public body may disclose an individual’s personal health information to a researcher under subsection (1) for the purposes of the researcher’s research only if

(a) the custodian reasonably believes that

(a) the research is of sufficient importance to outweigh the intrusion into privacy that would result from the disclosure of the personal health information,
(b) the research purpose cannot reasonably be accomplished unless the personal health information is provided in a form that identifies or may identify the individual, and
(c) it is unreasonable or impractical for the researcher to obtain consent from the individual; and

(b) the research meets requirements, if any.

68(3) If a researcher’s research requires direct contact with an individual, a custodian must not disclose the individual’s personal health information to the researcher without first obtaining the individual’s consent

Northwest Territories

Health Information Act, SNWT 2014, c. 2

Application
67 Sections 69 to 83 apply in respect of researchers that

(a) are health information custodians
(b) collect or wish to collect personal health information from one or more health custodians; or
(c) use or wish to use personal health information from one or more health information custodians

Disclosure of information for research purposes
76(1) Subject to sections 79 and 80, a health information custodian may disclose personal health information to a researcher in accordance with section 77 or 78

Disclosure not required
76(2) For greater certainty, a health information custodian is not required to disclose personal health information to a researcher whose research proposal has been approved by a research ethics committee under paragraph 69(1), or by an extra-territorial research ethics committee

Requirements for disclosure research
77 A health information custodian may disclose personal health information to a researcher whose research proposal has been approved by a research ethics committee, if

(a) in its decision, the committee determined that the researcher may collect personal health information from a source other than the individual the information is about;
(b) the researcher submits to the custodian

(i) an application in writing, in a form satisfactory to the custodian, that requests the disclosure of the personal health information to be used in the research,
(ii) a licence to carry out the research issued to the researcher under the Scientists Act, if one is required under that Act for the research,
(iii) the research proposal and a copy of the committee’s decision approving the proposal that includes the determination referred to in paragraph (a) and the following information

(A) whether express consent to the disclosure must be obtained from the individuals whose personal health information would be disclosed to the researcher,
(B) any conditions set by the committee,
(C) any recommendations made for consideration by a custodian that would be disclosing personal health information to the researcher, and

(iv) any other information required by the custodian; and

(c) the researcher enters into an agreement with the custodian in accordance with section 80.

Access to Information and Protection of Privacy Act

Circumstances where no unreasonable invasion of privacy
23(4) A disclosure of personal information is not an unreasonable invasion of a third party’s personal privacy where

(d) the disclosure is for research purposes and is in accordance with section 49

Disclosure in accordance with Part 1 or this Division
47 A public body may disclose personal information only

(a) in accordance with Part 1;or
(b) in accordance with this Division

Disclosure for research
49(1) A public body may only disclose personal information for a research purpose, including statistical research, where

(a) the research purpose cannot reasonably be accomplished unless that information is provided in individually identifiable form;
(b) any record linkage resulting from the disclosure is not harmful to the individuals the information is about and the benefits to be derived from the record linkage are clearly in the public interest;
(c) the head of the public body has approved conditions relating to the following:

(i) security and confidentiality,
(ii) the removal or destruction of individual identifiers at the earliest reasonable time,
(iii) the prohibition of any subsequent use or disclosure of that information in individually identifiable form without the express authorization of that public body; and

the person to whom the information is disclosed has signed an agreement to comply with the approved conditions, this Act and the regulations and any of the public body’s policies and procedures relating to the confidentiality of personal information.

Nunavut

Public Health Act

Authorized purposes
16(3) Health information may only be accessed, used or disclosed under this Act for one or more of the following purposes:

(a) Any purpose for which it may be collected under subsection 17(1);
(b) Any purpose authorized under section 19;
(c) Any purpose authorized under Access to Information and Protection of Privacy Act

Personal Health Information
16(4) Under this Act, personal health information may only be

(a) Accessed or used to the extent that it is necessary for the purposes authorized under subsection (3); and
(b) Disclosed to the extent that it is necessary for the purposes authorized under paragraphs (3)(b) and (c)

Disclosure of personal health information
19 The Chief Public Health Officer may disclose personal health information if

(a) the individual consents in accordance with the Access to Information and Protection of Privacy Act;

Access to Information and Protection of Privacy Act

Circumstances where no unreasonable invasion of privacy
23(4) A disclosure of personal information is not an unreasonable invasion of a third party’s privacy where

(d) the disclosure is for research purposes and is in accordance with section 49;

Disclosure for research
49 A public body may only disclose personal information for a research purpose, including statistical research, where

British Columbia

E-Health (Personal Health Information Access and Protection of Privacy) Act, SBC 2008, c 38

Establishment or designation of health information banks
3(1) Subject to the regulations, the minister may order establish or designate a database containing personal health information as a health information bank, if

(b) the collection and use of personal health information through the database is for a purpose set out in section 4 [collection and use of personal health information].

Data stewardship committee
13(1) Subject to this Act, the data stewardship committee may make rules governing the following:

(a) the calling and conduct of its meetings;
(b) the establishment of panels of the data stewardship committee to conduct business of that committee;
(c) the practices and procedures of the panels established under paragraph (b);
(d) the quorum of the data stewardship committee or of the panels established under paragraph (b);
(e) other matters respecting the conduct of the work of the data stewardship committee or of the panels established under paragraph (b), including the fees that may be charged by a health care body for information to defray the cost to the health care body to provide the information.

13(2) The data stewardship committee must establish policies and procedures respecting the disclosure of information under this Division.

13(3) A member of the data stewardship committee must take reasonable steps, in accordance with the regulations, to avoid or manage a conflict of interest

Alberta

Health Information Act

Power to enter agreement with information manager
66(1) In this section, “information manager” means a person or body that

(a) processes, stores, retrieves or disposes of health information,
(b) in accordance with the regulations, strips, encodes or otherwise transforms individually identifying health information to create non‑identifying health information, or
(c) provides information management or information technology services

but does not include an individual employed by a custodian who performs any of the functions listed in clauses (a) to (c).

Designation
72.1(1) The Minister may, in accordance with the regulations, designate an agency, corporation or other entity to act as a health information repository.

Disclosure of information
72.2 A custodian may, in accordance with the regulations, disclose individually identifying health information to a health information repository.

Powers and duties of repository
72.3 A health information repository has the powers, duties and functions given to it by this Act and the regulation

Saskatchewan

The Health Information Protection Act

Interpretation
2(1) In this Act

“information management service provider” means a person who or body that processes, stores, archives or destroys records of a trustee containing personal health information or that provides information management or information technology services to a trustee with respect to records of the trustee containing personal health information, and includes a trustee that carries out any of those activities on behalf of another trustee, but does not include a trustee that carries out any of those activities on its own behalf;

Manitoba

Personal Health Information Act

Purposes
24.1(2) A trustee may disclose personal health information to a prescribed organization under this section for any of the following purposes:

Protecting individual privacy
24.1(3) A prescribed health research organization must

(a) use personal health information disclosed to it under this section for the purpose for which it was disclosed and no other;
(b) have in place policies and procedures that protect the privacy of the individuals whose information is disclosed to it and that ensure the security and integrity of the information; and
(c) as soon as reasonably possible having regard to the use of the information, remove any information that, either by itself or when combined with other information available to the organization, allows the identity of the individuals to be readily ascertained

Agreement required
24.1(4) Before disclosing personal health information to a prescribed health research organization, the trustee must enter into an agreement with the organization that includes any requirements specified in the regulations.

Duties of health research organization
24.1(5) A prescribed health research organization must

(a) comply with the terms of the agreement entered into under subsection (4); and

if the organization is not a trustee, comply with the same requirements concerning the protection, retention and destruction of personal health information that the trustee is required to comply with under this Act

Ontario

Personal Health Information Protection Act, 2004, SO 2004, c 3, Sch A

Disclosure for planning and management of health system
45(1) A health information custodian may disclose to a prescribed entity personal health information for the purpose of analysis or compiling statistical information with respect to the management of, evaluation or monitoring of, the allocation of resources to or planning for all or part of the health system, including the delivery of services, if the entity meets the requirements under subsection (3). 2004, c. 3, Sched. A, s. 45 (1).

Exception
45(2) Subsection (1) does not apply to,

(a) notes of personal health information about an individual that are recorded by a health information custodian and that document the contents of conversations during a private counselling session or a group, joint or family counselling session; or
(b) prescribed information in circumstances that are prescribed. 2004, c. 3, Sched. A, s. 45 (2).

Approval
(3) A health information custodian may disclose personal health information to a prescribed entity under subsection (1) if,

(a) the entity has in place practices and procedures to protect the privacy of the individuals whose personal health information it receives and to maintain the confidentiality of the information; and

(b) the Commissioner has approved the practices and procedures, if the custodian makes the disclosure on or after the first anniversary of the day this section comes into force. 2004, c. 3, Sched. A, s. 45 (3).

Review by Commissioner
(4) The Commissioner shall review the practices and procedures of each prescribed entity every three years from the date of its approval and advise the health information custodian whether the entity continues to meet the requirements of subsection (3). 2004, c. 3, Sched. A, s. 45 (4).

Authorization to collect
(5) An entity that is not a health information custodian is authorized to collect the personal health information that a health information custodian may disclose to the entity under subsection (1). 2004, c. 3, Sched. A, s. 45 (5).

Use and disclosure
(6) Subject to the exceptions and additional requirements, if any, that are prescribed and despite subsection 49 (1), an entity that receives personal health information under subsection (1) shall not use the information except for the purposes for which it received the information and shall not disclose the information except as required by law. 2004, c. 3, Sched. A, s. 45 (6).

Personal Health Information Protection Act, Regulations

Prescribed entities for the purposes of s. 45 (1) of the Act
18(3) Despite subsection 45 (6) of the Act, every entity that is a prescribed entity for the purposes of subsection 45 (1) of the Act may use personal health information as if it were a health information custodian for the purposes of clause 37 (1) (j) and subsection 37 (3) of the Act.

18(4) Despite subsection 45 (6) of the Act, every entity that is a prescribed entity for the purposes of subsection 45 (1) of the Act may disclose personal health information as if it were a health information custodian for the purposes of clause 39 (1) (c) and sections 44, [45 and 47 of the Act.

Quebec

Bill 3: Access to information by a service provider or by a researcher

Division II Researcher
55. If so, authorized by the research access centre, a researcher other than a researcher subject to subdivision 1 may be informed of the existence of and have access to information held by a body and necessary for the carrying out of a research project, unless the person concerned has refused access to the information under subparagraph 3 or 4 of the first paragraph of section 8

Despite the first paragraph, if the information desired is designated information within the meaning of the Act respecting the Institut de la statistique du Quebec and the researcher is attached to a public body within the meaning of that Act, ther researcher msut instead address a request to the Institut de la statistique du Quebec to obtain communication of the information in accordance with that Act

56. The Government, on the recommendation of the Minister, designates a body from among the bodies referred to in section 2 of the Act respecting the governance and management of the information resources of public bodies and government enterprises (chapter G-1.03) to act as a research access centre

57. In order to obtain authorization from the access centre, a researcher referred to in section 48 must submit a written request for authorization to the access centre and enclose the documents required under the second paragraph of section 39. The provisions of sections 40 to 47 apply in such a case, with the necessary modifications, and the agreement referred to in section 43 is entered into, if applicable, with the access centre.

End of 58.
Information obtained by the access centre in accordance with subparagraph 2 of the first paragraph may be used or communicated only for the purposes of a research project for which it has granted authorization and the information must be destroyed once the project is completed.

60. The access centre, as well as any body charged with assisting it, must take the measures necessary for ensuring, at all times, compliance with the highest recognized information protection standards, in particular by observing the information governance rules referred to in section 83 and the special rules defined by the network information officer under section 89.

To that end, the access centre must, among other things, adopt a governance policy, which policy also applies to the bodies charged with assisting it. Section 97 applies to the access centre with respect to the adoption of that policy, with the necessary modifications

61. Each year, the access centre sends to the Minister and to the Commission d’accès à l’information a report concerning the research projects for which it has granted authorization. The Minister determines the form and content of the report.

New Brunswick

Personal Health Information Privacy and Access Act, SNB 2009, cP-7.05

Definitions
1 The following definitions apply in this Act

“Custodian” means an individual or organization that collects, maintains or uses personal health information for the purpose of providing or assisting in the provision of health care or treatment or the planning and management of the health care system or delivering a government program or service
(e.1) research data centres,
(f) researchers conducting a research project approved in accordance with this Act

Source of Information
28 A custodian shall collect personal health information directly from the individual to whom the information relates except if

(n) the custodian is the Minister, a research data centre or a researcher and is collecting the information from another custodian for the purpose of a research project that has been approved in accordance with an agreement referred to in paragraph 43.1(a).

38(1) A custodian may disclose personal health information relating to an individual without the consent of the individual if the disclosure is

(h) to a research data centre for the purpose of a research project approved in accordance with an agreement referred to in paragraph 43.1(a),
(h.01) if the custodian is a research data centre, to a researcher for the purpose of a research project approved in accordance with an agreement referred to in paragraph 43.1(a),

Disclosure to a research data centre
43.1 A custodian may disclose personal health information to a research data centre if the research data centre has entered into

Regulations
79(1) The Lieutenant-Governor in Council may make regulations

(d.1) respecting the terms of an agreement for the purposes of the definition “research data centre” in section 1;

Right to Information and Protection of Privacy, SNB 2009, c R-10.6

Disclosure of personal information
46(1.1) A public body that intends to disclose personal information to a research data centre may disclose the personal information only if the research data centre has entered into the agreements referred to in section 47.1

Collection, use and disclosure of personal information by a research data centre
47.1(1) If a research data centre intends to collect, use or disclose personal information under this Act, the research data centre shall have entered into

(a) a written agreement with the Province with respect to its establishment as a research data centre and the approval of research projects, and
(b) a written agreement with the public body or other body prescribed by regulation against risks, including unauthorized access, use, disclosure or disposal and providing for the secure disposal of the information, with respect to the sharing of personal information in the custody or under the control of the public body or other body.

47.1(2) The Minister of Health and a research data centre may perform data matching for the purpose of research referred to in paragraph 46(1)(b.1) using personal information disclosed to the Minister of Health or the research data centre, as the case may be, under that paragraph.

Regulations
85 The Lieutenant-Governor in Council may make regulations

(h.3) prescribing other bodies from which the Minister of Health or a research data centre may collect personal information for the purposes of section 37.1 and paragraph 47.1(1)(b)

Nova Scotia

No information found

Prince Edward Island

Health Information Act, RSPEI 1988, c H-1.41

Definitions
1 In this act

(z) “research data repository” means an organization that has entered into an agreement with the province for the purpose of

(i) conducting and facilitating research to describe and explain health care patterns and profiles of health and illness
(ii) assisting in the evaluation of monitoring of health care, justice, education and social services

facilitating research between or among areas such as heath care, justice, education and social services

Newfoundland and Labrador

No information found

Yukon

No information found

Northwest Territories

No information found

Nunavut

No information found

British Columbia

Office of the Information & Privacy Commissioner for BC 2018 Access to Data for Health Research

Page 6 & 7: Role of Population Data BC
Researchers may have access to health data through Population Data BC (PopData), a contracted service provider to the Ministry of Health. PopData is a provincial-wide multi-university platform that provides time-and project-limited data access to university affiliated researchers on a cost recovery basis.

The Ministry will disclose data from which direct identifiers have been removed, and will disclose personal information, only on the conditions set out in this policy.

This underscores the fact that the policy is aimed at the vast majority of data access requests, which are for “data” provisioned through PopData, from which direct identifiers have been removed. The discretion of the Chief Data Steward to approve access to fully identifiable personal information recognizes that in some cases access to fully-identifiable personal information may be warranted, subject to compliance with the other conditions set out in this policy. This section does not affect the discretion of the Data Stewardship Committee under certain of the applicable laws to approve access to fully-identifiable personal information

Alberta

Health Information Act

Interpretations
1 In this Act

“health information repository” means an agency, corporation or other entity designated by the Minister to act as a health information repository in accordance with Part 6.1

Power to transform health information
65 A custodian may, in accordance with the regulations, strip, encode or otherwise transform individually identifying health information to create non-identifying health information

Prohibition
68 A custodian or health information repository must not

(a) collect the health information to be used in data matching, or
(b) use or disclose the health information to be used in data matching or created through data matching in contravention of this Act.

Data matching by custodian or health information repository
69 A custodian or health information repository may perform data matching using information that is in its custody or under its control.

Data matching by custodians or health information repository
70(1) A custodian or health information repository may perform data matching by combining information that is in its custody or under its control with information that is in the custody or under the control of another custodian or health information repository.

70(2) Before performing data matching under this section, the custodian or health information repository in whose custody and control the information that is created through data matching will be stored must prepare a privacy impact assessment and submit the assessment to the Commissioner for review and comment.

70(3) A privacy impact assessment referred to in subsection (2) must

(a) describe how the information to be used in the data matching is to be collected, and
set out how the information that is created through data matching is to be used or disclosed.

Saskatchewan

The Health Information Protection Act

Duty to protect
16 Subject to the regulations, a trustee that has custody or control of personal health information must establish policies and procedures to maintain administrative, technical and physical safeguards that will:

(a) protect the integrity, accuracy and confidentiality of the information;
(b) protect against any reasonably anticipated:

(i) threat or hazard to the security or integrity of the information; (ii) loss of the information; or
(iii) unauthorized access to or use, disclosure or modification of the information; and

(c) otherwise ensure compliance with this Act by its employees.

Retention and destruction policy
17(1) A trustee must:

(a) have a written policy concerning the retention and destruction of personal health information that meets the requirements set out in the regulations; and
(b) comply with that policy and any prescribed standards with respect to the retention and destruction of personal health information.

17(2) A trustee must ensure that:

(a) personal health information stored in any format is retrievable, readable and useable for the purpose for which it was collected for the full retention period of the information established in the policy mentioned in subsection (1); and

personal health information is destroyed in a manner that protects the privacy of the subject individual.

Manitoba

Personal Health Information Act

Definitions
1(1) In this Act

“trustee” means a health professional, health care facility, public body, or health services agency that collects or maintains personal health information.

GENERAL DUTIES OF TRUSTEES

General duty of trustees re use and disclosure
20(1) A trustee shall not use or disclose personal health information except as authorized under this Division.

Limit on amount of information used or disclosed
20(2) Every use and disclosure by a trustee of personal health information must be limited to the minimum amount of information necessary to accomplish the purpose for which it is used or disclosed.

Limit on the trustee’s employees
20(3) A trustee shall limit the use of personal health information it maintains to those of its employees and agents who need to know the information to carry o t the purpose for which the information was collected or received or to carry out a purpose authorized under section 21

Duties of health research organization
24.1(5) A prescribed health research organization must

(a) comply with the terms of the agreement entered into under subsection (4); and
(b) if the organization is not a trustee, comply with the same requirements concerning the protection, retention and destruction of personal health information that the trustee is required to comply with under this Act

Trustee may provide information not an information manager
25(1) A trustee may provide personal health information to an information manager for the purpose of processing, storing or destroying it or providing the trustee with information management or information technology services

Freedom of Information and Protection of Privacy Act

“local public body” means

(a) an educational body
(b) a health care body, and
(c) local government body

“public body” means

(a) a department,
(b) a government agency,
(c) the Executive Council Office,
(d) the office of a minister, and
(e) a local public body, but does not include

(i) the office of a Member of the Legislative Assembly who is not a minister,
(ii) the office of an officer of the Legislative Assembly, or
(iii) The Court of Appeal, the Court of King’s Bench or the Provincial Court;

Disclosure of personal information
44(1) A public body may disclose personal information only

(j.1) for the purpose of

(ii) research and planning that relates to a service, program or activity of the Government of Manitoba or the public body

Disclosure for research purposes
47(1) A public body may disclose personal information for a research purpose only in accordance with this section

Ontario

Personal Health Information Protection Act, 2004, SO 2004, c 3, Sch A

Disclosure for planning and management of health system
45 (1) A health information custodian may disclose to a prescribed entity personal health information for the purpose of analysis or compiling statistical information with respect to the management of, evaluation or monitoring of, the allocation of resources to or planning for all or part of the health system, including the delivery of services, if the entity meets the requirements under subsection (3). 2004, c. 3, Sched. A, s. 45 (1).

Quebec

Bill 3: Access to information by a service provider or by a researcher

Division II Researcher
60. The access centre, as well as any body charged with assisting it, must take the measures necessary for ensuring, at all times, compliance with the highest recognized information protection standards, in particular by observing the information governance rules referred to in section 83 and the special rules defined by the network information officer under section 89.

New Brunswick

Personal Health Information Privacy and Access Act, SNB 2009, cP-7.05

Definitions
1 The following definitions apply in this Act

“Research data centre” means a public body that compiles and links personal information or personal health information for the purposes of research, analysis or evidence-based decision-making.

Right to Information and Protection of Privacy, SNB 2009, c R-10.6

Research data centre means a research data centre as defined under the Personal Health Information Privacy and Access Act

Nova Scotia

Personal Health Information Act, SNS 2010, c41

Interpretation
3 In this Act

(aaa) “agent” , in relation to a custodian, means a person who, with authorization of the custodian, acts for on behalf of the custodian in respect of personal health information for the purposes of the custodian, and not the agent’s purposes, whether or not the agent has the authority to bind the custodian, is paid by the custodian or is being renumerated by the custodian, and includes but is not limited to, an employee of the custodian or a volunteer who deals with personal health information, a custodian’s insurer, a lawyer retained by te custodian’s insurer or a liability protection provider;

(f) “custodian” means an individual or organization described below who has custody or control of personal health information as a result of or in connection with performing the person’s or organization’s powers or duties: (see Act for list)

Research Sections 52-60 reference custodian and:

Agent may act on behalf of custodian
29(1) Where a custodian is authorized to use personal health information for a purpose, the custodian may provide the information to an agent who may use it for that purpose on behalf of the custodian.

29(2) For the purpose of this Act, the providing of personal health information between a custodian and an agent of the custodian is a use by the custodian, and not a disclosure by the custodian or a collection by the agent.

Prince Edward Island

Health Information Act, RSPEI 1988, c H-1.41

Definitions
1 In this Act

(a) “agent”, in relation to a custodian, means a person that, with the authorization of the custodian, acts on behalf of the custodian in respect of personal health information for the purposes of the custodian, and not the agent’s purposes, whether or not the agent ahs the authority to bind the custodian, is paid by the custodian or is being renumerated by the custodian, and includes, but is not limited tom an employee of a custodian or a volunteer who deals with personal health information, a custodian’s insurer, a lawyer retained by a custodian’s insurer or a liability protection provider;
(a) “custodian” means a person or organization that collects, maintains, uses or discloses personal health information for the purpose of providing or assisting in the provision of health care or treatment or the planning and management of the health care system or delivering a government program or service related to health care, and, without limiting the foregoing, includes
(vi) researchers conducting a research project approved in accordance with this Act,
(vi.1) a research data repository,

Authorized purposes
22(5) A custodian may use personal health information in its custody or under its control for one or more of the following purposes

(m) for a research project approved by a research ethics board under section 30;
(n) for the purpose of conducting research or performing other services to facilitate another person’s research

(i) if the custodian or researcher has submitted a research plan to a research ethics board in accordance with section 30,
(ii) if the research ethics board has approved the research plan
(iii) if the custodian or researcher has complied with or undertaken to comply with any conditions imposed by the research ethics board, and
(iv) where the research ethics board recommends that consents should be obtained from the individuals whose personal health information is to be used, if those consents have been obtained; ‘

(o) for the purpose of performing data-matching;

Newfoundland and Labrador

Personal Health Information Act, SNL 2008, c P-7.01

Custodian
4(1) In this Act, “custodian” means a person described in one of the following paragraphs who has custody or control of personal health information as a result of or in connection with the performance of the person’s powers or duties of the work described in that paragraph:

(a) the authority;
(b) a board, council, committee, commission, corporation or agency established by the authority;
(c) a department created under the Executive Council Act , or a branch of the executive government of the province, when engaged in a function related to the delivery or administration of health care in the province;
(d) the minister, where the context so requires;
(e) a health care professional, when providing health care to an individual or performing a function necessarily related to the provision of health care to an individual;
(f) a health care provider;
(g) a person who operates

i. a health care facility,
ii. a pharmacy as defined in the Pharmacy Act, 2024 ,
iii. an ambulance service, or
iv. a centre, program or service for community health or mental health, the primary purpose of which is the provision of health care by a health care professional or health care provider;

(h) the Provincial Public Health Laboratory;
(i) [Rep. by 2022 cP-30.1 s57]
(j) with respect to Memorial University of Newfoundland, the Faculty of Medicine, the School of Nursing, the School of Pharmacy and the School of Human Kinetics and Recreation;
(k) the Centre for Nursing Studies;
(l) the Western Regional School of Nursing;
(m) a person who, as a result of the bankruptcy or insolvency of a custodian, obtains complete custody or control of a record of personal health information, held by the custodian;
(n) a rights advisor under the Mental Health Care and Treatment Act;
(o) the Workplace Health, Safety and Compensation Commission; and
(p) a person designated as a custodian in the regulations.

Access to Information and Protection of Privacy Act, 2015, SNL 2015, c A-1.2

Relationship to Personal Health Information Act
6(1) Notwithstanding section 5, but except as provided in sections 92 to 94, this Act and the regulations shall not apply and the Personal Health Information Act and regulations under that Act shall apply where

(a) A public body is a custodian; and
(b) The information or record that is in the custody or control of a public body that is a custodian is personal health information

For the purpose of this section, “custodian” and “personal health information” have the meanings ascribed to them in the Personal Health Information Act

Yukon

No information found

Northwest Territories

Health Information Act, SNWT 2014, c. 2

“information manager” means a person or organization that provides one or more of the following services for a health information custodian:

(a) the processing, storage, retrieval or disposal of personal health information,
(b) the transforming of personal health information, including the transforming of personal health information to create or produce non-identifying information,
(c) information management services, information system services or information technology service

“public custodian” means

(a) the Department, or
(b) a board or other organization that is established by or under an Act and prescribed as a health information custodian under paragraph (d) of the definition “health information custodian”

“researcher” means a person or organization, including a health information custodian, that collects or uses, or wishes to collect or to use, personal health information for research purposes.

Access to Information and Protection of Privacy Act

How to make access request
6(1) To obtain access to a record, a person must make a written request to the public body that the person believes has custody or control of the record.

Duty to assist applicant
7(1) The head of a public body shall make every reasonable effort to assist an applicant and to respond to an applicant openly, accurately, completely and without delay.

Nunavut

Public Health Act

Collection of health information
17(1) The Chief Public Health Officer, or a person acting under the direction and on behalf of the Chief Public Health Officer, may collect health information for one or more of the following purposes:

(e) to conduct or facilitate research into public health issues

Personal health information
17(1.1) A person referred to in subsection (1) may not collect personal health information except to the extent it is necessary for the purposes authorized under that subsection

Access to Information and Protection of Privacy Act

“public body” means

(a) a department, branch or office of the Government of Nunavut, or
(b) an agency, board, commission, corporation, office, municipality or other body designated in the regulations, but does not include
(c) the Office of the Legislative Assembly or the office of a member of the Legislative Assembly or a member of the Executive Council

Duty to assist applicants
7(1) The head of a public body shall make every reasonable effort to assist an applicant and to respond to an applicant openly, accurately, completely and without delay

Protection of personal information
42 The head of a public body shall protect personal information by making reasonable security arrangements against such risks as unauthorized access, collection, use, disclosure or disposal.

British Columbia

E-Health (Personal Health Information Access and Protection of Privacy) Act, SBC 2008, c 38

Disclosure of personal health information
5 A designation order may authorize the disclosure of personal health information only for one or more of the following purposes:

(c) if disclosure is inside or outside Canada, a purpose set out in section 4 (h) or (i).

Disclosure for health research purposes
14(2) the data stewardship committee may approve the request if both of the following apply:

(b) in the case of a request to disclose protection information outside Canada, there is express consent, in writing, to the disclosure from each person who is the subject of the protected information

Alberta

Health Information Act

Duty to protect health information
60(1) A custodian must take reasonable steps in accordance with the regulations to maintain administrative, technical and physical safeguards that will.

(b) protect the confidentiality of health information that is to be stored or used in a jurisdiction outside Alberta or that is to be disclosed by the custodian to a person in a jurisdiction outside Alberta and the privacy of the individuals who are the subjects of that information,

Health Information Regulation, Alta Reg 70/2001

Security of Health Information
8(4) In order to ensure the privacy and confidentiality of health information that is to be stored or used by a person in a jurisdiction outside Alberta or that is to be disclosed to a person in a jurisdiction outside Alberta, the custodian must, prior to the storage, use or disclosure of the information, enter into a written agreement with the person that

(a) provides for the custodian to retain control over the health information,
(b) adequately addresses the risks associated with the storage, use or disclosure of the health information,
(c) requires the person to implement and maintain adequate safeguards for the security and protection of the health information, (d) allows the custodian to monitor compliance with the terms and conditions of the agreement, and

contains remedies to address any non‑compliance with or breach of the terms and conditions of the agreement by the other person.”

Saskatchewan

No information found

Manitoba

Personal Health Information Act

Regulations
66(1) The Lieutenant Governor in Council may make regulations

(l) governing the disclosure of personal health information to persons or bodies outside Manitoba

Ontario

Personal Health Information Protection Act, 2004, SO 2004, c 3, Sch A

Research approved outside Ontario
44(10) Subject to subsection (11), a health information custodian may disclose personal health information to a researcher or may use the information to conduct research if,

(a) the research involves the use of personal health information originating wholly or in part outside Ontario;
(b) the research has received the prescribed approval from a body outside Ontario that has the function of approving research; and

the prescribed requirements are met

Quebec

Bill 3: Access to information by a service provider or by a researcher

Division II Researcher
45. The privacy impact assessment referred to in subparagraph 2 of the second paragraph of section 39 must be proportionate to the sensitivity of the information concerned, the purposes for which it is to be used, the quantity and distribution of the information and the medium on which it is stored.

Moreover, where the research project involves the communication of information outside Québec, the assessment must take into account

(1) the sensitivity of the information;
(2) the purposes for which it is to be used;
(3) the protection measures, including those that are contractual, that would apply to it; and
(4) the legal framework applicable in the State in which the information would be communicated, including the rules for the protection of health and social services information applicable in that State.

End of 48. Where the research project involves the communication of information outside of Quebec, the agreement must take into account, in particular, the results of the privacy impact assessment referred to in subparagraph 2 of the second paragraph of section 44 and, if applicable, the terms agreed on to mitigate the risks identified in the assessment

58. The access centre ensures the coordination and control of a researcher’s access following a request for authorization addressed to it in accordance with this subdivision. For that purpose, the functions of the access centre include

(1) processing all requests for authorization submitted to it;
(2) obtaining all the information to which it authorizes access;
(3) producing, using the information obtained, information files or analyses and communicating them to the researcher concerned; and
(4) exercising any other function entrusted to it by the Government.

Information obtained by the access centre in accordance with subparagraph 2 of the first paragraph may be used or communicated only for the purposes of a research project for which it has granted authorization and the information must be destroyed once the project is completed.

New Brunswick

Personal Health Information Privacy and Access Act, SNB 2009, cP-7.05

Express Consent
19(1) Unless otherwise provided in this Act, express consent of an individual is required in relation to the collection, use or disclosure of his or her personal health information by a custodian, including when the custodian discloses information to

(d) a person outside New Brunswick, and
(e) a person for the purpose of research

Regulations
79(1) The Lieutenant-Governor in Council may make regulations

(u.1) describing the circumstances in which a custodian may disclose personal health information relating to an individual that is collected in the Province to a person outside the Province;
(cc) respecting the personal health information in the custody or under the control of a custodian that may be stored outside Canada;

Nova Scotia

Personal Health Information Act, SNS 2010, c41

Disclosure to person outside province
44(1) A custodian may disclose personal health information about an individual collected in the Province to a person outside the Province if:

(a) the individual who is the subject of the information consents to the disclosure;
(b) the disclosure is permitted by this Act or the regulations;
(c) the disclosure is to a regulated health professional and the disclosure is to meet the functions of another jurisdiction’s prescription monitoring program;
(d) the following conditions are met:

(i) the disclosure is for the purpose of the planning and management of the health system or health administration,
(ii) the information relates to health care provided in the Province to an individual who resides in another province of Canada, and
(iii) the disclosure is made to the government of that other province of Canada; or

the disclosure is reasonably necessary for the provision of health care to the individual and the individual has not expressly instructed the custodian not to make the disclosure.

Prince Edward Island

Health Information Act, RSPEI 1988, c H-1.41

Disclosure outside province
35 A custodian may disclose personal health information relating to an individual that is collected in the province to a person outside the province without the consent of the individual only in the circumstances described in subsections 23(7), (10) and (13) or as specified in the regulations

Regulations
81(1) The Lieutenant Governor in Council may make regulations

(s) prescribing for the purposes of section 35 the circumstances in which a custodian may disclose personal health information relating to an individual that is collected in the province to a person outside the province

Newfoundland and Labrador

Personal Health Information Act, SNL 2008, c P-7.01

Disclosure outside the province
47(1) A custodian may disclose personal health information about an individual collected in the province to a person outside the province but only where

(a) The individual who is the subject of the information consents to the disclosure
(b) The disclosure is permitted by this Act or the regulations;
….

Regulations
90(1) the Lieutenant-Governor in Council may make regulations

(n) prescribing circumstances in which personal health information may be stored, transferred, used or disclosed outside the province;

Access to Information and Protection of Privacy Act, 2015, SNL 2015, c A-1.2

Application
5(2) This Act

(b) does not prohibit the transfer, storage or destruction of a record in accordance with an Act of the province or Canada or a by-law or resolution of a local public body

Yukon

Health Information Privacy and Management Act

Notice and knowledgeable consent
41(1) Except as provided in subsection (2), a custodian is entitled to assume that an individual’s consent to the collection, use or disclosure of the individual’s personal health information is knowledgeable if the custodian has posted, in a place where it is likely to come to the individual’s attention, or makes readily available to the individual, a notice that meets the prescribed requirements, if any, and that

(d) advises that if the personal health information is disclosed outside Yukon, the law of the jurisdiction to which it is disclosed will govern its use, collection and disclosure in that jurisdiction

Agreements authorized
70(3) A custodian may enter into an agreement under this section only with one or more of

(b) the government of any jurisdiction

Northwest Territories

Health Information Act, SNWT 2014, c. 2

Definitions
1(1) In this Act

“extra-territorial research ethics committee” means a body, recognized by or established pursuant to the legislation of a jurisdiction other than the Northwest Territories, that

(a) reviews and approves proposals for research that would include the collection or use of personal health information, and
(b) takes into consideration, during its review of research proposals, the protection of the privacy interests of individuals whose personal health information would be collected or used in the context of proposed research

Disclosure: approval by extra-territorial research ethics committee
78 A health information custodian may disclose personal health information to a researcher whose research proposal has been approved by an extra-territorial research ethics committee, if

(a) the research relates to a multi-jurisdictional research project involving

(i) personal health information about individuals from a number of jurisdictions, and
(ii) the collection of personal health information from a number of jurisdictions;

(b) the researcher submits to the custodian

(i) an application in writing, in a form satisfactory to the custodian, that requests the disclosure of the personal health information to be used in the research,
(ii) a licence to carry out the research issued to the researcher under the Scientists Act, if one is required under that Act for the research
(iii) the research proposal, and a copy of a decision of the extra-territorial research ethics committee approving the proposal, and
(iv) any other information required by the custodian

(c) the disclosure is not contrary to this or another Act;
(d) the researcher enters into an agreement with the custodian in accordance with section 80; and

any prescribed requirements are met

Nunavut

No information found

British Columbia

Freedom of Information and Protection of Privacy Act

FIPPA authorizes public bodies to disclose personal information for research purposes with or without consent. FIPPA provides how to release information for research purposes. One must pick a section of FIPPA and simply follow the criteria within that section. The most common are with consent:

How personal information is to be collected
27(1) A public body must collect personal information directly from the individual the information is about unless

(a) another method of collection is authorized by

(i) that individual,
(ii) the commissioner under section 42 (1) (i), or
(iii) another enactment,

(a.1) the collection of the information is necessary for the medical treatment of an individual and it is not possible

(i) to collect the information directly from that individual, or
(ii) to obtain authority under paragraph (a) (i) for another method of collection,

27(2) A public body must ensure that an individual from whom it collects personal information is told

(a) the purpose for collecting it,
(b) the legal authority for collecting it, and

the contact information of an officer or employee of the public body who can answer the individual’s questions about the collection.

Alberta

Health Information Act

Role of research ethics board
50(1) The research ethics board must

(a) consider whether the researcher should be required to obtain consents for the disclosure of the health information to be used in the research from the individuals who are the subjects of the information, and

Consent for additional information
55 If the researcher wishes to contact the individuals who are the subjects of the information disclosed under section 54(2) to obtain additional health information, the custodian or an affiliate of the custodian must first obtain consents from those individuals to their being contacted for that purpose.

Saskatchewan

The Health Information Protection Act

Consent required for use or disclosure
5(1) Subject to subsection (2), an individual has the right to consent to the use or disclosure of personal health information about himself or herself.

5(2) A trustee shall use or disclose personal health information about an individual only:

(a) with the consent of the subject individual; or
(b) in accordance with a provision of this Act that authorizes the use or disclosure

Consent
6(1) Where consent is required by this Act for the collection, use or disclosure of personal health information, the consent:

(a) must relate to the purpose for which the information is required;
(b) must be informed;
(c) must be given voluntarily; and
(d) must not be obtained through misrepresentation, fraud or coercion.

6(2) A consent to the collection, use or disclosure of personal health information is informed if the individual who gives the consent is provided with the information that a reasonable person in the same circumstances would require in order to make a decision about the collection, use or disclosure of personal health information.

6(3) A consent may be given that is effective for a limited period.

6(4) Consent may be express or implied unless otherwise provided.

6(5) An express consent need not be in writing.

6(6) A trustee, other than the trustee who obtained the consent, may act in accordance with an express consent in writing or a record of an express consent having been given without verifying that the consent meets the requirements of subsection (1) unless the trustee who intends to act has reason to believe that the consent does not meet those requirements

Right to revoke consent
7(1) An individual may revoke his or her consent to the collection of personal health information or to the use or disclosure of personal health information in the custody or control of a trustee.

7(2) A consent may be revoked at any time, but no revocation shall have retroactive effect.

7(3) A trustee must take all reasonable steps to comply with a revocation of consent promptly after receiving the revocation

Disclosure
27(1) A trustee shall not disclose personal health information in the custody or control of the trustee except with the consent of the subject individual or in accordance with this section, section 28 or section 29.

Use and Disclosure for Research
29(1) A trustee or a designated archive may use or disclose personal health information for research purposes with the express consent of the subject individual if:

in the opinion of the research ethics committee, the potential benefits of the research project clearly outweigh the potential risk to the privacy of the subject individual;

Manitoba

Personal Health Information Act

Elements of consent
19.1(1) When this Act requires an individual’s consent for the use or disclosure of personal health information, the consent must

(a) relate to the purpose for which the information is used or disclosed;
(b) be knowledgeable;
(c) be voluntary; and
(d) not be obtained through misrepresentation.

Knowledgeable consent
19.1(2) Consent is knowledgeable if the individual who gives it has been provided with the information that a reasonable person in the same circumstances would need in order to make a decision about the use or disclosure of the information.

Express or implied consent
19.1(3) Consent may be express or implied.

Consent may be withdrawn
19.2 An individual who has given consent, whether express or implied, to the use or disclosure of personal health information may withdraw it by notifying the trustee. A withdrawal does not have retroactive effect.

Restrictions on use of information
21(1) A trustee may use personal health information only for the purpose for which it was collected or received, and shall not use it for any other purpose, unless

(b) the individual the personal health information is about has consented to the use;

Disclosure without individual’s consent
22(2) A trustee may disclose personal health information without the consent of the individual the information is about if the disclosure is…

(f) in accordance with… section 24 or 24.1 (disclosure for health research) or section 25 (disclosure to an information manager);

(g) for the purpose of

(ii) for research and planning that relates to the provision of health care or payment for health care by the trustee;

(g.1) to another trustee who requires the information to evaluate or monitor the programs, services or benefits the other trustee provides;

(g.3) to another trustee for the purpose of de-identifying the personal health information;

(h) to a computerized health information network established by a body specified in subsection (2.1), in which personal health information is recorded for the purpose of

(iii) facilitating research and planning that relates to the provision of health care or payment for health care;

Freedom of Information and Protection of Privacy Act

Conditions of disclosure
47(4) The head of the public body may disclose personal information for a research purpose only if

(b) the head is satisfied that

(iii) it is unreasonable or impractical for the person proposing the research to obtain consent from the individuals the personal information is about, and

(d) the person to whom the personal information is disclosed has entered into a written agreement to comply with the approved conditions.

Ontario

Personal Health Information Protection Act, 2004, SO 2004, c 3, Sch A

(d) whether obtaining the consent of the individuals whose personal health information is being disclosed would be impractical

Compliance by researcher
44(6) A researcher who receives personal health information about an individual from a health information custodian under subsection (1) shall

(e) not make contact or attempt to make contact with the individual, directly or indirectly, unless the custodian first obtains the individual’s consent to being contacted;

Quebec

Bill 3: An Act Respecting Health and Social Services Information and Amending Various legislative provisions

6. Any consent to the use or communication of information held by a body must be clear, free, and informed and be given for specific purposes. As concerns research, consent may cover research themes, categories of research activities or categories of researchers.

Consent must be requested for each such purpose, in clear and simple language. It is valid only for the time necessary to achieve the purposes for which it was requested.

If the request for consent is made in writing, it must be presented separately from any other information communicated to the person concerned. If the person concerned so requests, the person or group that requested consent must provide assistance to help the person concerned understand the scope of the consent requested.

The consent of a minor under 14 years of age is given by the person having parental authority or the tutor. The consent of a minor 14 years of age or over is given by the minor, unless the law provides for consent by the person having parental authority.

A government regulation may determine the terms on which a person may give consent. Consent not given in accordance with this section or with a government regulation, where applicable, is without effect.

8. A person may refuse or allow either current or future information concerning him or her to be accessible to the following persons from the time the information becomes held by a body:

(3) a researcher, if the access sought is for the purpose of soliciting the person’s participation in a research project
(4) a researcher who is not attached to a body referred to in Schedule I, a public institution or to a private institution under agreement that operates a hospital centre

The refusal provided for in subparagraph 4 of the first paragraph may cover one or more pieces of information and may pertain to one or more research themes or categories of research activities.

For the purposes of this Act, a researcher is attached to a body referred to in Scheudle I, to a public institution or to a private institution under agreement that operates a hospital centre if the researcher practices his or her profession in a centre operated by such an institution or if he or she conducts research on behalf of such an institution or body under a contract of employment or a contract for services

New Brunswick

Personal Health Information Privacy and Access Act, SNB 2009, cP-7.05

Express Consent
19(1) Unless otherwise provided in this Act, express consent of an individual is required in relation to the collection, use or disclosure of his or her personal health information by a custodian, including when the custodian discloses information to

(e) a person for the purpose of research

38(1) A custodian may disclose personal health information relating to an individual without the consent of the individual if the disclosure is

(g.3) to a researcher for the purpose of a research project approved by a research review body under section 43,

(h) to a research data centre for the purpose of a research project approved in accordance with an agreement referred to in paragraph 43.1(a),

(h.01) if the custodian is a research data centre, to a researcher for the purpose of a research project approved in accordance with an agreement referred to in paragraph 43.1(a),

Disclosure for research purposes
43(1) A custodian may disclose personal health information to a person conducting a research project only if the project has been approved under this section.

43(2) An approval may be given by a research review body that meets the requirements prescribed by regulation.

43(3) An approval may be given under this section only if the research review body has determined that

(a) the research is of sufficient importance to outweigh the intrusion into privacy that would result from the disclosure of the personal health information,
(b) the research purpose cannot reasonably be accomplished unless the personal health information is provided in a form that identifies or may identify individuals,
(c) the individuals to whom the information relates have consented to its use and disclosure or it is unreasonable or impractical for the person proposing the research to obtain consent from the individuals to whom the information relates, and
(d) the research project contains

(i) reasonable safeguards to protect the privacy and security of the personal health information, and
(ii) procedures to destroy the information or deidentify the information at the earliest opportunity, consistent with the purposes of the project.

43(5) If a research project will require direct contact with individuals, a custodian shall not disclose personal health information relating to those individuals under this section without first obtaining their consent, but the custodian need not obtain their consent if the information consists only of the individuals’ names and addresses.

Nova Scotia

Personal Health Information Act, SNS 2010, c41

Express consent NOT required for disclosure for research if following conditions are met.

Disclosure without individual consent
57 A custodian may disclose personal health information about an individual to a researcher without the consent of the subject individual if

(a) the researcher has met the requirements in s 56
(b) a research ethics board has determined that the consent of the subject individuals is not required;
(c) the custodian is satisfied that

(i) the research cannot be conducted without using the personal health information,
(ii) the personal health information is limited to that necessary to accomplish the purpose of the research,
(iii) the personal health information is in the most de-identified form possible for the conduct of the research,
(iv) the personal health information will be used in a manner that ensures its confidentiality, and
(v) it is impracticable to obtain consent; and

(d) the custodian informs the Review Officer

Freedom of Information and Protection of Privacy Act

Use of personal information
26 A public body may use personal information only

(b) if the individual the information is about has identified the information and has consented, in the prescribed manner, to the use; or

Disclosure of personal information
27 A public body may disclose personal information only

(b) if the individual the information is about has identified the information and consented in writing to its disclosure

Prince Edward Island

Health Information Act, RSPEI 1988, c H-1.41

Disclosure without consent permitted
23(13) A custodian may disclose personal health information relating to an individual without the consent of the individual if the disclosure is

(h) to a research data repository in accordance with the terms of an agreement between the research data repository and the custodian

Disclosure to Researcher
32(4) A custodian may disclose to the researcher the personal health information requested under section 31 or perform data matching or other services to facilitate the research

Freedom of Information and Protection of Privacy Act, RSPEI 1988, c F-15.01

Use of personal information
36(1) a public body may use personal information only

(a) for the purpose for which the information was collected or compiled or for a use consistent with that purpose;
(b) if the individual the information is about has identified the information and consented, in the prescribed manner, to the use; or
(c) for a purpose for which that information may be disclosed to that public body under section 37, 39 or 40.

Disclosure for research or statistical purposes
39 A public body may disclose personal information for a research purpose, including statistical research, only if

Newfoundland and Labrador

Personal Health Information Act, SNL 2008, c P-7.01

Part III – CONSENT: section 23-28

Where consent must be express
25(1) Notwithstanding subsection 24(1), where a provision of this Act requires the consent of the individual to the disclosure of his or her personal health information, the required consent shall be express and may not implied where

(a) a custodian discloses the personal health information to a person that is not a custodian; or
(b) a custodian discloses the personal health information to another custodian and the disclosure is not for the purpose of providing health care or assisting in providing health care

Access to Information and Protection of Privacy Act, 2015, SNL 2015, c A-1.2

Use of personal information
66(1) A public body may use personal information only

(a) for the purpose for which that information was obtained or complied, or for a use consistent with that purpose described in section 69
(b) where the individual the information is about has identified the information and has consented to the use, in the manner set by the minister responsible for this Act; or
(c) for a purpose for which that information may be disclosed to that public body under sections 68 to 71 .

66(2) The use of personal information by a public body shall be limited to the minimum amount of information necessary to accomplish the purpose for which it is used.

Disclosure of personal information
68(1) A public body may disclose personal information only

(a) in accordance with Part II;
(b) where the individual the information is about has identified the information and consented to the disclosure in the manner set by the minister responsible for this Act;
(d) for the purpose of complying with an Act or regulation of, or with a treaty, arrangement or agreement made under an Act or regulation of the province or Canada ;

(s) in accordance with sections 70 and 71 ;

Yukon

Health Information Privacy and Management Act

Use for research
67 A custodian may, without the individual’s consent, use for the purpose of research an individual’s personal health information that is in its custody or control

Disclosure for research
68(1) (1) A custodian may, without an individual’s consent but subject to subsections (2) and (3), disclose the individual’s personal health information to a person (referred to in this section and section 69 as the “researcher”) for the purpose of the researcher’s research if

(a) an institutional research review committee has approved the research; and
(b) the custodian and the researcher have made an agreement under section 69.

Health Information General Regulation, YOIC 2016/159

Express Consent
19 where consent for the collection, use or disclosure of personal health information is required under the Act, the consent must be express if

(a) the collection, use or disclosure is for the purpose of research or marketing

Northwest Territories

Health Information Act, SNWT 2014, c. 2

Assessment: express consent
73(2) In determining whether express consent to the collection, use or disclosure of personal health information must be obtained from the individuals whose personal health information would be collected, used or disclosed, the research ethics committee may take into account whether the requirement for express consent would be unreasonable, impractical or not feasible.

Requirement for express consent
79 If the research ethics committee or extra-territorial research ethics committee that approved a research proposal determined that express consent must be obtained to the disclosure of the personal health information, a health information custodian shall not disclose the information to a researcher under section 77 or 78 unless the express consent is obtained.

Seeking express consent
82(1) After an agreement has been entered with a express researcher under section 80, a health information consent custodian may contact individuals to seek their express consent to disclose personal health information about them to the researcher

Access to Information and Protection of Privacy Act

Circumstances where no unreasonable invasion of privacy
23(4) A disclosure of personal information is not an unreasonable invasion of a third party’s personal privacy where

(d) the disclosure is for research purposes and is in accordance with section 49;

When personal information may be disclosed
48 A public body may disclose personal information

(b) where the individual the information relates to has identified the information and consented, in the prescribed manner, to its disclosure;

Nunavut

Public Health Act

Disclosure of personal health information
19 The Chief Public Health Officer may disclose personal health information if

(a) the individual consents in accordance with the Access to Information and Protection of Privacy Act;

Access to Information and Protection of Privacy Act

Circumstances where no unreasonable invasion of privacy
23(4) A disclosure of personal information is not an unreasonable invasion of a third party’s personal privacy where

(a) the third party has, in writing, consented to or requested the disclosure

Use of personal information
43 A public body may use personal information only

(a) for the purpose for which the information was collected or compiled, or for a use consistent with that purpose;
(b) if the individual the information is about has identified the information and consented, in the prescribed manner, to the use; or

for a purpose for which the information may be disclosed to that public body under Division C of this Part.

British Columbia

Freedom of Information and Protection of Privacy Act [RSBC 1996] CHAPTER 165

Disclosure outside of Canada
33.1 A public body may disclose personal information outside of Canada only if the disclosure is in accordance with the regulations, if any, made by the minister responsible for this Act.

E-Health (Personal Health Information Access and Protection of Privacy) Act, SBC 2008, c 38

Disclosure for health research purposes
14(2) the data stewardship committee may approve the request if both of the following apply:

(b) in the case of a request to disclose protection information outside Canada, there is express consent, in writing, to the disclosure form each person who is the subject of the protected information

Alberta

No information found

Saskatchewan

No information found

Manitoba

No information found

Ontario

Personal Health Information Protection Act, 2004, SO 2004, c 3, Sch A

the prescribed requirements are met

Quebec

No information found

New Brunswick

Personal Health Information Privacy and Access Act, SNB 2009, cP-7.05

79(1) The Lieutenant-Governor in Council may make regulations

Nova Scotia

Personal Health Information Act, SNS 2010, c41

Disclosure to person outside Province
44 (1) A custodian may disclose personal health information about an individual collected in the Province to a person outside the Province if

(a) the individual who is the subject of the information consents to the disclosure;

the disclosure is permitted by this Act or the regulations

Prince Edward Island

Health Information Act, RSPEI 1988, c H-1.41

Regulations
81(1) The Lieutenant Governor in Council may make regulations

Newfoundland and Labrador

Personal Health Information Act, SNL 2008, c P-7.01

Disclosure outside the province
47(1) A custodian may disclose personal health information about an individual collected I the province to a person outside the province but only where

(a) The individual who is the subject of the information consents to the disclosure
(b) The disclosure is permitted by this Act or the regulations;
…

Yukon

No information found

Northwest Territories

No information found

Nunavut

No information found

British Columbia

Office of the Information & Privacy Commissioner for BC 2018 Access to Data for Health Research

Page 3: Comprehensive data access agreement
The public body must have a written data access agreement with the researcher. This agreement must include privacy protective measures addressing security and confidentiality, removal or destruction of identifiers, prohibitions against further use without approval or disclosure beyond research, and an undertaking to comply with the approved conditions, FIPPA, and policies and procedures

E-Health (Personal Health Information Access and Protection of Privacy) Act, SBC 2008, c 38

Information-sharing agreements required for disclosure
19(3) An information-sharing agreement must include a requirement that

(a) protected information disclosed under the agreement will not be used or disclosed for the purpose of market research, and
(b) if disclosure is for a health research purpose, the person to whom information is disclosed must comply with

(i) the data stewardship committee’s policies and procedures established under section 13(2) [data stewardship committee], and
(ii) any conditions imposed under section 14 (2.1) (e) [disclosure for health research purposes].

Freedom of Information and Protection of Privacy Act

Personal information directories, privacy impact assessments and information-sharing agreements
69 (1) In this section:

“information-sharing agreement” means an agreement between a public body and one or more of the following:

(a) another public body;
(b) a government institution subject to the Privacy Act (Canada);
(c) an organization subject to the Personal Information Protection Act or the Personal Information Protection and Electronic Documents Act (Canada);
(d) a public body, government institution or institution as defined in applicable provincial legislation having the same effect as this Act;
(e) a person or a group of persons;
(f) a prescribed entity,

that sets conditions on the collection, use or disclosure of personal information by the parties to the agreement;

Public Information regarding health information banks
69.1(1) In this section

“health information-sharing agreement” means an agreement under section 14 or 19 of the E-Health (Personal Health Information Access and Protection of Privacy) Act;

Alberta

Health Information Act

Agreement between custodian and researcher
54(1) If the custodian decides to disclose health information to a researcher or perform data matching or other services to facilitate the research, the researcher must enter into an agreement with the custodian in which the researcher agrees

(a) to comply with

(i) this Act and the regulations made under this Act,
(ii) any conditions imposed by the custodian relating to the use, protection, disclosure, return or disposal of the health information, and
(iii) any requirement imposed by the custodian to provide safeguards against the identification, direct or indirect, of an individual who is the subject of the health information,

(b) to use the health information only for the purpose of conducting the research in accordance with the research protocol, RSA 2000 Section 54 Chapter H-5 HEALTH INFORMATION ACT 41
(c) not to publish the health information in a form that could reasonably enable the identity of an individual who is the subject of the information to be readily ascertained,
(d) not to make any attempt to contact an individual who is the subject of the health information to obtain additional health information unless the individual has provided the custodian with the consent referred to in section 55,
(e) to allow the custodian to access or inspect the researcher’s premises to confirm that the researcher is complying with the enactments, conditions and requirements referred to in clause (a), and (f) to pay the costs referred to in subsection (3).

54(2) When an agreement referred to in subsection (1) has been entered into, the custodian may disclose to the researcher the health information requested under section 52 or perform data matching or other services to facilitate the research

(a) with the consent of the individuals who are the subjects of the information, where the research ethics board recommends that consents should be obtained, or
(b) without the consent of the individuals who are the subjects of the information, where the research ethics board does not recommend that consents be obtained.

54(3) The custodian may set the costs of

(a) preparing information for disclosure, or performing data matching or other services
(b) making copies of health information, and
(c) obtaining the consents referred to in section 55, which must not exceed the actual cost of providing that service.

54(3.1) A researcher that enters into an agreement under this section must

(a) comply with the terms and conditions of the agreement and the conditions set out in the research ethics board’s response to the research protocol, and
(b) collect, use and disclose health information only in accordance with the agreement and the research protocol.

54(4) If a researcher contravenes or fails to comply with the terms and conditions of an agreement under this section, or the conditions set out in the research ethics board’s response to the research protocol,

(a) the agreement is cancelled, and
(b) the researcher is no longer authorized to use the health information for any purpose and must destroy the health information or return it to the custodian

Saskatchewan

The Health Information Protection Act

Information management service provider
18(2) Before providing personal health information to an information management service provider, a trustee must enter into a written agreement with the information management service provider that:

(a) governs the access to and use, disclosure, storage, archiving, modification and destruction of the information;
(b) provides for protection of the information; and
(c) meets the requirements of the regulations.

18(4) An information management service provider must comply with the terms of the agreement entered into pursuant to subsection (2).

Use and disclosure for research
29(1) A trustee or a designated archive may use of disclose personal health information for research purposes with the express consent of the subject individual if:

(c) the person who is to receive the personal health information enters into an agreement with the trustee or designated archive that contains provisions:

The Health Information Protection Regulations, 2023

Agreement with information management service provider
7 For the purposes of subsection 18(2) of the Act, a written agreement that is entered into between a trustee and an information management service provider must include:

(a) a description of the specific service the information management service provider will deliver;
(b) provisions setting out the obligations of the information management service provider respecting the security and safeguarding of the personal health information;
(c) provisions for the destruction of the personal health information, if applicable;
(d) a requirement that the information management service provider not use, disclose, obtain access to, process, store, archive, modify or destroy personal health information received from a trustee except for the purposes set out in subsection 18(1) of the Act;
(e) a requirement that the information management service provider comply with the terms of the agreement entered into with the trustee; and

a requirement that the information management service provider notify the trustee at the first reasonable opportunity of any breach of the agreement

Manitoba

Personal Health Information Regulation Man Reg 245/97

Research agreements
8.4 An agreement between a trustee and a researcher under subsection 24(4) of the Act must be in writing and must adequately identify the research project for which approval is given.

Agreement re health research
8.5(1) For the purpose of section 24.1 of the Act, the following are prescribed health research organizations:

(a) Manitoba Centre for Health Policy at the University of Manitoba;
(b) Canadian Institute for Health Information

8.5(2) For the purpose of 24.1(4) of the Act, an agreement between a trustee and a prescribed health research organization must

(a) specify the purposes for which the health research organization may use the personal health information;
(b) prohibit disclosure of personal health information except with the trustee’s prior written consent;
(c) require the health research organization to implement and maintain adequate safeguards for the protection, retention and destruction of personal health information satisfactory to the trustee;
(d) allow the trustee to monitor compliance with the terms of the agreement; and
(e) include remedies to address any failure by the health research organization to comply with the terms of the agreement

Agreement required
24(4) An approval under this section is conditional on the person proposing the research project entering into an agreement with the trustee, in accordance with the regulations, in which the person agrees

(a) not to publish the personal health information requested in a form that could reasonably be expected to identify the individuals concerned;
(b) to use the personal health information requested solely for the purposes of the approved research project; and
(c) to ensure that the research project complies with the safeguards and procedures described in clause (3)(d).

Ontario

Personal Health Information Protection Act, 2004, SO 2004, c 3, Sch A

Compliance by researcher
44(6) A researcher who receives personal health information about an individual from a health information custodian under subsection (1) shall,

Freedom of Information and Protection of Privacy Act, RR). 1190 Regulation 460

10(1) The following are the terms and conditions relating to security and confidentiality that a person is required to agree to before a head may disclose personal information to that person for a research purpose:

1. The person shall use the information only for a research purpose set out in the agreement or for which the person has written authorization from the institution.
2. The person shall name in the agreement any other persons who will be given access to personal information in a form in which the individual to whom it relates can be identified.
3. Before disclosing personal information to other persons under paragraph 2, the person shall enter into an agreement with those persons to ensure that they will not disclose it to any other person.
4. The person shall keep the information in a physically secure location to which access is given only to the person and to the persons given access under paragraph 2.
5. The person shall destroy all individual identifiers in the information by the date specified in the agreement.
6. The person shall not contact any individual to whom personal information relates, directly or indirectly, without the prior written authority of the institution.
7. The person shall ensure that no personal information will be used or disclosed in a form in which the individual to whom it relates can be identified without the written authority of the institution.
8. The person shall notify the institution in writing immediately if the person becomes aware that any of the conditions set out in this section have been breached.

10 (2) An agreement relating to the security and confidentiality of personal information to be disclosed for a research purpose shall be in the form titled “Security and Confidentiality Agreement of Personal Information for Research Purposes”, dated May 1, 2016 and available on the Government of Ontario’s Central Forms Repository website

Quebec

Bill 64: The Act respecting Access to documents held by public bodies and the Protection of personal information

23. The Act is amended by inserting the following sections after section 67.2:

“67.2.3. A public body that releases personal information in accordance with section 67.2.1 must first enter into an agreement with the person or body to whom or which the information is to be sent that stipulates, among other things, that the information

(1) may be made accessible only to persons who need to know it to exercise their functions and who have signed a confidentiality agreement;
(2) may not be used for purposes other than those specified in the research protocol;
(3) may not be cross-matched with any other information file that has not been provided for in the research protocol; and
(4) may not be released, published or otherwise distributed in a form allowing the persons concerned to be identified.

The agreement must also

(1) specify the information that must be provided to the persons concerned if personal information concerning them is used to contact them to participate in the study or research;
(2) provide for measures for ensuring the protection of the personal information;
(3) determine a preservation period for the personal information;
(4) set out the obligation to notify the public body of the destruction of the personal information; and
(5) provide that the public body and the Commission must be informed without delay

(a) of non-compliance with any condition set out in the agreement;
(b) of any failure to comply with the protection measures provided for in the agreement; and
(c) of any event that could breach the confidentiality of the information.

The agreement must be sent to the Commission and comes into force 30 days after it is received by the Commission

Bill 3: Access to information by a service provider or by a researcher

Division II Researcher
48. The authorization is made official by a written agreement between the researcher and the body to which the researcher is attached. The agreement must stipulate, among other things, that information covered by the authorization

(1) may be used only by persons who need to examine it to exercise their functions and who have signed a confidentiality agreement;
(2) may not be used for purposes other than those specified in the detailed presentation of the activities related to the research project;
(3) may not be paired with any information other than information mentioned in the detailed presentation of the activities related to the research project; and
(4) may not be communicated, published or otherwise distributed in a form allowing the person concerned to be identified.

The agreement must also

(1) specify the information that must be communicated to the persons concerned if information concerning them is used for the purpose of soliciting their participation in the research project;
(2) specify that the information may be used or communicated only in a form not allowing the person concerned to be identified directly, where it is possible to carry out the research project by using or receiving the information in such a form;
(3) specify the security measures that will be in place for the carrying out of the project;
(4) determine a preservation period for all the information;
(5) set out the obligation to inform the person exercising the highest authority within the body to which the researcher is attached of the destruction of the information;
(6) set out the obligation to inform without delay the person exercising the highest authority within the body to which the researcher is attached and the Commission d’accès à l’information

(a) of non-compliance with any condition set out in the agreement;
(b) of any failure to comply with the security measures provided for in the agreement; and
(c) of any event that could breach the confidentiality of information.

Where the research project involves the communication of information outside of Quebec, the agreement must take into account, in particular, the results of the privacy impact assessment referred to in subparagraph 2 of the second paragraph of section 44 and, if applicable, the terms agreed on to mitigate the risks identified in the assessment

A copy of the agreement must be sent to each body consulted under section 46 and to the Commission d’acces a l’information

49. A researcher authorized to be informed of the existence of or to have access to information who retains a third person for the carrying out of a research project must ensure that the latter complies with all the obligations incumbent on the researcher under the agreement the researcher entered into, under section 48.

50. A researcher authorized to be informed of the existence of or to have access to information may, with the authorization of the person exercising the highest authority within the body to which the researcher is attached, communicate the information to a person or group that requires it if the person or group needs the information to verify responsible conduct or compliance with standards of ethics and scientific integrity or to analyze the scientific conformity, validity or reproducibility of the research project.

The obligations incumbent on the researcher under the agreement the researcher entered into under section 48 apply, with the necessary modifications, to that person or group.

51. Where a researcher attached to a public body within the meaning of the Act respecting the Institut de la statistique du Québec (chapter I-13.011) is authorized to be informed of the existence of or to have access to information, and the information must, for the purposes of the research project, be compared, combined or paired, including, where applicable, with information communicated in accordance with Chapter I.2 of that Act, the researcher may communicate the information to the Institut for it to compare, combine or pair the information. In such a case, the Institut may use the information only for the purposes of the project and must destroy it once the project is completed.

52. The person exercising the highest authority within the body to which the researcher is attached may, without delay or formality, revoke the authorization granted under section 47 where the person has reason to believe that the generally accepted standards of ethics and scientific integrity, the security measures or any other measure provided for in the agreement are not being complied with or that the protection of the information is otherwise compromised.

New Brunswick

Personal Health Information Privacy and Access Act, SNB 2009, cP-7.05

Disclosure to a research data centre
43.1 A custodian may disclose personal health information to a research data centre if the research data centre has entered into

Right to Information and Protection of Privacy, SNB 2009, c R-10.6

Collection, use and disclosure of personal information by a research data centre
47.1 (1) If a research data centre intends to collect, use or disclose personal information under this Act, the research data centre shall have entered into

Nova Scotia

Personal Health Information Act, SNS 2010, c41

Custodian-researcher agreement
60 (1) Where a custodian discloses personal health information to a researcher, the researcher shall enter into an agreement with the custodian to adhere to the requirements in subsection (2).

60(2) An agreement referred to in subsection (1) must include a commitment by the researcher

(a) to comply with any terms and conditions imposed by a research ethics board;
(b) to comply with any terms and conditions imposed by the custodian;
(c) to use the information only for the purposes outlined in the research plan as approved by a research ethics board;
(d) not to publish the information in a form where it is reasonably foreseeable in the circumstances that it could be utilized, either alone or with other information, to identify an individual;
(e) to allow the custodian to access or inspect the researcher’s premises to confirm that the researcher is complying with the terms and conditions of this Act and of the agreement between the custodian and the researcher;
(f) to notify the custodian immediately and in writing if the personal health information is stolen, lost or subject to unauthorized access, use, disclosure, copying or modification;
(g) to notify the custodian immediately and in writing of any known or suspected breach of the agreement between the custodian and the researcher; and
(h) not to attempt to identify or contact the individuals unless the custodian or researcher has obtained prior consent by the individuals

Freedom of Information and Protection of Privacy Act

Disclosure for a research purpose
29 A public body may disclose personal information for a research purpose, including statistical research, if

(d) the person to whom that information is disclosed has signed an agreement to comply with the approved conditions, this Act and any of the public body’s policies and procedures relating to the confidentiality of personal information

Prince Edward Island

Health Information Act, RSPEI 1988, c H-1.41

Disclosure without consent permitted
23(13) A custodian may disclose personal health information relating to an individual without the consent of the individual if the disclosure is …

(h) to a research data repository in accordance with the terms of an agreement between the research data repository and the custodian

Written agreement with agent of custodian
41 Written agreement with agent of custodian A custodian that retains the services of an agent for the collection, use, disclosure, retention or secure destruction of personal health information shall enter into a written agreement with the agent requiring the agent to comply with

(a) the duties imposed on the agent under the agreement; and
(b) the same requirements concerning the protection, retention and secure destruction of personal health information that the custodian is required to comply with under this Act.

Freedom of Information and Protection of Privacy Act, RSPEI 1988, c F-15.01

Disclosure for research or statistical purposes
39 A public body may disclose personal information for a research purpose, including statistical research only if

(d) the person to whom the information is disclosed has signed an agreement to comply with the approved conditions, this Act and any of the public body’s policies and procedures relating to the confidentiality of personal information

Newfoundland and Labrador

Personal Health Information Act, SNL 2008, c P-7.01

Disclosure of registration information
45(3) With the approval of the Lieutenant Governor in Council, the minister may enter into agreements for the sharing of registration information without the consent of the subject individual with 

(a)  the Government of Canada or the government of a province or territory of Canada ; or
(b)  a person or body designated in the regulations. 

45(4) An agreement made under subsection (3) shall specify that the party to whom the registration information is disclosed shall use the information only for the purposes specified in the agreement. 

Access to Information and Protection of Privacy Act, 2015, SNL 2015, c A-1.2

Disclosure for research or statistical purposes
70. A public body may disclose personal information for a research purpose, including statistical research, only where

(d) the person to whom that information is disclosed has signed an agreement to comply with the approved conditions, this Act and the public body’s policies and procedures relating to the confidentiality of personal information.

Yukon

Health Information Privacy and Management Act

Required Agreement
69 An agreement under this section between a custodian and a researcher must be in writing and must require the researcher, in respect of the personal health information to be to be disclosed by the custodian under subsection 68(1)

(a) to maintain technical and physical safeguards to ensure the confidentiality and security of the personal health information
(b) to destroy or remove, at the earliest opportunity consistent with the purposes of the research, any identifying information;
(c) not to make any subsequent use or disclosure of the personal health information in individually identifiable form without the express prior authorization of the custodian;
(d) not to publish any individual’s personal health information in a form that could reasonably be expected to identity the individual
(e) to use the personal health information solely for the purposes of the research approved under paragraph 68(1)(a)
(f) to meet the prescribed requirements, if any.

Health Information General Regulation, YOIC 2016/159

Agreements with researchers
26 An agreement under section 69 of the Act between a custodian and researcher must require the researcher

(a) to permit the custodian to monitor the researcher’s compliance with the agreement;
(b) to provide the custodian with any information that the custodian may reasonably require for the purposes of paragraph (a);
(c) to refrain from contacting any individual who is a subject of the research, unless the custodian has first obtained the individual’s consent to be contacted by the researcher;
(d) to notify the custodian immediately in writing if the researcher becomes aware of any breach of the agreement;
(e) to comply with the conditions, if any, specified by the institutional research review committee in respect of the research proposal; and
(f) on termination of the agreement, to deal with any personal health information to which the agreement applies that is in the researcher’s custody or control as a result of the agreement

(i) by transferring the personal health information that the custodian requests to the custodian, and

following the completion of the transfer, by securely destroying all records of the personal health information that remain in the researcher’s custody or control.

Northwest Territories

Health Information Act, SNWT 2014, c. 2

Disclosure agreement: Requirements
80(1) A health information custodian may not disclose personal health information to a researcher under section 77 or 78 unless the custodian and researcher enter into an agreement in which the researcher agrees to comply with

(a) this Act and the regulations, including the requirements referred to in paragraphs 81(a) to (d);
(b) any specified standards, policies and procedures of the custodian in respect of the confidentiality of personal health information;
(c) any terms and conditions of the agreement that bind the researcher in respect of the

(i) use and disclosure of the information,
(ii) protection of the confidentiality of the information and the privacy of the individuals the information is about,
(iii) security and confidentiality of records that contain the information, and

(d) any terms and conditions of the agreement binding the researcher that safeguard against the direct or indirect identification of an individual the information is about, including terms and conditions for the removal or destruction of personal identifiers.

Requirements
81 A researcher who collects personal health information about one or more individuals from a health information custodian for the purposes of conducting research shall

(a) comply with conditions set by the research ethics committee under paragraph 69(d), or conditions set by an extra-territorial research ethics committee that are not in conflict with this Act;
(b) not publish the information in a form that could reasonably be expected to identify the individuals the information is about;
(c) not contact or attempt to make contact with an individual the information is about unless the custodian obtains express consent from the individual for the researcher to contact the individual to request further details, as referred to in subsection 82(2);
(d) use the information only for the purposes

Access to Information and Protection of Privacy Act

Disclosure for research
49(1) A public body may only disclose personal information for a research purpose, including statistical research, where

(d) the person to whom the information is disclosed has signed an agreement to comply with the approved conditions, this Act and the regulations and any of the public body’s policies and procedures relating to the confidentiality of personal information.

Access to Information and Protection of Privacy Regulations R-206-96

Research Agreements
8 An agreement made between a public body and a person under paragraph 49(d) of the Act must include the following:

(a) a condition that the person may use the personal information only for the research purpose set out in the agreement or for which the person has written authorization from the public body;
(b) an identification of any other persons who will be given access to the personal information by the person;
(c) a condition that the person must, before disclosing personal information to persons referred to in paragraph (b), enter into an agreement with those persons to ensure that they will adhere to the same policies and procedures of confidentiality as are applicable to the person who entered into the agreement under paragraph 49(d) of the Act;
(d) a condition that the person must keep the personal information in a secure location to which access is given only to the persons referred to in paragraph (b);
(e) a condition that the person must remove or destroy all individual identifiers in the personal information by the date and in the manner specified in the agreement;
(f) a condition that the person must not contact any individual to whom the personal information relates, directly or indirectly, without the prior written authority of the public body;
(g) a condition that the person must ensure that no personal information will be used or disclosed in a form in which the individual to whom it relates can be identified without the written authority of the public body;
(h) a condition that the person must ensure that identifiable personal information about an individual is not used for an administrative purpose directly affecting the individual;
(i) a condition that the person must notify the public body in writing immediately if the person becomes aware that any of the conditions set out in the agreement have been breached;

a condition that, if a person fails to meet the conditions of the agreement, the agreement may be immediately terminated by the public body

Nunavut

Access to Information and Protection of Privacy Act

Disclosure for research
49 A public body may only disclose personal information for a research purpose, including statistical research, where

Access to Information and Protection of Privacy Act Regulations

Research Agreements
8 An agreement made between a public body and a person under paragraph 49(d) of the Act must include the following: 3

British Columbia

E-Health (Personal Health Information Access and Protection of Privacy) Act, SBC 2008, c 38

(b) the collection and use of personal health information through the database is for a purpose set out in section 4 [collection and use of personal health information].

Appointment of data stewardship committee
12(1) The minister must appoint a data stewardship committee consisting of not more than 12 persons

Office of the Information & Privacy Commissioner for BC 2018 Access to Data for Health Research

Page 4: E-Health (Personal Health Information Access and Protection of Privacy act s 14,19 and 20:

E-Health Act governs the collection, use and disclosure of personal health information in Ministry of Health or health authority databases that are designated by the Minister of Health as health information banks. The following databases are designated as health information banks:

the Provincial Laboratory Information Solution (PLIS) repository, which contains personal health information pertaining to lab services delivered by health authorities and private labs;
the Client Registry System/Enterprise Master Patient Index, which contains demographic information for all individuals receiving publicly-funded health care services in British Columbia; and
the Provider Registry, which contains personal information about health service providers.

The E-Health Act permits disclosure of personal information without consent for a health research purpose if it is authorized by the designation order. Furthermore, disclosures for a research purpose must be approved by the Data Stewardship Committee. The Data Stewardship Committee is an arm’s length body appointed by the Minister of Health, comprised of health professionals and members of the public. Statutory terms and conditions for disclosure for research purposes are the same as those in FIPPA with two additional prohibitions:

any subsequent use or disclosure of personal health information must be expressly authorized by the Data Stewardship Committee, and
personal health information and information related to a health service provider cannot be disclosed for market research purposes. Because of its commercial nature, market research is distinct from health research.

BC Ministry of Health: “Access to Health Data for Research” Directive Document

Chief Data Steward’s role—general
1. The Chief Data Steward:

(a) has the sole delegated authority to approve applications to the Ministry, but not in relation to applications that under certain applicable laws require the approval of the Data Stewardship Committee;
(b) has the sole delegated authority to enter into research agreements for the Ministry;
(c) exercises all other authority that this policy gives to the Chief Data Steward;
(d) is the sole authoritative source of interpretation of this policy in all cases;
(e) may, with the approval of the Ministry, establish policies and procedures, and forms of documents, to implement this policy;

may give directions to Ministry employees regarding the implementation of this policy.

Alberta

Health Information Act

Designation
72.1(1) The Minister may, in accordance with the regulations, designate an agency, corporation or other entity to act as a health information repository.

Regulations
108 The Minister may make regulations

(a) designating bodies as research ethics boards for the purposes of sections 48 to 56;

(a.1) specifying the information that is to be included in a proposed research protocol under section 49.

Saskatchewan

The Health Information Protection Act

Use and disclosure for research
29(1) a trustee or a designated archive may use or disclose personal health information for research purposes with the express consent of the subject individual if:

(b) the research project has been approved by a research ethics committee approved by the minister;

Regulations
63(1) For the purpose of carrying out this Act according to its intent, the Lieutenant Governor in Council may make regulations:

(q) prescribing persons with whom or bodies with which the minister may enter into agreements pursuant to clause 28(5)(b)

Manitoba

Personal Health information Act

Regulations
66(1) The Lieutenant Governor in Council may make regulations

(l) governing the disclosure of personal health information to persons or bodies outside Manitoba

Ontario

Personal Health Information Protection Act, 2004, SO 2004, c 3, Sch A

Health information custodian

3 (1) In this Act,

“health information custodian”, subject to subsections (3) to (11), means a person or organization described in one of the following paragraphs who has custody or control of personal health information as a result of or in connection with performing the person’s or organization’s powers or duties or the work described in the paragraph, if any:

7. The Minister, together with the Ministry of the Minister if the context so requires.

Quebec

Bill 3: Access to information by a service provider or by a researcher

Division II Researcher
53. Each year, the person exercising the highest authority within a body referred to in Schedule I, a public institution or a private institution under agreement that operates a hospital centre sends to the Minister and to the Commission d’accès à l’information a report concerning the research projects for which a request for authorization has been addressed to him or her. The Minister determines the form and content of the report.

54. A regulation of the Minister may determine the procedure and means by which a researcher can be informed of the existence of information and have access to it in accordance with this subdivision.

54. A regulation of the Minister may determine the procedure and means by which a researcher can be informed of the existence of information and have access to it in accordance with the subdivision

59. The Minister may designate, from among the bodies referred to in section 2 of the Act respecting the governance and management of the information resources of public bodies and government enterprises, one or more bodies charged with assisting, to the extent determined by the Minister, the access centre in the exercise of its functions.

New Brunswick

Personal Health Information Privacy and Access Act, SNB 2009, cP-7.05

Disclosure of registration information
44(2) With the approval of the Lieutenant-Governor in Council, the Minister may enter into agreements for the sharing of registration information without the consent of the individual to whom the information relates with

(a) the Government of Canada or the government of a province or territory of Canada, or

a person or body designated in the regulations (i.e. could ask for regulation change to permit)

Nova Scotia

No information found

Prince Edward Island

Health Information Act, RSPEI 1988, c H-1.41

Regulations
81(1) The Lieutenant Governor in Council may make regulations

Newfoundland and Labrador

Personal Health Information Act, SNL 2008, c P-7.01

Interpretation
2(1) In this Act

(n) “minister” means the minister appointed under the Executive Council Act to administer this Act

Custodian4(1) In this Act, “custodian” means a person described in one of the following paragraphs who has custody or control of personal health information as a result of or in connection with the performance of the persons’ powers or duties or the work described in that paragraph

(d) the minister, where the context so requires

4(4) Where a custodian fails to carry out his or her duties, the minister may appoint a person to act in place of the custodian until custody and control of the record fully passes to another person and may recover the costs and expenses of an incidental to the appointment from the custodian

Disclosure of registration information
45(1) The minister may disclose registration information without the consent of an individual

(b) with the approval of the Lieutenant Governor in Council, to another public body on the terms or conditions that the Lieutenant Governor in Council may determine

Health Research Ethics Authority Act, SNL 2006, c H-1.2

Definitions
2 In this Act

(f) “minister” means the minister appointed under the Executive Council Act to administer this Act

Regulations
27 The minister may make regulations necessary to give effect to the purpose of this Act

Access to Information and Protection of Privacy Act, 2015, SNL 2015, c A-1.2

Definitions
2 In this Act

(j) “head”, in relation to a public body, means

i. in the case of a department, the minister who presides over it,
ii. in the case of a corporation, its chief executive officer,
iii. in the case of an unincorporated body, the minister appointed under the Executive Council Act to administer the Act under which the body is established, or the minister who is otherwise responsible for the body

(q) “minister” means a member of the executive council appointed under the Executive Council Act;

(r) “minister responsible for this Act” means the minister appointed under the Executive Council Act to administer this Act

Disclosure of personal information
68(1) A public body may disclose personal information only

(b) where the individual the information is about has identified the information and consented to the disclosure in the manner set by the minister responsible for the Act

(f) to an officer or employee of the public body or to a minister, where the information is necessary for the performance of the duties of, or for the protection of the health or safety of, the officer, employee, or minister;

(u) to an officer or employee or a public body or to a minister, where the information is necessary of the delivery of a common or integrated program or service and for the performance of the duties of the officer or employee or minster to whom the information is disclosed

Yukon

No information found

Northwest Territories

Health Information Act, SNWT 2014, c. 2

Research ethics committee
68 The Minister may, by order, designate an organization as a research ethics committee for the purposes of this Act.

Regulations
195 The Commissioner, on the recommendation of the Minister may make regulations

(a) prescribing persons, classes of persons and organizations as health information custodians for the purposes of paragraphs (d) and (e) of the definition “health information custodian” in subsection 1(1)

(w) prescribing purposes for which a person other than a health information custodian or an individual may collect or use the individual’s personal health number under paragraph 32(1)(c)

(z.8) prescribing requirements for an application for approval of a research proposal made to a research ethics committee under section 72;

(z.9) prescribing requirements that must be met before a health information custodian may disclose personal health information to a researcher under section 78;

(z.10) respecting agreements referred to in subsection 80(1);

(z.11) establishing a process for the review of whether a researcher is in compliance with the provisions of an agreement referred to in subsection 80(1) and the requirements referred to in section 81, and respecting

(i) the persons or organizations that may conduct reviews, including their powers on review,
(ii) the duties of a researcher who is under review, and
(iii) exceptions to provisions of this Act restricting disclosure of personal health information by a health information custodian or the Information and Privacy Commissioner for the purposes of a review;

Nunavut

No information found

British Columbia

Office of the Information & Privacy Commissioner for BC 2018 Access to Data for Health Research

Page 3: Research Ethics Board (REB) Approval
“the Ministry of Health and health authorities generally require researchers to obtain approval from a REB for their study before they disclose data to researchers. This helps ensure, among other things, that individually identifiable data is necessary to conduct the research and that the research is in the public interest.”

Access to Health Data for Research

Definitions

“ethics approval” means approval in writing of an application granted by the research ethics board or committee established at or recognized by a British Columbia university, hospital or health authority which has authority to provide that approval for that application

Alberta

Health Information Act

Interpretation
1(1) “research ethics board” means a body designated by the regulations as a research ethics board;

Role of research ethics board
50(1) The research ethics board must

(i) the proposed research is of sufficient importance that the public interest in the proposed research outweighs to a substantial degree the public interest in protecting the privacy of the individuals who are the subjects of the health information to be used in the research,
(ii) the researcher is qualified to carry out the research,
(iii) adequate safeguards will be in place at the time the research will be carried out to protect the privacy of the individuals who are the subjects of the health information to be used in the research and the confidentiality of that information, and
(iv) obtaining the consents referred to in clause (a) is unreasonable, impractical or not feasible.

50(2) In making an assessment under subsection (1)(b), the research ethics board must consider the degree to which the proposed research may contribute to

(a) identification, prevention or treatment of illness or disease,
(b) scientific understanding relating to health,
(c) promotion and protection of the health of individuals and communities,
(d) improved delivery of health services, or
(e) improvements in health system management.

50(3) The research ethics board must prepare a response setting out

(a) its recommendation under subsection (1)(a)
(b) its assessment of the matters set out in subsection (1)(b), and
(c) any conditions that the research ethics board considers should be imposed on the researcher.

50(4) The research ethics board must send a copy of the response required in subsection (3) to the Commissioner

Saskatchewan

The Health Information Protection Act

(b) the research project has been approved by a research ethics committee approved by the minister; and

(c) in the opinion of the research ethics committee, the potential benefits of the research project clearly outweigh the potential risk to the privacy of the subject individual;

Manitoba

Personal Health information Act Regulations

Health research privacy committee
8.2(1) A research applicant seeking approval for a health research project under section 24 of the Act must provide the health research privacy committee with the following information:

(a) the purpose of the health research;
(b) the name of the principal researcher or researchers responsible for the project, including any collaborating researchers if the project is multi-centre in scope;
(c) the duration of the project, the date of commencement and the projected date it will conclude;
(d) a detailed description of the personal health information required for the research;
(e) a description of any possible linkage or merging of the personal health information with other information and the rationale for that linkage or merger;
(f) whether the research project will require direct contact with individuals;
(g) a description of the methods to be employed to maintain security of the personal health information, including disposal of the information;
(h) the names of persons who will receive the project results, including any proposed submissions for publication;
(i) identification of the sources and duration of funding for the research project;
(j) [repealed] M.R. 146/2001;
(k) any additional information the committee considers necessary

8.2(1.1) On receiving the information required under subsection (1), the health research privacy committee must ensure that the information is forwarded to Research Manitoba, for consideration by CHIPER.

8.2(2) After receiving satisfactory confirmation that the proposed research project has been approved by CHIPER, the health research privacy committee may grant or refuse to grant an approval of the project, and must advise the research applicant in writing of its decision.

8.2(2.1) The health research privacy committee may sit in panels of three members, and when considering a proposed research project,

(a) a panel has all the jurisdiction of the committee; and
(b) a decision of a majority of the members of a panel is the decision of the committee.

8.2(3) The committee may determine its own practice and procedure.

8.2(5) The committee shall provide the minister with an annual report of its activities.

8.2(6) In this section, “CHIPER” means the Committee for Harmonized Health Impact, Privacy, and Ethics Review (CHIPER), as established by Research Manitoba

Freedom of Information and Protection of Privacy Act

Definitions
1(1) In this Act

“head“, in relation to a public body, means
(d) in any other case, the person or group of persons designated under section 80 or the regulations as the head of the public body;

Designation of a head by a local public body
80 A local public body shall, by by-law or resolution, designate a person or group of persons as the head of the local public body for the purposes of this Act

Conditions of disclosure
47(4) The head of the public body may disclose personal information for a research purpose only if

(b) the head is satisfied that

(i) the personal information is requested for a bona fide research purpose,
(ii) the research purpose cannot reasonably be accomplished unless the personal information is provided in a form that identifies individuals,
(iii) it is unreasonable or impractical for the person proposing the research to obtain consent from the individuals the personal information is about, and
(iv) (iv) disclosure of the personal information, and any information linkage, is not likely to harm the individuals the information is about and the benefits to be derived from the research and any information linkage are clearly in the public interest;

(c) the head of the public body has approved conditions relating to

(d) the person to whom the personal information is disclosed has entered into a written agreement to comply with the approved conditions

Ontario

Personal Health Information Protection Act, 2004, SO 2004, c 3, Sch A

“research” means a systematic investigation designed to develop or establish principles, facts or generalizable knowledge, or any combination of them, and includes the development, testing and evaluation of research; (“recherche”)

“researcher” means a person who conducts research; (“chercheur”)

“research ethics board” means a board of persons that is established for the purpose of approving research plans under section 44 and that meets the prescribed requirements;

Research
37(3) Under clause (1) (j), a health information custodian may use personal health information about an individual only if the custodian prepares a research plan and has a research ethics board approve it and for that purpose subsections 44 (2) to (4) and clauses 44 (6) (a) to (f) apply to the use as if it were a disclosure

Disclosure for research
44(1) A health information custodian may disclose personal health information about an individual to a researcher if the researcher,

(a) submits to the custodian,

1. an application in writing,
2. a research plan that meets the requirements of subsection (2), and
3. a copy of the decision of a research ethics board that approves the research plan; and

(b) enters into the agreement required by subsection (5). 2004, c. 3, Sched. A, s. 44 (1).

Same
44(1.1) For greater certainty, the decision of only one research ethics board is sufficient for the purposes of subclause (1) (a) (iii)

Personal Health Information Protection Act, 2004, Ontario Regulation 329/04

Research ethics boards
15. The following are prescribed as requirements that must be met by a research ethics board:

1. The board must have at least five members, including,

i. at least one member with no affiliation with the person or persons that established the research ethics board,
ii. at least one member knowledgeable in research ethics, either as a result of formal training in research ethics, or practical or academic experience in research ethics,
iii. at least two members with expertise in the methods or in the areas of the research being considered, and
iv. at least one member knowledgeable in considering privacy issues.

2. The board may only act with respect to a proposal to approve a research plan where there is no conflict of interest existing or likely to be perceived between its duty under subsection 44 (3) of the Act and any participating board member’s personal interest in the disclosure of the personal health information or the performance of the research

Requirements for research plans
16. The following are prescribed as additional requirements that must be set out in research plans for the purposes of clause 44 (2) (c) of the Act:

Quebec

Bill 64: The Act respecting Access to documents held by public bodies and the Protection of personal information

23. The Act is amended by inserting the following sections after section 67.2:

“67.2.2. A person or body wishing to use personal information for study or research purposes or for the production of statistics must

(1) request it in writing;
(2) enclose the research protocol with the request;
(3) state the grounds supporting fulfillment of the criteria set out in subparagraphs 1 to 5 of the second paragraph of section 67.2.1;
(4) mention all the persons and bodies to whom or which the person or body is making a similar request for the purposes of the same study or research or production of statistics;
(5) if applicable, describe the different technologies that will be used to process the information; and
(6) if applicable, submit the documented decision of a research ethics committee relating to the study or research or the production of statistics.

Bill 64: Act Respecting the Protection of Personal Information in the Private Sector

110. section 21 of the Act is replaced by the following sections:

21.0.1 A person or body wishing to use personal information for study or research purposes or for the production of statistics must

(6) if appliable, send the documented decision of a research ethics committee relating to the study or research or the production of statistics

New Brunswick

Personal Health Information Privacy and Access Act, SNB 2009, cP-7.05

Disclosure for Research Purposes
43(1) A custodian may disclose personal health information into a person conducting a research project only if the project has been approved under this section

43(2) An approval may be given by a research review body that meets the requires prescribed by regulation

43(3) An approval may be given under this section only if the research review body has determined that

(a) the individuals to whom the information relates have consented to its use and disclosure or it is unreasonable or impractical for the person proposing the research to obtain consent from the individuals to whom the information relates, and
(b) the research project contains

(i) reasonable safeguards to protect the privacy and security of the personal health information, and

procedures to destroy the information or de-identify the information at the earliest opportunity, consistent with the purposes of the project

Nova Scotia

Personal Health Information Act, SNS 2010, c41

Interpretation
52 In sections 53 to 60,

(d) “research ethics board” means a research ethics board established and operating in conformity with the Tri-Council Policy Statement;
(e) “Tri-Council Policy Statement” means the Tri-Council Policy Statement “Ethical Conduct for Research Involving Humans” adopted in August 1998 by the Medical Research Council of Canada, the Natural Sciences and Engineering Research Council of Canada and the Social Sciences and Humanities Research Council of Canada, and includes any amendments or successor statements.

Steps required prior to using information
55 A custodian may use personal health information for research if, before commencing the research, the custodian

(c) Receives the approval of a research ethics board; and
(d) Meets any conditions imposed by the research ethics board

Obligations of researcher
56 A custodian may disclose personal health information about an individual to a researcher if the researcher

(a) Submits to the custodian

(iii) a copy of the submission to and decision of a research ethics board that approves the

research plan; and

Disclosure without individual consent
57 A custodian may disclose personal health information about an individual to a researcher without the consent of the subject individual if

(b) A research ethics board has determined that consent of the subject individuals is not required

Research Plan
59(1) Before commencing research, a researcher seeking to conduct research utilizing personal health information shall submit a research plan to a research ethics board.

Custodian-researcher agreement
60(2) An agreement referred to in subsection (1) must include a commitment by the researcher

(a) To comply with any terms and conditions imposed by a research ethics board
(c) to use the information only for the purposes outlined in the research plan as approved by a research ethics board

Prince Edward Island

Health Information Act, RSPEI 1988, c H-1.41

Definitions
1 In this Act

(aa) “research ethics board” means a research ethics board designated in the regulations;

Research ethics board
2(2) for the purpose of clause 1(aa) of the Act, the Prince Edward Island Research Ethics Board is designated as a research board.

Submission of research plan
30(1) a person who proposes to use personal health information for research purposes shall submit a research plan respecting the proposed research to a research ethics board for approval

Consideration of research plan
30(3) A research ethics board to which a research plan is submitted shall

Factors in assessment
30(4) In making an assessment under clause (3)(c), the research ethics board shall consider the degree to which the proposed research may contribute to

Response in writing
30(5) If the research ethics board approves the research plan, it shall prepare a written response to the researcher setting out

(a) its recommendation under subsection (3)(a);
(b) its assessment of the matters set out in subsection (3)(b);
(c) and any conditions that the research ethics board considers should be imposed on the researcher.

Idem
30(6) If the research ethics board refuses to approve a research plan, it shall prepare a written response to the researcher setting out its reasons for the refusal.

Copy to Commissioner
30(7) The research ethics board shall send a copy of its response prepared pursuant to subsection (5) to the Commissioner.

Bar to research
30(9) If the research ethics board refuses to approve the research plan, the researcher shall not apply to a custodian under section 31

Newfoundland and Labrador

Personal Health Information Act, SNL 2008, c P-7.01

Interpretation
2(1) In this Act

(w) “research ethics board” means the research ethics board appointed by the Health Research Ethics Authority for Newfoundland and Labrador under the Health Research Ethics Authority Act ;

(x) “research ethics body” means a research ethics body approved by the Health Research Ethics Authority for Newfoundland and Labrador under the Health Research Ethics Authority Act ;

Health Research Ethics Authority Act, SNL 2006, c H-1.2

Approval required for research
9(1) A person shall not engage in health research involving human subjects without first obtaining approval for the research from the research ethics board or a research ethics body approved by the authority under section 8

9(2) A person shall submit an application for approval to engage in health research involving human subjects to the authority.

9(3) The authority shall, within 2 business days of its receipt, refer an application made to it under subsection (2) to the research ethics board or a research ethics body approved by the authority under section 8

9(4) The research ethics board or a research ethics body approved by the authority under section 8 shall consider the application referred to it under subsection (3) within 30 days of receiving it and may

(a) approve the application
(b) approve the application subject to the changes the board or other body may require; or
(c) refuse to approve the application.

9(5) In exercising its powers under subsection (4), the research ethics board or other research ethics body shall apply

(a) one or both of

(i) the tri-council policy statement, and
(ii) the International Conference on Harmonization of Technical Requirements for the Registration of Pharmaceuticals for Human Use Guidance E6: Good Clinical Practice: Consolidated Guideline; and

(b) other guidelines or standards approved by the authority for the purpose.

9(6) Notwithstanding subsection (5), the research ethics board or a research ethics body approved by the authority under section 8, subject to the approval of the authority, may vary a standard or rule contained in the tri-council policy statement or other document referred to in or approved under subsection (5) or substitute a standard or rule in its entirety where the board or other body considers it appropriate with respect to a proposed project of health research involving human subjects.

Monitoring research projects
11(1) The research ethics board or research ethics body approved by the authority under section 8, whichever gave approval for the health research involving human subjects, shall monitor the research activities of persons engaged in health research involving human subjects.

11(2) The research ethics board or a research ethics body approved by the authority under section 8, whichever gave approval for the health research project involving human subjects, may conduct a review of record keeping, research methodology, conduct towards human subjects and the research results relating to a project of health research involving human subjects.

11(3) A principal investigator shall provide the research ethics board or a research ethics body approved by the authority under section 8, whichever gave the approval for the health research project involving human subjects, or a member of it or a person appointed by it to act on its behalf, with access to its records, in whatever form they are kept.

11(4) A principal investigator shall provide the research ethics board or a research ethics body approved by the authority under section 8, whichever gave the approval for the health research project involving human subjects, or a member of it or a person appointed by it to act on its behalf, with access to the premises where health research involving human subjects is being conducted.

11(5) Where, as a result of a review conducted under this section, the research ethics board or a research ethics body approved by the authority under section 8, whichever gave approval for the health research project, believes

(a) the health research being conducted does not conform to the health research project it approved;
(b) record keeping associated with the project is inadequate;
(c) the research methodology being applied is not in keeping with the methodology approved for the project; or
(d) conduct towards human subjects involved in the research project is improper,
(e) the board or other body may suspend the research project until the deficiencies identified by it have been corrected, or the board or other body may cancel the research project.

Yukon

Health Information Privacy and Management Act

Definitions
65 In this Division, “institutional research review committee” means a committee

(a) that a university, a hospital affiliated with a university, or a prescribed person establishes

(i) to review the efficacy and scientific and ethical value of a research proposal involving human subjects or involving the review of records containing personal health information
(ii) to ensure that the person proposing the research has adequate proposing the research has adequate safeguards in place to protect the confidentiality of personal health information; and

(b) that operates in conformity with

(i) the Tri-Council Policy Statement “Ethical Conduct for Research Involving Humans” adopted in August 1998 by the Medical Research Council of Canada, the Natural Sciences and Engineering Research Council of Canada and the Social Sciences and Humanities Research Council of Canada, including any amendments, or

any generally recognized policy that replaces the statement described in subparagraph (i)

Northwest Territories

Health Information Act, SNWT 2014, c. 2

Definitions
1(1) In this Act

“extra-territorial research ethics committee” means a body, recognized by or established pursuant to the legislation of a jurisdiction other than the Northwest Territories, that

“research ethics committee” means a research ethics committee designated by the Minister under section 68 or a research ethics committee established by the regulations

Research ethics committee
68 The Minister may, by order, designate an organization as a research ethics committee for the purposes of this Act

Role: Research ethics committee
69 A research ethics committee

(a) shall review a research proposal submitted to it by a researcher in accordance with section 72 and approve or reject the proposal;
(b) shall determine whether a researcher may collect personal health information from a source other than the individuals the information is about, if the research proposal includes collection from another source;
(c) shall determine whether

(i) express consent to the collection of personal health information must be obtained from the individuals whose information would be collected by a researcher, or
(ii) express consent to the use or disclosure of personal health information must be obtained from the individuals whose information would be used by a researcher or disclosed by a health information custodian to a researcher;

(d) may set conditions that a researcher must comply with in respect of

(i) collection of personal health information,
(ii) use of personal health information, and
(iii) subsequent disclosure of personal health information collected by a researcher, including the disclosure of personal health information in research produced using that information; and

(e) may make recommendations for consideration by a health information custodian that would be disclosing personal health information to a researcher

Application to research ethics committee
72(1) A researcher may apply to a research ethics committee for approval of a research proposal

Requirements
72(2) An application made under subsection (1) must include

(a) a research proposal that complies with the prescribed requirements; and
(b) any other information required by the research ethics committee.

Factors for assessment
73(1) When deciding under paragraph 69(a) whether to approve a research proposal, a research ethics committee shall assess the following factors:

(a) whether the objectives of the research can reasonably be accomplished without the personal health information that would be collected, used or disclosed;
(b) whether the proposed research is of sufficient importance that the public interest in it outweighs to a substantial degree the public interest in protecting the privacy of the individuals whose personal health information would be collected, used or disclosed, taking into account the degree to which the proposed research could contribute to

(i) identification, prevention or treatment of illness or disease,
(ii) scientific understanding relating to health,
(iii) promotion and protection of community health and the health of individuals, and
(iv) improvements in the delivery of health services and the management of health systems;

(c) whether the researcher is qualified to carry out the research;
(d) the researcher’s proposed security measures and whether adequate safeguards would be in place to protect the confidentiality of the personal health information that would be collected, used or disclosed and the privacy of the individuals the information is about

Notice required
74(1) A research ethics committee shall give notice to a researcher of

(a) its decision to approve or reject a research proposal; and
(b) in the case of approval of a research proposal,

(i) its determination under paragraph 69(b) in respect of collection of personal health information from a source other than the individual,
(ii) its determination under paragraph 69(c) in respect of express consent,
(iii) any conditions set under paragraph 69(d), and
(iv) any recommendations made under paragraph 69(e)

Access to Information and Protection of Privacy Act

Disclosure for research
49(1) A public body may only disclose personal information for a research purpose, including statistical research, where

(c) the head of the public body has approved conditions relating to the following:

(i) security and confidentiality,
(ii) the removal or destruction of individual identifiers at the earliest reasonable time,
(iii) the prohibition of any subsequent use or disclosure of that information in individually identifiable form without the express authorization of that public body; and

Nunavut

No information found

British Columbia

No information found

Alberta

Health Information Act

Interpretations
1 In this Act

“personal health number” means the number assigned to an individual by the Department to uniquely identify the individual;

Collection of personal health number
21(1) Only the following have the right to require an individual to provide the individual’s personal health number:

(a) custodians;
(b) persons authorized by the regulations to do so.

21(2) When requesting a personal health number from an individual, the person referred to in subsection (1) must advise the individual of the person’s authority under subsection (1).

21(3) An individual may refuse to provide the individual’s personal health number where the person requesting it is not a person referred to in subsection (1)

Saskatchewan

The Health Information Protection Act

Interpretation
2(1) In this Act:

“health services number” means a unique number assigned to an individual who is or was registered as a beneficiary to receive insured services within the meaning of the Saskatchewan Medical Care Insurance Act

Manitoba

Personal Health Information Act

Definitions
1(1) In this Act,

“PHIN” means the personal health identification number assigned to an individual by the minister to uniquely identify the individual for health care purposes;

Purposes of this Act
2 The purposes of this Act are

(d) to control the collection, use and disclosure of an individual’s PHIN;

(c.1) the information is demographic information about an individual, or is his or her PHIN, and is used to

(i) confirm eligibility for health care or payment for health care, or
(ii) verify the accuracy of the demographic information or PHIN;

Production and use of PHIN
26(1) No person other than a trustee may require the production of another person’s PHIN or collect or use another person’s PHIN.

Exceptions
26(2) Despite subsection (1), a person may collect or use another person’s PHIN

(b) for purposes of a health research project approved under section 24; or
(c) in circumstances permitted by the regulations.

Regulations
66(1) The Lieutenant Governor in Council may make regulations

(k) for the purpose of clause 26(2)(c), permitting the collection and use of a person’s PHIN number for specified purposes or by specified persons or bodies

Freedom of Information and Protection of Privacy Act,

Definitions
1(1) In this Act

“personal health information” means recorded information about an identifiable individual that relates to

(d) the PHIN as defined in The Personal Health Information Act and any other identifying number, symbol or particular assigned to an individual,

Ontario

Personal Health Information Protection Act, 2004, SO 2004, c 3, Sch A

Definitions
2 In this Act

“health number” means the number, the version code or both of them assigned to an insured person within the meaning of the Health Insurance Act by the General Manager within the meaning of that Act;

Personal health information
4 (1) In this Act,

“personal health information”, subject to subsections (3) and (4), means identifying information about an individual in oral or recorded form, if the information,

(f) is the individual’s health number, or

Collection or use
34(2) Despite subsection 49(1), a person who is neither a health information custodian nor acting as an agent of a health information custodian shall not collect or use another person’s health number except,

(d) if the person is prescribed and is collecting or using the health number, as the case may be, for purposes related to health administration, health planning, health research or epidemiological studies; or

Personal Health Information Protection Act, 2004, Ontario Regulation 329/04

Health number collection
11. The following are prescribed persons for the purposes of clause 34 (2) (d) of the Act:

1. The Workplace Safety and Insurance Board.
2. Every person that is prescribed under section 13.
3. Every entity that is prescribed under section 18.
4. A researcher mentioned in paragraph 2 of section 12, for the purposes of the research.
5. A person conducting health research to the extent that the individual to whom the health number was issued has provided a valid consent to the collection or use of his or her health number for that purpose

Disclosure of health number
12. The following are prescribed as exceptions for the purposes of subsection 34 (3) of the Act:

1. A person who is not a health information custodian may disclose a health number for a purpose related to the provision of provincially funded health resources.
2. A researcher who has custody or control of personal health information, including a health number, by reason of a disclosure authorized under section 44 of the Act may disclose the health number to a person who is a prescribed person for the purposes of clause 39 (1) (c) of the Act, an entity prescribed for the purposes of subsection 45 (1) of the Act or another researcher if,

i. the disclosure is part of a research plan approved under section 44 of the Act, or
ii. the disclosure is necessary for the purpose of verifying or validating the information or the research.

Quebec

No information found

New Brunswick

Personal Health Information Privacy and Access Act, SNB 2009, cP-7.05

Medicare number
48(1) No person may require the production of an individual’s Medicare number or collect or use an individual’s Medicare number except a person that requires its production, collection or use for the following purposes:

(a) for the provision of health care;
(b) to verify the individual’s eligibility to participate in a health care program or receive a health care service;
(c) for the payment and management of the health care system;
(d) to verify the individual’s eligibility to participate in the drug insurance plan under the Prescription and Catastrophic Drug Insurance Act;
(e) to obtain proof of immunization under subsection 42.1(1) of the Public Health Act; and
(f) for the establishment or maintenance of the immunization registry or the notifiable disease registry under the Public Health Act.

48(1.1) Despite subsection (1), a public body may collect and use an individual’s Medicare number, including the use to perform data matching, for the purpose of a research project approved

(a) by a research review body under section 43, or

in accordance with an agreement referred to in paragraph 43.1(a).

Nova Scotia

Personal Health Information Act, SNS 2010, c41

Authority of Minister to give access to health card number
46 Notwithstanding any enactment, except the Juries Act and the Elections Act, the Minister has the sole authority for deciding who may have access to the information in the health card number database, the Common Client Registry or any successor client information system related to the health card number.

Prince Edward Island

Health Information Act, RSPEI 1988, c H-1.41

Definitions
1 In this Act

(n) “health number” means a health number as defined in the Provincial Health Number Act R.S.P.E.I. 1988, Cap. P-27.01.

(t) “personal health information” means identifying information about an individual in oral or recorded from that

(ii) relates to information about an individual that is collected for the purpose of registering the individual for the provision of health care, including a health number, medical record number and any other identifier assigned to an individual,

Newfoundland and Labrador

Personal Health Information Act, SNL 2008, c P-7.01

Interpretation
2(1) In this Act

(m) “MCP” means the Newfoundland and Labrador Medical Care Plan administered under the Medical Care and Hospital Insurance Act

Yukon

Health Information Privacy and Management Act Regulations

Definitions
2(1) In this Act

“Yukon public health insurance plan number” means the registration number or other unique identifier assigned to an insured person for the purposes of the Health Care Insurance Plan Act.

Restrictions
18(1) Subject to subsection (2), no person may collect, use or disclose an individual’s Yukon public health insurance plan number

18(2) Subsection (1) does not apply to the collection, use or disclosure of an individual’s Yukon public health insurance plan number…

(b) for health research or a designated investigation;

Northwest Territories

Health Information Act, SNWT 2014, c. 2

(f) a personal health number, other identifying number, symbol, or other particular assigned to an individual in respect of health services or health information

Prohibition: personal health number
32(1) A person other than an individual who is assigned a personal health number or a health information custodian, shall not collect or use the individual’s personal health number unless the collection or use is required

(a) for a purpose for which a custodian has disclosed the number to the person;
(b) for a purpose permitted by an enactment or by an Act or regulation of Canada; or
(c) for a prescribed purpose

Requirement to provide information
32(2) A person other than a health information custodian that requests an individual to provide a personal health number shall inform that individual of the person’s legal authority to do so.

Regulations
195 the commissioner, on the recommendation of the Minister, may make regulations

(w) prescribing purposes for which a person other than a health information custodian or an individual may collect or use the individual’s personal health number under paragraph 32(1)(c);

Nunavut

Public Health Act

(h) an identifying number, symbol or other particular assigned to an individual in respect of health services or health information;

British Columbia

Freedom of Information and Protection of Privacy Act

Disclosure of personal information
33(3) A public body may disclose personal information in any of the following circumstances

(h) for a research purpose, including statistical research, if

(iii) any data-linking is not harmful to the individual the information is about and the benefits to be derived from the data-linking are clearly in the public interest

Data-linking programs
36.1(1) This section does not apply to a data-linking program that is part of research for the purpose of which personal information may be disclosed under section 33 (3) (h).

E-Health (Personal Health Information Access and Protection of Privacy) Act, SBC 2008, c 38

Disclosure for Health Research Purposes
14(2) The data stewardship committee may approve the request if both of the following apply:

(a) in the case of a request to disclose personal health information, all of the requirements set out in subsection (2.1) are met;

14(2.1) The requirements for the purposes of subsection (2) (a) are as follows:

(d) any data linkage is not harmful to the individuals who are the subjects of the personal health information and the benefits to be derived from the record linkage are clearly in the public interest;

Alberta

Health Information Act

Interpretations
1 In this Act

“data matching” means the creation of individually identifying health information by combining individually identifying or non‑identifying health information or other information from 2 or more electronic databases, without the consent of the individuals who are the subjects of the information;

Use of individually identifying information
27(1) A custodian may use individually identifying health information in its custody or under its control for the following purposes

(d) conducting research or performing data matching or other services to facilitate another person’s research

(i) disclosure of the health information to be used in the research;
(ii) performance of data matching;
(iii) performance of any other service to facilitate the research.

Conditions and consents
53(1) A custodian who has received the documents referred to in section 52 may, but is not required to, disclose the health information or perform data matching or other services to facilitate the research

53(2) If the custodian decides to disclose the health information or perform data matching or other services to facilitate the research,

(a) the custodian

(i) must impose on the researcher the conditions suggested by the research ethics board, and
(ii) may impose other conditions on the researcher, and

(b) if the research ethics board recommended that consents referred to in section 50(1)(a) be obtained, the researcher must obtain the consents before the disclosure of the health information or performance of data matching or other services.

53(3) A health information repository that has received the documents referred to in section 52 may disclose the health information or perform data matching or other services to facilitate the research only in accordance with the regulations

Data matching for research
72 If data matching is performed for the purpose of conducting research, sections 48 to 56 must be complied with before the data matching is performed

Saskatchewan

The Health Information Protection Act

Application of Act
(3)(2) This Act does not apply to:

statistical information or de-identified personal health information that cannot reasonably be expected, either by itself or when combined with other information available to the person who receives it, to enable the subject individuals to be identified;

Manitoba

The Personal Health Information Act

Disclosure without individual’s consent
22(2) A trustee may disclose personal health information without the consent of the individual the information is about if the disclosure is

(g.3) to another trustee for the purpose of de-identifying the personal health information;

Conditions for approval
24(3) An approval may be given under this section only if the committee has determined that

(d) the research proposal contains

(ii) procedures to destroy or remove, at the earliest opportunity consistent with the purposes of the research, any information that, either by itself or when combined with other information available to the holder, allows individuals to be readily identified;

Protecting Individual Privacy
24.1(3) A prescribed health research organization must:

(c) as soon as reasonably possible having regard to the use of the information, remove any information that, either by itself or when combined with other information available to the organization, allows the identity of the individuals to be readily ascertained

Personal Health Information Act Regulations

(e) a description of any possible linkage or merging of the personal health information with other information and the rationale for that linkage or merger;

Freedom of Information and Protection of Privacy Act

Conditions of disclosure
47(4) The head of the public body may disclose personal information for a research purpose only if
(iv) disclosure of the personal information, and any information linkage, is not likely to harm the individuals the information is about and the benefits to be derived from the research and any information linkage are clearly in the public interest;

Ontario

Personal Health Information Protection Act, 2004, Ontario Regulation 329/04

Requirements for research plans

16. The following are prescribed as additional requirements that must be set out in research plans for the purposes of clause 44 (2) (c) of the Act:

3. A description of how the personal health information will be used in the research, and if it will be linked to other information, a description of the other information as well as how the linkage will be done.

4. An explanation as to why the research cannot reasonably be accomplished without the personal health information and, if it is to be linked to other information, an explanation as to why this linkage is required.

Quebec

Bill 64: Act Respecting the Protection of Personal Information in the Private Sector

110. Section 21 of the Act is replaced by the following sections:

“21.0.2. A person who communicates personal information in accordance with section 21 must first enter into an agreement with the person or body to whom or which the information is to be sent that stipulates, among other things, that the information

(3) may not be cross-matched with any other information file that has not been provided for in the research protocol; and

Act Respecting access to documents held by public bodies and the protection of personal information
23. The Act is amended by inserting the following sections after section 67.2:

“67.2.3. A public body that releases personal information in accordance with section 67.2.1 must first enter into an agreement with the person or body to whom or which the information is to be sent that stipulates, among other things, that the information

may not be cross-matched with any other information file that has not been provided for in the research protocol; and

New Brunswick

Personal Health Information Privacy and Access Act, SNB 2009, cP-7.05

Definitions
1 The following definitions apply in this Act

“Data matching” means the creation of identifying information by combining identifying information or de-identified personal health information or other information from 2 or more electronic data bases or 2 or more electronic records.

Permitted uses
34(1) A custodian may use personal health information in its custody or under its control for one or more of the following purposes:

(m.2) if the custodian is the Minister or a researcher, to perform data matching for the purpose of a research project approved by a research review body under section 43;

(m.3) if the custodian is the Minister or a research data centre, to perform data matching for the purpose of a research project approved in accordance with an agreement referred to in paragraph 43.1(a)

Disclosure for health care programs or other programs
38(1) A custodian may disclose personal health information relating to an individual without the consent of the individual if the disclosure is

(g.2) to the Minister and the Minister uses the personal health information to perform data matching for the purpose of a research project approved

(i) by a research review body under section 43, or
(ii) in accordance with an agreement referred to in paragraph 43.1(a)

Medicare Number
48(1.1) Despite subsection (1) (i.e. conditions for requiring Medicare number), a public body may collect and use an individual’s Medicare number, including the use to perform data matching, for the purpose of a research project approved.

(a) By a research review body under section43 or
(b) In accordance with an agreement referred to in paragraph 43.1(a)

Right to Information and Protection of Privacy, SNB 2009, c R-10.

Definitions
1 The following definitions apply in this Act

“Data matching” means the creation of identifying information by combining identifying information or de-identified information or other information from two or more electronic databases or two or more electronic records

Collection, use and disclosure of personal information by a research data centre
47.1(2) The Minister of Health and a research data centre may perform data matching for the purpose of research referred to in paragraph 46(1)(b.1) using personal information disclosed to the Minister of Health or the research data centre, as the case may be, under that paragraph.

Nova Scotia

Personal Health Information Act, SNS 2010, c41

Interpretation
52 In sections 53 to 60

(a) “Data matching” means the creation of individual identifying health information by combining individual identifying or non-identifying health information or other information from two or more databases without the consent of the individuals who are the subjects of the information

Research plan
59(3) In order to meet the requirements for a custodian under this Act, the research plan must include

(e) where the personal health information will be linked to other information, a description of other information as well as how the linkage will be conducted
(j) where there is to be data matching, an explanation of why data matching is required

Freedom of Information and Protection of Privacy Act

Disclosure for research purpose
29 A public body may disclose personal information for a research purpose, including statistical research, if

Any record linkage is not harmful to the individuals that information is about and the benefits to be derived from the record linkage are clearly in the public interest

Prince Edward Island

Health Information Act, RSPEI 1988, c H-1.41

Definitions
1 In this Act

(f) “data matching” means the creation of individually identifying personal health information by combining individually identifying personal health information de-identified personal health information or other information from 2 or more electronic database s or 2 or more electronic records, without the consent of the individuals to whom the information relates;

Privacy Impact Assessment
25(1) subject t o subsection (2), a custodian shall prepare a privacy impact assessment and submit the assessment to the Commissioner for review and comment before undertaking any of the following:

(c) data matching with personal health information collected by it or with any personal health information held by another custodian or another person

Data matching
26(1) a custodian may perform data matching using personal information that is in its custody of under its control

Idem
26(2) if data matching is performed for the purpose of conducting research, the custodian that proposes to perform the data matching shall comply with sections 30 to 32 before the data matching is performed

Idem
27(1) A custodian may perform data matching by combining personal health information that is in its custody or under its control with personal health information that is in the custody or under the control of another custodian.

Privacy impact assessment
27(2) Before performing data matching under this section, the custodian in whose custody and control the personal health information that is created through data matching will be stored shall prepare a privacy impact assessment and submit the assessment to the Commissioner for review and comment.

Data matching by custodian and non-custodian
28(1) A custodian may perform data matching by combining personal health information that is in its custody or under its control with personal health information that is in the custody or under the control of a person that is not a custodian.

Privacy impact assessment
28(2) Before performing data matching under this section, the custodian shall prepare a privacy impact assessment and submit the assessment to the Commissioner for review and comment.

Data matching for research
29 For the purposes of this Part, a privacy impact assessment shall

(a) specify how the proposed administrative practices and information systems relating to the collection, use and disclosure of personal health information may affect the privacy of the individual to whom the information relates;
(b) describe how the personal health information to be used in the data matching is to be collected; and
(c) set out how the personal health information that is created through data matching is to be used or disclosed

Freedom of Information and Protection of Privacy Act, RSPEI 1988, c F-15.01

Disclosure for research or statistical purposes
39 A public body may disclose personal information for a research purpose, including statistical research, only if

(b) any record linkage is not harmful to the individuals the information is about and the benefits to be derived from the record linkage are clearly in the public interest

Power to make regulations
77(1) the Lieutenant Governor in Council may make regulations

(k) respecting standards to be observed and procedures to be followed by a public body implementing a program for data matching and data sharing or linkage

Newfoundland and Labrador

Personal Health Information Act, SNL 2008, c P-7.01

Additional powers of commissioner
79 In addition to the commissioner’s powers and duties respecting requests for review, the commissioner may

(e) comment on the implications for the confidentiality of personal health information of

(i) using or disclosing personal information for record linkage

Access to Information and Protection of Privacy Act, 2015, SNL 2015, c A-1.2

Disclosure for research or statistical purposes
70 A public body may disclose personal information for a research purpose, including statistical research, only where

(b) any record linkage is not harmful to the individuals that information is about and the benefits to be derived from the record linkage are clearly in the public interest

General powers and duties of commissioner
95(1) In addition to the commissioner’s powers and duties under Parts II and III, the commissioner may

(f) comment on the implications for protection of privacy of

(i) using or disclosing personal information for record linkage, or

Yukon

No information found

Northwest Territories

Access to Information and Protection of Privacy Act

Disclosure for research
49(1) A public body may only disclose personal information for a research purpose, including statistical research, where

(b) any record linkage resulting from the disclosure is not harmful to the individuals the information is about and the benefits to be derived from the record linkage are clearly in the public interest;

Nunavut

Access to Information and Protection of Privacy Act

Disclosure for research
49 A public body may only disclose personal information for a research purpose, including statistical research, where

British Columbia

Alberta

A Practical Guide to the Health Information Act

Saskatchewan

No information found

Manitoba

Government of Manitoba tool for health researchers to understand the Personal Health Information Act: https://www.gov.mb.ca/health/phia/trustees.html

Ontario

Information and Privacy Commissioner of Ontario Resources

Quebec

New Brunswick

No information found

Nova Scotia

NS Health: Privacy and Confidentiality of Personal Health Information

Prince Edward Island

No information found

British Columbia

Office of the Information & Privacy Commissioner for BC 2018 Access to Data for Health Research

Page 4: E-Health (Personal Health Information Access and Protection of Privacy act s 14,19 and 20:
E-Health Act governs the collection, use and disclosure of personal health information in Ministry of Health or health authority databases that are designated by the Minister of Health as health information banks. The following databases are designated as health information banks:

the Provincial Laboratory Information Solution (PLIS) repository, which contains personal health information pertaining to lab services delivered by health authorities and private labs;
the Client Registry System/Enterprise Master Patient Index, which contains demographic information for all individuals receiving publicly-funded health care services in British Columbia; and
the Provider Registry, which contains personal information about health service providers.

any subsequent use or disclosure of personal health information must be expressly authorized by the Data Stewardship Committee, and
personal health information and information related to a health service provider cannot be disclosed for market research purposes. Because of its commercial nature, market research is distinct from health research.

Freedom of Information and Protection of Privacy Act

Personal information directories, privacy impact assessments and information-sharing agreements
69 (1) In this section:

“privacy impact assessment” means an assessment that is conducted by a public body to determine if a current or proposed enactment, system, project, program or activity meets or will meet the requirements of Part 3 of this Act.

(2) The minister responsible for this Act must maintain and publish a personal information directory to provide information about records in the custody or under the control of ministries of the government of British Columbia and about the use of those records.

(3) The personal information directory must include a summary that meets the requirements of the minister responsible for this Act of the following information:

(a) the personal information banks that are in the custody or under the control of each ministry of the government of British Columbia;
(b) the information-sharing agreements into which each ministry of the government of British Columbia has entered;
(c) the privacy impact assessments referred to in subsection (5);
(d) any other information the minister responsible for this Act considers appropriate.

(4) The head of a ministry must correct as soon as possible any errors or omissions in the portion of the personal information directory that relates to the ministry, and provide the corrected information to the minister responsible for this Act.

(5) The head of a ministry must conduct a privacy impact assessment and must do so in accordance with the directions of the minister responsible for this Act.

(5.1) The head of a ministry, with respect to a proposed enactment, system, project, program or activity, must submit, during the development of the proposed enactment, system, project, program or activity, the privacy impact assessment to the minister responsible for this Act for the minister’s review and comment.

(5.2) If the minister responsible for this Act receives a privacy impact assessment under subsection (5.1) respecting a common or integrated program or activity, the minister must submit, during the development of the proposed enactment, system, project, program or activity, the privacy impact assessment to the commissioner for the commissioner’s review and comment.

(5.3) The head of a public body that is not a ministry must conduct a privacy impact assessment and must do so in accordance with the directions of the minister responsible for this Act.

(5.4) The head of a public body that is not a ministry, with respect to a proposed system, project, program or activity, must submit, during the development of the proposed system, project, program or activity, the privacy impact assessment, if it addresses a common or integrated program or activity, to the commissioner for the commissioner’s review and comment.

(5.5) The head of a public body must notify the commissioner of a common or integrated program or activity at an early stage of developing the initiative, program or activity.

(5.7) The head of a ministry must prepare an information-sharing agreement in accordance with the directions of the minister responsible for this Act.

(6) The head of a public body that is not a ministry must make available for inspection and copying by the public a directory that lists the public body’s personal information banks and includes the following information with respect to each personal information bank:

(a) its title and location;
(b) a description of the kind of personal information and the categories of individuals whose personal information is included;
(c) the authority for collecting the personal information;
(d) the purposes for which the personal information was obtained or compiled and the purposes for which it is used or disclosed;
(e) the categories of persons who use the personal information or to whom it is disclosed;
(f) information required under subsection (7).

(7) The minister responsible for this Act may require one or more public bodies, or classes of public bodies, that are not ministries of the government of British Columbia

(a) (a)to provide additional information for the purposes of subsection (6), and
(b) (b)to comply with one or more of the subsections in this section as if the public body were a ministry of the government of British Columbia.

(9) The minister responsible for this Act, in consultation with the commissioner, must establish an information-sharing code of practice that makes recommendations respecting how personal information is to be collected, used and disclosed under this Act.

(10) The minister responsible for this Act may, under subsection (5) or (5.3), give different directions for different categories of personal information.

Alberta

Health Information Act

Duty to prepare privacy impact assessment
64(1) Subject to subsection (3), each custodian must prepare a privacy impact assessment that describes how proposed administrative practices and information systems relating to the collection, use and disclosure of individually identifying health information may affect the privacy of the individual who is the subject of the information.

64(2) Subject to subsection (3), the custodian must submit the privacy impact assessment to the Commissioner for review and comment before implementing any proposed new practice or system described in subsection (1) or any proposed change to existing practices and systems described in subsection (1).

64(3) Subsections (1) and (2) do not apply to custodians described in section 1(1)(f)(iv), (ix.1), (ix.2), (xii) and (xii.1) in the collection, use or disclosure of health information between or among these custodians for a function set out in section 27(2), unless the custodians will implement a new information system or change an existing information system in conjunction with the collection, use or disclosure

Saskatchewan

The Health Information Protection Act

PART IV: LIMITS ON COLLECTION, USE AND DISCLOSURE OF PERSONAL HEALTH INFORMATION BY TRUSTEES

Collection, use and disclosure on need-to-know basis
23(1) A trustee shall collect, use or disclose only the personal health information that is reasonably necessary for the purpose for which it is being collected, used or disclosed.

23(2) A trustee must establish policies and procedures to restrict access by the trustee’s employees to an individual’s personal health information that is not required by the employee to carry out the purpose for which the information was collected or to carry out a purpose authorized pursuant to this Act.

23(4) A trustee must, where practicable, use or disclose only de-identified personal health information if it will serve the purpose

Manitoba

No information found

Ontario

No information found

Quebec

Bill 3: Access to information by a service provider or by a researcher and amending various legislative provisions

Chapter I General Provisions
3. In this Act

“research project” means a process aimed at developing knowledge, in particular for innovation purposes, by means of structured study or systematic investigation

Bill 3: Access to information by a service provider or by a researcher
Division II Researcher

46. The person exercising the highest authority within the body to which the researcher is attached must, before granting the request, consult each of the bodies that hold information covered by the request, which then have 10 days to submit observations.

47. The person exercising the highest authority within the body to which the researcher is attached may authorize the researcher to be informed of the existence of and to have access to the information, if the person considers that the following criteria are met:

(1) it is unreasonable to require obtaining the consent of the person concerned;
(2) the objective of the research project outweighs, with regard to the public interest, the impact of using or communicating the information on the privacy of the person concerned;
(3) the security measures that will be in place for the carrying out of the research project are suitable for ensuring the protection of the information and comply with the information governance rules referred to in section 83 and the special rules defined by the network information officer under section 89; and
(4) where the research project involves the communication of information outside Québec, the privacy impact assessment referred to in subparagraph 2 of the second paragraph of section 39 establishes that the information would receive adequate protection, in particular in light of generally recognized principles regarding the protection of personal information.

An unfavourable decision must give reasons and be notified in writing to the researcher who submitted the request.

New Brunswick

Personal Health Information Privacy and Access Act, SNB 2009, cP-7.05

Definitions
1 The following definitions apply in this Act

“research” means a systematic investigation designed to develop or establish principles, facts or general knowledge, or any combination of them, and includes the development, testing and evaluation of research.

Source of Information
28 A custodian shall collect personal health information directly from the individual to whom the information relates except if

Nova Scotia

No information found

Prince Edward Island

Health Information Act, RSPEI 1988, c H-1.41

Definitions
1 In this Act

(bb) “researcher” means a person whose research plan has been submitted to a research ethics board pursuant to section 30

Authorized purposes
22(5) a Custodian may use personal health information in its custody or under its control for one or more of the following purposes

(m) For a research project approved by a research ethics board under section 30;
(n) for the purpose of conducting research or performing other services to facilitate another person’s research

(i) if the custodian or researcher has submitted a research plan to a research ethics board in accordance with section 30,
(ii) if the research ethics board has approved the research plan,
(iii) if the custodian or researcher has complied with or undertaken to comply with any conditions imposed by the research ethics board, and
(iv) where the research ethics board recommends that consents should be obtained from the individuals whose personal health information is to be used, if those consents have been obtained;

Powers of Custodian
33(3) Where authorized to do so by an order under subsection (2), a custodian may

(a) enter and search any premises of the researcher where the research is conducted;
(b) operate or cause to be operated any computer system of the researcher to search any data contained in or available to the system and produce a document from the data; and

seize and make copies of any documents of the researcher that are on or may be relevant to the investigation

Newfoundland and Labrador

Personal Health Information Act, SNL 2008, c P-7.01

Interpretation
2(1) In this Act

(v) “research” means a systematic investigation designed to develop or establish principles or facts or to generate knowledge, or any combination of principles, facts and knowledge, and includes the development, testing and evaluation of research;

Health Research Ethics Authority Act, SNL 2006, c H-1.2

Definitions
2 In this Act

(i) “tri-council policy statement” means the Tri-Council Policy Statement “Ethical Conduct for Research Involving Humans” adopted in August, 1998 by the Medical Research Council of Canada, the Natural Sciences and Engineering Research Council of Canada and the Social Sciences and Humanities Research Council of Canada, and includes amendments to the statement and another statement of principles and guidelines respecting ethical conduct for research involving humans adopted by those councils in substitution for the tri-council policy statement.

Labrador Inuit rights
2.1 This Act and regulations made under this Act shall be read and applied in conjunction with the Labrador Inuit Land Claims Agreement Act and, where a provision of this Act or regulations made under this Act is inconsistent or conflicts with a provision, term or condition of the Labrador Inuit Land Claims Agreement Act , the provision, term or condition of the Labrador Inuit Land Claims Agreement Act shall have precedence over the provision of this Act or a regulation made under this Act.

Access to Information and Protection of Privacy Act, 2015, SNL 2015, c A-1.2

Privacy impact assessment
72(1) A minister shall, during the development of a program or service by a department or branch of the executive government of the province, submit to the minister responsible for this Act

(a) a privacy impact assessment for that minister’s review and comment; or
(b) the results of a preliminary assessment showing that a privacy impact assessment of the program or service is not required.

72(2) A minister shall conduct a preliminary assessment and, where required, a privacy impact assessment in accordance with the directions of the minister responsible for this Act.

72(3) A minister shall notify the commissioner of a common or integrated program or service at an early stage of developing the program or service.

72(4) Where the minister responsible for this Act receives a privacy impact assessment respecting a common or integrated program or service for which disclosure of personal information may be permitted under paragraph 68 (1)(u), the minister shall, during the development of the program or service, submit the privacy impact assessment to the commissioner for the commissioner’s review and comment.

Disclosure of Information
102(1) The commissioner and a person acting for or under the direction of the commissioner, shall not disclose information obtained in performing duties or exercising powers under this Act, except as provided in subsections (2) to (5)

Yukon

Health Information Privacy and Management Act

Collection for research
66 (1) Subject to subsection (2), a custodian may, for the purpose of research, collect an individual’s personal health information from the individual or any other person.

66(2) If a custodian intends to collect an individual’s personal health information for the purpose of research (other than research that is incidental to a purpose for which this Act otherwise allows the custodian to collect the personal health information), the custodian must

(a) where the custodian is a public body, a branch, operation or program of a Yukon First Nation or a prescribed person, meet the prescribed requirements, if any; or
(b) where the custodian is not a person described in paragraph (a), obtain prior approval of the collection by an institutional research review committee.

Use for research
67 A custodian may, without the individual’s consent, use for the purpose of research an individual’s personal health information that is in its custody or control.

Northwest Territories

Health Information Act Regulations R-089-2015

7(1) In this section, “Tri-Council Policy Statement” means the Canadian Institutes of Health Research, Natural Sciences and Engineering Research Council of Canada, and Social Sciences and Humanities Research Council of Canada, Tri-Council Policy Statement: Ethical Conduct for Research Involving Humans, December 2010.

7(2) The Tri-Council Policy Statement, as amended from time to time, is adopted for the purposes of this section.

7(3) A research ethics committee designated under section 68 of the Act shall operate in conformity with the Tri-Council Policy Statement.

Fees for Researchers
12(1) If, under subsection 80(2) of the Act, an agreement between a health information custodian and a researcher requires the payment of fees and disbursements, those fees and disbursements shall be paid in accordance with this section.

12(2) For each activity associated with providing access and described in Column 2 of the table set out in Part 2 of the Schedule, the fee payable for that activity is the corresponding amount set out in Column 3 of that table.

12(3) Access to records under an agreement between a health information custodian and a researcher is subject to the payment of applicable fees and disbursements.

Nunavut

Access to Information and Protection of Privacy Act

“privacy impact assessment” means an assessment that is conducted by a public body as defined in section 2, but not including a municipality, to determine if a current or proposed program or service meets or will meet the requirements of Part 2 of this Act

Privacy impact assessment
42.1(1) A minister shall, during the development of a program or service by a public body or the redesign of an existing program or service by a public body, submit to the Minister responsible for this Act

(a) a privacy impact assessment for the Minister’s review and comment; or
(b) the results of a preliminary assessment showing that a privacy impact assessment of the program or service is not required

British Columbia

No information found

Alberta

No information found

Saskatchewan

The Health Information Protection Regulations, 2023

Definitions and interpretation
2(2) For the purposes of the Act, “research” means an undertaking intended to extend the knowledge through a disciplined inquiry, a systematic investigation or both

Trustees
4 For the purpose of subclause 2(1)(t)(xv) of the Act the following are prescribed as trustees:

(a) the health quality council;
(b) every person who owns or operates a privately-owned facility in or from which health services are provided by a health professional;
(c) hearing aid dealers within the meaning of The Hearing Aid Sales and Services Act.

Duty to protect personal health information
5 To ensure compliance with the Act by its employees, a trustee that has custody or control of personal health information must:

(a) provide orientation and ongoing training for its employees about the trustee’s policies and procedures respecting the protection of personal health information; and
(b) ensure that each of its employees signs a pledge of confidentiality that includes an acknowledgement that the employee:

(i) is bound by the trustee’s policies and procedures mentioned in clause (a); and
(ii) is aware of the consequences of breaching those policies and procedures.

Manitoba

No information found

Ontario

No information found

Quebec

No information found

New Brunswick

New Brunswick Regulation 2010-112 under the Personal Health Information Privacy and Access Act

Research review body
17 For the purposes of subsection 43(2) of the Act, a research review body shall operate in conformity with the Tri-Council Policy Statement

Personal health information stored outside Canada
22 Information managers providing a public body with information management or information technology services may store personal health information in their custody or in their control outside Canada

Nova Scotia

No information found

Prince Edward Island

No information found

Newfoundland and Labrador

No information found

Yukon

No information found

Northwest Territories

No information found

Nunavut

No information found

Type of Information

British Columbia

Alberta

Saskatchewan

Manitoba

Ontario

Quebec

New Brunswick

Nova Scotia

Prince Edward Island

Newfoundland and Labrador

Yukon

Northwest Territories

Nunavut

British Columbia

BC Ministry of Health: “Access to Health Data for Research” Directive Document

Alberta

No information found

Saskatchewan

No information found

Manitoba

No information found

Ontario

BILL 3: Explanatory Notes

Quebec

BILL 3: Explanatory Notes

New Brunswick

No information found

Nova Scotia

No information found

Prince Edward Island

No information found

Newfoundland and Labrador

No information found

Yukon

No information found

Northwest Territories

No information found

Nunavut

No information found

British Columbia

E-Health (Personal Health Information Access and Protection of Privacy) Act, SBC 2008, c 38

Definitions
1 In this Act:

“Personal health information” means recorded information about an identifiable individual that is related to the individual’s health or the provision of health services to the individual.

Freedom of Information and Protection of Privacy Act [RSBC 1996] CHAPTER 165

Schedule 1: Definitions
In this Act:

“personal information” means recorded information about an identifiable individual other than contact information;

Alberta

Health Information Act

Interpretation
1 in this Act

“health information” means one or both of the following:

(i) Diagnostic, treatment and care information
(ii) Registration information;

“diagnostic, treatment and care information” means information about any of the following:

Freedom of Information and Protection of Privacy Act (FOIP)

Definitions
1 In this Act,

“personal information” means recorded information about an identifiable individual, including

the individual’s personal views or opinions, except if they are about someone else

Saskatchewan

The Health Information Protection Act

Interpretation
2(1) In this Act

“personal health information” means, with respect to an individual, whether living or deceased:

(A) in the course of providing health services to the individual; or
(B) incidentally to the provision of health services to the individual; or

(v) registration information

Manitoba

Personal Health Information Act

Definitions
1(1) In this Act,

“personal health information” means recorded information about an identifiable individual that relates to:

and includes

Freedom of Information and Protection of Privacy Act

“personal information” means recorded information about an identifiable individual, including

Ontario

Personal Health Information Protection Act, 2004, SO 2004, c 3, Sch A

Personal health information
4(1) In this Act,

“personal health information”, subject to subsections (3) and (4), means identifying information about an individual in oral or recorded form, if the information,

Quebec

Bill 3: Access to information by a service provider or by a researcher and amending various legislative provisions

Unless the context indicates otherwise, “information” used without a qualifier in this Act means health and social services information.

New Brunswick

Personal Health Information Privacy and Access Act, SNB 2009, cP-7.05

Definitions
1 The following definitions apply in this Act
“personal health information” means identifying information about an individual in oral or recorded form if the information

Right to Information and Protection of Privacy, SNB 2009, c R-10.6

Definitions
1 The following definitions apply in this Act
“personal information” means recorded information about an identifiable individual, including but not limited to,

Nova Scotia

Personal Health Information Act, SNS 2010, c41

Interpretation
3 in this Act

(r) “personal health information” means identifying information about an individual, whether living or deceased, and in both recorded and unrecorded forms, if the information

4(2) Notwithstanding subsection (1), personal health information does not include identifying information contained in a record that is in the custody or under the control of a custodian if

Freedom of Information and Protection of Privacy Act

Interpretation
3(1) In this act

(i) “personal information” means recorded information about an identifiable individual, including

Prince Edward Island

Health Information Act, RSPEI 1988, c H-1.41

Definitions
1 In this Act
(t) “personal health information” means identifying information about an individual in an oral or recorded form that

Freedom of Information and Protection of Privacy Act, RSPEI 1988, c F-15.01

Definitions
1 In this Act

(a) “personal information” means recorded information about an identifiable individual including

Newfoundland and Labrador

Personal Health Information Act, SNL 2008, c P-7.01

Personal health information
5(1) In this Act, “personal health information” means identifying information in oral or recorded form about an individual that relates to

Access to Information and Protection of Privacy Act, 2015, SNL 2015, c A-1.2

Definitions
2 In this Act

(u) “personal information” means recorded information about an identifiable individual, including

Yukon

Health Information Privacy and Management Act

Definitions
(1) In this Act

“health information” of an individual means identifying information of the individual, in unrecorded or recorded form, that

“personal health information” of an individual means

(a) health information of the individual, and
(b) except as prescribed, prescribed registration information and prescribed provider registry information in respect of the individual;

“personal information” has the same meaning as in the Access to Information and Protection of Privacy Act.

Access to Information and Protection of Privacy Act

Definitions
1 In this Act

“personal information” means, subject to section 3, recorded information about an identifiable individual, including

(i) political or religious beliefs, associations, or activities
(ii) amounts or sources of income, or
(iii) income tax returns

(i) information about

Northwest Territories

Health Information Act, SNWT 2014, c. 2

Definitions
1 In this Act

Access to Information and Protection of Privacy Act

Definitions
2 In this Act

“personal information” means information about an identifiable individual, including

the individual’s personal opinions, except where they are about someone else;

Nunavut

Public Health Act

Definitions
3 In this Act

“personal health information” means health information related to a specific, identified individual or that could identify a specific individual

Access to Information and Protection of Privacy Act

Definitions
2 In this Act,

“personal information” means information about an identifiable individual, including

British Columbia

BC Ministry of Health: “Access to Health Data for Research” Directive Document
(Provides helpful definitions for researchers that are consistent with TCPS):

Alberta

Health Information Act

Interpretation
1 In this Act

107(5) No person to whom non-identifying health information is disclosed and who intends to use the information to perform data matching shall fail to comply with section 32(2).

Regulations
108(1) The Lieutenant Governor in Council may make regulations

(q) respecting the stripping, encoding or other transformation of individually identifying health information to create non-identifying health information pursuant to section 65;

Saskatchewan

The Health Information Protection Act

Application of Act
3(2) This Act does not apply to:

Collection, use and disclosure on need-to-know basis
23(4) A trustee must, where practicable, use or disclose only de-identified personal health information if it will serve the purpose

Restrictions on Use
26(2) A trustee may use personal health information:

(b) for the purposes of de-identifying the personal health information

the research purposes cannot be reasonably accomplished using de-identified personal health information or other information;

Manitoba

Personal Health Information Act

Disclosure without individual’s consent
22(2) A trustee may disclose personal health information without the consent of the individual the information is about if the disclosure is:

(g.3) to another trustee for the purpose of de-identifying the personal health information

Conditions for approval
24(3) An approval may be given under this section only if the committee has determined that

Protecting individual privacy
24.1(3) A prescribed health research organization must

Ontario

Personal Health Information Protection Act, 2004, SO 2004, c 3, Sch A

Definitions
2 In this Act

11.2(2) The limitation in subsection (1) does not prevent any of the following from using information that they de-identified, either alone or with other information, to identify an individual:

A health information custodian.
A prescribed entity mentioned in subsection 45 (1).
A prescribed person who compiles or maintains a registry of personal health information.