The Personal Health Information Act (PHIA) is a health sector-specific access and privacy law that regulates how custodians provide access to personal health information and the manner in which custodians collect, use, disclose, and protect personal health information. Individuals can also ask for correction of their personal health information where the information is factually incorrect.
Am I a Custodian?
PHIA defines a custodian as a person who has custody or control of personal health information as a result of or in connection with the performance of their powers, duties, or work. “Personal health information” means identifying information in oral or recorded form that relates to the provision of health care. PHIA gives “health care” a broad definition and means any observation, examination, assessment, care, service, or procedure in relation to an individual that someone carries out, provides, or undertakes for a health-related purpose.
Examples of custodians include:
- NL Health Services;
- WorkplaceNL;
- regulated health professionals in private practice, such as doctors, dentists, pharmacists, physiotherapists, massage therapists, optometrists, occupational therapists, opticians, and psychologists;
- health care providers, other than health care professionals, who receive payment to provide health care services, such as medical radiation technologists, medical laboratory technologists, audiologists, speech-language pathologists, chiropodists, and respiratory therapists;
- those who operate a health care facility, a pharmacy, an ambulance service, or a centre or program for community or mental health; and
- Faculty of Medicine and the Schools of Nursing, Pharmacy, and Human Kinetics and Recreation at Memorial University.
PHIA provides that the following are not custodians:
- an employee of a custodian when acting in the course of their employment;
- a body responsible for disciplining health professionals;
- all court levels in the province; and
- an officer of the House of Assembly.
Access
PHIA gives individuals the right to access their personal health information in custodians’ custody or control, and the right to request a correction of their personal health information where the recorded information is factually inaccurate or incomplete. If an individual makes such a request and is not satisfied with a custodian’s response to a request for access or correction, they may file a complaint with our Office.
Privacy
PHIA also requires custodians to take reasonable security measures to protect the personal health information in its custody or control. If an individual believes on reasonable grounds that a custodian has or is about to improperly collect, use, or disclose their or someone else’s personal health information, they may file a complaint with our Office.