Information and Privacy

Who is subject to the Right to Information and Protection of Privacy Act?

All New Brunswick public bodies are subject to the Right to Information and Protection of Privacy Act. New Brunswick public bodies include:

• Provincial departments, secretariats and offices, including Crown corporations and commissions;
• Horizon Health Network, Vitalité Health Network, EM/ANB Inc. (formerly Ambulance New Brunswick), the New Brunswick Health Council;
• Public Anglophone and Francophone schools and school districts;
• Municipalities and their respective offices, including municipal police forces;
• Local Service Districts, rural communities, and regional service commissions;
• Public universities, NBCC, CCNB, and the NB College of Craft and Design; and
• other specifically designated government bodies in Schedule A of the Act, which include:
  • Algonquin Properties Limited;
  • District Education Councils;
  • Opportunities New Brunswick;
  • Service New Brunswick; and
  • Recycle New Brunswick.

Who is not subject to the Act?

The Act covers Provincial and municipal entities and public universities, but does not apply to:

• the offices of Members of the Legislative Assembly (MLAs);
• the offices of officers of the Legislative Assembly (the Speaker of the Legislative Assembly, the Clerk of the Legislative Assembly, and statutory officers including the Chief Electoral Officer, the Child, Youth and Senior Advocate, the Consumer Advocate for Insurance, the Integrity Commissioner, the Official Languages Commissioner, and the Auditor General);
• New Brunswick courts, including the Court of Appeal, the Court of King’s Bench, the Provincial Court, and the Small Claims Court; and
• private sector businesses and entities.

There are also certain types of records that the Act does not apply to, including information in a court records, a record made by or for an Officer of the Legislative Assembly, etc.  To see a full list of the record to which the Act does not apply, you can refer to s.4 of the Act.

How to make a request for information or request a correction to a record held by a public body

You can make these kinds of requests directly to the public body that holds the information you are seeking or are seeking to correct. To do so, you may submit either a written letter or a completed form.  To assist with these kinds of requests, the Province has prepared standard forms for the public to use:

• Request for Information form: click here
• Request for Correction form: click here

If you submit a written letter instead of completing a form, please be sure to indicate the following:

• your name and contact information (including mailing address, telephone number, and email address);
• date of the request;
• that you are making the request for access to a record or correction of a records under the Right to Information and Protection of Privacy Act;
• the name of the business or organization on behalf of which you are making the request, if applicable; and
• whether you are asking to examine the record or to receive a paper or electronic copy of the record.

You may find it helpful keep a copy of the request in case the public body has questions or needs to clarify your request or in the event that you are not satisfied with the public body’s response and wish to exercise your right to file a complaint with our Office or refer the matter to the Court of King’s Bench.

If you have any questions when filling out your request or during the processing of your request, you may contact the Right to Information Coordinator of the public body in question.  A list of public bodies and their Right to Information Coordinators can be found at the following link: List of Public Bodies

Duty to assist

Under section 9 of the Act, public bodies are required to “make every reasonable effort to assist an applicant, without delay, fully and in an open and accurate manner”. This means that public bodies are obligated to:

• Work with you to ensure that it understands what information you are seeking
• Conduct an adequate search for all relevant information
• Keep you informed about the status of your request and when you can expect to receive a response
• Provide you with a meaningful response that contains helpful explanations if access to any of the information is being refused or does not exist
• Inform you of your rights if you are not satisfied with the public body’s decision in relation to your access request.

Time limit for the public body to respond to a request for information or request for correction of a record

The Act allows a public body 30 business days to respond to a request for information, and 20 business days to respond to a request for correction of a record. In certain situations described below, the public body can self-extend this timeline of its own accord by up to an additional 30 business days for a request for information, or an additional 20 business days for a request for correction of a record:

(a)        the applicant does not give enough detail to enable the public body to identify the requested record,

(b)        the applicant does not respond to a public body’s request for clarification as soon as practicable,

(c)        a large number of records is requested/must be searched or responding within the time limit would interfere unreasonably with the public body’s operations,

(d)        the public body needs additional time to notify and receive representations from a third party (an external person, association, or private entity) or to consult with another public body before deciding whether or not to grant access to a record,

(e)        a third party refers the matter to a judge of the Court of King’s Bench of New Brunswick under subsection 65(1) or files a complaint with the Ombud under paragraph 67(1)(b), or

(f)         the applicant requests records that relate to a proceeding commenced by a Notice of Action or a Notice of Application.

If a public body extends the time limit to respond of its own accord (i.e., without the Ombud’s approval), you have the right to complain to our Office about the extension.

If the public body is unable to respond to a request within its own timeline, it may apply to our Office for a further extension of time, based on the same criteria as above.  If our Office grants the public body additional time to respond, you do not have a right to complain to our Office about the extension.

If public body does not respond by the time limit to respond (either the original or extended time limit, as the case may be), you then have the right to either file a complaint with our Office or refer the matter to the Court of King’s Bench.

Review options

If you are not satisfied with how a public body has handled or responded to your request for information, you can either file a complaint with our Office or refer the matter to a judge of the Court of King’s Bench, but you cannot do both.

If you are not satisfied with how a public body has handled or responded to your request to correct personal information, you can only file a complaint with our Office.

How to file a complaint

A complaint must be received by our Office within 40 business days after you received the public body’s response to your request for information or request for correction of information.  If you did not receive a response by either the original or extended time limit to respond, you can file a complaint with our Office within 40 business days after the expiry of the time for responding to the request.

If you choose to file a complaint, you must submit the following documentation to our Office:

• a completed Complaint form (Form 2): (click here),
• a copy of your request, and
• a description of why you are dissatisfied with the public body’s response.

In submitting your complaint, it is also helpful to provide us with a copy of the public body’s response at that time, as it will help us better understand your complaint.

How to refer a matter to the court

If you wish to refer your access matter directly to the court, you must do so within 40 business days of receiving the public body’s response.  To do so, you must submit the following information to the Clerk of the Court of King’s Bench:

• a completed Referral form (Form 1: click here),
• a copy of your request, and
• a written description of why you are dissatisfied with the public body’s response.

If you have further questions about referring a matter to the court, you may contact the Clerk’s Office in the region where you live.

Complaint investigation process

As indicated above, the Act allows a person who has made an access request or a request for correction to his or her personal information to a public body to file a complaint with our Office if he or she is not satisfied with how the public body handled or responded to the request, or if the public body failed to reply to the request.

The first step when we receive a complaint is to determine whether we have received all the required information to accept a complaint and whether we have jurisdiction to investigate the complaint. Where this is the case, we will then notify the public body involved and provide it with a copy of the complaint. At that time, we will also ask the public body to provide us with the relevant information and to provide us with a written reply to the complaint, including explanations as to why access to information was refused, the steps taken to search for relevant records, etc. Public bodies have 10 business days to provide our Office with any records that we require be produced for our review.

Informal resolution process

Once we receive the public body’s reply, we will take appropriate steps to resolve the complaint informally to the satisfaction of the applicant and the public body, and in a manner consistent with the purposes of the Act.  Depending on the circumstances, this may include the public body providing further disclosure of information and accompanying explanations, or where we find the public body has provided access to all of the information the applicant was entitled to receive, we will provide the applicant with explanations to support our findings.  In both cases, we will seek the applicant’s input as to whether this is satisfactory to resolve the complaint, and where this is so, this will conclude our investigation and the file will be closed.  The Act allows us 45 business days to reach an informal resolution of a complaint. The 45 business days begin on the day that we receive the public body’s reply to the access complaint, i.e., within 10 business days of the public body receiving notice of the complaint.

Where a complaint is not resolved within 45 business days, the matter will be remitted to the Ombud to determine if the circumstances merit a formal investigation.

In some cases, the Ombud may decide to cease the investigation if the Ombud believes the public body has provided the applicant with all of the information he or she was entitled to receive under the Act.  If the Ombud ceases the investigation at that point, our Office will inform the applicant and the public body of this decision and the reasons why.

Formal investigation process

If the Ombud finds that further action is to be taken by the public body to uphold the applicant’s access rights and proceeds with a formal investigation, the Ombud will conclude the investigation with a report of findings. The Ombud may recommend that the public body:

• grant the access request, in whole or part;
• grant the request for correction of personal information;
• reconsider an access request that was deemed abandoned under section 12(1) of the Act.

The Act states that the Ombud has 90 business days from receipt of an access complaint to issue a report of findings; however, the Ombud has the authority to extend this time limit by giving notice to the parties to the complaint of the anticipated date for providing the report.

When the Ombud issues a report of findings with recommendations, the public body has 20 business days from the date it received the report to decide whether it will accept the Ombud’s recommendations or not and give notice of its decision to the parties, with a copy to our Office. The public body’s notice must include the reasons for its decision, and where applicable, of the applicant’s appeal rights and time limits to file an appeal with the Court of King’s Bench.

Third parties

If you have received a notice from a public body that it intends to disclose information that relates to you in response to an access request and you do not agree, you have the right to file a complaint with our Office. If you choose to file a complaint, you must submit the following documentation to our Office within 15 business days after the date of the public body’s notice to you:

• a completed Complaint form (Form 5: click here),
• a copy of the public body’s decision on the disclosure of your information.

Our investigation process for third party complaints is the same as explained above for access complaints.

If you wish to refer the matter directly to the courts, you must do so within 15 business days after the date of the public body’s notice to you. To do so, you must submit the following information to the Court Clerk:

• a completed Referral form (Form 4: click here), and
• a copy of the public body’s decision on the disclosure of your information.

If you have further questions about referring a matter to the courts, you may contact the Clerk’s Office in the region where you live.

Personal information

Public bodies are required to follow the obligations set out in Part 3 of the Act whenever they collect, use or disclose personal information. The Act defines personal information as “recorded information about an identifiable individual,” and includes everything that a public body holds in its records about you in your personal capacity, such as:

• your name,
• your home contact information, including your civic address, email address, home telephone, mobile, and facsimile number,
• information about your age, gender, sexual orientation, marital status or family status,
• information about your ancestry, race, colour, nationality or national or ethnic origin,
• information about your religion or creed or religious belief, association or activity,
• your personal health information,
• your blood type, fingerprints or other hereditary characteristics,
• information about your political belief, association or activity,
• information about your education, employment or occupation or educational, employment or occupational history,
• information about your source of income or financial circumstances, activities or history,
• information about your criminal history, including regulatory offences,
• your personal views or opinions, except if they are about another person (as this is considered that other person’s personal information),
• the views or opinions expressed about you by another person, and
• an identifying number, symbol or other particular assigned you (for example, driver’s license number, Medicare number, etc.).

It is important to note that Part 3 of the Act only applies to information that is personal in nature, and does not apply to information about businesses or other organizations.

Collection, use and disclosure of personal information

Under the Act, public bodies are only lawfully allowed to collect your personal information where:

• the collection is authorized or required by a Provincial or federal law;
• the information relates directly to and is necessary for a public body service, program or activity, or
• the information is collected for law enforcement purposes.

Public bodies can only collect the least amount of your personal information as is reasonably necessary to accomplish the purpose for which it is collected.  For example, if you are applying for a driver’s licence, the public body is not allowed to collect information about your income, as it has nothing to do with granting a driver’s licence.

As a general rule, public bodies must collect your personal information directly from you, unless it is specifically authorized to collect it from another source in certain circumstances.

As for the use and disclosure of personal information, the following general principles apply:

• public bodies can only use and disclose personal information as authorized under Division B of Part 3 of the Act;
• every use and disclosure of personal information must be limited to the minimum amount of personal information as is necessary to accomplish the purpose for which it is used or collected; and
• public bodies must limit the use and disclosure of personal information to those who need to know it in order to carry out their duties.

If you are concerned about how a public body has handled your personal information or if you have been notified by a public body of a privacy breach involving your personal information, you have the right to file a complaint with our Office. Please download and complete our Privacy Complaint form and submit it to our Office.

Privacy complaint investigation process

When we receive a privacy complaint, we will notify the public body involved and provide it with a copy of your complaint. If you have any concerns about our Office sharing your complaint with the public body, please let us know so that we can discuss this with you as soon as possible.

When we notify the public body of your complaint, we will ask the public body to provide a written reply to the concerns raised in your complaint and any other information that may be relevant to the matter.

Informal resolution process

Once we have received the public body’s response to your privacy complaint, we will review the information provided, along with the applicable provisions of the Act, and determine if the public body handled your personal information inappropriately. If we find this to be the case, and the public body acknowledges its error and agrees to undertake appropriate corrective measures, we will then provide you with the reasons as to why the privacy breach occurred and invite your input as to whether the corrective measures undertaken by the public body are satisfactory to resolve your complaint.

Formal investigation process

Where we find that the public body has not handled your personal information in keeping with the Act and the public body does not agree or does not wish to take appropriate steps to undertake appropriate corrective measures, the matter will be referred to the Ombud for review and final disposition, and will likely result in our Office issuing formal recommendations to the public body. If we issue recommendations to the public body they will be limited to improving compliance with the Act. Our Office cannot recommend that someone be fired, recommend financial compensation for any mishandling of your personal information, or investigate or assess criminal or civil culpability on the part of the public body.

It is important to note that while our Office is mandated to investigate privacy complaints and issue recommendations to public bodies where the Ombud deems it necessary, our mandate is limited to ensuring that public bodies implement appropriate practices, policies, and safeguards to reduce the risk of a similar situation occurring again in the future.

How to report a breach

As of April 1, 2018, changes to the Right to Information and Protection of Privacy Act’s Regulations requires, in certain circumstances, public bodies to notify the affected individuals and the Ombud as soon as possible of privacy breaches involving an individual’s personal information. To assist public bodies in respecting the new mandatory reporting requirements, we have developed a new Privacy Breach Notification Form that we ask public bodies to fill out and submit to our Office.

How to request a timeline extension

Application for Time Extension

Who is subject to the Personal Health Information Privacy and Access Act?

Custodians

The Act applies to all individuals or organizations that collect, maintain, or use personal health information for the purpose of providing or assisting in the provision of health care or treatment, or the planning and management of the health care system, or delivering a government program or service.

Custodians include, but are not limited to:

• public bodies who handle personal health information (for example the Department of Health),
• health care providers, and includes:
  1. social workers registered under the New Brunswick Association of Social Workers Act
  2. New Brunswick members of the Canadian Health Information Management Association
• the Minister of Health;
• the following organizations and/or agencies:
  1. EM/ANB Inc. (formerly known as Ambulance New Brunswick),
  2. the New Brunswick Health Council,
• regional health authorities (Horizon Health Network and Vitalité Health Network),
  1. the Workplace Health, Safety and Compensation Commission,
  2. the Canadian Blood Services,
• research data centres (i.e. the NB Institute for Research, Data & Training at the University of New Brunswick),
• researchers conducting a research project approved in accordance with this Act
• a laboratory or a specimen collection centre,
• nursing homes and operators as those terms are defined in the Nursing Homes Act,
• a person designated in the regulations as a custodian, such as:
  1. a school or school district,
  2. a coroner appointed under the Coroners Act,
• a successor who obtains custody of records containing personal health information held by a custodian, and,
• Service New Brunswick (under the limited circumstance of compiling or maintaining a registry of personal health information).

Information Managers and Agents

Information managers are individuals or organizations working on behalf of a custodian to store, retrieve, archive, dispose, de-identify or transform personal health information handled by a custodian, or provide information management or information technology services. While information managers are not custodians in their own right under the Act, they must follow the same rules as custodians under the Act regarding the handling of personal health information.

Agents are individuals or organizations working on behalf of a custodian for a specific purpose relating to personal health information, but who is not an employee of the custodian. Information manager can also be agents. To be considered an agent for the purposes of the Act, the agent works directly for or on behalf of the custodian, and not for its own purposes. The custodian is responsible for the actions of the agent at all times in relation to the agent’s handling of personal health information.

Custodians must have a written agreement in place with either an agent or information manager before retaining their services.

Who is not subject to the Act?

While the definition of custodian is broad, the Act does not apply to individuals or organizations that handle personal health information for purposes other than health care. The Act does not apply to the handling of personal health information in the following circumstances:

1. An individual or organization that collects, maintains or uses personal health information for purposes other than health care, treatment, planning, or management of the health care system, including,
   • employers
   • insurance companies
   • regulatory bodies of health care providers
   • licensed or registered health care providers who do not provide health care
   • any other individual or organization prescribed by regulation;
2. a note made by or for, or a communication or draft decision of a person who is acting in a judicial or quasi-judicial capacity;
3. a constituency record of a Minister of the Crown;
4. information in a court, judge, judicial administration record, or a record relating to support services provided to a judge or to a court official;
5. anonymous or statistical information that does not, either by itself or when combined with other information available to the holder of the information, permit individuals to be identified;
6. an individual’s personal health information if 50 years have passed since the death of the individual;
7. the New Brunswick Insurance Board;
8. the New Brunswick Human Rights Commission;
9. the Labour and Employment Board established under the Labour and Employment Board Act;
10. the Designation Appeal Board established under the Post-Secondary Student Financial Assistance Act;
11. Premier’s Council on Disabilities;
12. a review board appointed under section 30 of the Mental Health Act;
13. the Mental Health Services Advisory Committee established under the Mental Health Services Act;
14. a tribunal appointed under section 7.5 of the Mental Health Act;
15. a person, service or organization designated as psychiatric patient advocate services under the Mental Health Act;
16. a review board established by the Restigouche Hospital Center Inc.; and
17. the Workers’ Compensation Appeals Tribunal established under the Workplace Health, Safety and Compensation Commission and Workers’ Compensation Appeals Tribunal Act.

How to make a request for information for your personal health information

You can make a request directly to a custodian that holds your personal health information in order to examine or receive a copy of it. You may do so in person (orally) or in writing; however, a custodian may require that your request be in writing.

When making a request please be sure to indicate the following:

• your name and contact information;
• whether you wish to examine or get a copy of the record or part of the record; and
• sufficient detail to permit the custodian to identify and locate the information you are seeking access to so the information can be located with reasonable efforts.

You may find it helpful to keep a copy of the request, if you made it in writing, or make a note of the date of the oral request in case the custodian has questions or needs to clarify your request, or in the event that you are not satisfied with the custodian’s response and wish to exercise your right to file a complaint with our Office or refer the matter to the courts.

Duty to assist

Under section 8 of the Act, custodians are required to offer assistance to you when making an access request if your request does not contain sufficient details to permit the custodian to identify and locate the information you are requesting. If this is the case, the custodian must help you reformulate your request. This means that the custodians are obligated to:

• conduct an adequate search for all the information you are seeking,
• let you examine the information and receive a copy if you wish,
• inform you in writing if the information does not exist or cannot be found, or of the reason access to any information is being refused, and
• inform you of your rights if you are not satisfied with the custodian’s decision in relation to your request.

Time limit for the custodian to respond to a request for information

The Act allows a custodian 30 business days to respond to access requests. In certain situations, the custodian can self-extend this timeline of its own accord by up to an additional 30 business days, where:

(a)   you do not give enough detail to enable the custodian to identify a requested record,

(b)   you do not respond to a request for clarification by the custodian as soon as practicable,

(c)  the relevant provisions of your record are being translated for a unilingual physician treating you if the record is in an official language the physician cannot understand,

(d)   a large number of records is requested or must be searched or responding within 30 business days would interfere unreasonably with the operations of the custodian,

(e)   time is needed to notify and receive representations from a third party or to consult with another custodian before permitting the personal health information to be examined or copied, or

(f)   you request records that relate to a proceeding commenced by a Notice of Action or a Notice of Application.

If a custodian extends the time limit to respond of its own accord (i.e. without the Ombud’s approval), you have the right to complain to our Office about the extension.

If the custodian is unable to respond to an access request within its own timeline, it may apply to our Office for a further extension of time, based on the same criteria above.  If our Office grants the custodian additional time to respond, you do not have a right to complain to our Office about the extension.

If a custodian does not respond by the time limit to respond (either the original or extended time limit, as the case may be), you then have a right to either file a complaint with our Office or refer the matter to the courts.

Custodian’s response

Upon receiving a request, a custodian shall respond as promptly as required in the circumstances, but no later than 30 business days after receiving it (unless the time limit is extended – see Time Limit for the Custodian to Respond to a Request for Information above), or the request is transferred to another custodian.  When responding to a request, a custodian shall:

1. make the personal health information available to you for examination and provide a copy, if requested;
2. inform you in writing if the information does not exist or cannot be found; or
3. inform you in writing that the request is refused, in whole or in part, and that the refusal is based on one of the reasons described in section 14, and to advise you of the right to make a complaint about the refusal under Part 6.

If the custodian does not respond to the request within 30 business days and it can be treated as a refusal to provide access.

Fees to access personal health information

You can examine a record free of charge, but if copies of a record are requested, the Act allows a custodian to charge certain fees to recover costs for the search, preparation, copying and delivery of the record. These fees cannot exceed those indicated in the Regulations, which are as follows:

• the first two hours to search and prepare the health records are free; $15 dollars for every additional 30 minutes of time spent after that,
• a maximum of $0.25 for each page copied,
• computer user fees when required to access databases to search for your health records, and
• costs incurred to send the records by special courier delivery (at the request of the individual).

Request for a correction of personal health information

You have the right to make a request for correction to the personal health information you are entitled to examine and copy. This request can be made directly to the custodian that holds your personal health information.

Your request for correction shall be in writing and include:

1. your name and contact information;
2. the particular information you wish to have corrected;
3. the record where you believe the information to be incorrect.

In responding to your request for correction, the custodian shall do one of the following:

1. make the requested correction to the record to the personal health information so that if forms part of the record;
2. inform you, in writing, if the personal health information to be corrected no longer exists or cannot be found;
3. in the event it does not hold your personal health information, that it inform you of this fact, provide you with the name and contact information of the custodian that does hold your personal information, and transfer the request to that custodian and notify you of the transfer;
4. inform you, in writing of its refusal to correct your personal health information, the reason for the refusal, and your right to add a statement of disagreement to the record, and of your right to make a complaint with our Office or the courts about the refusal.

The statement of disagreement is a short note written by you that explains the correction you had requested and the reason for the request for correction.

The Act allows a custodian 30 business days to respond to requests for correction of personal health information. In certain situations, the custodian can self-extend this timeline of its own accord by up to an additional 30 business days (see Time Limit for the Custodian to Respond to a Request for Information above).

Review options

If you are not satisfied with how a public body has handled or responded to your access to information request or your request for correction, you can either file a complaint with our Office or refer the matter to a judge of the Court of King’s Bench. Please note you cannot do both.

How to file a complaint with our office

If, after making the request to a custodian for access or correction, you are not happy with how a custodian has handled your request for information or for correction, you have the right to file a complaint with our Office, within the following timelines:

1. A complaint must be received by our Office within 60 days after receiving the custodian’s response; or,
2. If you did not receive a response by either the original or extended time limit to respond, you may file a complaint with our Office within 120 days from the date you submitted the request to the custodian.

If you choose to file a complaint, you will be required to submit the complaint to our Office in writing. You may do so by sending us a letter (by mail, email or facsimile) with the following details:

1. a) the date you made your request,
2. b) whether you made the request by letter or in person,
3. c) to whom the request was made (ex. the name of the health care provider), and,
4. d) what took place (ex. that your request was refused, not responded to, or you did not get all of the information you were seeking).

If you submitted a written request, we will ask that you submit a copy of this along with a copy of the response you received, if any. It is not necessary to provide us with the personal records you received, even if these are not complete because we will investigate the case directly with the custodian.

How to refer a matter to the courts

If you wish to refer your case to the Court of King’s Bench, you must do so within 30 days after the date of the custodian’s decision. To do so, please contact the Clerk’s Office in the region where you live.

Complaint investigation process

The types of complaints we generally receive under the Act are:

1. No response complaint – the custodian has not responded to a request for access,
2. fee complaint – the custodian has provided an invoice to an individual that is not in conformity with the Act, and,
3. content complaint – the individual believes that the custodian did not provide all of the requested personal health information.

The first step when we receive a complaint is to determine whether we have received all the required information to accept a complaint and if we have jurisdiction to investigate your complaint. Where this is the case, we will then notify the custodian involved and provide it with a copy of the complaint.  At that time, we will also ask the custodian to provide us with a written or verbal reply to the complaint, including explanations as to why access to information was refused, if any, the steps taken to search for relevant records, etc.

Informal resolution process

Once we receive the custodian’s reply, we will take appropriate steps to resolve the complaint informally to your and the custodian’s satisfaction, and in a manner consistent with the purposes of the Act.  Depending on the circumstances, this may include the custodian providing you with further disclosure of information and accompanying explanations, or where we find the custodian has provided access to all of the information you were entitled to receive, we will provide you with explanations to support our findings.  In both cases, we will seek  your input as to whether this is satisfactory to resolve the complaint, and where this is so, this will conclude our investigation and the file will be closed.

In some cases, the Ombud may decide to cease the investigation if the Ombud believes the custodian has provided you with all of the information you were entitled to receive under the Act. If the Ombud ceases the investigation at that point, our Office will inform you and the custodian of this decision and the reasons why.

Formal investigation process

If the Ombud finds that further action is to be taken by the custodian to uphold the applicant’s access rights and proceeds with a formal investigation, the Ombud will conclude the investigation with a report of findings.  The Ombud may recommend that the custodian:

• grant the access request or the request for correction, in whole or part;
• reply to the request or deny the request.

The Act states that the Ombud has 90 days from receipt of an access complaint to issue a report of findings; however, the Ombud has the authority to extend this time limit by giving notice to the parties to the complaint of the anticipated date for providing the report.

When the Ombud issues a report of findings with recommendations, the custodian has 15 days from the date it received the report to decide whether it will accept the Ombud’s recommendations or not and give notice of its decision to the parties, with a copy to our Office. The custodian’s notice must include the reasons for its decision, and where applicable, of the applicant’s appeal rights and time limits to file an appeal with the Court of King’s Bench.

Privacy overview

Custodians are required to follow the requirements set out in Part 4 – Collection, use and disclosure of Personal Health Information of the Act whenever they handle personal health information. The Act defines “personal health information” to mean identifying information about you, an individual, in oral or recorded form if the information:

1. relates to your physical or mental health, family history or health care history, including genetic information about you,
2. is your registration information, including your Medicare number,
3. relates to the provision of health care to you,
4. relates to information about your payments or your eligibility for health care, or your eligibility for coverage for health care,
5. relates to your donation of any body part or bodily substance or is derived from the testing or examination of any of your body part or bodily substance,
6. identifies your substitute decision maker, or
7. identifies your health care provider.

You can file a privacy complaint with our Office if you believe that a custodian has:

• collected, used or disclosed your personal health information contrary to the Act; or
• failed to protect your personal health information in a secure manner as required by the Act.

To file a privacy complaint with our Office, please complete our Privacy Complaint form and submit it to our Office.

Collection, use and disclosure of personal information

Under the Act, custodians are only lawfully allowed to collect your personal health information where:

• the custodian has your consent under the Act and the collection, to the best of the custodian’s knowledge, is necessary for a lawful purpose,
• the collection is permitted by the Act,
• without your consent, if you are incapable of giving consent and
  • the custodian cannot get the consent of your substitute decision-maker in a timely manner, or
  • you have been admitted to a psychiatric facility as an involuntary patient under the Mental Health Act.

As a general rule, custodians must collect your personal health information directly from you, unless the Act specifically authorizes the collection from another source in certain circumstances.

As for the use and disclosure of your personal health information, the following general principles apply:

• custodians can only use or disclose your personal health information as authorized under Division B of Part 4 of the Act,
• every use or disclosure of your personal health information must be limited to the minimum amount of information necessary to accomplish the purpose for which it is used or disclosed; and,
• custodians must limit the use and disclosure of your personal health information to those who need to know the information to carry out their duties.

If you are concerned about how a custodian has handled your personal health information or if you have been notified by a custodian of a privacy breach involving your personal health information, you have the right to file a complaint with our Office. Please complete our Privacy Complaint form and submit it to our Office.

Privacy complaint investigation process

When we receive a privacy complaint, we will notify the custodian involved and provide it with a copy of your complaint. If you have any concerns about our Office sharing your complaint with the custodian, please let us know so that we can discuss this with you as soon as possible.

When we notify the custodian of your complaint, we will ask the custodian to provide a written reply to the concerns raised in your complaint and any other information that may be relevant to the matter.

Our Office has 90 days to complete an investigation into a privacy complaint.

Informal resolution process

Once we have received the custodian’s response to your privacy complaint, we will review the information provided, along with the applicable provisions of the Act, and determine if the custodian handled your personal information inappropriately. If we find this to be the case, and the custodian acknowledges its error and agrees to undertake appropriate corrective measures, we will then provide you with the reasons as to why the privacy breach occurred and invite your input as to whether the corrective measures undertaken by the public body are satisfactory to resolve your complaint.

Formal Investigation

Where we find that the custodian has not handled your personal information in keeping with the Act and the custodian does not agree or does not wish to take appropriate steps to undertake appropriate corrective measures, the matter will be referred to the Ombud for review and final disposition, and may result in our Office issuing formal recommendations to the custodian. If we issue recommendations to the custodian, they will be limited to improving compliance with the Act. Our Office cannot recommend that someone be fired, recommend financial compensation for any mishandling of your personal information, or investigate or assess criminal or civil culpability on the part of the custodian.

It is important to note that while our Office is mandated to investigate privacy complaints and issue recommendations to custodians where the Ombud deems it necessary, our mandate is to ensure that custodians implement appropriate practices, policies, and safeguards to reduce the risk of a similar situation occurring again in the future.