Section 88 of the Personal Health Information Act (PHIA) outlines the instances in which a person, custodian, or information manager may be subject to charges of an offence and the penalties for such occurrences. Generally, where the Commissioner believes there are reasonable grounds for a criminal prosecution based on the particular facts of each case, the Commissioner will lay a charge or charges against the person, custodian, or information manager. The Provincial Court of Newfoundland and Labrador will hear the proceedings at the court house located closest to where the incident occurred. To be successful, the evidence must establish the elements of the offence beyond a reasonable doubt.
In relation to a person, which includes not only an individual but also a board, commission, tribunal, partnership, association, organization, or other entity, an offence occurs where the person:
- who is not entitled to access the information, intentionally obtains or attempts to obtain the personal health information of another individual;
- intentionally makes a false statement to, or misleads or attempts to mislead, the Commissioner or another person performing duties or exercising powers under PHIA;
- intentionally obstructs the Commissioner or another person performing duties or exercising powers under PHIA; or
- intentionally destroys or erases personal health information with the intent to evade a request for access to the information.
In relation to a custodian or information manager, an offence occurs where the custodian or information manager:
- collects, uses, or discloses personal health information in a manner that is contrary to the provisions of PHIA;
- fails to protect personal health information in a secure manner as PHIA requires; or
- discloses personal health information in a manner that is contrary to the provisions of PHIA with the intent to obtain a monetary or other material benefit for themselves or another person.
However, if a custodian or information manager can establish that it took all reasonable steps to prevent a contravention of PHIA, then no offence will have occurred.
If the Court is satisfied beyond a reasonable doubt that the prosecution has established any of the offences, the Court will find the person guilty of a criminal offence. Sentencing can include a fine up to $10,000, imprisonment for up to six months, or both.