Health Information Privacy Rules Flashcards
Rule 1
Purpose of collection of health information
For lawful purpose connected with a function or activity of health agency and necessary for that purpose
Rule 2
Source of health information
1) must collect info directly from individual concerned
2) but not necessary if the agency believes that:
a- individual concerned authorises collection of information from someone else
b- unable to give their authority and health agency made representative aware of the matters set out in rule 3(1), collects info from representative or someone else
c- compliance would prejudice the interests of individual concerned, purposes of collection or safety of individual
d- compliance not reasonably practicable in circumstances of a particular case
e-collection is for assembling family or genetic history of individual
f-info is publicly available
g- information will not be used in the form where individual can be identified or for statistical purposes where individual can not be identified or for research purposes where it will not bee published in a form where participant can be identified
h- non compliance is necessary to avoid prejudice to the maintenance of the law by any public sector agency or for protection of the public revenue or for the conduct of proceedings before any court or tribunal
i-collection is granted under section 54
Rule 3
Collection of Health Information
1) Where a health agency collects health information, the individual concerned and representative must take steps to ensure that they are aware of:
a- the fact that the information is being collected
b- purpose for which it is collected for
c-intended recipients
d- name and address of health collecting information and agency holding the information
e- whether or not supply of information is voluntary or mandatory including the particular law
f- consequences if not provided
g- rights to access and correction in rule 6 and 7
2) the above must be done before the information is collected, if not it should be done as soon as practicable after it is collected
3) Health agency is not required to take those steps in subrule 1 if the same kind of information or information of the same kind or related purpose on a recent previous occasion
4)It is not necessary for a health agency to comply with subrule 1 if the agency believes that the compliance would
prejudice the interests of the individual or
prejudice the purpose of collection or
compliance is not reasonably practicable or
non-compliance is necessary to avoid prejudice to the maintenance of the law by any public sector
Rule 4
Manner of collection of health information
Health must not be collected by a health agency
a- by unlawful means
b- by means that in the circumstances of the case are unfair or intrude to an unreasonable extent upon the personal affairs of the individual concerned
Rule 5
Storage and security of health information
The agency that holds health information must ensure
a- information is protected against
loss or
access, use, modification or disclosure except with the authority of the agency or
other misuse and
b- information to be given to individual including any storing, processing, or destruction of the information, everything reasonably within the power of the agency of the information and
c- the document is disposed of in a manner that preserves the privacy of the individual
Rule 6
Access to personal information
1) Where a health agency hold information in such a way that it can be readily retrieved the individual concerned is entitled
a- to obtain from the agency to confirm whether they hold such information
b- to heave access to that information
2) must be advised that the individual may request correction of that information
Rule 7
Correction of health information
1) individual is entitled to
a- request to correct information
b- request there to be attached to information a statement of the correction sought but not made
2) if requested health agency must take such steps to correct the information and must ensure it is accurate, up to date, complete and not misleading
3) If not willing to correct information according to request, the agency must take steps that are reasonable to attach the information in a way it will always be read with the information of any statement provided by the individual of the correction sought
4) If taken steps 2 or 3 then must, if reasonable practicable, inform each person or body or agency to whom the information has been disclosed of those steps
5) If agency receives a request the agency must inform individual concerned of the action taken as a result of the request
Rule 8
Accuracy of health information to be checked before use
1) must ensure that the information used is accurate, up to date, complete, relevant and not misleading
Rule 9
Retention of health information
1) must not keep longer than required
2) subrule 1 does not prohibit any agency from keeping any document that contains health information the retention of which is necessary or desirable for the purposes of providing health services or disability services to individual concerned
Rule 10
Limits on use of health information
1) must not use the information for any other purpose unless the health agency believes on reasonable grounds
a- use for other purpose is authorised by individual concerned or representative if individual unable to give their authority
b- is used directly related to the purpose in connection to which it was obtained
c- source of information is publicly available
d- necessary to prevent or lessen a serious and imminent threat to public health and safety or life or health of individual concerned
e- information is used in a form where it can not be used to identify person or for statistically purposes and unable to identify or for research purposes and will not be published in a way to identify people involved
f- non compliance is necessary to avoid prejudice to the maintenance of law by any public sector agency or for the conduct of proceedings before any court or tribunal
Rule 11
Limits on Disclosure of Health Information
Rule 12
Unique identifiers
Health agency should not assign unique ID to individuals unless assignment is necessary to enable health agency to carry out 1 or more of its functions efficiently
