The following electronic version is for informational purposes only.
The printed version remains the official version.
Certified correct as passed Third Reading on the 29th day of May, 2008
Ian D. Izard, Q.C., Law Clerk
HONOURABLE GEORGE ABBOTT
MINISTER OF HEALTH
HER MAJESTY, by and with the advice and consent of the Legislative Assembly of the Province of British Columbia, enacts as follows:
Part 1 — Definitions and Interpretation
1 In this Act:
"administrator" means
(a) in the case of a health information bank in the custody or under the control of the ministry of the minister, or a ministry database, the chief data steward, and
(b) in the case of a health information bank in the custody or under the control of a health care body other than the ministry of the minister, a person authorized to administer the health information bank under section 3 [establishment or designation of health information banks];
"chief data steward" means a person employed in the ministry of the minister who is designated by the minister as the chief data steward for the purposes of this Act;
"commissioner" means the commissioner under the Freedom of Information and Protection of Privacy Act;
"data stewardship committee" means the data stewardship committee established under section 12 [appointment of data stewardship committee];
"designation order" means an order establishing or designating a health information bank under section 3;
"disclosure directive" means a written instruction under section 9 [making and revoking disclosure directives];
"employee", in relation to a health care body, includes a volunteer and a person retained under a contract to perform services;
"health care body" means
(a) the ministry of the minister,
(b) a health care body as defined in the Freedom of Information and Protection of Privacy Act,
(c) the Provincial Health Services Authority, and
(d) a society that reports to the Provincial Health Services Authority;
"health information bank" means a health information bank established or designated under section 3;
"health research purpose" means the purpose described in section 4 (h) [collection and use of personal health information];
"ministry database" means a database that is
(a) in the custody or control of the ministry of the minister, and
(b) prescribed for the purposes of this Act;
"person" includes a health care body;
"personal health information" means recorded information about an identifiable individual that is related to the individual's health or the provision of health services to the individual;
"planning or research purpose" means any purpose described in section 4 (g) or (h);
"regional health board" means a regional health board designated under section 4 of the Health Authorities Act;
"through", in relation to the collection or disclosure of personal health information through a health information bank, includes collection and disclosure of personal health information both into and from a health information bank.
2 (1) If a provision of this Act refers to a provision of the Freedom of Information and Protection of Privacy Act, a reference in that Act to
(a) a "public body" is to be read for the purposes of this Act as a reference to a health care body, and
(b) the "head of a public body" is to be read for the purposes of this Act as a reference to the head of a health care body.
(2) For the purposes of
(a) Division 2 [Disclosure Directives] of Part 2, and
(b) section 17 [one's own personal health information to be available], in relation to a person's own personal health information,
a reference to a person includes a person having authority under the common law or an enactment to make personal and health care decisions in respect of the person.
Part 2 — Administration of Health Information Banks
Division 1 — Establishment or Designation of Health Information Banks
3 (1) Subject to the regulations, the minister may by order establish or designate a database containing personal health information as a health information bank, if
(a) the database is in the custody or under the control of a health care body, and
(b) the collection and use of personal health information through the database is for a purpose set out in section 4 [collection and use of personal health information].
(2) A designation order must do all of the following:
(a) identify the type or nature of personal health information to be contained in the health information bank, and the source of the personal health information;
(b) in the case of a health information bank in the custody or under the control of a health care body other than the ministry of the minister, authorize one individual who is an employee of the health care body to administer the health information bank;
(c) identify the purposes, as set out in section 4, for which personal health information may be collected and used through the health information bank;
(d) identify the purposes, if any, as set out in section 5 [disclosure of personal health information], for which personal health information may be disclosed from the health information bank;
(e) authorize one or more persons to collect, use or disclose personal health information through the health information bank;
(f) identify from whom personal health information may be collected into the health information bank, including identifying whether personal health information may be collected other than directly from the individual whom the personal health information is about;
(g) except in the case of disclosure for a planning or research purpose, identify to whom personal health information contained in the health information bank may be disclosed;
(h) identify the limits or conditions, if any, on the collection, storage, use or disclosure of personal health information contained in or disclosed from a health information bank.
(3) A designation order may describe a person by name, title, position or class.
(4) A designation order is not effective until notice of the designation order is published in the Gazette.
(5) If a health information bank is established or designated by a designation order, personal health information may be collected, used and, subject to sections 14 [disclosure for planning or research purposes] and 19 [information-sharing agreements required for disclosure], disclosed through the health information bank by a person who is authorized to do so by the designation order, according to the terms of the designation order.
4 A designation order may authorize the collection and use of personal health information only for one or more of the following purposes:
(a) to identify an individual who needs or is receiving health services;
(b) to provide health services to, or facilitate the care of, an individual;
(c) to identify a person who is providing health services;
(d) to prevent or manage chronic conditions, at the individual or population level;
(e) to facilitate health insurance and health service billing, including for the purposes of
(i) a payment in respect of health services or prescribed drugs, devices or pharmaceutical services to be made to or by the government of British Columbia or a public body,
(ii) authorizing, administering, processing, verifying or cancelling such a payment,
(iii) resolving an issue regarding such a payment, or
(iv) audits by a federal or Provincial government payment agency that makes reimbursement for the cost of health services or prescribed drugs, devices or pharmaceutical services;
(f) to assess and address public health needs;
(g) to engage in health services planning, maintenance or improvement, including
(i) health service development, management, delivery, monitoring and evaluation,
(ii) compiling statistical information, and
(iii) public health surveillance;
(h) to conduct or facilitate research into health issues;
(i) to assess and address threats to public health.
5 A designation order may authorize the disclosure of personal health information only for one or more of the following purposes:
(a) if disclosure is inside Canada, a purpose set out in section 4 (a) to (f) [collection and use of personal health information];
(b) a planning or research purpose;
(c) if disclosure is inside or outside Canada, a purpose set out in section 4 (i).
6 (1) A person authorized under a designation order to collect personal health information into a health information bank may request a health care body or a prescribed person to provide information or records that contain personal health information and that are in the custody or under the control of the health care body or prescribed person if
(a) the information or records being requested have a reasonable and direct connection to the purpose for which collection is authorized under the designation order, and
(b) the person making the request is acting in accordance with the terms of the designation order.
(2) Subject to any other enactment that prohibits disclosure, a health care body or a prescribed person to whom a request is made under subsection (1) must comply with the request in the manner and at the times requested if the information or records are in the custody or under the control of the health care body or prescribed person.
7 (1) In this section, "request for information" means a request for information or records made under section 6 [requests for information by authorized persons].
(2) A person who receives a request for information may make a complaint to the commissioner, and the commissioner may investigate and attempt to resolve the complaint.
(3) Section 6 (2) is suspended, in respect of the request for information that is the subject of the complaint, during the period of the commissioner's investigation, if any.
(4) Sections 44 to 48 and 49 (1) and (2) of the Freedom of Information and Protection of Privacy Act apply to an investigation under subsection (2) of this section, and, for these purposes, a reference in those sections to an investigation, inquiry or audit under that Act is to be read as a reference to an investigation under this section.
(5) If an investigation is made under this section, the commissioner must, after the investigation, do one of the following by order:
(a) if the commissioner determines that the person making the request for information is acting within that person's authority under a designation order, either
(i) require the person making the complaint to provide the information or records in accordance with the request for information, or
(ii) require the person making the request for information to reconsider the request;
(b) if the commissioner determines that the person making the request for information is not acting within that person's authority under a designation order, require the person to withdraw the request and, if applicable, destroy personal health information collected outside the person's authority.
(6) If an order is made under subsection (5),
(a) the commissioner may specify terms or conditions in the order, and
(b) the persons affected by the order must comply within 30 days of its issuance.
(7) If an investigation is not made under this section, section 6 (2) applies.
Division 2 — Disclosure Directives
8 (1) Subject to subsection (3), the minister must in a designation order authorize a person whose personal health information is contained in the health information bank that is the subject of the designation order to make a disclosure directive.
(2) An authorization under subsection (1) may limit the making of disclosure directives to
(a) one or more types of personal health information, as identified in the designation order under section 3 (2) (a) [establishment or designation of health information banks], contained in the health information bank,
(b) one or more purposes, as identified in the designation order under section 3 (2) (d), for which personal health information may be disclosed from the health information bank, and
(c) one or more persons or classes of persons, as identified in the designation order under section 3 (2) (g).
(3) Subsection (1) does not apply in respect of a health information bank if the data stewardship committee recommends to the minister that disclosure directives should not be made in respect of the health information bank.
9 (1) If in a designation order the minister authorizes the making of disclosure directives, a person may, subject to the regulations,
(a) make a disclosure directive as authorized by the designation order, and
(b) revoke a disclosure directive the person has made.
(2) A person who makes or revokes a disclosure directive must
(a) make the disclosure directive or revocation in writing,
(b) comply with any prescribed conditions respecting the making or revoking of disclosure directives, and
(c) forward to a prescribed person the disclosure directive or revocation and, if applicable, the prescribed records.
(3) Until the contrary is demonstrated, every person is presumed to be capable of understanding the nature of a disclosure directive and the consequences of making or revoking a disclosure directive.
(4) A disclosure directive takes effect when activated in the health information bank to which it relates.
10 (1) A person who is otherwise permitted to collect, use or disclose personal health information from a health information bank must not do so in any manner that is inconsistent with a disclosure directive except as follows:
(a) to notify a person that a disclosure directive applies to personal health information that would otherwise be available to the person;
(b) for a purpose described in section 33.1 (1) (c) of the Freedom of Information and Protection of Privacy Act;
(c) with the express consent of the person who made the disclosure directive;
(d) if section 12 [exception — urgent or emergency health care] of the Health Care (Consent) and Care Facility (Admission) Act applies and a health care provider acting under that section reasonably believes that the personal health information may be required to provide health care in accordance with that section.
(2) For the purposes of subsection (1) (d), a reference in section 12 of the Health Care (Consent) and Care Facility (Admission) Act to an "adult" is to be read for the purposes of this section as a reference to a person having a disclosure directive.
Division 3 — Data Stewardship Committee
11 (1) The data stewardship committee is solely responsible for managing the disclosure, for a planning or research purpose, of information contained in a health information bank or a ministry database.
(2) In addition to the data stewardship committee's role under subsection (1), the data stewardship committee may make recommendations to the minister for the purposes of section 8 (3).
12 (1) The minister must appoint a data stewardship committee consisting of not more than 12 persons.
(2) The committee appointed under subsection (1) must include at least
(a) one person from within the ministry of the minister,
(b) one person chosen as representative of either regional health boards or the Provincial Health Services Authority,
(c) one person nominated by the council of the College of Physicians and Surgeons of British Columbia,
(d) one person nominated by the council of the College of Pharmacists of British Columbia,
(e) one person nominated by the board of the college established under section 15 (1) of the Health Professions Act for the health profession of the practice of nursing,
(f) one person engaged in health research, and
(g) 3 persons chosen as representative of the general public.
(3) The minister may designate a chair and one or more vice chairs of the data stewardship committee from among the persons appointed to that committee.
(4) Members of the data stewardship committee may be paid
(a) remuneration set by the minister, and
(b) reasonable and necessary travel and out of pocket expenses incurred in carrying out the work of the data stewardship committee.
13 (1) Subject to this Act, the data stewardship committee may make rules governing the following:
(a) the calling and conduct of its meetings;
(b) the establishment of panels of the data stewardship committee to conduct business of that committee;
(c) the practices and procedures of the panels established under paragraph (b);
(d) the quorum of the data stewardship committee or of the panels established under paragraph (b);
(e) other matters respecting the conduct of the work of the data stewardship committee or of the panels established under paragraph (b), including the fees that may be charged by a health care body for information to defray the cost to the health care body to provide the information.
(2) The data stewardship committee must establish policies and procedures respecting the disclosure of information under this Division.
(3) A member of the data stewardship committee must take reasonable steps, in accordance with the regulations, to avoid or manage a conflict of interest.
14 (1) A person who requires information for a planning or research purpose may request information from a health information bank or ministry database only by submitting to the data stewardship committee
(a) a request in the form and in the manner required by the data stewardship committee, and
(b) information required by the data stewardship committee for the purposes of evaluating the request.
(2) The data stewardship committee may approve the request if all of the following apply:
(a) the request is for a planning or research purpose;
(b) in the case of information from a health information bank, the disclosure is authorized under the terms of the designation order;
(c) in the case of personal health information requested for a health research purpose, the requirements of section 15 [disclosure for health research purposes] have been met;
(d) in the case of a request to disclose personal health information outside Canada, there is express consent, in writing, to the disclosure from each person who is the subject of the personal health information.
(3) If the data stewardship committee approves the request, the administrator may, subject to any conditions set by the data stewardship committee on approving the request, disclose the information to the person who made the request.
(4) An administrator must not disclose information under subsection (3) except under an information-sharing agreement
(a) with the person who made the request, and
(b) made, whether or not personal health information is disclosed, in accordance with section 19 (2) and (3) [information-sharing agreements required for disclosure].
15 If a request for personal health information under section 14 [disclosure for planning or research purposes] is made for a health research purpose, the data stewardship committee may approve the request only if all of the following criteria are met:
(a) the health research purpose cannot reasonably be accomplished unless personal health information is disclosed;
(b) personal health information is disclosed on condition that it not be used for the purpose of contacting a person to participate in the health research, unless the commissioner approves
(i) the health research purpose,
(ii) the use of disclosed personal health information for the purpose of contacting a person to participate in the health research, and
(iii) the manner in which contact is to be made, including the information to be made available to persons contacted;
(c) any record linkage is not harmful to the individuals who are the subjects of the personal health information and the benefits to be derived from the record linkage are clearly in the public interest;
(d) the data stewardship committee has imposed conditions relating to
(i) security and confidentiality,
(ii) the removal or destruction of individual identifiers at the earliest reasonable time, and
(iii) the prohibition of any subsequent use or disclosure of personal health information without the express authorization of the data stewardship committee.
16 (1) At least once each year, the data stewardship committee must report to the minister respecting
(a) the activities of the data stewardship committee,
(b) information-sharing agreements entered into by an administrator under this Division, and
(c) any matter the minister requires.
(2) After making a report under subsection (1), the data stewardship committee must promptly publish the report.
Division 4 — Other Matters Relating to Disclosure
17 (1) Subject to this Act and the regulations made under it, an administrator must make available, without request, to a person
(a) that person's personal health information contained in the health information bank for which the administrator is responsible,
(b) a record of any disclosure directives made by the person that apply to the health information bank, and
(c) information respecting who has collected, used or disclosed that person's personal health information.
(2) An administrator may delete from the information that would otherwise be available, or from a record made available, under this section any information he or she would be entitled to refuse to disclose under the Freedom of Information and Protection of Privacy Act.
(3) Section 19 [information-sharing agreements] does not apply to disclosure of personal health information under this section.
18 (1) An administrator may disclose personal health information inside Canada from a health information bank for one or more of the following purposes:
(a) a purpose described in section 33.2 (b) or (f) of the Freedom of Information and Protection of Privacy Act;
(b) to investigate or discipline a person regulated by a governing body of a health profession that has authority, under an enactment, to investigate or discipline the person;
(c) to monitor, by a governing body of a health profession, the practice of a health profession that is, under an enactment, regulated by that body;
(d) a purpose for which the person who is the subject of the personal health information has expressly consented.
(2) An administrator may disclose personal health information inside or outside Canada from a health information bank for one or more of the following purposes:
(a) a purpose described in section 33.1 (1) (a), (c), (e), (e.1), (g), (m), (n) or (p) of the Freedom of Information and Protection of Privacy Act, or
(b) a purpose for which the person who is the subject of the personal health information has expressly consented in writing.
(3) Section 19 [information-sharing agreements] does not apply to disclosure of personal health information under this section.
19 (1) Personal health information contained in a health information bank may be disclosed only if
(a) disclosure is authorized by the terms of the designation order that relates to the health information bank,
(b) the administrator of the health information bank enters into an information-sharing agreement under this section, and
(c) if personal health information is to be disclosed on a bulk or regular basis, it is disclosed only to one or more of the following persons:
(i) an agency or ministry of the government of British Columbia, of another province or of Canada, including a Crown corporation;
(ii) a health care body;
(iii) an aboriginal government, an educational body or a social services body, as those terms are defined in the Freedom of Information and Protection of Privacy Act;
(iv) a public body in another jurisdiction of Canada that is equivalent to one described in subparagraphs (ii) and (iii);
(v) a health service provider;
(vi) a body responsible for the regulation of health professionals;
(vii) an association of health professionals;
(viii) a prescribed body that is public in nature.
(2) An information-sharing agreement must identify all of the following:
(a) the persons, by name, title, position or class, who may collect, use or disclose information under the agreement;
(b) the circumstances in which information may be disclosed under the agreement;
(c) the limits, if any, on
(i) the disclosure of information by the administrator under the agreement, and
(ii) the use or disclosure of the information obtained under the agreement by persons identified under paragraph (a);
(d) the conditions, if any, on the disclosure of information under the agreement, including conditions respecting
(i) security and confidentiality,
(ii) the removal or destruction of individual identifiers at the earliest reasonable time,
(iii) the prohibition of any subsequent use or disclosure of personal health information without express authorization, and
(iv) the monitoring of compliance with the agreement;
(e) the term of the agreement and the circumstances in which the agreement may be renewed, suspended or terminated.
(3) An information-sharing agreement must include a requirement that
(a) if
(i) personal health information, or
(ii) any information related to a health service provider
is disclosed under the agreement, the personal health information or information will not be used or disclosed for the purpose of market research,
(b) if disclosure is for a planning or research purpose, the person to whom information is disclosed must comply with the data stewardship committee's policies and procedures established under section 13 (2) [data stewardship committee], and
(c) if disclosure is for a health research purpose, the person to whom personal health information is disclosed must comply with the conditions imposed under section 15 (d) [disclosure for health research purposes].
20 Despite this Act or the terms of a designation order, or section 35 of the Freedom of Information and Protection of Privacy Act, a person must not disclose
(a) personal health information, or
(b) information related to health service providers
contained in a health information bank or ministry database for the purpose of market research.
21 (1) Personal health information must not be collected into a health information bank or used in a health information bank for any purpose or in any manner other than in accordance with the designation order in respect of the health information bank.
(2) Personal health information contained in a health information bank must not be disclosed for any purpose or in any manner other than
(a) in accordance with the designation order in respect of the health information bank, or
(b) as permitted under this Act.
22 A person must not dismiss, suspend, demote, discipline, harass or otherwise disadvantage another person, or deny another person a benefit, because
(a) the other person, acting in good faith and on the basis of reasonable belief, has notified the minister, an administrator or the commissioner
(i) that a person has contravened or is about to contravene this Act, or
(ii) that a person has collected, used or disclosed, or is about to collect, use or disclose, personal health information in a manner that contravenes the terms or conditions of a designation order,
(b) the other person, acting in good faith and on the basis of reasonable belief, has done or stated an intention of doing anything that is required to be done in order to avoid having any person contravene this Act,
(c) the other person, acting in good faith and on the basis of reasonable belief, has refused to do or stated an intention of refusing to do anything that is in contravention of this Act, or
(d) the person believes that the other person will do anything described in any of paragraphs (a) to (c).
23 (1) Despite section 3 [establishment or designation of health information banks], the minister may by order designate a database that contains personal information of health service providers as a health information bank.
(2) This Act applies to a database designated under subsection (1) as if the database contained personal health information, and a reference in this Act to "personal health information" must be read as a reference to the personal information of health service providers.
24 (1) A person who contravenes any of the following sections commits an offence and is liable to a fine of up to $200 000:
(a) section 10 [effect of disclosure directives];
(b) section 20 [no disclosure for market research purposes];
(c) section 21 [protection of privacy];
(d) section 22 [whistle-blower protection].
(2) If a corporation commits an offence under this section, an officer, director or agent of the corporation who authorizes, permits or acquiesces in the commission of the offence also commits an offence, whether or not the corporation is prosecuted for the offence.
(3) In a prosecution for an offence under this section, it is a defence for the person charged to prove that the person exercised due diligence to avoid the commission of the offence.
25 Section 5 [general offence] of the Offence Act does not apply in respect of this Act or the regulations made under it.
26 (1) The Lieutenant Governor in Council may make regulations referred to in section 41 of the Interpretation Act.
(2) Without limiting subsection (1), the Lieutenant Governor in Council may make regulations as follows:
(a) defining "health services" and "health service provider" for the purposes of this Act;
(b) prescribing databases, by name or by class, that must not be designated as a health information bank under section 3 [establishment or designation of health information banks];
(c) limiting or prohibiting classes of persons from making disclosure directives;
(d) respecting
(i) the manner in which a disclosure directive must be made,
(ii) conditions that apply to the making or revocation of a disclosure directive,
(iii) to whom a disclosure directive must be provided, and
(iv) records that must accompany a disclosure directive;
(e) respecting conflicts of interest in relation to members of the data stewardship committee, including defining conflicts of interest and providing rules for the management of conflicts of interest;
(f) for the purposes of section 17 [one's own personal health information to be available], including
(i) respecting the information that may, or must not, be made available,
(ii) respecting how personal health information is to be made available, including putting conditions on direct access to personal health information,
(iii) respecting information that must be removed from a record before the record is made available, and
(iv) respecting fees that may be charged by administrators for making available the information referred to in subsection (1) (c) of that section;
(g) defining "bulk or regular" for the purposes of section 19 [information-sharing agreements required for disclosure];
(h) for any other matter for which regulations are contemplated by this Act.
(3) A power to make a regulation under this Act in respect of a person includes a power to
(a) establish classes of persons, and
(b) make regulations that are different for different classes of persons.
27 Section 12 (2) (c) of the E-Health (Personal Health Information Access and Protection of Privacy) Act is repealed and the following substituted:
(c) one person nominated by the board of the college established under section 15 (1) of the Health Professions Act for the health profession of the practice of medicine, .
28 Section 12 (2) (d) is repealed and the following substituted:
(d) one person nominated by the board of the college established under section 15 (1) of the Health Professions Act for the health profession of the practice of pharmacy, .
Adult Guardianship and Planning Statutes Amendment Act, 2007
29 Sections 102 and 103 of the Adult Guardianship and Planning Statutes Amendment Act, 2007, S.B.C. 2007, c. 34, are repealed.
Freedom of Information and Protection of Privacy Act
30 Section 35 of the Freedom of Information and Protection of Privacy Act, R.S.B.C. 1996, c. 165, is amended
(a) by renumbering the section as section 35 (1),
(b) by repealing subsection (1) (a.1) and substituting the following:
(a.1) subject to subsection (2), the information is disclosed on condition that it not be used for the purpose of contacting a person to participate in the research, , and
(c) by adding the following subsection:
(2) Subsection (1) (a.1) does not apply in respect of research in relation to health issues if the commissioner approves
(a) the research purpose,
(b) the use of disclosed information for the purpose of contacting a person to participate in the research, and
(c) the manner in which contact is to be made, including the information to be made available to persons contacted.
31 Section 69.1 is amended
(a) in subsection (1) in the definition of "health care body" by striking out "section 10.1 of the Health Act;" and substituting "section 1 of the E-Health (Personal Health Information Access and Protection of Privacy) Act;",
(b) in subsection (1) by repealing the definitions of "health information bank" and "health information-sharing agreement" and substituting the following:
"health information bank" means a health information bank and a ministry database within the meaning of the E-Health (Personal Health Information Access and Protection of Privacy) Act;
"health information-sharing agreement" means an agreement under section 14 or 19 of the E-Health (Personal Health Information Access and Protection of Privacy) Act; , and
(c) in subsection (3) (a) by striking out "section 10.2 (designation or establishment of health information banks) of the Health Act" and substituting "section 3 (establishment or designation of health information banks) of the E-Health (Personal Health Information Access and Protection of Privacy) Act".
32 Schedule 2 is amended by adding the following:
| Public Body: | Data Stewardship Committee |
| Head: | Chair . |
Health Act
33 Sections 10.1 to 10.7 of the Health Act, R.S.B.C. 1996, c. 179, are repealed.
Health Statutes Amendment Act, 2007
34 Section 21 (b) of the Health Statutes Amendment Act, 2007, S.B.C. 2007, c. 19, is repealed and the following substituted:
(b) by adding the following definitions:
"personal health information" means recorded information about an identifiable individual that is related to the individual's health or the provision of health services to the individual;
"personal representative" means a person having authority under the common law or an enactment to make personal and health care decisions in respect of another person; .
35 Section 23 is repealed and the following substituted:
23 Section 36 is repealed and the following substituted:
36 (1) A person must not record personal health information in PharmaNet except in accordance with this Act.
(2) Despite the Personal Information Protection Act, a person who obtains information, files or records under this Act must not use them, or disclose them to any other person, except
(a) as permitted under this Act, or
(b) for the purposes of
(i) court proceedings, or
(ii) enabling the college, or a person or committee acting for the college, to carry out their powers, duties or functions under this Act or the bylaws.
(3) Subsection (2) does not apply to a person in respect of his or her own personal health information, or to the person's personal representative when acting in the course of his or her duties.
36 Sections 26 (b), 27 (a), 34 (b) and 35 (b) are repealed.
37 Section 29 (b) is repealed and the following substituted:
(b) by adding the following definitions:
"personal health information" means recorded information about an identifiable individual that is related to the individual's health or the provision of health services to the individual;
"personal representative" means a person having authority under the common law or an enactment to make personal and health care decisions in respect of another person; .
38 Section 30 is repealed and the following substituted:
30 Section 12 is repealed and the following substituted:
12 (1) A person must not record personal health information in PharmaNet except in accordance with this Act.
(2) Despite the Personal Information Protection Act, a person who obtains information, files or records under this Act must not use them, or disclose them to any other person, except
(a) as permitted under this Act, or
(b) for the purposes of
(i) court proceedings, or
(ii) enabling the college, or a person or committee acting for the college, to carry out their powers, duties or functions under this Act or the bylaws.
(3) Subsection (2) does not apply to a person in respect of his or her own personal health information, or to the person's personal representative when acting in the course of his or her duties.
Pharmacists, Pharmacy Operations and Drug Scheduling Act
39 Section 38.1 of the Pharmacists, Pharmacy Operations and Drug Scheduling Act, R.S.B.C. 1996, c. 363, is amended
(a) in subsection (1) by striking out "any applicable regulation under subsection (2) (c)," and substituting "the regulations,",
(b) by adding the following subsection:
(1.1) Subject to this Act and the regulations, a person, or the person's personal representative, may have access to
(a) that person's personal health information on PharmaNet,
(b) a record of any disclosure directives made by the person that apply to PharmaNet, and
(c) information respecting who has collected, used or disclosed that person's personal health information through PharmaNet. ,
(c) in subsection (2) by striking out "In relation to access referred to in subsection (1), the Lieutenant Governor in Council may make regulations" and substituting "In relation to access referred to in subsections (1) and (1.1), the Lieutenant Governor in Council may make regulations as follows:",
(d) in subsection (2) by striking out ", and" at the end of paragraph (b),
(e) in subsection (2) by adding the following paragraph:
(d) respecting fees that may be charged for access to the information referred to in subsection (1.1) (c). , and
(f) by adding the following subsection:
(3) Without limiting a regulation made under subsection (2) (c), an employee in the ministry of the minister designated by the minister for this purpose may delete from the information that would otherwise be available, or a record made available, under subsection (1.1) any information he or she would be entitled to refuse to disclose under the Freedom of Information and Protection of Privacy Act.
40 Section 39 is amended
(a) by adding the following subsection:
(5.1) Despite subsection (5), the PharmaNet committee may disclose the names and addresses of patients and practitioners if the commissioner under the Freedom of Information and Protection of Privacy Act approves
(a) the research purpose,
(b) the use of disclosed information for the purpose of contacting a patient or practitioner to participate in the research, and
(c) the manner in which contact is to be made, including the information to be made available to persons contacted. , and
(b) by repealing subsection (6) and substituting the following:
(6) Except as provided in the bylaws,
(a) the PharmaNet committee, or
(b) a person who may access, under section 38.1, personal health information
must not disclose personal health information or any information related to a practitioner for the purposes of market research.
41 The following Part is added:
Part 4.1 — Disclosure Directives
39.2 (1) In this Part, "disclosure directive" means a written instruction under section 39.3 [making and revoking disclosure directives].
(2) A reference to a person in this Part in relation to the making or revoking of a disclosure directive includes the person's personal representative when acting in the course of his or her duties.
39.3 (1) Subject to the regulations, a person may
(a) make a disclosure directive as authorized by a regulation, and
(b) revoke a disclosure directive the person has made.
(2) A person who makes or revokes a disclosure directive must
(a) make the disclosure directive or revocation in writing,
(b) comply with any prescribed conditions respecting the making or revoking of disclosure directives, and
(c) forward to a prescribed person the disclosure directive or revocation and, if applicable, the prescribed records.
(3) Until the contrary is demonstrated, every person is presumed to be capable of understanding the nature of a disclosure directive and the consequences of making or revoking a disclosure directive.
(4) A disclosure directive takes effect when activated in the PharmaNet system.
39.4 (1) A person who is otherwise permitted to collect, use or disclose personal health information from PharmaNet must not do so in any manner that is inconsistent with a disclosure directive except as follows:
(a) to notify a person that a disclosure directive applies to personal health information that would otherwise be available to the person;
(b) as required under this Act;
(c) for a purpose described in section 33.1 (1) (c) of the Freedom of Information and Protection of Privacy Act;
(d) with the express consent of the person who made the disclosure directive;
(e) if section 12 [exception — urgent or emergency health care] of the Health Care (Consent) and Care Facility (Admission) Act applies and a health care provider acting under that section reasonably believes that the personal health information may be required to provide health care in accordance with that section.
(2) For the purposes of subsection (1) (e), a reference in section 12 of the Health Care (Consent) and Care Facility (Admission) Act to an "adult" is to be read for the purposes of this section as a reference to a person having a disclosure directive.
39.5 A person must not dismiss, suspend, demote, discipline, harass or otherwise disadvantage another person, or deny another person a benefit, because
(a) the other person, acting in good faith and on the basis of reasonable belief, has notified the minister or the commissioner under the Freedom of Information and Protection of Privacy Act that a person has disclosed, or is about to disclose, personal health information in a manner that is inconsistent with a disclosure directive,
(b) the other person, acting in good faith and on the basis of reasonable belief, has done or stated an intention of doing anything that is required to be done in order to avoid having any person contravene section 39.4,
(c) the other person, acting in good faith and on the basis of reasonable belief, has refused to do or stated an intention of refusing to do anything that is in contravention of section 39.4, or
(d) the person believes that the other person will do anything described in any of paragraphs (a) to (c).
39.6 (1) The Lieutenant Governor in Council may make regulations as follows:
(a) limiting or prohibiting classes of persons from making disclosure directives;
(b) limiting the making of disclosure directives to
(i) one or more types of personal health information contained in the PharmaNet system,
(ii) one or more purposes for which personal health information may be disclosed from the PharmaNet system, and
(iii) one or more persons or classes of persons to whom personal health information from the PharmaNet system may be disclosed;
(c) respecting
(i) the manner in which a disclosure directive must be made,
(ii) conditions that apply to the making or revocation of a disclosure directive,
(iii) to whom a disclosure directive must be provided, and
(iv) records that must accompany a disclosure directive.
(2) A power to make a regulation under this Act in respect of a person includes a power to
(a) establish classes of persons, and
(b) make regulations that are different for different classes of persons.
42 Section 78 is amended
(a) in subsection (2) by striking out "39 (1), (6) or (7)," and substituting "39 (1) or (7),",
(b) in subsection (3) by adding "other than section 39 (6), 39.4 or 39.5," after "If a person contravenes this Act,", and
(c) by adding the following subsections:
(6) A person who contravenes section 39 (6), 39.4 or 39.5 commits an offence and is liable to a fine of up to $200 000.
(7) In a prosecution for an offence under this section, it is a defence for the person charged to prove that the person exercised due diligence to avoid the commission of the offence.
Pharmacy Operations and Drug Scheduling Act
43 Section 15 of the Pharmacy Operations and Drug Scheduling Act, S.B.C. 2003, c. 77, is amended
(a) in subsection (1) by striking out "any applicable regulation under subsection (2) (h)," and substituting "the regulations,",
(b) by adding the following subsection:
(1.1) Subject to this Act and the regulations, a person, or the person's personal representative, may have access to
(a) that person's personal health information on PharmaNet,
(b) a record of any disclosure directives made by the person that apply to PharmaNet, and
(c) information respecting who has collected, used or disclosed that person's personal health information through PharmaNet. ,
(c) in subsection (2) by striking out "In relation to access referred to in subsection (1), the Lieutenant Governor in Council may make regulations" and substituting "In relation to access referred to in subsections (1) and (1.1), the Lieutenant Governor in Council may make regulations as follows:",
(d) in subsection (2) by striking out ", or" at the end of paragraph (g) (iv),
(e) in subsection (2) by adding the following paragraph:
(i) respecting fees that may be charged for access to the information referred to in subsection (1.1) (c). , and
(f) by adding the following subsection:
(7) Without limiting a regulation made under subsection (2) (c), an employee in the ministry of the minister designated by the minister for this purpose may delete from the information that would otherwise be available, or from a record made available, under subsection (1.1) any information he or she would be entitled to refuse to disclose under the Freedom of Information and Protection of Privacy Act.
44 Section 16 is amended
(a) by adding the following subsection:
(2.1) Despite subsection (2), the PharmaNet stewardship committee may disclose patient or practitioner names or addresses or other information that could allow a patient or practitioner to be identified or contacted if the commissioner under the Freedom of Information and Protection of Privacy Act approves
(a) the research purpose,
(b) the use of disclosed information for the purpose of contacting a patient or practitioner to participate in the research, and
(c) the manner in which contact is to be made, including the information to be made available to persons contacted. , and
(b) by repealing subsection (3) and substituting the following:
(3) Despite other provisions of this Act or section 35 of the Freedom of Information and Protection of Privacy Act,
(a) the PharmaNet stewardship committee, or
(b) a person who may access, under section 15, personal health information on PharmaNet,
must not disclose personal health information or any information related to a practitioner for the purpose of market research.
45 The following Part is added:
Part 2.1 — Disclosure Directives
16.2 (1) In this Part, "disclosure directive" means a written instruction under section 16.3 [making and revoking disclosure directives].
(2) A reference to a person in this Part in relation to the making or revoking of a disclosure directive includes the person's personal representative when acting in the course of his or her duties.
16.3 (1) Subject to the regulations, a person may
(a) make a disclosure directive as authorized by a regulation, and
(b) revoke a disclosure directive the person has made.
(2) A person who makes or revokes a disclosure directive must
(a) make the disclosure directive or revocation in writing,
(b) comply with any prescribed conditions respecting the making or revoking of disclosure directives, and
(c) forward to a prescribed person the disclosure directive or revocation and, if applicable, the prescribed records.
(3) Until the contrary is demonstrated, every person is presumed to be capable of understanding the nature of a disclosure directive and the consequences of making or revoking a disclosure directive.
(4) A disclosure directive takes effect when activated in the PharmaNet system.
16.4 (1) A person who is otherwise permitted to collect, use or disclose personal health information from PharmaNet under this Act must not do so in any manner that is inconsistent with a disclosure directive except as follows:
(a) to notify a person that a disclosure directive applies to personal health information that would otherwise be available to the person;
(b) as required under this Act;
(c) for a purpose described in section 33.1 (1) (c) of the Freedom of Information and Protection of Privacy Act;
(d) with the express consent of the person who made the disclosure directive;
(e) if section 12 [exception — urgent or emergency health care] of the Health Care (Consent) and Care Facility (Admission) Act applies and a health care provider acting under that section reasonably believes that the personal health information may be required to provide health care in accordance with that section.
(2) For the purposes of subsection (1) (e), a reference in section 12 of the Health Care (Consent) and Care Facility (Admission) Act to an "adult" is to be read for the purposes of this section as a reference to a person having a disclosure directive.
16.5 A person must not dismiss, suspend, demote, discipline, harass or otherwise disadvantage another person, or deny another person a benefit, because
(a) the other person, acting in good faith and on the basis of reasonable belief, has notified the minister or the commissioner under the Freedom of Information and Protection of Privacy Act that a person has disclosed, or is about to disclose, personal health information in a manner that is inconsistent with a disclosure directive,
(b) the other person, acting in good faith and on the basis of reasonable belief has done or stated an intention of doing anything that is required to be done in order to avoid having any person contravene section 16.4,
(c) the other person, acting in good faith and on the basis of reasonable belief has refused to do or stated an intention of refusing to do anything that is in contravention of section 16.4, or
(d) the person believes that the other person will do anything described in any of paragraphs (a) to (c).
16.6 (1) The Lieutenant Governor in Council may make regulations as follows:
(a) limiting or prohibiting classes of persons from making disclosure directives;
(b) limiting the making of disclosure directives to
(i) one or more types of personal health information contained in the PharmaNet system,
(ii) one or more purposes for which personal health information may be disclosed from the PharmaNet system, and
(iii) one or more persons or classes of persons to whom personal health information from the PharmaNet system may be disclosed;
(c) respecting
(i) the manner in which a disclosure directive must be made,
(ii) conditions that apply to the making or revocation of a disclosure directive,
(iii) to whom a disclosure directive must be provided, and
(iv) records that must accompany a disclosure directive.
(2) A power to make a regulation under this Act in respect of a person includes a power to
(a) establish classes of persons, and
(b) make regulations that are different for different classes of persons.
46 Section 29 is amended
(a) in subsection (2) by striking out "16 (3) or (4)," and substituting "16 (4),",
(b) in subsection (3) by adding "other than section 16 (3), 16.4 or 16.5," after "If a person contravenes this Act,", and
(c) by adding the following subsections:
(6) A person who contravenes section 16 (3), 16.4 or 16.5 commits an offence and is liable to a fine of up to $200 000.
(7) In a prosecution for an offence under this section, it is a defence for the person charged to prove that the person exercised due diligence to avoid the commission of the offence.
47 The provisions of this Act referred to in column 1 of the following table come into force as set out in column 2 of the table:
| Item | Column 1 Provisions of Act |
Column 2 Commencement |
| 1 | Anything not elsewhere covered by this table | The date of Royal Assent |
| 2 | Sections 1 to 28 | By regulation of the Lieutenant Governor in Council |
| 3 | Sections 30 to 33 | By regulation of the Lieutenant Governor in Council |
| 4 | Sections 39 to 46 | By regulation of the Lieutenant Governor in Council |